RE: [Sip] SIP Identity using Media Path

["Dan Wing" <dwing@xxxxxxxxx>]

> mån 2007-07-02 klockan 16:04 -0700 skrev Dan Wing:
> 
> > > Chapter 9 says:
> > > 
> > > "in order for the mechanism to work, SBC-type-of-entities 
> > > must permit DTLS, TLS, ICE, or HIP messages to be exchanged 
> > > in the media path."
> > > 
> > > A small question for clarification: at what point must this 
> > > exchange (two-way, I assume) work? As soon as the UAS has 
> > > received the INVITE?
> > 
> > Yes.
> 
> I think this will have a much better chance of succeeding if the
> specification requires this exchange to use the same source and
> destination ports as the media that will later be sent on the same
> channel.

Yes, that is how HIP's key exchange, TLS, DTLS-SRTP, and ICE
all function.

> If not, an SBC may lock onto this stream and reject 
> media from other sources.

Yes, I agree that will give the best chance.  Of course, it is
always possible for an SBC (or firewall) to block such messages 
anyway (as has been discussed on the RTPSEC mailer).

-d


> Hans
> 
> -- 
> Hans Persson <hasse@xxxxxxxxxx>    Ingate - Firewalls with SIP & NAT
> Ingate Systems AB  +46 13 210857   http://www.ingate.com/
> 
> Private: <unicorn@xxxxxxxxxxxxxx>  
> http://www.lysator.liu.se/~unicorn/