<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hi John and Andrew, </div><div><br></div><div>This does not relate to ICE support with rtpproxy, but it might be relevant. </div><div><br></div><div>Although it provides less flexibility, from a security perspective, it could make more sense to keep the ‘always_use_rtpproxy’ under the Domain Preferences, under admin-only control.</div><div><br></div><div>If a subscriber's account has been compromised, there is a chance that the account could be set to ‘always_use_rtpproxy’ = never. This could potentially allow for SIP INVITE SDP spoofing where RTP could be set to transmit from an unauthorized, outside IP. </div><div><br></div><div>My understanding is that having ‘always_use_rtpproxy’ = always forces your sipwise:ce server to be in the middle of the RTP path. This eliminates the possibility for RTP to pas through an unauthorized IP.</div><div><br></div><div>Perhaps this scenario is a little paranoid based on my experiences. I'd love to hear opinions anyone of the list might have on this subject. </div><div><br></div><div apple-content-edited="true">
<div apple-content-edited="true" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="border-collapse: separate; border-spacing: 0px; "><div apple-content-edited="true"><div style="border-collapse: separate; border-spacing: 0px; ">thanks,</div><div style="border-collapse: separate; border-spacing: 0px; ">Graham</div><div style="border-collapse: separate; border-spacing: 0px; "><br></div></div></div></div></div><div apple-content-edited="true">
</div>
<br><div><div>On 2013-06-03, at 11:06 AM, Andrew Pogrebennyk <<a href="mailto:apogrebennyk@sipwise.com">apogrebennyk@sipwise.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">John,<br><br>On 06/03/2013 04:12 PM, John Murray wrote:<br><blockquote type="cite">The subscriber preferences ‘always_use_rtpproxy’ and<br>‘never_use_rtpproxy’ seem to have disappeared in version 2.8.<br><br>I this intentional? What is the default behaviour now?<br></blockquote><br>There is a use_rtpproxy preference with drop-down list of all possible<br>modes in 2.8. The default is use rtpproxy and do not add any ICE candidates.<br><br><blockquote type="cite">Also OPTIONS pings from peers to an unknown domain would give ‘403<br>Domain not served here’ on 2.7 and before whereas now there is no response.<br><br>This causes my peers to see the SPCE as down. Unfortunately I can’t<br>enter the domain as the peer uses ‘To: <a href="sip:ping@skyrack2’">sip:ping@skyrack2’</a> which is a<br>format I can’t enter and they claim this is a limitation of their SBC.<br><br>Is this a security mechanism?<br></blockquote><br>I think that's how Jon wanted it to work. I'll have to search the<br>archives for his posts on this subject or wait for him to comment :o)<br><br>Andrew<br><br><br>_______________________________________________<br>Spce-user mailing list<br><a href="mailto:Spce-user@lists.sipwise.com">Spce-user@lists.sipwise.com</a><br>http://lists.sipwise.com/listinfo/spce-user<br></blockquote></div><br></body></html>