Re: MSRP - First SEND request purpose?

On Dec 22, 2011, at 2:08 AM, prasun bheri wrote:

> Hello Group,
> 
> ref: RFC 4975 (MSRP)
> "The first SEND request serves to bind a connection to an MSRP
>       session from the perspective of the passive endpoint.  If the
>       connection is not authenticated with TLS, and the active endpoint
>       did not send an immediate request, the passive endpoint would have
>       no way to determine who had connected, and would not be able to
>       safely send any requests towards the active party until after the
>       active party sends its first request."
> 
> From the passive end point of view:
> 
> It knows the remote party's IP and port number from the SDP received. 
> So upon 'TCP socket accept', it will know the remote party who is connected.
> Will it not be sufficent to bind this connection to an MSRP session?
> 


HI Prasun,

It's fairly easy for a malicious endpoint to forge a source IP address and port number. The initial SEND request will contain the MSRP URI that the passive endpoint sent to the active endpoint in the SDP exchange. Since that URI is supposed to be hard to guess, that makes it considerably harder for a malicious endpoint to pretend to be the expected peer.

Hope this helps!

Ben.