Technical Analysis of NAT Problems with SIP. Kirill Ivanov

Transcription

1 Technical Analysis of NAT Problems with SIP Kirill Ivanov

2 The Problem of NAT in SIP Network address translators are common devices that hide private networks behind public IP addresses. In many cases connections can be initiated from the private network to the Internet, but not the other way around, depends on the NAT type. NAT devices can modify IP and UDP/TCP headers but not the SIP and SDP headers.

3 The Problem of NAT in SIP Types of NAT basic (one-to-one NAT), PAT port address translation (many-to-one, manyto-many) Methods of the port translation Full cone NAT, Address restricted cone NAT, Port restricted cone NAT, Symmetric NAT.

4 Full Cone NAT

5 Address restricted cone NAT

6 Port restricted cone NAT

7 Laboratory environment

8 The Problems of NAT in SIP, routing of responses

9 The Problems of NAT in SIP, routing of responses Alice send Registration request to SIP Server: REGISTER sip: :5060 SIP/2.0 Via: SIP/2.0/UDP :5060;branch=z9hG4bKd8754z-c52fa14af877a d8754z-;rport Max-Forwards: 70 Contact: 96d6;transport=udp> To: From: Call-ID: YmU3MGU3OTNmMzEyMjZlMDA5NDViYjZmNzJjOTBmN GY CSeq: 26 REGISTER Expires: 3600 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO User-Agent: X-Lite release 4.5 stamp Content-Length: 0 REGISTER message received by SIP Server contains Alice s private IP address: Internet Protocol, Src: ( ), Dst: ( ) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: sip (5060) REGISTER sip: :5060 SIP/2.0 Via: SIP/2.0/UDP :5060;branch=z9hG4bKd8754z-e7f52e a d8754z-;rport Max-Forwards: 70 Contact: <sip:2006@ :5060;rinstance=e4a234de6cd5 96d6;transport=udp> To: "2006"<sip:2006@ :5060> From: "2006"<sip:2006@ :5060>;tag=772e63a0 Call-ID: YmU3MGU3OTNmMzEyMjZlMDA5NDViYjZmNzJjOTBmN GY CSeq: 27 REGISTER Expires: 3600 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO User-Agent: X-Lite release 4.5 stamp Content-Length: 0

10 The Problems of NAT in SIP, routing of responses

11 The Problems of NAT in SIP, routing of requests

12 The Problems of NAT in SIP, routing of requests 200 OK Sent by SIP Server to Alice: SIP/ OK Via: SIP/2.0/TCP :5060;branch=z9hG4bK- d8754z-223f9ac e6-1---d8754z- ;rport;received= To: 4C09-95D4-4AC9536F3DE From: Call-ID: MjVkNTJjZGM5Mjk1OWE1MzI5Yzk2NDdkYTEzZmYxODA CSeq: 1 INVITE Contact: <sip: :5060;transport=tcp> X-Genesys-CallUUID: UCRB99H5TD1IV7LN97CK5O4K Allow: INVITE, ACK, PRACK, CANCEL, BYE, UPDATE User-Agent: X-Lite release 4.5 stamp Session-Expires: 1800;refresher=uas Min-SE: 90 Supported: uui,timer Content-Type: application/sdp Content-Length: OK received by Alice, is exactly the same as the one sent by SIP Server: SIP/ OK Via: SIP/2.0/TCP :5060;branch=z9hG4bK- d8754z-223f9ac e6-1---d8754z- ;rport;received= To: <sip:2004@ :5060>;tag=6d f79e- 4C09-95D4-4AC9536F3DE From: "2006"<sip:2006@ :5060>;tag=c708f067 Call-ID: MjVkNTJjZGM5Mjk1OWE1MzI5Yzk2NDdkYTEzZmYxODA CSeq: 1 INVITE Contact: <sip: :5060;transport=tcp> X-Genesys-CallUUID: UCRB99H5TD1IV7LN97CK5O4K Allow: INVITE, ACK, PRACK, CANCEL, BYE, UPDATE User-Agent: X-Lite release 4.5 stamp Session-Expires: 1800;refresher=uas Min-SE: 90 Supported: uui,timer Content-Type: application/sdp Content-Length: 180

13 The Problems of NAT in SIP, routing of requests Alice Azure network SIP Server Bob INVITE TCP SYN TRYING DECLINE ACK

14 RTP NAT traversal problems. Alice Azure network SIP Server Bob INVITE INVITE TRYING TRYING OK ACK RINGING OK ACK RTP RTP

15 INVITE from Alice to SIP Server: RTP NAT traversal problems. INVITE SIP/2.0 Via: SIP/2.0/TCP :5060;branch=z9hG4bKd8754z-a329ef65b699cb d8754z-;rport Max-Forwards: 70 Contact: To: From: 200 OK message from Bob, received by Alice: SIP/ OK Via: SIP/2.0/TCP :5060;branch=z9hG4bK- d8754z-a329ef65b699cb d8754z- ;rport;received= To: 4C09-95D4-4AC9536F3DE From: Call-ID: MWJlMjAwN2I3NjUxNGJkN2UxNTM1YmJhYTk4MmZmMz Y v=0 o= IN IP s=x-lite 4 release 4.5 stamp c=in IP t=0 0 m=audio RTP/AVP a=rtpmap:101 telephone-event/8000 a=fmtp: a=sendrecv v=0 o= IN IP s=x-lite c=in IP t=0 0 m=audio RTP/AVP a=sendrecv a=rtpmap:101 telephone-event/8000 a=fmtp:

16 STUN Session Traversal Utilities for NAT (STUN) is a simple protocol for discovering the serverreflexive address. A STUN server is located in the public Internet The STUN server receives the query and inspects the sender address, which is the server-reflexive address. It sends back a reply containing the server-reflexive address in its payload. The client thus learns its server-reflexive address.

17 STUN STUN request from Bob to STUN Server Internet Protocol, Src: ( ), Dst: ( ) User Datagram Protocol, Src Port: sip (5060), Dst Port: stun (3478) Simple Traversal of UDP Through NAT [Response In: 35] Message Type: Binding Request (0x0001) Message Length: 0x0008 Message Transaction ID: 014f4039ec6aba1ebd4d58497c Attributes Binding response from STUN Server to Bob: Frame 103: 134 bytes on wire (1072 bits), 134 bytes captured (1072 bits) Ethernet II, Src: Cisco_5f:c2:b3 (00:09:43:5f:c2:b3), Dst: Vmware_d9:93:c9 (00:0c:29:d9:93:c9) Internet Protocol, Src: ( ), Dst: ( ) User Datagram Protocol, Src Port: stun (3478), Dst Port: sip (5060) Simple Traversal of UDP Through NAT Attributes Attribute: MAPPED-ADDRESS Attribute Type: MAPPED-ADDRESS (0x0001) Attribute Length: 8 Protocol Family: IPv4 (0x0001) Port: 5060 IP: ( )

18 STUN Alice Azure network STUN Server SIP Server Bob Binding request MAPPED ADDRESS Binding request MAPPED ADDRESS INVITE TRYING INVITE TRYING RINGING OK OK ACK BYE

19 STUN INVITE sent by Alice contains her mapped address in contact field and in SDP connection information : INVITE sip:2004@ :5060;transport=tcp SIP/2.0 Via: SIP/2.0/TCP :48620;branch=z9hG4bK-d8754z- 231f738b18e d8754z-;rport Max-Forwards: 70 Contact: <sip:2006@ :1024;transport=tcp> To: <sip:2004@ :5060> From: "2006"<sip:2006@ :5060>;tag=afdd27ce Call-ID: YTJhMDUyNzM1OWQwOTJjNWUyZGY5NWJkMWQwNTg2Mjk CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: X-Lite release 4.5 stamp Content-Length: 212 v=0 o= IN IP s=x-lite 4 release 4.5 stamp c=in IP t=0 0 m=audio 1025 RTP/AVP a=rtpmap:101 telephone-event/8000 a=fmtp: a=sendrecv 200 OK Received by Alice, with SIP Server s IP address in Contact field and Bob s mapped address in SDP connection information. SIP/ OK Via: SIP/2.0/TCP :48620;branch=z9hG4bK-d8754z- 231f738b18e d8754z-;rport;received= To: <sip:2004@ :5060>;tag=243d7fa b2-a8c6-816a08c3ad3d From: "2006"<sip:2006@ :5060>;tag=afdd27ce Call-ID: YTJhMDUyNzM1OWQwOTJjNWUyZGY5NWJkMWQwNTg2Mjk CSeq: 1 INVITE Contact: <sip: :5060;transport=tcp> X-Genesys-CallUUID: P8574M3VIP6550D8COP9ROFAUS Allow: INVITE, ACK, PRACK, CANCEL, BYE, UPDATE User-Agent: X-Lite release 4.5 stamp Session-Expires: 1800;refresher=uas Min-SE: 90 Supported: uui,timer Content-Type: application/sdp Content-Length: 178 v=0 o= IN IP s=x-lite c=in IP t=0 0 m=audio RTP/AVP a=sendrecv

20 TURN To be reachable, a device behind a symmetric NAT needs to initiate and maintain a connection to a relay. Extension to STUN TURN servers located in the Internet A NATed TURN client asks the server to allocate a public address and port and relay packets to and from that address.

21 TURN Alice Azure network TURN Server SIP Server Bob Binding request Binding response Allocate request UDP Binding request Binding response Allocate error response unauthorized Allocate request with authorization Allocate success XOR-RELAYED address INVITE TRYING INVITE TRYING RINGING Allocate request UDP Allocate error response unauthorized Allocate request with authorization Allocate success XOR-RELAYED address Channel bind request Channel bind success Channel Data OK OK Channel bind request Channel bind success Channel Data ACK BYE

22 TURN STUN server responds with ALLOCATE- SUCCESS message with XOR-RELAYED address and XOR-MAPPED ADDRESS STUN 126 Allocate Success Response XOR-RELAYED-ADDRESS: :64455 lifetime: 600 bandwidth: -1 XOR-MAPPED-ADDRESS: :1024 Alice sends INVITE message to SIP server with XOR-RELAYED address in connection information in SDP, and XOR-MAPPED address in Contact field. INVITE SIP/2.0 Via: SIP/2.0/TCP :5060;branch=z9hG4bK-d8754z e48f0d6e6-1---d8754z-;rport Max-Forwards: 70 Contact: To: From: Call-ID: Nzc0MjM3MjNkZDRhNTZjOGQxOTYxZWUyYWViYTY1M2M CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: X-Lite release 4.5 stamp Content-Length: 212 v=0 o= IN IP s=x-lite 4 release 4.5 stamp c=in IP t=0 0 m=audio RTP/AVP a=rtpmap:101 telephone-event/8000

23 200 OK sent by SIP Server SIP/ OK Via: SIP/2.0/TCP :5060;branch=z9hG4bK-d8754z e48f0d6e6-1---d8754z- ;rport;received= To: From: Call-ID: Nzc0MjM3MjNkZDRhNTZjOGQxOTYxZWUyYWViYTY1M2M CSeq: 1 INVITE Contact: <sip: :5060;transport=tcp> X-Genesys-CallUUID: P8574M3VIP6550D8COP9ROFAUS00004K Allow: INVITE, ACK, PRACK, CANCEL, BYE, UPDATE User-Agent: X-Lite release 4.5 stamp Session-Expires: 1800;refresher=uas Min-SE: 90 Supported: uui,timer Content-Type: application/sdp Content-Length: 180 v=0 o= IN IP s=x-lite c=in IP t=0 0 m=audio RTP/AVP a=sendrecv a=rtpmap:101 telephone-event/8000 a=fmtp: TURN

24 TURN After receiving 200 OK Alice binds the channel on TURN server by sending Channel bind request STUN 242 Channel-Bind Request user: realm: viagenie.ca with nonce ChannelNumber=0x6951 XOR-PEER-ADDRESS: :64465 On which TURN Server responds with Channel-bind success response STUN 86 Channel-Bind Success Response Bob does the same, after this both clients begin to send Channel Data TURN messages, which carry data to TURN server.

25 ICE ICE includes the multiplicity of IP addresses and ports in SDP offers and answers, which are then tested for connectivity by peer-to-peer connectivity checks. IP addresses and ports are performed using STUN When the client gathers all of its candidates, it orders them in priority order and sends to another client in SDP offer. Receiving such offer another client gathers all of its candidates and includes them in SDP answer. At the end of that process each client has full list of another client s candidates. UN. ICE also uses TURN.

26 ICE Alice Azure network STUN/TURN Server SIP Server Bob Binding request Binding response INVITE TRYING INVITE TRYING Binding request Binding response RINGING Binding request Candidate 1 Binding request Candidate 1 OK OK Binding request Candidate 1 Binding request Candidate 1 ACK BYE

27 ICE Binding response received by Alice: STUN 98 Binding Success Response MAPPED-ADDRESS: :1025 XOR-MAPPED-ADDRESS: :1025 RESPONSE-ORIGIN: :3478 INVITE Sent by Alice to SIP Server contains mapped address in Contact field and in connection information in SDP, also two candidates are presented in SDP INVITE SIP/2.0 Via: SIP/2.0/TCP :5060;branch=z9hG4bK-d8754z-20516fcbef9ed d8754z-;rport Max-Forwards: 70 Contact: To: From: v=0 o= IN IP s=x-lite 4 release 4.5 stamp c=in IP t=0 0 a=ice-ufrag:15746d a=ice-pwd:a33de27fdbd17170dfcb68d9d019bba3 m=audio 1025 RTP/AVP a=rtpmap:101 telephone-event/8000 a=fmtp: a=sendrecv a=rtcp:1026 IN IP a=candidate:1 1 UDP typ host a=candidate:2 1 UDP typ srflx raddr rport a=candidate:1 2 UDP typ host a=candidate:2 2 UDP typ srflx raddr rport 55865

28 ICE Binding response received by Bob STUN Binding Success Response MAPPED-ADDRESS: :53223 XOR-MAPPED-ADDRESS: :53223 RESPONSE-ORIGIN: :3478 SIP/ OK Via: SIP/2.0/UDP :5060;branch=z9hG4bK22365C0B-D009-42F3-A23D-953E78E52C9F-32 Contact: To: From: v=0 o= IN IP s=x-lite 4 release 4.5 stamp c=in IP t=0 0 a=ice-ufrag:6bb70c a=ice-pwd:26b02178fe49cf2728e0c262687e1fa2 m=audio RTP/AVP a=rtpmap:101 telephone-event/8000 a=fmtp: a=sendrecv a=rtcp:53223 IN IP a=candidate:1 1 UDP typ host a=candidate:2 1 UDP typ srflx raddr rport a=candidate:1 2 UDP typ host a=candidate:2 2 UDP typ srflx raddr rport 53223

29 ICE RTP form Alice to Bob is sent on second candidate address: Internet Protocol Version 4, Src: ( ), Dst: ( ) User Datagram Protocol, Src Port: (55864), Dst Port: (53222) Real-Time Transport Protocol RTP form Bob to Alice is sent on second candidate address: Internet Protocol, Src: ( ), Dst: ( ) User Datagram Protocol, Src Port: (53222), Dst Port: blackjack (1025) Real-Time Transport Protocol

30 SBC SIP Client Alice Azure network SIP Server X.X ISP Router ISP network SBC Internet Lab router with NAT Private network SIP Client Bob SIP Client Kirill Laboratory

31 SBC Kirill s SIP client sends the REGISTER message with his local IP address in Contact and Via fields: REGISTER sip: :5060 SIP/2.0 Via: SIP/2.0/UDP :5060;branch=z9hG4bKd8754z-eddebc6d10b305bb-1---d8754z-;rport Max-Forwards: 70 Contact: <sip:2005@ :5060;rinstance=152ae735a9024e4 d;transport=udp> To: "2005"<sip:2005@ :5060> From: "2005"<sip:2005@ :5060>;tag=56ccd5e3 Call-ID: YmY1NzVhOGU5ZTVhNjFlZTE1NzQ0YmQyODI3YzVlOD CSeq: 1 REGISTER Expires: 3600 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO User-Agent: X-Lite release stamp Content-Length: 0 Register received by Server, Contact and Via fields were changed to SBC address and port number: REGISTER sip: :5060 SIP/2.0 Via: SIP/2.0/UDP :55052;branch=z9hG4bKd8754z-eddebc6d10b305bb-1---d8754z-;rport Max-Forwards: 70 Contact: <sip:2005@ :55052;rinstance=152ae735a9024e 4d;transport=udp> To: "2005"<sip:2005@ :5060> From: "2005"<sip:2005@ :5060>;tag=56ccd5e3 Call-ID: YmY1NzVhOGU5ZTVhNjFlZTE1NzQ0YmQyODI3YzVlODY. CSeq: 1 REGISTER Expires: 3600 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO User-Agent: X-Lite release stamp Content-Length: 0

32 SBC SIP server send 200 OK to address received in REGISTER s Contact field: SIP/ OK Via: SIP/2.0/UDP :55052;branch=z9hG4bK- d8754z-eddebc6d10b305bb-1---d8754z- ;rport;received= To: "2005"<sip:2005@ :5060>;tag=6D F79E-4C09-95D4-4AC9536F3DE From: "2005"<sip:2005@ :5060>;tag=56ccd5e3 Call-ID: YmY1NzVhOGU5ZTVhNjFlZTE1NzQ0YmQyODI3YzVlODY. CSeq: 1 REGISTER Expires: 1800 Contact: <sip:2005@ :55052;rinstance=152ae735a9024e4 d;transport=udp>;expires=1800 Content-Length: 0 Here is 200 OK received by Kirill s UA, Via and Contact addresses have been changed again. SIP/ OK Via: SIP/2.0/UDP :5060;branch=z9hG4bK- d8754z-eddebc6d10b305bb-1---d8754z- ;rport;received= To: "2005"<sip:2005@ :5060>;tag=6D F79E-4C09-95D4-4AC9536F3DE From: "2005"<sip:2005@ :5060>;tag=56ccd5e3 Call-ID: YmY1NzVhOGU5ZTVhNjFlZTE1NzQ0YmQyODI3YzVlODY. CSeq: 1 REGISTER Expires: 1800 Contact: <sip:2005@ :5060;rinstance=152ae735a9024e 4d;transport=udp>;expires=1800 Content-Length: 0 R1#sh ip nat translations Pro Inside global Inside local Outside local Outside global udp : : : :55052

33 SBC INVITE INVITE TRYING RINGING OK ACK BYE OK RINGING OK ACK BYE OK

34 SBC Here is the INVITE message sent by Kirill with private addresses in Via, Contact and the connection information fields. INVITE SIP/2.0 Via: SIP/2.0/UDP :50562;branch=z9hG4bKd8754z-aa1929cdfbff5eb6-1---d8754z-;rport Max-Forwards: 70 Contact: To: From: Call-ID: NzNhYWFjNjIzMzQ0OTg0ZGZkNDU5OWNkNTI1MDhhNTE CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: X-Lite release 4.5 stamp Content-Length: 213 v=0 o= IN IP s=x-lite 4 release 4.5 stamp c=in IP t=0 0 m=audio RTP/AVP a=rtpmap:101 telephone-event/8000 a=fmtp: a=sendrecv And here is an INVITE received by SIP Server: INVITE sip:2004@ :5060;transport=udp SIP/2.0 Via: SIP/2.0/UDP :50562;branch=z9hG4bKd8754z-aa1929cdfbff5eb6-1---d8754z-;rport Max-Forwards: 70 Contact: <sip:2005@ :50562;transport=udp> To: <sip:2004@ :5060> From: "2005"<sip:2005@ :5060>;tag=7da9659d Call-ID: NzNhYWFjNjIzMzQ0OTg0ZGZkNDU5OWNkNTI1MDhhNTE CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: X-Lite release 4.5 stamp Content-Length: 211 v=0 o= IN IP s=x-lite 4 release 4.5 stamp c=in IP t=0 0 m=audio RTP/AVP a=rtpmap:101 telephone-event/8000 a=fmtp: a=sendrecv