Subject: [SIP] Proxy Routing Logic

From: [email-masked]
Date: Fri, 29 Dec 2000 17:42:06 -0600

Jonathan Rosenberg wrote:
>> -----Original Message-----
> >From: Billy Biggs [mailto:[email-masked]]
> >Sent: Wednesday, December 20, 2000 12:54 PM
> >To: Jo Hornsby
> >Cc: Fairlie-Cuninghame, Robert; Jonathan Rosenberg; Keith
> >Robinson; SIP
> >List
> >Subject: Re: [SIP] Proxy Routing Logic
> >
> >
> >Jo Hornsby ([email-masked]):
> >
> >>>> [Of course there will be always be different routing behaviour
> >>>> depending on whether the request has a Route or not. [...]
> >>>
> >>>   Right, but this decision should only occur after you've
> >decided if
> >>> the request is for you.  It's very important that proxies
> >don't just
> >>> assume the request is meant for them if it happens to appear on one
> >>> of their listening sockets. [...]
> >>
> > >Maybe I'm not following properly, since I'm jumping in
> >mid-stream, as
> >> it were, but if I get a request, I'm going to do my best to
> >honour it.
> >> Maybe I won't know anything about the domain in the Request-URI, but
> > >I'll SRV and A, and hopefully everything will still be okay.
> >
>  > By "honour it" you mean proxy it to the destination indicated by the
> >Request-URI (and maybe add a Record-Route), right?
> .
> >  I just want to make sure proxies don't replace the
> >request-URI blindly
> >with the next Route unless the request is destined for them.

>I believe they should do this, in fact.

>Note that Jo and Robert are correct; consensus was that if a local outbound
>proxy wants to stay on the path, it should record-route. This results in the
>most flexibility (enables outbound proxies who want to see only the initial
>request).

If that is the consensus for what outbound proxy is then the 'outbound proxy'
the way
I understood it ceases to exist. First, it is UAC who makes a given Proxy its
outbound one.
that is, 'outbound functionality' is not something you can enable/disable on the
 Proxy.
Moreover, not only there should not be a different behavior for outbound proxies
 versus
non-outbound, there cannot be since the Proxy has no way of knowing if it is
being used
as outbound one or not (maybe with the exaption of so called firewall proxies
that most
likely are used as outbound proxies only - but even that may not always be the
case).
On the side note: you cannot require outbound proxy to insert Record-Route (I
think
I saw posting recommending this) for that exact reason - since every Proxy can
potentially
be used as the outbound one every one would have to insert Record-Route.
My UAC uses proxy name-resolutions.com for every outgoing request for just that
reason: to
resolve domain names on my behalf. I have to use for all outgoing requests since
 the
maddr in Record-Route (and therefore in Route as well) may contain domain name.
My second UAC uses proxy free-gifts.com as the outbound one for every outgoing
request since I can win a gift every time I use it. There
are many reasons why I would want to use an outbound Proxy and I expect
everything
to work regardless of whether my outbound Proxy adds Record-Route or not.
regards, Jacek Grabiec
sip:[email-masked]

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Henning Schulzrinne <[email-masked]>
Date: Sat, 30 Dec 2000 17:32:43 -0800

I think it is somewhat simpler to decouple the notion of outbound
proxies from the RR functionality. I have a hard time picturing a case
where an outbound proxy would only want to be in the path of the first
request. It seems simple, and in line with current implementations and
the DHCP draft, so 

An additional complication is that RR is currently being defined for
INVITE and BYE only, while outbound proxies generally would be for every
request. Basically saying "outbound proxy is for all requests but the
requests that are within a call leg" seems a bit odd. However, it does
mean that the outbound proxy is the one that actually uses the first
Route header.

Things could get a bit odd if things are configured so that the outbound
proxy is not the one "closest" to the inside party. For example, you
could have a call through

acme.com and then
sales.acme.com

reaching [email-masked]. If acme.com is the outbound proxy and
sales.acme.com record-routes for the inbound call, routing gets strange.
There's probably not much one can do here except say "don't do that".

Also note, in practice, the species of outbound proxy that we have seen
so far (firewall proxies) will almost always have to RR in order to make
sure that requests from the outside traverse it.

---

From: Billy Biggs <[email-masked]>
Date: Sat, 30 Dec 2000 20:39:51 -0500

Henning,

  I'm sorry, but I don't quite understand your email.  Did it get cut
off?

  Currently, I know of a few shipping implementations where the outbound
proxy receives all outgoing requests.  Even if an implementation used a
different definition, I can't think of a situation where the requests
wouldn't go to the correct destination.

Henning Schulzrinne ([email-masked]):

> Things could get a bit odd if things are configured so that the
> outbound proxy is not the one "closest" to the inside party. For
> example, you could have a call through
> 
> acme.com and then
> sales.acme.com
> 
> sales.acme.com record-routes for the inbound call, routing gets
> strange.  There's probably not much one can do here except say "don't
> do that".

  I don't understand how the routing gets strange.  If a request for
sip:sales.acme.com arrives at acme.com, then it should realize that the
request is not for it an proxy it accordingly.

> Also note, in practice, the species of outbound proxy that we have
> seen so far (firewall proxies) will almost always have to RR in order
> to make sure that requests from the outside traverse it.

  I routinely set the outbound proxy of my phone to the machine under my
desk so I can trace its messages easier.  The firewall proxy
record-routes while the outbound proxy doesn't.  Everything works great.

-- 
Billy Biggs                     [email-masked]
http://www.billybiggs.com/      [email-masked]

---

From: Henning Schulzrinne <[email-masked]>
Date: Sat, 30 Dec 2000 21:56:57 -0800

I haven't worked out the details, but something like the following:

- Bob@acme gets a request, through acme.com, which knows him to be in
sales.acme.com. For whatever reason, sales.acme.com adds itself to the
RR on the incoming call.

- The firewall acme.com is configured as the outbound proxy. (It also
record-routes, but that doesn't matter here.)

- Requests now go to acme.com, which sends them to sales.acme.com
because of the Route. Sales.acme sends it back to acme.com as its
outbound proxy. This should be a spiral, so it's just extra work.

The traditional justification for outbound proxies has been for
firewalls that all first requests need to go through. To avoid the
spiral, Bob would have to make sure to configure its system with the
'closest' *inbound* system, which in turn would have to use the real
firewall as its outbound proxy. This is somewhat annoying as it would
mean that the DHCP configuration for the two proxies is different.

Again, this is a configuration issue, not as much a protocol issue, but
it may out some brittleness if random parties start record-routing. (As
long as only acme.com record-routes and is the outbound proxy,
sales.acme.com can do its job for inbound requests without harm.)

In any event, the new text should clearly state what outbound proxies
need to do with Route headers. The 'every host removes top Route' rule
implied in 2543/6.33 would not work with outbound proxies, since the UAC
already removed the top Route and placed it in the Request-URI. (I
scanned the new text and it seems silent on this issue at least in
section 'proxy processing of non-initial request'.)