Subject: RE: [SIP] Multi-proxy authentication deadlock

From: "Robert Sparks" <[email-masked]>
Date: Sun, 3 Dec 2000 22:21:38 -0600

I can't construct deadlock now either.

I think the case being discussed that
lead to the comment was:

UA         P1            P2
| req       |             |
|---------->|             |
| 407       |             |
|<----------|             |
|           |             |
|req(c1)    |             |
|---------->|req          |
|           |------------>|
|           |407          |
|407        |<------------|
|<----------|             |
|           |             |
|req(c1,c2) |             |
|---------->|             |
|407        |             |
|<----------|             |

Where P1 rejected credentials c1 the second time around
because it expired the challenge after receiving them
the first time. This doesn't result in deadlock however,
as the last 407 will either be reissuing the same challenge
with a new nonce (stale=true), or a new challenge altogether,
and when the corresponding credentials, c1', are provided,
the flow will continue:

|req(c1',c2)|             |
|---------->|req(c2)      |
|           |------------>|req
|           |             |------->

So, the statement could be removed, or changed to note
that a proxy that expires a challenge after the first
successful response increases the number of submissions
it takes to get a request to its intended destination
significiantly. The worst case is having all n proxies
in the path of a request challenge and expire the
challenge after the first successful response. That
scenario requires submitting the request 2^n times to
get it to its intended final destination.

RjS

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Jonathan Rosenberg
> Sent: Wednesday, November 22, 2000 4:10 PM
> To: 'Alexandre Charest'; [email-masked]
> Subject: RE: [SIP] Multi-proxy authentication deadlock
>
>
> Hmm; I could not create the case either. The case that I thought
> would cause
> a deadlock does not, in fact.
>
> Robert?
>
> -Jonathan R.
>
> ---
> Jonathan D. Rosenberg                       72 Eagle Rock Ave.
> Chief Scientist                             First Floor
> dynamicsoft                                 East Hanover, NJ 07936
> [email-masked]                     FAX:   (973) 952-5050
> http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
> http://www.dynamicsoft.com
>
>
> > -----Original Message-----
> > From: Alexandre Charest [mailto:[email-masked]]
> > Sent: Wednesday, November 22, 2000 8:21 AM
> > To: [email-masked]
> > Subject: [SIP] Multi-proxy authentication deadlock
> >
> >
> > In (expired) ID draft-sparks-sip-multiproxy-auth-00:
> >
> > "A UAC should be prepared to terminate the deadlock situation
> > caused by a
> > proxy in the chain that expires a challenge after its first successful
> > response."
> > Can somebody give an example of call flow resulting in such a
> > deadlock? I
> > tried many scenarios and I can't figure out what is meant.
> > Thanks.
> >
> > Alexandre Charest
> > Software Designer
> > Mediatrix Telecom Inc. (www.mediatrix.com)
> > tél:(819) 829-8749 #275
> > fax: (819) 829-5100
> >
> >
> > _______________________________________________
> > SIP mailing list
> > [email-masked]
> > http://lists.bell-labs.com/mailman/listinfo/sip
> >
>
> _______________________________________________
> SIP mailing list
> [email-masked]
> http://lists.bell-labs.com/mailman/listinfo/sip
>

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip