Subject: RE: [Sip] How to indicate during proxy discovery thataproxysuppor ts"outbound"

From: "Drage, Keith (Keith)" <[email-masked]>
Date: Mon, 3 Apr 2006 14:54:52 +0100

I seem to remember we had the list discussion on what RFC3329 did with Proxy-Require after RFC3329 was published.

That discussion did not come up with better ways of dealing with the RFC 3329 issue, but I seem to remember at least one SIP guru disagreeing with that usage of Proxy-Require.

regards

Keith

> -----Original Message-----
> From: Patrick Timmons [mailto:[email-masked]]
> Sent: 01 April 2006 02:31
> To: 'Jeroen van Bemmel'; 'Hadriel Kaplan'; 'Cullen Jennings'; 'Dean
> Willis'; [email-masked]
> Cc: 'Juha Heinanen'
> Subject: RE: [Sip] How to indicate during proxy discovery
> thataproxysupports"outbound"
> 
> 
> Jeroen -
> 
> Ah, I wasn't aware that RFC3329 legitimized stripping 
> Proxy-Require headers
> for edge proxies.  Thanks for the reference.
> 
> However -- in a general sense, the issue here is that the UA 
> needs to know
> specific features as they pertain to the topology of the 
> network; i.e., that
> the *edge* supports 'outbound'.  My sense is that it's 
> perfectly reasonable
> to think that there will be requirements for UAs to know 
> specific features
> of proxies that sit topologically off of the edge (?-CSCF, 
> for example).  In
> this case, the Proxy-Require technique breaks down... and 
> we're left with
> supporting two different methods for achieving (essentially) 
> the same ends.
> 
> For features that are specific to the edge proxy like 
> sec-agree and outbound
> this approach clearly works at least as efficiently as an additional
> round-trip.  I'm certainly not opposed to using the 
> technique, since RFC3329
> set the precedent that it is okay to do so.  But it seems 
> that using OPTIONS
> to query the options of a device is putting the protocol to 
> its intended
> use; as to whether this virtue is worth the extra round-trip 
> is open for
> debate I suppose.
> 
> Maybe I'll go back and read the archives -- this must have 
> come up before
> during the development of RFC3329, which was before my time.
> 
> pt.
> 
> -----Original Message-----
> From: Jeroen van Bemmel [mailto:[email-masked]] 
> Sent: Friday, March 31, 2006 3:29 PM
> To: Patrick Timmons; 'Hadriel Kaplan'; 'Cullen Jennings'; 
> 'Dean Willis';
> [email-masked]
> Cc: 'Juha Heinanen'
> Subject: Re: [Sip] How to indicate during proxy discovery
> thataproxysupports"outbound"
> 
> Patrick,
> 
> Benefit of that is that it's nice and simple, drawback is an extra
> roundtrip. If you're willing to risk an extra roundtrip, you could do
> slightly better by adding Proxy-Require: outbound to the request, and
> specify proxy behavior similar to RFC3329. In particular, the 
> edge proxy
> would be required to remove the Proxy-Require header if it supports
> outbound, and then forward the request (although RFC3261 
> table 2 does not
> allow a proxy to remove a Proxy-Require header, that is what 
> is done). A
> non-supporting proxy would respond with an error, and the 
> request could be
> retried without outbound.
> 
> This approach would only give an extra roundtrip in case the 
> edge proxy does
> not support outbound
> 
> Regards,
> 
> Jeroen
> 
> ----- Original Message -----
> From: "Patrick Timmons" <[email-masked]>
> To: "'Hadriel Kaplan'" <[email-masked]>; "'Jeroen van 
> Bemmel'" 
> <[email-masked]>; "'Cullen Jennings'" <[email-masked]>; 
> "'Dean Willis'"
> 
> <[email-masked]>; <[email-masked]>
> Cc: "'Juha Heinanen'" <[email-masked]>
> Sent: Friday, March 31, 2006 9:56 PM
> Subject: RE: [Sip] How to indicate during proxy discovery that
> aproxysupports"outbound"
> 
> 
> > Why not require that the UA send an OPTIONS request to its outbound 
> > proxy with Max-Forwards: 0?  This jibes with the 
> recommendations put 
> > forth in RFC
> > 3261 (sec. 11) regarding querying capabilities of proxies:
> >
> >   Alternatively, a server receiving an OPTIONS request with a Max-
> >   Forwards header field value of 0 MAY respond to the request
> >   regardless of the Request-URI.
> >
> >      This behavior is common with HTTP/1.1.  This behavior 
> can be used
> >      as a "traceroute" functionality to check the capabilities of
> >      individual hop servers by sending a series of OPTIONS requests
> >      with incremented Max-Forwards values.
> >
> > The edge proxy could reply to such a request with "Supported: 
> > outbound, keepalive-stun", or something along these lines.
> >
> > The registrar's support of sip-outbound could be queried 
> similarly.  
> > This could be done either prior to, or immediately after initial
> registration.
> >
> > pt.
> >
> > -----Original Message-----
> > From: Hadriel Kaplan [mailto:[email-masked]]
> > Sent: Thursday, March 30, 2006 4:31 AM
> > To: 'Jeroen van Bemmel'; 'Cullen Jennings'; 'Dean Willis'; 
> > [email-masked]
> > Cc: 'Juha Heinanen'
> > Subject: RE: [Sip] How to indicate during proxy discovery that 
> > aproxysupports"outbound"
> >
> > Hi Jeroen,
> > The whole point is actually to make it a MUST that the UA 
> perform a "safe"
> > check, where "safe" means a sip-compliant check, before it does 
> > anything bad.  It cannot be a choice of a sip-outbound 
> compliant UA to 
> > just do bad if it wishes.  It's not actually the outbound 
> sip changes 
> > that are the big problem, it's really the binary/stun messages.
> >
> > I'm not overly worried about anyone sending new sip signaling - of 
> > course you can send that.  Every new draft/RFC does that, and the 
> > beauty of SIP is to have that backwards-compatible flexibility.  If 
> > the new sip-signaling needs to be understood by boxes that 
> didn't have 
> > to understand it before because they may create issues for 
> the legacy 
> > sip "network", well that's a problem from a SIP WG 
> perspective I would 
> > think.  And that is also a problem right now, perhaps, if a 
> > sip-outbound UA assumes the edge proxy is a sip-outbound 
> proxy, when 
> > it is not.  Right now the draft has no way to let the UA know the 
> > edge-proxy supports outbound.  It has a way for it to know the 
> > registrar does, although even then it doesn't say that 
> knowledge must 
> > be used for anything.  The results of that may lead to constant 
> > forking, which is probably not a good thing.
> >
> > But the REAL problem is the UA can send a binary message.  I 
> > understand why we want to do that, and although I hated the idea at 
> > first, I am willing to accept the decision and it's growing on me.  
> > BUT, it's still a major issue if UAs can send it when they 
> like.  They 
> > MUST safely check to make sure it's ok.
> >
> > It's not a major issue for my company - our products will 
> handle it fine.
> > But I can't speak for others.  And not everyone who makes a 
> > sip-compliant proxy/registrar/UAS follows this mailing list.  And 
> > people have all kinds of old software out there, which may 
> be hard to 
> > upgrade.  One only needs to look at the initial Protos test 
> results to 
> > get an idea of the potential.
> >
> > Do we really want CERT Advisories issued, and the root 
> cause being the 
> > IETF SIP Working Group???  Ironically, that would be good 
> for firewall 
> > and SBC vendors - but not good for SIP.  We have to do as much as 
> > possible to prevent it.
> >
> > -Hadriel
> >
> >
> >> -----Original Message-----
> >> From: Jeroen van Bemmel [mailto:[email-masked]]
> >> Sent: Thursday, March 30, 2006 1:08 AM
> >> To: Cullen Jennings; Dean Willis; [email-masked]
> >> Cc: Juha Heinanen
> >> Subject: Re: [Sip] How to indicate during proxy discovery that a 
> >> proxysupports"outbound"
> >>
> >> > On 3/25/06 1:53 PM, "Jeroen van Bemmel" 
> <[email-masked]> wrote:
> >> >
> >> >> Could you explain why it is needed that the UA knows 
> whether the 
> >> >> proxy supports outbound before sending its REGISTER request?
> >> >
> >> > So that we don't send things to the proxy that it does 
> not understand.
> >> > Some
> >> > people did not care about this - some felt strongly 
> about it. Some
> >> pointed
> >> > out that the proxy might black list a client that seemed to be
> >> "attacking
> >> > it" with bogus packets.
> >>
> >> The people that feel strongly about this could add 
> 'Require: outbound'
> >> to their request. Implementations that would blacklist 
> such clients 
> >> would be considered broken.
> >>
> >> An alternative would perhaps be to depend on an 
> authentication challenge:
> >> first send a normal REGISTER, challenge, respond to the 
> challenge and 
> >> if
> >> Supported: outbound is there modify the request as needed. 
> Not common 
> >> practice though...
> >>
> >> Jeroen
> >>
> >>
> >> _______________________________________________
> >> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> >> This list is for NEW development of the core SIP Protocol Use 
> >> [email-masked] for questions on current sip Use 
> >> [email-masked] for new developments on the application of sip
> >
> >
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol Use 
> > [email-masked] for questions on current sip Use 
> > [email-masked] for new developments on the application of sip
> > 
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol Use
> [email-masked] for questions on current sip Use
> [email-masked] for new developments on the application of sip
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Jeroen van Bemmel" <[email-masked]>
Date: Mon, 3 Apr 2006 19:02:00 +0200

Keith,

You are correct - see 
http://www1.ietf.org/mail-archive/web/sip/current/msg07871.html

JR refers to RFC 3323 also doing this, and agrees that RFC3261 should be 
updated to allow this sort of behavior

Regards,

jeroen

PS Note that also here it is discussed that the proxy shouldn't touch any 
Require headers

----- Original Message ----- 
From: "Drage, Keith (Keith)" <[email-masked]>
To: "'Patrick Timmons'" <[email-masked]>; "'Jeroen van Bemmel'" 
<[email-masked]>; "'Hadriel Kaplan'" <[email-masked]>; "'Cullen 
Jennings'" <[email-masked]>; "'Dean Willis'" <[email-masked]>; 
<[email-masked]>
Cc: "'Juha Heinanen'" <[email-masked]>
Sent: Monday, April 03, 2006 3:54 PM
Subject: RE: [Sip] How to indicate during proxy discovery 
thataproxysupports"outbound"

>I seem to remember we had the list discussion on what RFC3329 did with 
>Proxy-Require after RFC3329 was published.
>
> That discussion did not come up with better ways of dealing with the RFC 
> 3329 issue, but I seem to remember at least one SIP guru disagreeing with 
> that usage of Proxy-Require.
>
> regards
>
> Keith
>