Subject: RE: [Sip] How to indicate during proxy discoverythataproxysupports"outbound"

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Mon, 3 Apr 2006 09:21:43 +0200

Hi,

In case the outbound proxy and the registrar are NOT the same, I assume
that the outbound proxy would not only remove the option tag from the
Proxy-Require header, but also from the Require header? Because, as far
as I can see there is no reason to require the registrar to also support
outbound.

Regards,

Christer

-----Original Message-----
From: Jeroen van Bemmel [mailto:[email-masked]] 
Sent: 3. huhtikuuta 2006 9:29
To: Christer Holmberg (JO/LMF); Hadriel Kaplan; [email-masked]
Subject: Re: [Sip] How to indicate during proxy
discoverythataproxysupports"outbound"

Christer,

Besides detection for support, Proxy-Require is also useful for
backwards compatibility

Consider how the edge proxy decides whether or not it needs to perform
outbound processing. Without Proxy-Require, it would have to either look
for
'Require: outbound' or inspect the Contact headers, look for 'reg-id'
and assume that means the UAC supports / wants to use outbound. From a
protocol purist perspective, both of these alternatives are less
preferred than Proxy-Require

BTW, section 3.4 should have some text discussing this. It currently
says "edge proxy should use Path" but the processing seems to depend on
the fact that there is a 'reg-id'. What if there is none?

Regards,

Jeroen

----- Original Message -----
From: "Christer Holmberg" <[email-masked]>
To: "Hadriel Kaplan" <[email-masked]>; <[email-masked]>
Sent: Monday, April 03, 2006 7:33 AM
Subject: RE: [Sip] How to indicate during proxy
discoverythataproxysupports"outbound"

Hi Hadriel,

My mail was rabout the OPTIONS alternative. And, you wouldn't even need
Require there, because the outbound proxy would simply reply what it
supports. In fact, no standardization is required for that, so should we
mention it as an option?

And, if there are no issues (removal of options tags from the
P-R/Require header by proxy) with the REGISTER alternative I don't have
any issues with that solution - as long as we document the assumptions
and restriction.

Regards,

Christer
Regards,

Christr

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol Use
[email-masked] for questions on current sip Use
[email-masked] for new developments on the application of sip 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Jeroen van Bemmel" <[email-masked]>
Date: Mon, 3 Apr 2006 18:55:50 +0200

Christer,

No, I think the outbound proxy shouldn't be touching any Require headers, 
whether present or not

It is up to the UAC to decide whether the request needs a Require header or 
not. If people have strong feelings against sending a REGISTER request with 
reg-id parameters etc, then perhaps the draft could say "UAC SHOULD add 
Require: outbound to the REGISTER request"

Though in RFC3329 the proxy does remove the Require header, it seems that 
outbound is different from sec-agree in this case.

Regards,

Jeroen

----- Original Message ----- 
From: "Christer Holmberg (JO/LMF)" <[email-masked]>
To: "Jeroen van Bemmel" <[email-masked]>; "Hadriel Kaplan" 
<[email-masked]>; <[email-masked]>
Sent: Monday, April 03, 2006 9:21 AM
Subject: RE: [Sip] How to indicate during proxy 
discoverythataproxysupports"outbound"

Hi,

Regards,

Christer

-----Original Message-----
From: Jeroen van Bemmel [mailto:[email-masked]]
Sent: 3. huhtikuuta 2006 9:29
To: Christer Holmberg (JO/LMF); Hadriel Kaplan; [email-masked]
Subject: Re: [Sip] How to indicate during proxy

Christer,

Regards,

Jeroen

----- Original Message -----
From: "Christer Holmberg" <[email-masked]>
To: "Hadriel Kaplan" <[email-masked]>; <[email-masked]>
Sent: Monday, April 03, 2006 7:33 AM
Subject: RE: [Sip] How to indicate during proxy

Hi Hadriel,

Regards,

Christer
Regards,

Christr

---

From: "Bob Penfield" <[email-masked]>
Date: Mon, 3 Apr 2006 14:04:36 -0400

inline.
----- Original Message ----- 
From: "Jeroen van Bemmel" <[email-masked]>

> Christer,
>
> No, I think the outbound proxy shouldn't be touching any
> Require headers, whether present or not
>
> It is up to the UAC to decide whether the request needs
> a Require header or not. If people have strong feelings
> against sending a REGISTER request with reg-id parameters
> etc, then perhaps the draft could say "UAC SHOULD add
> Though in RFC3329 the proxy does remove the Require header,
> it seems that outbound is different from sec-agree in
> this case.
>

I'm afraid I disagree. I think that 'outbound' is the same as sec-agree in 
this case.

For outbound we need two option tags to make things unambiguous: One for the 
reusable connection with keepalive behavior that the first hop must do (e.g 
'outbound-stun'), and one for the registrar behavior of recognizing reg-id 
and sip-instance in the Contact (e.g. 'outbound-reg').

Unless the UA knows that the outbound proxy is not the registrar, its first 
REGISTER will have:

Require: outbound-stun, outbound-reg
Proxy-Require: outbound-stun

outbound-reg is intended for the registrar, and outbound-stun is intended 
for the first hop.

Remember, for REGISTER, the registrar is the UAS, not a proxy. If the first 
hop is the registrar, the Require header applies, and 'outbound-stun' needs 
to be there so the registrar does the reusable connection with keepalive.

If the first hop is not the registrar, it must remove the 'outbound-stun' 
tag from both the Require and the Proxy-Require. This is because the 
'outbound-stun' feature is applied completely by the first hop proxy. The 
registrar does not need to do any 'outbound-stun' behavior. It only needs to 
do 'outbound-reg' behavior. If the tag was left in the Require header, it 
would a) reject it if it does not support 'outbound-stun'; or b) do the 
wrong thing by applying 'outbound-stun' behavior.

cheers,
(-:bob

---

From: "Jeroen van Bemmel" <[email-masked]>
Date: Mon, 3 Apr 2006 21:03:20 +0200

Bob,

Indeed, if a UAC would do as you describe, i.e.

> Proxy-Require: outbound-stun

then the proxy would have to remove both outbound-stun option tags.

Outbound is different from RFC3329 in that it still requires specific 
behavior from the server (registrar) even when one or more proxies are in 
between (i.e. mapping of incoming requests to the correct flow). In a 
deployment with one or more proxies, the registrar wouldn't be handling 
STUN. However, since the registrar must also work in deployments without 
proxies it needs to support STUN anyway. So in this sense, Supported: 
outbound-reg would imply Supported: outbound-stun

It depends on whether one considers it acceptable for one option-tag to 
signify different behavior at proxies versus servers. In other words, are we 
talking about 1 or 2 features? Is there ambiguity? Lets see

"Proxy-Require: outbound" would mean that the proxy must support STUN (i.e. 
expect it and send replies), Path and the generation/mapping of flow 
identifiers.
"Require: outbound" would mean that the registrar must support STUN and the 
mapping of flow identifiers

I personally don't see any ambiguity here. So in my mind the UAC would send

REGISTER
Require: outbound
Proxy-Require: outbound
Supported: path
....

and if there is an edge proxy, it would remove only the Proxy-Require 
header. The registrar would even be able to detect whether it should expect 
STUN requests (if there is still a Proxy-Require, it would be a direct 
connection). However, I don't see why it would need to know this.

Note that IMHO the UAC shouldn't try to "optimize" its REGISTER request by 
omitting the Proxy-Require if it knows that there is a direct connection 
with the registrar. So there would not be any "unless" rule here

Regards,

Jeroen

----- Original Message ----- 
From: "Bob Penfield" <[email-masked]>
To: "Jeroen van Bemmel" <[email-masked]>; "Christer Holmberg (JO/LMF)" 
<[email-masked]>; "Hadriel Kaplan" <[email-masked]>; 
<[email-masked]>
Sent: Monday, April 03, 2006 8:04 PM
Subject: Re: [Sip] How to indicate during 
proxydiscoverythataproxysupports"outbound"

> For outbound we need two option tags to make things unambiguous: One for 
> the reusable connection with keepalive behavior that the first hop must do 
> (e.g 'outbound-stun'), and one for the registrar behavior of recognizing 
> reg-id and sip-instance in the Contact (e.g. 'outbound-reg').
>
> Unless the UA knows that the outbound proxy is not the registrar, its 
> first REGISTER will have:
>
> Remember, for REGISTER, the registrar is the UAS, not a proxy. If the 
> first hop is the registrar, the Require header applies, and 
> 'outbound-stun' needs to be there so the registrar does the reusable 
> connection with keepalive.
>
> registrar does not need to do any 'outbound-stun' behavior. It only needs 
> to do 'outbound-reg' behavior. If the tag was left in the Require header, 
> it would a) reject it if it does not support 'outbound-stun'; or b) do the

---

From: "Bob Penfield" <[email-masked]>
Date: Mon, 3 Apr 2006 16:10:29 -0400

Jeroen,

My point is that there are two sets of behaviors. The 'outbound-stun' can 
still be used by UAs that do not set up redundant connections (i.e. it will 
not include sip-instance or reg-id and will not include 
Require:outbound-reg). In that case, if there is an outbound proxy between 
the UA and the registrar, the registrar does not need to support 
'outbound-stun'.

The ambiguity comes into play at the registrar. If there was only one tag, 
and the registrar saw it in the Require header, would that mean that it 
should expect STUN keepalive's from the edge proxy? Or just look for reg-id 
and sip-instance in the Contacts? or both?

cheers,
(-:bob

Robert F. Penfield
Chief Software Architect
Acme Packet, Inc.
71 Third Avenue
Burlington, MA 01803
[email-masked]

----- Original Message ----- 
From: "Jeroen van Bemmel" <[email-masked]>
To: "Bob Penfield" <[email-masked]>; "Christer Holmberg (JO/LMF)" 
<[email-masked]>; "Hadriel Kaplan" <[email-masked]>; 
<[email-masked]>
Sent: Monday, April 03, 2006 3:03 PM
Subject: Re: [Sip] How to indicate during 
proxydiscoverythataproxysupports"outbound"

> signify different behavior at proxies versus servers. In other words, are 
> we talking about 1 or 2 features? Is there ambiguity? Lets see
>
> "Proxy-Require: outbound" would mean that the proxy must support STUN 
> (i.e. expect it and send replies), Path and the generation/mapping of flow 
> identifiers.
> "Require: outbound" would mean that the registrar must support STUN and 
> the mapping of flow identifiers
>
> header. The registrar would even be able to detect whether it should 
> expect STUN requests (if there is still a Proxy-Require, it would be a 
> direct connection). However, I don't see why it would need to know this.
>
> <[email-masked]>; "Hadriel Kaplan" 
>> I'm afraid I disagree. I think that 'outbound' is the same as sec-agree 
>> in this case.
>>
>> the reusable connection with keepalive behavior that the first hop must 
>> do (e.g 'outbound-stun'), and one for the registrar behavior of 
>> recognizing reg-id and sip-instance in the Contact (e.g. 'outbound-reg').
>>
>> it would a) reject it if it does not support 'outbound-stun'; or b) do 
>> the wrong thing by applying 'outbound-stun' behavior.
>>
>> cheers,
>> (-:bob
>>
>>> Regards,
>>>
>>> Jeroen
>>>

---

From: "Jeroen van Bemmel" <[email-masked]>
Date: Mon, 3 Apr 2006 22:44:57 +0200

Bob,

see inline

rgrds,

jerone
----- Original Message ----- 
From: "Bob Penfield" <[email-masked]>
To: "Jeroen van Bemmel" <[email-masked]>; "Christer Holmberg (JO/LMF)" 
<[email-masked]>; "Hadriel Kaplan" <[email-masked]>; 
<[email-masked]>
Sent: Monday, April 03, 2006 10:10 PM
Subject: Re: [Sip] How to indicate during 
proxydiscoverythataproxysupports"outbound"

> still be used by UAs that do not set up redundant connections (i.e. it 
> will not include sip-instance or reg-id and will not include 

The above seems true only for UDP. Even for a single TCP connection, the UA 
would have to specify the flow identification components (i.e. sip-instance 
+ reg-id, latter could be implied if absent). If not, what would be the 
point of keeping the flow alive? Inbound requests would not be routed via it 
(unless the connection reuse mechanism was used, but the scoping of these 
drafts was intentionally separated: for NAT traversal, only outbound is 
applicable)

STUN for UDP only is currently already possible without any support from 
registrar or edge proxies. So what "outbound-stun" would do is direct STUN 
traffic to the outbound proxy instead of some global STUN server?

> should expect STUN keepalive's from the edge proxy? Or just look for 
> reg-id and sip-instance in the Contacts? or both?
>

As far as I understood the edge proxy would never send STUN keepalive 
requests. If it would, additional processing rules are needed (e.g. not 
remove the Proxy-Require because next hop must support STUN too). So Require 
would always mean: look for reg-id + sip-instance, setup flow mapping

> To: "Bob Penfield" <[email-masked]>; "Christer Holmberg 
> (JO/LMF)" <[email-masked]>; "Hadriel Kaplan" 
>> (i.e. expect it and send replies), Path and the generation/mapping of 
>> flow identifiers.
>> Note that IMHO the UAC shouldn't try to "optimize" its REGISTER request 
>> by omitting the Proxy-Require if it knows that there is a direct 
>> connection with the registrar. So there would not be any "unless" rule 
>> here
>>
>> Regards,
>>
>> Jeroen
>>
>>> outbound-reg is intended for the registrar, and outbound-stun is 
>>> intended for the first hop.
>>>
>>> If the first hop is not the registrar, it must remove the 
>>> 'outbound-stun' tag from both the Require and the Proxy-Require. This is 
>>> because the 'outbound-stun' feature is applied completely by the first 
>>> hop proxy. The registrar does not need to do any 'outbound-stun' 
>>> behavior. It only needs to do 'outbound-reg' behavior. If the tag was 
>>> left in the Require header, it would a) reject it if it does not support 
>>> 'outbound-stun'; or b) do the wrong thing by applying 'outbound-stun' 
>>> behavior.
>>>
>>> cheers,
>>> (-:bob
>>>
>>>> Regards,
>>>>
>>>> Jeroen
>>>>