Subject: Re: [Sip] Comments on draft-ietf-sip-connect-reuse-05.txt

From: Lavis Zhou <[email-masked]>
Date: Sat, 29 Apr 2006 15:02:58 +0800

Hi,

A quite old thread, just pick it up. If the following idea had been proposed or discussed before, Pls let it be.

Is it possible to extend the Alias parameter in Via to make it have 2 values: one as received, one as sent-by? 

The sender will set the alias value to received as normal case, but for virtual host, the sender will set it to sent-by, so the receiver can use either the received IP or the sent-by in via as alias host.

Maybe it's one way to resolve it, but this will make the processing in receiver little complex.

Rgds,
Lavis

***************************************************************************************
????????????????????,??????????????????????????????????(?????????????????????)?????????????????,????????????????????!
**************************************************************************************

***************************************************************************************
This e-mail and its attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!
***************************************************************************************
----- Original Message ----- 
From: "Cullen Jennings" <[email-masked]>
To: "Jeroen van Bemmel" <[email-masked]>; <[email-masked]>
Sent: Friday, March 17, 2006 3:21 AM
Subject: Re: [Sip] Comments on draft-ietf-sip-connect-reuse-05.txt

> On 3/14/06 10:06 AM, "Jeroen van Bemmel" <[email-masked]> wrote:
> 
> >> 
> >> If a proxy hosts two domain one.example.com and two.example.com on the
> >> same
> >> IP and port, this does not seem to work. The wrong TLS connection would be
> >> used. The problem is the cache is populated with the IP/port as the index
> >> instead of using the cert name as the index.
> >> 
> > 
> > At first I did not understand your point, until I saw your other posting on
> > the -04 version: [copy]
> > 
> > | Second, I don't think it works. If a server runs two virtual domain a.com
> > | and b.com both on 1.2.3.4:5060 and use the TLS extended hello to separate
> > | them, then if it connects to C as A.com, and later C wants to send a sips
> > | message to B.com, it will deliver it over the connection to A.com which is
> > | totally broken from a security point of view.
> > 
> > So what you're saying is that a TLS connection should not be used to
> > multiplex traffic for different virtual domains, even though it is known to
> > end up at the exact same host and port?
> 
> Yes exactly, the problem is when the message arrives on a connection that is
> from both A.com and B.com, the proxy receiving it does not know if it came
> from A.com or B.com and can't make the appropriate policy decisions on what
> to do with based on which domain it came from. Proxy often implement white
> or black list style authorization policy based on where a call came from.
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip