Subject: [Sip] Connection Reuse draft to focus on TLS connections

From: Dean Willis <[email-masked]>
Date: Mon, 2 Mar 2009 14:03:55 -0600

We intend to slightly rescope the Connection Reuse draft:

http://tools.ietf.org/id/draft-ietf-sip-connect-reuse-12.txt

Based on input from our ADs, the WG chairs and the editor of the have  
agreed to eliminate the part of the draft that discusses the  
implementation of reusing non-TLS connections. The stage for this is  
set in the abstract of the current draft, from which I quote:

> From the security perspective, it is bad practice to reuse a single  
> connection for the TCP or SCTP transport between two peers, and this  
> document provides specific insights into why this is the case. As a  
> remedy, it suggests using two TCP connections (or two SCTP  
> associations), each opened pro-actively towards the recipient by the  
> sender.

We may  discuss at a later date the idea of developing a draft for  
connection reuse in the absence of TLS.

I'm really not expecting anybody to object strongly to this approach,  
but am bringing this to the list to avoid surprises down the road. If  
you have major issues with doing it this way, please bring them up now.

--
Dean Willis (as chair, ten years and counting . . .)

---

From: "Christer Holmberg" <[email-masked]>
Date: Mon, 2 Mar 2009 21:12:53 +0100

Hi,

Just a question: does this rescope affect chapter 8 (Overlap with
connection reuse) of the keep draft
(http://users.piuha.net/cholmber/drafts/draft-holmberg-sip-keep-03.txt)?

Regards,

Christer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Dean Willis
Sent: Monday, March 02, 2009 10:04 PM
To: SIP WG
Cc: Cullen Jennings; Keith Drage
Subject: [Sip] Connection Reuse draft to focus on TLS connections

Based on input from our ADs, the WG chairs and the editor of the have
agreed to eliminate the part of the draft that discusses the
implementation of reusing non-TLS connections. The stage for this is set

_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol Use
[email-masked] for questions on current sip Use
[email-masked] for new developments on the application of sip

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 02 Mar 2009 14:19:55 -0600

> (http://users.piuha.net/cholmber/drafts/draft-holmberg-sip-keep-03.txt)?

Christer: I believe the text you have in keep-03 stays as it
is.  When we start work on a new draft for connection oriented
non-TLS transports, we may have to update that section with
one more reference to the new draft.  That should be the
extent of impact on keep-03.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/

---

From: Hadriel Kaplan <[email-masked]>
Date: Mon, 2 Mar 2009 15:58:45 -0500

One should note it's not applicable to just "TLS" - it's only applicable to mutual-TLS.  I don't mean to sound negative, but really you might as well limit it's applicability to IPv6 as well at this rate.  :(

Can this draft at least remove the statement in section 8.1 that the client SHOULD NOT add an alias parameter to TCP/SCTP transports?   There's actually nothing wrong with adding one - it's the server side of the connection that needs to not use/honor it based on its policy. (and if you think adding one would be malicious, then trust me malicious devices will simply add one and ignore this draft's SHOULD NOT statement)  All the parameter says is effectively: "I am willing to accept requests on this connection I created, if you wish to send them to me over it".

-hadriel

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Dean
> Willis
> Sent: Monday, March 02, 2009 3:04 PM
> To: SIP WG
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 02 Mar 2009 15:21:49 -0600

Hadriel Kaplan wrote:
> One should note it's not applicable to just "TLS" - it's only
> applicable to mutual-TLS.  I don't mean to sound negative, but really
> you might as well limit it's applicability to IPv6 as well at this
> rate.  :(
> 
> Can this draft at least remove the statement in section 8.1 that the
> client SHOULD NOT add an alias parameter to TCP/SCTP transports?

Hadriel: I have had discussions with the AD on TCP/SCTP connection
reuse and their impact on the current TLS connection reuse draft.
The AD is of the opinion that it will be hard to progress
the current connect-reuse draft in IESG while allowing TCP/SCTP
connection reuse in the big-I Internet.

Obviously, the fact remains that people will use TCP connection
reuse, whether or not this draft prohibits it or not.  The
question boils down to how to best move *this* work ahead
(i.e., TLS connection reuse), and then deal with TCP connection
reuse.

The best way forward is to excise any text relating to TCP/SCTP
connection reuse, and focus this draft on TLS only (the original
motivation for the draft.)  This allows us to get the TLS
connect-reuse draft out (it has been pending now for four
arduous, laborious, suspenseful, pondering, brutal, intemperate,
and exacting years.)

In parallel, right after the -00 deadline for IETF 74 is over,
I will put out a new draft on TCP/SCTP connection reuse that
allows reuse for these transports when certain assumptions
are met.  I have been assured by the AD that a milestone can
be quickly added to SIP/DISPATCH/SIPCORE WG to allow the new
work to progress expeditiously.

Is that a workable solution for you?  Please let me know.

- vijay

---

From: Hadriel Kaplan <[email-masked]>
Date: Mon, 2 Mar 2009 16:26:07 -0500

Ahhh, so you'd like to end your misery.  That sounds fair.  Ignore my comment.

-hadriel
p.s. but you're a glutton for punishment if you submit another I-D for non-TLS connect-reuse. ;)

> From: Vijay K. Gurbani [mailto:[email-masked]]
> Sent: Monday, March 02, 2009 4:22 PM
> To: Hadriel Kaplan
> Cc: SIP WG
> Subject: Re: [Sip] Connection Reuse draft to focus on TLS connections
>
> Hadriel Kaplan wrote:

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 02 Mar 2009 15:30:41 -0600

> Ahhh, so you'd like to end your misery.  That sounds fair.  Ignore my

Ending my connect-reuse induced misery is one part, yes.

> -hadriel p.s. but you're a glutton for punishment if you submit
> another I-D for non-TLS connect-reuse. ;)

Aha, but I can have you co-edit the TCP/SCTP connect-reuse draft
and make sure that the punishment is equitably shared between us ;-)

But seriously, as long as the need to do TCP/SCTP connection reuse
is there, I don't mind spending time doing that effort, with you
or anyone else (in fact, I have an editor in mind for the new
draft ... ;-) )

- vijay