Subject: RE: [Sip] bis-05: transport mechanisms

From: Jonathan Rosenberg <[email-masked]>
Date: Sat, 8 Dec 2001 00:07:20 -0500

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Wednesday, December 05, 2001 6:23 PM
> To: Drage, Keith (Keith)
> Cc: [email-masked]'
> Subject: [Sip] bis-05: transport mechanisms
> 
> 
> Drage, Keith (Keith) writes:
>  > Line 2813 of the bis draft states:
>  > 
>  > All SIP elements MUST support UDP at a minimum.
>  > 
>  > When we get to the definition of URL parameters in 
> 3216-3218 we have the
>  > following:
>  > 
>  > The transport parameter determines the transport mechanism 
> to be used for
>  > sending SIP messages. SIP can use any network transport 
> protocol. Parameter
>  > names are defined for UDP [30], TCP [31], TLS [25], and SCTP [32].
> 
> I think that placing TLS in the same level of
> naming hierarchy as "transport" is asking for
> trouble. If we must, we should append the security
> layer to the actual L4 transport, as in TCP/TLS or
> UDP/IPsec, etc.
> 

transport=tls refers to TLS/TCP specifically, we should simply clarify that.

However, it makes no sense to me to specify a transport of UDP/IPsec, since
IPSec configuration is usually at the OS layer, below the SIP application.
Thus, the proxy or UA would have no way to even explicitly use or not use
IPSec.

-Jonathan R.

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Sun, 9 Dec 2001 12:13:20 -0800 (PST)

> Thus, the proxy or UA would have no way to even explicitly use or not use

   Again, this is an API issue, not a protocol issue. I 
   can very easily install an SA on my Linux box from an
   application by doing:

     system ("ipsec manual --up mtcc.com");

   or somesuch. I can also sniff the credentials
   on a given SPI, albeit the API pretty well
   sucks at the moment.

   Let's not confuse the current lack of decent
   IPsec socket interface with complete inability.
   Indeed, expanded use of transport IPsec will 
   probably force this issue.
   
	Mike