Subject: [Sip] Re: Comment on draft-ietf-sip-connect-reuse-04

From: Rohan Mahy <[email-masked]>
Date: Tue, 6 Dec 2005 08:26:13 -0800

On Nov 7, 2005, at 15:53, Cullen Jennings wrote:

>
> Two issues...
>
> This is very difficult to implement for most people. If you do a DNS 
> lookup
> of an A record, this requires you to get every IP address then look at 
> your
> alias to see if you have one that matches - and not do load balancing. 
> This
> is hard unless you have your own DNS resolve library which most people 
> do
> not.

You don't need to lookup every IP address, you do need to consult a 
list of "named" connections before you do SRV lookup however.

> Second, I don't think it works. If a server runs two virtual domain 
> a.com
> and b.com both on 1.2.3.4:5060 and use the TLS extended hello to 
> separate
> them, then if it connects to C as A.com, and later C wants to send a 
> sips
> message to B.com, it will deliver it over the connection to A.com 
> which is
> totally broken from a security point of view.

This does not result in a problem.  A.com connects to C *from* an 
ephemeral port. The connection reuse causes C to reuse a connection to 
A.com when contacting A.com.  A new connection from B.com would use a 
different ephemeral port.

thanks,
-rohan

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Brett Tate" <[email-masked]>
Date: Thu, 8 Dec 2005 14:05:00 -0500

> > This is very difficult to implement for most people. 
> > If you do a DNS lookup of an A record, this requires 
> > you to get every IP address then look at your
> > alias to see if you have one that matches - and not 
> > do load balancing. This is hard unless you have your 
> > own DNS resolve library which most people do not.
> 
> You don't need to lookup every IP address, you do need 
> to consult a list of "named" connections before you 
> do SRV lookup however.

Rohan,

Thanks for answering Cullen's question.

I understand "You don't need to lookup every IP address".  However I don't
fully understand when to query the alias list and what all should be
included within the query.  The answer only mentioned the portion prior to
the SRV query.  This would indicate transport successfully determined via
NAPTR or transport parameter and there was no port.  This example is
partially included within the draft.  

Are there other locations within the DNS NAPTR, SRV, A-record resolution
process when the alias query should occur?  

And if an alias not found during first query, should more queries occur
during DNS resolution process?  

And if so, what should be the contents used for each query (port added by
SRV, handling of trailing dot added by NAPTR or SRV, etcetera)?

Just trying to extrapolate the response to understand how it fits some of my
questions within an earlier posting...

http://www1.ietf.org/mail-archive/web/sip/current/msg12077.html

Thanks,
Brett