Subject: [Sip] Outbound Comment: negotiation and edge proxies

From: Adam Roach <[email-masked]>
Date: Thu, 06 Jul 2006 00:49:08 -0500

This one, I might just be confused about, but I combed the draft and 
can't figure out how it is supposed to work.

Section 5 of the outbound document places a number of requirements on 
edge proxies that must be implemented for outbound to work. However, 
negotiation of the outbound mechanism is between the client and the 
registrar. An edge-proxy that doesn't understand outbound will blithely 
shuttle messages back and forth between the client while they signal 
support for the outbound mechanism.

During registration, all a non-outbound edge-proxy will see and care 
about is "Supported: path," which makes it fat and happy. It won't care 
about the funky bits on the end of the Contact. It won't care about the 
"Supported: outbound" header field in the REGISTER response. And it 
won't do anything suspicious that might give the client or the registrar 
some idea that things are about to go quite wrong. The client and 
registrar have done the secret handshake, and are absolutely certain 
that outbound handling is alive and well.

I think this can be fixed with a little more behavior around what 
edge-proxies that support this draft are required to do. Specifically: 
since section 5.1 already has some pretty strong normative language that 
requires edge-proxies to insert Path header fields with certain 
properties, it's a rather small leap to dictate that the form of the 
URIs in these Path header fields must include something that the 
registrar can use to verify outbound support.

For example:

   When an Edge Proxy receives a registration request with a reg-id
   header parameter in the Contact header field, it MUST form a flow
   identifier token that is unique to this network flow.  The Edge Proxy
   MUST insert this token into a URI referring to this proxy and place
   this URI into a Path header field as described in RFC 3327 [RFC3327].
   The token MAY be placed in the userpart of the URI. The URI MUST
   include an ";outbound" parameter.

With that in place, the registrar can now look at an inbound REGISTER 
request and (in addition to checking the Contact header field) look 
through the Path header fields to ensure that all of them contain URIs 
with ";outbound" parameters. If they don't, it can take evasive action 
(perhaps not returning the "Supported: outbound" header field in the 
response?) that prevents things from going wrong.

/a

----

P.S. There is one corner case that this doesn't seem to cover: the 
situation in which the client has a locally provisioned default outbound 
proxy. This locally provisioned default outbound proxy won't use Path at 
all, but it will remain in the signaling for all requests from the 
client. I'm not certain how often this will become a problem, and 
working around it would require something similar to the Path indication 
I describe above, but on Via header fields. That feels like a really 
ugly hack, and I'm not sure it's worth the inelegance to handle cases 
that will be rare, if they exist at all.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: <[email-masked]>
Date: Thu, 6 Jul 2006 10:10:24 +0300

Hi,

The comments sent on the list during last few days seem to
indicate reasonably large concern that it is not sufficient
for the UA to check that the configured proxy URI contains
keepalive=stun parameter, in order for the UA to make sure
that the proxy actually supports outbound. Thus I will 
expect that the next version of outbound draft will address
this issue. Note that the authors of the draft have promised
to raise this as an open issue in the WG meeting, so please
be prepared to contribute that discussion.

The comments I am referring to are this (mine included):

Bob Penfield:
>Does that mean that a UA should not send STUN if the 
>keepalive=stun is not present?
>
>If so, will outbound be useful prior to the completion of the various 
>configuration mechanisms? And is it acceptable for a 
>mis-configured UA to cause the proxy or the registrar to crash or
mis-behave?
>
>A mechanism such as the proposed Proxy-Require/Require method 
>similar to sec-agree allows the UA to determine that the proxy and 
>registrar support STUN before it sends and potentially harmful
messages.

Adam Roach:
>reFrom [email-masked] Thu Jul 06 03:19:52 2006
Content-class: urn:content-classes:message
Subject: RE: [Sip] Outbound: Validating if the proxy supports outbound or not
Date: Thu, 6 Jul 2006 10:10:24 +0300
From: <[email-masked]>
To: <[email-masked]>, <[email-masked]>
Cc: [email-masked], [email-masked]

Hi,

The comments sent on the list during last few days seem to
indicate reasonably large concern that it is not sufficient
for the UA to check that the configured proxy URI contains
keepalive=stun parameter, in order for the UA to make sure
that the proxy actually supports outbound. Thus I will 
expect that the next version of outbound draft will address
this issue. Note that the authors of the draft have promised
to raise this as an open issue in the WG meeting, so please
be prepared to contribute that discussion.

The comments I am referring to are this (mine included):

Bob Penfield:
>Does that mean that a UA should not send STUN if the 
>keepalive=stun is not present?
>
>If so, will outbound be useful prior to the completion of the various 
>configuration mechanisms? And is it acceptable for a 
>mis-configured UA to cause the proxy or the registrar to crash or
mis-behave?
>
>A mechanism such as the proposed Proxy-Require/Require method 
>similar to sec-agree allows the UA to determine that the proxy and 
>registrar support STUN before it sends and potentially harmful
messages.

Erkki Koivusalo:
>The specific concerns that I have (and would like the WG to 
>consider in the meeting) are closely related to what you told:
>
>>We got very strong feed back on one point - don't send 
>>STUN messages to a proxy unless you know it supports them. 
>
>Does the WG consider checking the configured URI as a safe enough
>check for the UA to ensure that the SIP proxy support STUN ?
>
>In my opinion it is not. As an example a vendor X could implement
>a compliant but bad UA which provides an option for the user to 
>configure the settings via an User Interface e.g. like this:
>"Is the phone behind a NAT: Yes/No". When the user selects
>"Yes" the UA would add the keepalive=stun flag to the proxy URI
>even if the user does not have a clue if the proxy actually
>supports outbound or not. There is nothing in outbound draft
>to prevent such unsafe implementations to appear.

Jeroen van Bemmel:
>The point is that these are really 2 separate issues:
>1. Discovering the set of outbound proxy URIs (with keepalive=stun 
>parameters in them)
>2. Confirming that a given proxy in the set actually supports 
>outbound (ie validating the keepalive=stun information)
>
>Of these 2 options, (1) is indeed a separable problem. 
>(2) - to me - is not, for me outbound is not acceptable 
>without something to address (2).

Regards,

Erkki

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Thu, 6 Jul 2006 10:47:38 +0200

Hi,
 
We talk about "keepalive=stun", and we talk about edge proxies supporting outbound.
 
I think we need to separate the issues.
 
1. Whether the edge proxy supports STUN for keep-alive, and whether it needs to be able to "indicate" that.
 
2. Whether the edge proxy supports outbound (in which case it also supports STUN for keep-alive), and whether it needs to be able to "indicate" that.
 
Regards,
 
Christer

________________________________

From: [email-masked] [mailto:[email-masked]]
Sent: Thu 06/07/2006 09:10
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: [Sip] Outbound: Validating if the proxy supports outbound or not

Hi,

mis-behave?
messages.

Adam Roach:
>with ";outbound" parameters. If they don't, it canJul 2006 10:49:27 +0200
Content-class: urn:content-classes:message
Subject: RE: [Sip] Outbound: Validating if the proxy supports outbound or not
Date: Thu, 6 Jul 2006 10:47:38 +0200
From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
To: <[email-masked]>,
	<[email-masked]>,
	<[email-masked]>
Cc: [email-masked], [email-masked]

Hi,
 
We talk about "keepalive=stun", and we talk about edge proxies supporting outbound.
 
I think we need to separate the issues.
 
1. Whether the edge proxy supports STUN for keep-alive, and whether it needs to be able to "indicate" that.
 
2. Whether the edge proxy supports outbound (in which case it also supports STUN for keep-alive), and whether it needs to be able to "indicate" that.
 
Regards,
 
Christer

________________________________

From: [email-masked] [mailto:[email-masked]]
Sent: Thu 06/07/2006 09:10
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: [Sip] Outbound: Validating if the proxy supports outbound or not

Hi,

mis-behave?
messages.

Regards,

Erkki

 take evasive action

Regards,

Erkki

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Thu, 6 Jul 2006 10:45:16 +0200

Hi Adam,
 
>However, negotiation of the outbound mechanism is between the client and the registrar. 
 
Negotiation of the STUN for keep-alive mechanism is between the client and the edge proxy.
 
And, again, I hope we can agree on the fact that the STUN for keep-alive is a stand-alone function, so the "outbound" option tag may not be present at all.
 
Regards,
 
Christer

From: Adam Roach [mailto:[email-masked]]
Sent: Thu 06/07/2006 07:49
To: Cullen Jennings; SIP WG
Subject: [Sip] Outbound Comment: negotiation and edge proxies

For example:

/a

----

---

From: Juha Heinanen <[email-masked]>
Date: Sat, 8 Jul 2006 18:39:44 +0300

[email-masked] writes:

 > that the proxy actually supports outbound. 

erkki,

i don't understand this concern.  your own outbound discovery draft
allows finding out outbound and non-outbound proxies of a domain.  if
proxy is outbound proxy, it of course support stun keepalives.  if not,
it doesn't.

-- juha

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Sat, 8 Jul 2006 18:49:53 +0200

Juha, how do you define an "oubound proxy"?
 
Is a proxy that supports STUN for keep-alive, but nothing else, an outbound proxy?

From: Juha Heinanen [mailto:[email-masked]]
Sent: Sat 08/07/2006 17:39
To: [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: [Sip] Outbound: Validating if the proxy supports outbound or not

erkki,

-- juha

---

From: Juha Heinanen <[email-masked]>
Date: Sat, 8 Jul 2006 20:37:45 +0300

> Is a proxy that supports STUN for keep-alive, but nothing else, an

no. why you ask me?  see section 5 of outbound. but i will give up
this tread now.

-- juha