Subject: Re: [Sip] query on sip-outbound and sip-connect-reuse

From: "Malleswara Rao Ankem" <[email-masked]>
Date: Mon, 14 May 2007 11:32:59 +0530

The outbound draft does not talk of what happens when there is a UDP to TCP
switchover due to MTU overshoot. Since the edge proxy cannot initiate a TCP
connection towards the UA, its the UA which should take care of maintaining
the TCP connection with the network and the flows are created only through
registration.
So if I have a UA which primarily performs SIP signaling on UDP but would
like to support TCP only for huge messages (that cross MTU), then as per the
current outbound draft it will have to create a flow for TCP based transport
during the registration itself and create another flow for UDP based
transport by registering from the 5060 port.

On 3/20/07, Aki Niemi <[email-masked]> wrote:

>
>
> ext Malleswara Rao Ankem wrote:
> > Hello,
> > I've a query on sip-outbound draft (-08) which indicates that a TCP
> > connection (flow) established by the client be re-used by the edge
> proxy.
> > While the sip-connect-reuse draft (-07) indicates that only a TCP
> > connection
> > established for TLS (by the client) should be re-used by the edge proxy
> as
> > there is a security threat incase the TCP connection is re-used.
> > Was this not considered or it was mentioned in outbound draft somewhere
> but
> > I overlooked it.
>
> The reason is that for the server-to-server case, for which
> connect-reuse is meant, you can't trust a connection unless both parties
> are authenticated, and currently the only way to do this in SIP is to do
> mutual auth in TLS.
>
> This is not the case with outbound, where Digest authentication
> effectively does mutual auth. Of course a better option is to do one way
> authenticated TLS and then on top of that have Digest authenticate the
> client.
>
> > Also, in sip-outbound if the client needs to be reachable on UDP and on
> TCP
> > does the client need to establish, register and maintain (keepalive) two
> > different "flows" to the registrar? which would basically means two
> > different REGISTER cycles with same instance id but different reg-id?
>
> I guess. I have no idea why you would want to do that though.
>
> Cheers,
> Aki
>
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Avasarala Ranjit-A20990" <[email-masked]>
Date: Mon, 14 May 2007 15:34:03 +0800

sec 14 of sip oubound draft address the situation when the UA could
switchover from UDP to TCP when the MTU size is large. But yes there are
no current deployments that really support the switchover.

Regards 
Ranjit 

________________________________

From: Malleswara Rao Ankem [mailto:[email-masked]] 
Sent: Monday, May 14, 2007 11:33 AM
To: Aki Niemi
Cc: [email-masked]
Subject: Re: [Sip] query on sip-outbound and sip-connect-reuse

The outbound draft does not talk of what happens when there is a UDP to
TCP switchover due to MTU overshoot. Since the edge proxy cannot
initiate a TCP connection towards the UA, its the UA which should take
care of maintaining the TCP connection with the network and the flows
are created only through registration. 
So if I have a UA which primarily performs SIP signaling on UDP but
would like to support TCP only for huge messages (that cross MTU), then
as per the current outbound draft it will have to create a flow for TCP
based transport during the registration itself and create another flow
for UDP based transport by registering from the 5060 port. 
 
On 3/20/07, Aki Niemi <[email-masked] > wrote: 

	ext Malleswara Rao Ankem wrote:
	> connection (flow) established by the client be re-used by the
edge proxy.
	> established for TLS (by the client) should be re-used by the
edge proxy as 
	> Was this not considered or it was mentioned in outbound draft
somewhere but
	
	The reason is that for the server-to-server case, for which 
	connect-reuse is meant, you can't trust a connection unless both
parties
	are authenticated, and currently the only way to do this in SIP
is to do
	mutual auth in TLS.
	
	This is not the case with outbound, where Digest authentication 
	effectively does mutual auth. Of course a better option is to do
one way
	authenticated TLS and then on top of that have Digest
authenticate the
	client.
	
	> Also, in sip-outbound if the client needs to be reachable on
UDP and on TCP 

	Cheers,
	Aki

---

From: Paul Kyzivat <[email-masked]>
Date: Mon, 14 May 2007 07:48:06 -0400

If you are going to maintain a TCP connection for handling large 
messages, then why not use it for all messages?

	Paul

Malleswara Rao Ankem wrote:
> The outbound draft does not talk of what happens when there is a UDP 
> to TCP switchover due to MTU overshoot. Since the edge proxy cannot 
> On 3/20/07, *Aki Niemi* <[email-masked] 
> <mailto:[email-masked]> > wrote:
> 
> 
> 
>      > established for TLS (by the client) should be re-used by the edge
>     proxy as
>      > Also, in sip-outbound if the client needs to be reachable on UDP
>     and on TCP
> ------------------------------------------------------------------------
>