Subject: [Sip] Comment on draft-ietf-sip-fork-loop-fix-05

From: Paul Kyzivat <[email-masked]>
Date: Fri, 20 Jul 2007 18:20:07 -0400

Just catching up :-(

One thing occurred to me - this document goes out of its way to say that 
a proxy need not do the loop check unless it forks. In general that 
makes sense, but in one case it does not:

Some proxies hide/suppress/obfuscate via headers, and then reverse the 
process on responses. A proxy that does so breaks loop checking by any 
of the proxies whose vias it hid. So I think a proxy that does this MUST 
perform a loop check itself even if it does not fork.

	Thanks,
	Paul

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: [email-masked]
Date: Sat, 21 Jul 2007 10:09:05 -0400

From: Paul Kyzivat <[email-masked]>

Hmmm, if you have a loop consisting of two obfuscating non-forking
proxies and one non-obfuscating forking proxy, could any of the three
proxies detect the loop?

Dale

---

From: Paul Kyzivat <[email-masked]>
Date: Sat, 21 Jul 2007 14:20:31 -0400

> proxies and one non-obfuscating forking proxy, could any of the three

Yes, if the obfuscating proxy performs the loop checking based on its 
own Via.

But if you have *two* obfuscating proxies in the loop then I think it 
becomes impossible to detect the loop.

In a way, this is similar the a loop that includes both a sip leg and a 
PSTN leg.

I don't have a good solution for either of these.

	Paul

---

From: Robert Sparks <[email-masked]>
Date: Sun, 22 Jul 2007 09:42:31 -0500

The thing you describe is not a proxy :)

Seriously, we don't put a lot of work into specifying behavior when  
things violate the specification.

I'd be willing to add a paragraph of general tone noting that the  
loop detection mechanism breaks if you remove other people's vias.
(If there were two of the things you describe in the network,  
removing each other's vias, then there is no hope of ever detecting a  
loop).

RjS

On Jul 20, 2007, at 5:20 PM, Paul Kyzivat wrote:

> Just catching up :-(
>
> One thing occurred to me - this document goes out of its way to say  
> that a proxy need not do the loop check unless it forks. In general  
> that makes sense, but in one case it does not:
>
> Some proxies hide/suppress/obfuscate via headers, and then reverse  
> the process on responses. A proxy that does so breaks loop checking  
> by any of the proxies whose vias it hid. So I think a proxy that  
> does this MUST perform a loop check itself even if it does not fork.
>
> 	Thanks,
> 	Paul
>
>

---

From: Paul Kyzivat <[email-masked]>
Date: Sun, 22 Jul 2007 12:11:45 -0400

Robert Sparks wrote:
> I'd be willing to add a paragraph of general tone noting that the loop 
> detection mechanism breaks if you remove other people's vias.

That works for me.

The technique is in widespread use. Often the things doing it are 
clearly B2BUAs (though that doesn't mitigate the looping problem), but I 
have certainly heard of things that are otherwise proxies that do this. 
I think it behooves us to point out when techniques that people think 
are reasonable actually cause real problems.

> (If there were two of the things you describe in the network, removing 
> each other's vias, then there is no hope of ever detecting a loop).

Right. :-(

	Paul

>> of the proxies whose vias it hid. So I think a proxy that does this 
>> MUST perform a loop check itself even if it does not fork.
>>
>>     Thanks,
>>     Paul
>>
>>