Subject: [Sip] draft-ietf-sip-connect-reuse

From: Cullen Jennings <[email-masked]>
Date: Sat, 8 Nov 2008 09:23:57 -0700

I do not believe this draft represents the consensus that we have  
agree in the SIP WG .

This does not work for TCP. Reverse DNS lookup is not strong enough to  
replace TLS. I'm not even interested in discussing the reason why yet  
again but I would like to see the draft updated to reflect the WG  
consensus. To do this it need to say MUST use TLS. Having it allow  
straight SCTP and TCP when the reverse DNS or some other unspecified  
thing happens is not what we agreed to.  This can be fixed by changing  
a few words and deleting a sentence or two in security consideration.  
I'm glad to send edits if you want.

This draft is important for the SIP Connect work - lets make these  
changes to what we agreed to and get this finished quickly.

Cullen as individual contributor

_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Sun, 9 Nov 2008 05:06:45 +0100

(As WG chair)

Well I went looking for any consensus you are referring to.

In the limited time I have available I failed to find it.

Can you be more explicit about when you think a decision was made in
this respect, and whether it was on list or in a meeting.

Please note by the way that I believe the document has been in pretty
much its current form for at least 18 months.

regards

Keith

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Cullen Jennings
> Sent: Saturday, November 08, 2008 4:24 PM
> To: SIP List
> Subject: [Sip] draft-ietf-sip-connect-reuse
> 
> 
> I do not believe this draft represents the consensus that we 
> have agree in the SIP WG .
> 
> This does not work for TCP. Reverse DNS lookup is not strong 
> enough to replace TLS. I'm not even interested in discussing 
> the reason why yet again but I would like to see the draft 
> updated to reflect the WG consensus. To do this it need to 
> say MUST use TLS. Having it allow straight SCTP and TCP when 
> the reverse DNS or some other unspecified thing happens is 
> not what we agreed to.  This can be fixed by changing a few 
> words and deleting a sentence or two in security consideration.  
> This draft is important for the SIP Connect work - lets make 
> these changes to what we agreed to and get this finished quickly.
> 
> This list is for NEW development of the core SIP Protocol Use 
> [email-masked] for questions on current sip

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 10 Nov 2008 09:16:14 -0600

> I do not believe this draft represents the consensus that we have

Oh no, Cullen; don't say that!  We went through a lot of list
discussion to get the consensus text you see in the draft now.

More inline.

> This does not work for TCP. Reverse DNS lookup is not strong enough
> to replace TLS. I'm not even interested in discussing the reason why
> yet again but I would like to see the draft updated to reflect the WG
> thing happens is not what we agreed to.  This can be fixed by
> changing a few words and deleting a sentence or two in security
> consideration. I'm glad to send edits if you want.

The issue is that connect-reuse ought to be done only over TLS.
That much everyone agrees to.  However, during the -09 revision,
we had a long discussion on the list about allowing connection
reuse over TCP (and SCTP) assuming certain caveats related to
trust relationship between the peers doing the reuse are in place.
This discussion happened during Nov 20, 2007 - Nov 26, 2007.

On Dec 13, 2007, following a 1-slide status update during
the Vancouver IETF, I had presented on the list for ratification
a summary of the consensus reached during November 2007 (please see
http://www.ietf.org/mail-archive/web/sip/current/msg21723.html).

Following this, -09 was released on Feb. 8, 2008 (please
see http://www.ietf.org/mail-archive/web/sip/current/msg22022.html).

> changes to what we agreed to and get this finished quickly.

Astonishingly enough, connection reuse over TCP is probably
most attractive to the SIPConnect work, where the PBX has a
trust relationship with the service provider and is willing
to trust the SP to send requests in the backwards direction.
I do not think TLS is widely deployed (yet) in SIPConnect.

In short, the draft as you see it now reflects the consensus
we had reached during the November 2007 timeframe.  The bulk
of the substantive material has remained the same since then,
with the subsequent revisions attending to typos and such.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip