Subject: [Sip] Another Comment on draft-audet-sip-sips-guidelines-03 w.r.t. telURI etc

From: "Samir Srivastava" <[email-masked]>
Date: Thu, 14 Sep 2006 19:16:26 -0500

1) In section 5, it makes following statement
"However, if an SIPS AOR is used, a SIPS Contact MUST also be used. If a
SIP AOR is used, a SIP Contact MUST also be used. Those are mechanical
rules with no influence on routing. "
Which doesn't allow the mailto and tel URL registration for SIPS and
SIP. Atleast It should have allowed the telURI and mailto for SIP. 
Refer the following from section 10.2.1 of 3261
"A SIP UA can choose to register telephone numbers (with the tel URL,
RFC 2806 [9]) or email addresses (with a mailto URL, RFC 2368 [32]) as
Contacts for an address-of-record, for example." 
Why we are restricting this...
2) Now the big question 3261, in section 8.1.1.2 gives an example of 411
with telURI to be interpreted by the visitor domain proxy (not to be
interpreted by the home domain proxy with airport example ) How can we
route it securly ?

Thx
Samir 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 15 Sep 2006 10:24:41 -0400

> Contacts for an address-of-record, for example."

I have some sympathy for this. I think we get wound up thinking that the 
contacts being registered are in fact destinations belonging to the UAC 
doing the REGISTER. While this is usually the case, it need not always 
be the case.

The mailto case, or other kinds of URIs that have can't be used to 
transmit sip requests, are pretty benign here. The only way they can 
have a request on routing is to be returned in a 3xx response, all the 
way back to the UAC. In that case there is no security issue, because 
the UAC gets to decide whether to use this "insecure" transport.

TEL is more troublesome, because sip requests *can* be routed to it, but 
  the URI doesn't guarantee a secure path.

Maybe the solution to all contacts that aren't "secure enough" (namely 
everything except SIPS) should be permitted in registration, but should 
not be considered as candidates for routing. Instead, like mailto, they 
can only be used by being returned to the UAC in a 3xx.

It seems that you can already get in the above situation as follows:

	REGISTER sips:example.com
	To: sip:[email-masked]
	From: sip:[email-masked]
	Contact: sip:[email-masked]
	Contact: tel:+12125551234
	Contact: mailto:[email-masked]

	REGISTER sips:example.com
	To: sips:[email-masked]
	From: sips:[email-masked]
	Contact: sips:[email-masked]

After this, how is an INVITE to sip:[email-masked] routed?
It may only be *forwarded* to sips:[email-masked].
But it could be redirected to the others. So the proxy can either just 
redirect, or it can try forwarding to the one valid forwarding 
destination and then redirect with the remaining destinations if that 
one doesn't work out.

Given that the proxy must be prepared to deal with contacts that it may 
not be permitted to forward to, I fail to see the rationale for 
preventing registration to a sips URI of contacts that can't be routed 
to securely.

> interpreted by the home domain proxy with airport example ) How can we 

Note that the usage of <tel:411> in 3261 is *invalid*. So it has to be 
taken with a grain of salt. (Something similar but valid is 
<tel:411;phone-context=+1>.)

Also, ECRIT has been quite busy since the publication of 3261, so we 
have more evolved practices defined now. I believe that today the 
recommendation would rather be to use <urn:sos>

But these both suffer from not being SIPS, and not having a secure form. 
(Do we want TELS and URNS ??? :-)

Perhaps you can't ever expect security on an emergency call - it may be 
compromised in many ways in order to expedite handling the emergency. 
Not very satisfying, but maybe its reality.

In the case of TEL, if you want a secure call, there are a couple of 
things you can do:

- perform your own ENUM lookup and select a sips target

- convert to a SIPS URI with the domain name of a domain you
   believe will be able reach the destination securely. When a
   proxy for the chosen domain receives the request it may do
   as it wishes to ensure it reaches the destination securely.

	Paul

---

From: "Francois Audet" <[email-masked]>
Date: Fri, 15 Sep 2006 11:48:14 -0500

Thanks. 

It was not the intent to exclude those.

Basically, it should say the following:

	If all the Contacts are SIPS, a SIPS AOR MUST also be used by
the UAC. If at least 
	one of the Contacts is SIP or neither SIPS nor SIPS (e.g.,
mailto, tel, http, https), a 
	SIP AOR MUST also be used by the UAC. However, The UAS (the
Registrar), MUST treat the 
	SIP and SIPS schemes of the AOR the same way (i.e., it MUST NOT
care if it is SIP or
	SIPS). Those are mechanical rules with no influence on routing.

________________________________

	From: Srivastava, Samir (SC100:8826) 
	Sent: Thursday, September 14, 2006 5:16 PM
	To: [email-masked]
	Subject: [Sip] Another Comment on
draft-audet-sip-sips-guidelines-03 w.r.t. telURI etc

	1) In section 5, it makes following statement 
	"However, if an SIPS AOR is used, a SIPS Contact MUST also be
used. If a SIP AOR is used, a SIP Contact MUST also be used. Those are
mechanical rules with no influence on routing. "

	Which doesn't allow the mailto and tel URL registration for SIPS
and SIP. Atleast It should have allowed the telURI and mailto for SIP. 

	Refer the following from section 10.2.1 of 3261 
	"A SIP UA can choose to register telephone numbers (with the tel
URL, RFC 2806 [9]) or email addresses (with a mailto URL, RFC 2368 [32])
as Contacts for an address-of-record, for example." 

	Why we are restricting this... 
	2) Now the big question 3261, in section 8.1.1.2 gives an
example of 411 with telURI to be interpreted by the visitor domain proxy
(not to be interpreted by the home domain proxy with airport example )
How can we route it securly ?

	Thx 
	Samir

---

From: "Samir Srivastava" <[email-masked]>
Date: Mon, 18 Sep 2006 15:27:25 -0500

Hi Paul,

   Thx for the clarification on current usage of tel:411 etc. It should
be logged in bugzilla too.

   I am not of the opinion of getting every URI with "S" suffix for
secure routing which needs to be routed over SIP network.

   It doubles the entries in DNS, IANA registries (more cycles etc). We
are getting these pains because of non-modularity. In my view it is
secure-routing requirement. Applying HTTPS (CS model) to hop-by-hop SIP
is wrong.

   With Proxy-Require, we settle the security separately and keep the
development of new URL schemes, Properties etc separately. Unless there
is change in secure protocol etc, we don't have to worry about the
security of each URL scheme separately. Also as per the current proposal
of SIPS, preference among the different transports will be *only* in
DNS. It will be good to consider all required DNS entries with out-bound
variants too. 

   Proxy-Require is more scalable and neat solution. 

   I can only ask the group to reconsider the decision of SIPS, which
looks to me dead on this. 

Thx
Samir

> -----Original Message-----
> From: Paul Kyzivat [mailto:[email-masked]]
> Sent: Friday, September 15, 2006 7:25 AM
> To: Srivastava, Samir (SC100:8826)
> Cc: [email-masked]
> Subject: Re: [Sip] Another Comment on
draft-audet-sip-sips-guidelines-03
> w.r.t. telURI etc
URL,