Subject: RE: [Sipping] Re: draft-sinnreich-sipdev-req-06.txt

From: "Francois Audet" <[email-masked]>
Date: Wed, 18 May 2005 19:21:58 -0400

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Paul Kyzivat
> Sent: Tuesday, May 17, 2005 16:47
> To: Christian Stredicke
> Cc: Johnston, Alan; [email-masked]
> Subject: Re: [Sipping] Re: draft-sinnreich-sipdev-req-06.txt
>
> Maybe I am not being clear. Suppose I have a device that creates and 
> registers two contacts:
> 
> 	sip:[email-masked]
> 	sip:[email-masked]
> 
> It expects to be receiving requests at those addresses, and no others.

I don't think it is reasonable. You could have more "aliases" configured
internally for the device.

In particular, it could have a bunch of "lineX" including phone-context and
different phone numbers.

I guess we could mandate registering all those aliases, but I don't believe
this is common practice.

Also, you could have device that accept any request regadless of the user
name (which is I believe whate the majority of single-user device do today).
_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Paul Kyzivat <[email-masked]>
Date: Thu, 19 May 2005 09:26:00 -0400

> I guess we could mandate registering all those aliases, but I don't believe

I guess I wasn't clear enough. I think I agree with you. I was only 
postulating an *example* of a device where those were the only two 
addresses where it expects to receive requests.

I agree that a device could have addresses which it has not 
*registered*, but which it has made available to callers in some way. 
(E.g. as contact addresses in INVITEs.)

I was struggling for a way to explain this, and to word a requirement. I 
think the revised requirement captured it reasonably.

> name (which is I believe whate the majority of single-user device do 

That is the part te draft is trying to put limits on. I understand the 
security implications to an operator of a managed device, and so I have 
no objection to the attempt to have a configurable option to restrict 
this behavior.

Lets try to explain this again:

- a device of the sort we are discussing normally has no addresses
   that are externally known a priori

- callers normally learn the addresses at which the device can be
   reached because it actively makes those addresses known. This may
   be via registration of a uri, or by including a uri
   in some other sip message that it sends. (The URIs could also
   be published using other protocols.)

- callers are expected to contact the device using one of the URIs
   the device has exposed without altering the URI in any way.

- the device *ought* to know the set of URIs it has exposed.

- if the device receives requests at a URI other than one it has
   exposed, that request should probably be considered inappropriate.

It is this last bullet that they were trying to place a requirement on. 
Namely to make an option that when set requires the device to detect 
this inappropriate usage and report it as an error.

My only concern with this was that I thought the proposed wording could 
also be read to include a setting that required the device to accept the 
inappropriate request as valid. I don't think a device should ever be 
required to do that.

	Paul