[Sip] target topology in connect-reuse

[Jonathan Rosenberg <[e-mail]>]

During the sip meeting, we had a lot of discussion about the 
interactions between connect-reuse and the RFC 3263 mechanisms for load 
balancing. The current mechanism in connect-reuse will, I believe, 
create a single connection between a proxy in one domain and one of the 
servers in another domain.

I think the objective of the connect-reuse mechanism is to produce a 
topology that looks like this:

     Please view in a fixed-width font such as
                     Courier.






        +---------+
        |         |
        |         |
        | Proxy   | ---
        |         |    ------          +---------+
        |         |\         -----     |         |
        +---------+ \\            ---  |         |
                      \                | Proxy   |
                       \            -- |         |
                        \\      ----   |         |
        +---------+       \  ---     / +---------+
        |         |       -\\       /
        |         |   ----   \    //
        | Proxy   | --        \  /
        |         |            \X
        |         | --         / \
        +---------+   ----    /   \
                          ---/     \\  +---------+
                           / ----    \ |         |
                          /      --    |         |
                         /         --  | Proxy   |
        +---------+     /       ---    |         |
        |         |   //    ----       |         |
        |         |  /   ---           +---------+
        | Proxy   | / ---
        |         | --
        |         |
        +---------+

That is, between each proxy in domain A and each proxy in domain B, 
there is a single connection used for traffic in each direction. The 
transaction load is distributed across those connections proportiaonlly 
to the weight factors in the SRV records.

This effect can be achieved if a connection is aliased to to an IP 
address, so that the connection reuse takes place *after* the DNS 
operations have occurred.

This means that, when one proxy (A) opens a connection to another (B), A 
has to tell B that, when B wants to send requests to a particular IP 
address, it can use this connection instead. This needs to be done 
securely.

I'd suggest the following. A opens a TCP connection to a server in B 
(based on the DNS lookup of B's domain). There is a TLS exhcange. A 
indicates to B an IP address for which it is an alias. B takes the 
domain from the subjectAltName in the cert presented by A, looks up the 
domain in DNS, and verifies that the offered IP address is listed in the 
DNS record. If so, it is accepted as an alias.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Director, Service Provider VoIP Architecture   Parsippany, NJ 07054-2711
Cisco Systems
[e-mail]                              FAX:   [phone]
http://www.jdrosen.net                         PHONE: [phone]
http://www.cisco.com


_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [e-mail] for questions on current sip
Use [e-mail] for new developments on the application of sip