Re: [Sip] WGLC: draft-ietf-sip-connect-reuse-08.txt

"Vijay K. Gurbani" <vkg@alcatel-lucent.com> Thu, 22 November 2007 04:08 UTC

Return-path: <sip-bounces@ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iv3Me-0008WC-A3; Wed, 21 Nov 2007 23:08:32 -0500
Received: from sip by megatron.ietf.org with local (Exim 4.43) id 1Iv3Mc-0008W5-ML for sip-confirm+ok@megatron.ietf.org; Wed, 21 Nov 2007 23:08:30 -0500
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iv3Mc-0008Vx-CU for sip@ietf.org; Wed, 21 Nov 2007 23:08:30 -0500
Received: from ihemail3.lucent.com ([135.245.0.37]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iv3MZ-0006XX-Rh for sip@ietf.org; Wed, 21 Nov 2007 23:08:30 -0500
Received: from ihmail.ih.lucent.com (h135-1-218-70.lucent.com [135.1.218.70]) by ihemail3.lucent.com (8.13.8/IER-o) with ESMTP id lAM48BWW029912; Wed, 21 Nov 2007 22:08:11 -0600 (CST)
Received: from [135.244.0.86] (vkg.lra.lucent.com [135.244.0.86]) by ihmail.ih.lucent.com (8.11.7p1+Sun/8.12.11) with ESMTP id lAM489j13706; Wed, 21 Nov 2007 22:08:09 -0600 (CST)
Message-ID: <474500A5.5040605@alcatel-lucent.com>
Date: Wed, 21 Nov 2007 22:08:05 -0600
From: "Vijay K. Gurbani" <vkg@alcatel-lucent.com>
Organization: Bell Labs Security Technology Research Group
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: Paul Kyzivat <pkyzivat@cisco.com>
Subject: Re: [Sip] WGLC: draft-ietf-sip-connect-reuse-08.txt
References: <E1IhwYv-0005h8-Ss@stiedprstage1.ietf.org> <5D1A7985295922448D5550C94DE291800184A454@DEEXC1U01.de.lucent.com> <5D1A7985295922448D5550C94DE29180018C877A@DEEXC1U01.de.lucent.com> <E6C2E8958BA59A4FB960963D475F7AC302316F376A@mail.acmepacket.com> <473E220B.7020509@lucent.com> <E6C2E8958BA59A4FB960963D475F7AC302317A5891@mail.acmepacket.com> <4741D470.6030308@alcatel-lucent.com> <4741F132.6060300@cisco.com> <E6C2E8958BA59A4FB960963D475F7AC30231807EFA@mail.acmepacket.com> <474367FD.4090800@cisco.com> <E6C2E8958BA59A4FB960963D475F7AC3023185BB83@mail.acmepacket.com> <47437A45.40409@cisco.com> <4744AFB8.7030801@lucent.com> <4744BF62.3040806@cisco.com>
In-Reply-To: <4744BF62.3040806@cisco.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.57 on 135.245.2.37
X-Spam-Score: 0.0 (/)
X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb
Cc: IETF SIP List <sip@ietf.org>, Rohan Mahy <rohan@ekabal.com>, Brett Tate <brett@broadsoft.com>
X-BeenThere: sip@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Session Initiation Protocol <sip.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/sip>, <mailto:sip-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:sip@ietf.org>
List-Help: <mailto:sip-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/sip>, <mailto:sip-request@ietf.org?subject=subscribe>
Errors-To: sip-bounces@ietf.org

Paul Kyzivat wrote:
> I think much less should be said.
> 
> Don't say that A must reject requests sent to it over the connection. 
> But also don't specify, or even imply, a mechanism by which B might 
> decide it is ok to send requests on this connection.

Any way you cut, slice, and dice this thing, TCP connection reuse
in the backwards direction is bad.  Note that it does not work with
virtual servers at all.

Unfortunately, people are using it and as such something ought to
be said about it in the draft.  I agree that as the less said, the
better.  I also agree that putting the "alias" parameter in the
Via request for TCP.

Going back to our scenario of A opening a connection to B, it
probably suffices to massage the text you proposed in an earlier
email of this thread:

    B MUST NOT reuse this connection for requests to the
    supposed party at the other end UNLESS it has some way
    of verifying the identity of that party to the same level
    of assurance as it would have by doing the DNS lookup and
    establishing its own connection. For instance, if a DNS
    lookup resolved to the same address and port as the source
    port of the inbound connection then that ought be be good
    enough.

This still does not solve the problem of reusing TCP connections
for virtual servers; i.e., B does not know that that A's physical
IP address is being used by multiple virtual domains.  Again, I
can just point this out for the TCP and SCTP transport in
the virtual server section more emphatically and leave it at that.

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://www.alcatel-lucent.com/bell-labs


_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sipping@ietf.org for new developments on the application of sip