RE: [Sip] query on sip-outbound and sip-connect-reuse

sec 14 of sip oubound draft address the situation when the UA could
switchover from UDP to TCP when the MTU size is large. But yes there are
no current deployments that really support the switchover.

Regards 
Ranjit 

________________________________

From: Malleswara Rao Ankem [mailto:malleshavn@gmail.com] 
Sent: Monday, May 14, 2007 11:33 AM
To: Aki Niemi
Cc: sip@ietf.org
Subject: Re: [Sip] query on sip-outbound and sip-connect-reuse

The outbound draft does not talk of what happens when there is a UDP to
TCP switchover due to MTU overshoot. Since the edge proxy cannot
initiate a TCP connection towards the UA, its the UA which should take
care of maintaining the TCP connection with the network and the flows
are created only through registration. 
So if I have a UA which primarily performs SIP signaling on UDP but
would like to support TCP only for huge messages (that cross MTU), then
as per the current outbound draft it will have to create a flow for TCP
based transport during the registration itself and create another flow
for UDP based transport by registering from the 5060 port. 

On 3/20/07, Aki Niemi <aki.niemi@nokia.com > wrote: 

	ext Malleswara Rao Ankem wrote:
	> Hello,
	> I've a query on sip-outbound draft (-08) which indicates that
a TCP 
	> connection (flow) established by the client be re-used by the
edge proxy.
	> While the sip-connect-reuse draft (-07) indicates that only a
TCP
	> connection
	> established for TLS (by the client) should be re-used by the
edge proxy as 
	> there is a security threat incase the TCP connection is
re-used.
	> Was this not considered or it was mentioned in outbound draft
somewhere but
	> I overlooked it.

	The reason is that for the server-to-server case, for which 
	connect-reuse is meant, you can't trust a connection unless both
parties
	are authenticated, and currently the only way to do this in SIP
is to do
	mutual auth in TLS.

	This is not the case with outbound, where Digest authentication 
	effectively does mutual auth. Of course a better option is to do
one way
	authenticated TLS and then on top of that have Digest
authenticate the
	client.

	> Also, in sip-outbound if the client needs to be reachable on
UDP and on TCP 
	> does the client need to establish, register and maintain
(keepalive) two
	> different "flows" to the registrar? which would basically
means two
	> different REGISTER cycles with same instance id but different
reg-id? 

	I guess. I have no idea why you would want to do that though.

	Cheers,
	Aki