Re: [Sip] query on sip-outbound and sip-connect-reuse

The outbound draft does not talk of what happens when there is a UDP to TCP
switchover due to MTU overshoot. Since the edge proxy cannot initiate a TCP
connection towards the UA, its the UA which should take care of maintaining
the TCP connection with the network and the flows are created only through
registration.
So if I have a UA which primarily performs SIP signaling on UDP but would
like to support TCP only for huge messages (that cross MTU), then as per the
current outbound draft it will have to create a flow for TCP based transport
during the registration itself and create another flow for UDP based
transport by registering from the 5060 port.

On 3/20/07, Aki Niemi <aki.niemi@nokia.com> wrote:

>
>
> ext Malleswara Rao Ankem wrote:
> > Hello,
> > I've a query on sip-outbound draft (-08) which indicates that a TCP
> > connection (flow) established by the client be re-used by the edge
> proxy.
> > While the sip-connect-reuse draft (-07) indicates that only a TCP
> > connection
> > established for TLS (by the client) should be re-used by the edge proxy
> as
> > there is a security threat incase the TCP connection is re-used.
> > Was this not considered or it was mentioned in outbound draft somewhere
> but
> > I overlooked it.
>
> The reason is that for the server-to-server case, for which
> connect-reuse is meant, you can't trust a connection unless both parties
> are authenticated, and currently the only way to do this in SIP is to do
> mutual auth in TLS.
>
> This is not the case with outbound, where Digest authentication
> effectively does mutual auth. Of course a better option is to do one way
> authenticated TLS and then on top of that have Digest authenticate the
> client.
>
> > Also, in sip-outbound if the client needs to be reachable on UDP and on
> TCP
> > does the client need to establish, register and maintain (keepalive) two
> > different "flows" to the registrar? which would basically means two
> > different REGISTER cycles with same instance id but different reg-id?
>
> I guess. I have no idea why you would want to do that though.
>
> Cheers,
> Aki
>