Re: [sipcore] New Version Notification for draft-ibc-sipcore-sip-websocket-00 (previously draft-ibc-rtcweb-sip-websocket-00)

[Iñaki Baz Castillo <[e-mail]>]

2011/12/2 Gilad Shaham <[e-mail]>:
> I followed the previous draft and read this one. I know that from the last
> draft you would like to refrain from sips issues, but I would expect it to
> be mentioned at the very least in the security section (13.1). If I'm
> reading the examples correctly they mean - use TLS for WebSocket, but from
> there forward use any transport, even unencrypted. I'm not sure everyone
> would realize that and personally, I don't see a problem sending sips to
> indicate it should be secure end-to-end as defined by RFC 5630.

Hi Gilad. Indeed we have avoided mentioning sips stuff in the draft.
We consider that adding it won't help understanding the sips theory,
nor it will help understanding the SIP WebSocket transport proposed in
the draft. Personally I consider that the sips stuff should be
reworked.

Said that, what do you exactly miss (related to sips) in the draft?
maybe an example flow? or perhaps a consideration that "in presence of
a sips URI the WebSocket transport must be secure which means "wss"
URI in the WebSocket connection"?


> I'm also not so sure why the 'anonymous.invalid' strings are shown in this
> RFC for the Via and Contact headers. This usage is neither defined nor
> referenced anywhere other than the examples. If this specification doesn't
> mandate/recommend it I don't think it should be there, and if it does, it
> should be clearly defined (or reference another RFC that does).

As explained in the draft, the JavaScript stack in WebSocket capable
web browsers has no way to determine the source IP:port from which a
WebSocket connection has been established, this is, the SIP UA running
within a JavaScript application in a web does not know its local
address. Therefore we've chosen 'anonymous.invalid' for Via
sentby-host value and for Contact in the initial REGISTER (once the
registration is done, the SIP UA would know its GRUU addresses).
Regardless GRUU is implemented in the registrar, the usage of Outbound
(RFC 5626) makes unnecessary for the SIP UA to know its local address.

Of course, in case there is a hostname more appropriate than
'anonymous.invalid' then we could propose it. Is there?


Thanks a lot for your comments.




-- 
Iñaki Baz Castillo
<[e-mail]>