Re: [sipcore] RESPONSE REQUESTED: SIPCORE work and milestones

["Asveren, Tolga" <[e-mail]>]

Thanks for the clarification.

i- I agree that connection re-use needs to be addressed as it would be a normative change.
ii- Is it a mandate that mutual authentication needs to be used if transport=tls? If so, that would require another normative change to align with practical needs.
iii- I think both i-/ii- are relatively straightforward to address. The more interesting/challenging aspect is how to failover DTLS connections without a need for per-transaction state synchronization and with the fewest round-trips possible.

Thanks,
Tolga

From: Olle E. Johansson [mailto:[e-mail]]
Sent: Thursday, December 22, 2016 10:55 AM
To: Asveren, Tolga <[e-mail]>
Cc: Olle E Johansson <[e-mail]>; Christer Holmberg <[e-mail]>; Adam Roach <[e-mail]>; SIPCORE <[e-mail]>; Ben Campbell <[e-mail]>
Subject: Re: [sipcore] RESPONSE REQUESTED: SIPCORE work and milestones


On 22 Dec 2016, at 16:34, Asveren, Tolga <[e-mail]<mailto:[e-mail]>> wrote:

Olle,

I missed the point about why “practically possible failover” needs to be solved both for TLS/DTLS (I am not arguing it would be good to have a solution for both) and also what this issue in general has something to do with client certificates.
Could you provide a bit more information/clarifications?

We’ve discussed it a number of times both here and on the SIP Forum techwg mailing list. You can find summaries here:

http://www.slideshare.net/oej/sip-half-outbound-random-notes
http://www.slideshare.net/oej/sip-tls-security-in-a-peer-to-peer-world

In short, without SIP Outbound the client connection can’t be re-used for outbound requests. Seems like there is a huge
resistance to implement SIP Outbound. We need a way for the client to allow the server to reuse the inbound connection
for outbound requests even though there’s no TLS certificate matching the URI on the client side.

We’ve had a lot of clients register with “;transport=tls” at SIPit without a client cert - which means we can’t communicate
based on that registration.

Cheers,
/O


Thanks,
Tolga

From: Olle E. Johansson [mailto:[e-mail]]
Sent: Thursday, December 22, 2016 9:08 AM
To: Asveren, Tolga <[e-mail]<mailto:[e-mail]>>
Cc: Olle E Johansson <[e-mail]<mailto:[e-mail]>>; Christer Holmberg <[e-mail]<mailto:[e-mail]>>; Adam Roach <[e-mail]<mailto:[e-mail]>>; SIPCORE <[e-mail]<mailto:[e-mail]>>; Ben Campbell <[e-mail]<mailto:[e-mail]>>
Subject: Re: [sipcore] RESPONSE REQUESTED: SIPCORE work and milestones


On 22 Dec 2016, at 14:50, Asveren, Tolga <[e-mail]<mailto:[e-mail]>> wrote:

Regarding the interest in SIP/UDP/DTLS:
This is mainly based on prospect of larger scalability on server side. There may/may not be an immediate need to tweak/change things to make DTLS related processing (hopefully just on the local stack level rather than on on-the-wire protocol- with some supporting SIP enhancements) more “failover friendly”. This issue requires more analysis/discussion but does not sound unsolvable IMHO.
We will have to solve client connection reuse for both TLS and DTLS sessions though. Unless you want to have
client certificates on all devices.

Adam as chair: SIP Client Connection Reuse is something we’ve disussed under multiple names - “half outbound” or “why is ;transport=tls”
deprecated” or “Why doesn’t SIP Outbound happen?”. Maybe that deserves a milestone.

/O



Thanks,
Tolga

From: sipcore [mailto:[e-mail]] On Behalf Of Christer Holmberg
Sent: Thursday, December 22, 2016 7:39 AM
To: Adam Roach <[e-mail]<mailto:[e-mail]>>; 'SIPCORE' <[e-mail]<mailto:[e-mail]>>
Cc: Ben Campbell <[e-mail]<mailto:[e-mail]>>
Subject: Re: [sipcore] RESPONSE REQUESTED: SIPCORE work and milestones

Hi,

I will obviously be actively involved in 4), and I also agree that 5) should be done as it is a correction.

As far as the other potential work is concerned, 3) has the highest priority for me, and I would actively participate in that work.

I would review 1) and 2), but I would really like to see an individual draft on 2) before we agree whether to create a milestone for it. For example, I would like to see some input on WHY to do it, and HOW it is intended to be deployed etc. How does DTLS fit SIP? What are the advantages? OR, do we want to specify DTLS-for-SIP simply because DTLS is “hot”?

Regards,

Christer

From: sipcore <[e-mail]<mailto:[e-mail]>> on behalf of "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Date: Tuesday 20 December 2016 at 22:27
To: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Cc: Ben Campbell <[e-mail]<mailto:[e-mail]>>
Subject: [sipcore] RESPONSE REQUESTED: SIPCORE work and milestones

[as chair]

Now that we have our new charter approved, I'd like the working group to have a discussion about the specific work items that we should take on in the short- to medium-term so that we can revise our milestones appropriately. Based on recent discussions on the mailing list, the following topics have some mind-share behind them. What I'd like from everyone with an interest in any of these topics is to indicate (a) whether you are willing to actively review and comment on documents on the topic; and (b) what priority each task has relative to each other: there are five topics; please indicate a unique priority from one (most important) to five (least important) for each topic.

  1.  "Happy Eyeballs for SIP" (aka Happy Earballs), currently under discussion on the list.
  2.  "DTLS Transport for SIP", as proposed by Tolga Asveren's recent messages.
  3.  A mechanism for labeling the nature of SIP calls, with <draft-schulzrinne-sipcore-callinfo-spam> as a likely candidate draft.
  4.  Fixing Content-ID in SIP, as discussed in <https://www.ietf.org/mail-archive/web/sipcore/current/msg07245.html><https://www.ietf.org/mail-archive/web/sipcore/current/msg07245.html>, with <draft-holmberg-sipcore-content-id> as a likely candidate draft.
  5.  Clarifications around SIP name-addr, with <draft-sparks-sipcore-name-addr-guidance> as a likely candidate draft

I will also note that we have already declared consensus on adopting <draft-ietf-sipcore-status-unwanted> as a WG document, and will be adding an associated milestone. I want to take this opportunity to remind people that the document is in WGLC, and your comments are strongly encouraged, the earlier the better.

Please respond before the end of 2016. Thanks!

Thanks!

/a
_______________________________________________
sipcore mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/sipcore