Re: [sipcore] New Version Notification for draft-ibc-sipcore-sip-websocket-00 (previously draft-ibc-rtcweb-sip-websocket-00)

[Gilad Shaham <[e-mail]>]

On Mon, Dec 5, 2011 at 10:31 AM, Iñaki Baz Castillo <[e-mail]> wrote:

> 2011/12/2 Gilad Shaham <[e-mail]>:
> >> Said that, what do you exactly miss (related to sips) in the draft?
> >> maybe an example flow? or perhaps a consideration that "in presence of
> >> a sips URI the WebSocket transport must be secure which means "wss"
> >> URI in the WebSocket connection"?
> >>
> > If using sips in the examples has a negative effect on clarity I
> understand,
> > but it is a bcp and a recommendation, is it not? It should be clear that
> > implementors would not rely solely on 'wss' for end-to-end-encryption,
> but
> > rather use sips URI for that purpose, especially since the draft does
> > recommend securing the traffic. In other words, I believe there should
> be at
> > the very least text explaining that in the security considerations
> section.
>
> Ok, it makes sense. We will add a text under the Security section
> about the relationship between SIPS usage and WSS transport
> requirement.
>
> Great, then I'll look for it in the next draft.

>
>
>
> >> As explained in the draft, the JavaScript stack in WebSocket capable
> >> web browsers has no way to determine the source IP:port from which a
> >> WebSocket connection has been established, this is, the SIP UA running
> >> within a JavaScript application in a web does not know its local
> >> address. Therefore we've chosen 'anonymous.invalid' for Via
> >> sentby-host value and for Contact in the initial REGISTER (once the
> >> registration is done, the SIP UA would know its GRUU addresses).
> >> Regardless GRUU is implemented in the registrar, the usage of Outbound
> >> (RFC 5626) makes unnecessary for the SIP UA to know its local address.
> >>
> >> Of course, in case there is a hostname more appropriate than
> >> 'anonymous.invalid' then we could propose it. Is there?
> >
> > The string did reminded me of the privacy extensions, since it's used in
> the
> > From header, but I was more concerned there is something unspecified.
> > Outbound still mandates a URI since the authoritative proxy will store
> that
> > value to form the target set and therefore it seems as if the UA should
> be
> > prepared to receive anonymous.invalid as target URI. Should that be the
> case
> > or should the UA generate some kind of URI? It's just an example and it's
> > possible it's easy to explain how it works, but my point is that this
> seems
> > undefined.
> >
> > I agree that the URI should not be mandatory since it is due to
> javascript
> > security limitations and it's certainly possible this transport would be
> > used outside the browser. If you are looking for alternative hostnames,
> > 'localhost' comes to mind, but I didn't really consider whether it's
> better,
> > worse or equivalent.
>
> Yes, using localhost would be another option, but it has a drawback in
> case the WebSocket SIP UA does not use GRUU: in that case a remote
> peer would see "localhost" as the target of of WS UA. If it sends a
> REFER to a third participant containing "Refer-To:
> <sip:alice@localhost;transport=ws>" then the third participant would
> try to open a WS connection to itself. Well, as the draft states, GRUU
> is required for SIP UA's using WebSocket transport, at least in web
> browsers.
>
> So I'm not sure wheter using "localhost" is better than using
> "anonymous.invalid". Maybe it is better to use "invalid.domain"?
>
> So, if we were to have normative text that defines this, it would probably
explain why localhost or any routable domain name is a bad choice as
opposed to a non-routable domain. Should a UA be free to choose based on a
set of rules or are we defining one host part for all? Should it generate
parts or all of this domain dynamically to assist with matching incoming
requests? Is one free to use an invalid IP (such as the infamous 0.0.0.0)?

And most importantly, do others believe this requires normative text or not?

Thanks,
Gilad