Re: [sipcore] New Version Notification for draft-ibc-sipcore-sip-websocket-00 (previously draft-ibc-rtcweb-sip-websocket-00)

[Gilad Shaham <[e-mail]>]

On Mon, Dec 5, 2011 at 11:51 AM, Iñaki Baz Castillo <[e-mail]> wrote:

> 2011/12/5 Gilad Shaham <[e-mail]>:
> >> Yes, using localhost would be another option, but it has a drawback in
> >> case the WebSocket SIP UA does not use GRUU: in that case a remote
> >> peer would see "localhost" as the target of of WS UA. If it sends a
> >> REFER to a third participant containing "Refer-To:
> >> <sip:alice@localhost;transport=ws>" then the third participant would
> >> try to open a WS connection to itself. Well, as the draft states, GRUU
> >> is required for SIP UA's using WebSocket transport, at least in web
> >> browsers.
> >>
> >> So I'm not sure wheter using "localhost" is better than using
> >> "anonymous.invalid". Maybe it is better to use "invalid.domain"?
> >>
> > So, if we were to have normative text that defines this, it would
> probably
> > explain why localhost or any routable domain name is a bad choice as
> opposed
> > to a non-routable domain. Should a UA be free to choose based on a set of
> > rules or are we defining one host part for all? Should it generate parts
> or
> > all of this domain dynamically to assist with matching incoming
> requests? Is
> > one free to use an invalid IP (such as the infamous 0.0.0.0)?
>
> Take into account that when a JavaScript code (running in a web
> browser) open a WebSocket connection given a WS URI with domain, the
> JavaScript code is not aware of the resulting IP nor the IP family
> (IPv4 or IPv6). So IMHO using a IP address in Via/Contact is a bad
> idea.
>
I agree the later messages should not try to resolve an IP address, but I
still don't see why it's that much different to have an invalid IP rather
than an invalid domain. The advantage of an IP is that you are sure no one
would try to resolve it, although it's true you would have no idea whether
to place IPv4 or IPv6 in there and you'd just have to choose one of them.
So it's not that I think one is better than the other, but some may ask for
this option from compatibility point of view - I assume some
implementations were never built with domain name in Contact header or in
Via header in mind, although this is perfectly legitimate to do so. Anyway,
if you strongly object to IP, domain is good too.

>
> Assuming that a domain is used, I think that which one to set should
> not be normative, for the following reasons:
>
> 1) If Outbound is being used (and it's a MUST for these kind of SIP
> endpoints) the host in Via and Contact does not matter (for
> registration or dialogs).
>
> 2) If GRUU is used, the host in Contact would be a globally routable
> URI. If GRUU is not used, then there is no way  at all for SIP REFER
> mechanism to work (since a SIP WebSocket client can only be contacted
> via the WS connection it has opened with the WS server). So the domain
> in Contact does not matter (with GRUU it will always work, without
> GRUU it will never work).
>
>
> Seems right. So we are saying a UA MAY include an invalid host part in the
registration Contact header and any request top Via header. The UA MUST
support Outbound and SHOULD (or MUST) support GRUU.
Actually, there is good reason to consider mandating GRUU for this
scenario. The reason is that suppose 2 different users named Alice register
to 2 different AORs. Both Alice users go through the same proxy (named P1)
that supports websockets and it forwards the requests to the different
registrars. When an incoming request to one of the Alices comes in, a proxy
will forward the request to alice@<invalid host> through P1, but P1 cannot
distinguish the two and they are in fact different users. I also believe
UAs should be encouraged to compare the instance id of incoming requests.