Subject: [Sip] comments on draft-ietf-sipping-dialogusage-02.txt

From: "B, Nataraju" <[email-masked]>
Date: Mon, 14 Aug 2006 12:04:19 +0530

Hi Sparks, 

I had gone through the document, here are few comments. 

Note: I assume the behavior mentioned in sec 4 applies both at client receiving these responses (Notifier) and server generating these replies (Subscriber). If this was meant to be only @ sender of NOTIFY shall we need to mention the similar set of actions @ Subscriber side too? 

1. Sec 4 describes what the effects on dialog are and its usages when particular responses are received for NOTIFY message, the responses 404, 410, 416, lead to dialog and its usage termination. 

      a. I feel we should have mentioned ONLY the authenticated NOTIFY requests will have this effect on the dialogs/usages. Otherwise any middle men can trace the message and send the NOTIFY messages which terminate the dialogs, which is undesirable ☹. If the entity sending NOTIFY really intend to do that it can resend NOTIFY with authorization credentials which will help to terminate the associated dialogs.

      b. Other alternative would be that let those responses have no effect on the dialog/usages, eventually the subscription duration would take care of dialog termination or the actual entity would terminate or extend the subscription. Any way the request from actual notifier would have the proper URIs or credentials which will never lead to these responses. 

The same logic would need to extend for replies 481, 483, 484, 489 and 604 also.

2. Sec 4 of the draft

    <<<   423 Interval Too Brief: This response won't happen in our example

      scenario, but if it came in response to a reSUBSCRIBE, the

      subscribe usage is not destroyed (or otherwise affected).  No

      other usages of the dialog are affected. >>>

      In the above Para the meaning of last part of 1st sentence (I mean, the subscribe usage is not destroyed (or otherwise affected)) and 2nd sentence is not clear, both mention the same meaning? Can we make it explicit about what we really mean here ? 

Thanks, 

Nataraju A B

Sonus Networks India Pvt Ltd

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Paul Kyzivat <[email-masked]>
Date: Mon, 14 Aug 2006 10:03:49 -0400

B, Nataraju wrote:

> 1. Sec 4 describes what the effects on dialog are and its usages when 
> particular responses are received for NOTIFY message, the responses 404, 
> 410, 416, lead to dialog and its usage termination.
> 
>       a. I feel we should have mentioned ONLY the authenticated NOTIFY 
> requests will have this effect on the dialogs/usages. Otherwise any 
> middle men can trace the message and send the NOTIFY messages which 
> terminate the dialogs, which is undesirable ☹. If the entity sending 
> NOTIFY really intend to do that it can resend NOTIFY with authorization 
> credentials which will help to terminate the associated dialogs.

I agree we wouldn't want to enable a MITM attack here.

But I think that is already covered. If the request isn't properly 
authenticated, then the response will be 401, not 404, 410, or 416.

	Paul