Subject: [Sip] Outbound issues: slides 9 and 10

From: Rohan Mahy <[email-masked]>
Date: Tue, 8 Aug 2006 07:38:58 -0700

The issues on slide 9 (how does a registrar verify that an edge proxy 
supports outbound) and slide 10 (what does "Supported: outbound" mean) 
deal with detecting that all the required hops support outbound.  Slide 
9 specifically uncovered a problem with outbound proxies that add a 
Path URI but don't include a flow token.

The proposed solution is as follows.  If a proxy inserts a Path header 
with a flow token consistent with the rules described in outbound, it 
MUST add the ;ob parameter to the proxy URI that has the flow token.

The registrar verifies that any Path header URIs contain the ;ob 
parameter.  If there are any Path URIs without the ob parameter, the 
registrar does not return Supported: outbound.  Furthermore, the 
registrar needs to check that the first hop after the UAC is 
represented in the Path list (unless the registrar recognizes that the 
first hop after the UAC is in the same domain and doesn't need to 
include Path URIs with a flow token).  Note that this implies that 
whatever the proxy puts in the Via (IP address or FQDN), it must put 
the same hostname in the Path header (but there is no need for a 
complete URI comparison).  If the first hop is not correctly 
represented, the registrar ignores the reg-id parameter and does not 
return Supported: outbound.

The implication of this is that an outbound-proxy that supports 
outbound needs to support Path and flow tokens for registrations to all 
foreign domains.  Inside the same domain, the first-hop proxy and the 
registrar can still use Path to communicate with each other, but they 
can use some other private mechanism to disaggregate this 
functionality.

thanks,
-rohan

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Wed, 9 Aug 2006 18:46:28 +0200

Hi,

>The issues on slide 9 (how does a registrar verify that an edge proxy
supports outbound) and slide 10 (what does >"Supported: outbound" mean)
deal with detecting that all the required hops support outbound.  Slide
>The proposed solution is as follows.  If a proxy inserts a Path header
with a flow token consistent with the rules d
>escribed in outbound, it MUST add the ;ob parameter to the proxy URI
that has the flow token.
>The registrar verifies that any Path header URIs contain the ;ob
parameter.  If there are any Path URIs without the ob 
>parameter, the registrar does not return Supported: outbound.

[CHH] Why would every Path header need to contain the ;ob parameter? The
REGISTER request may traverse, in addition to the outbound proxy,
multiple proxies which insert a Path header. Do all these proxies really
need to support outbound?

>Furthermore, the registrar needs to check that the first hop after the
UAC is represented in the Path list (unless the 
>registrar recognizes that the first hop after the UAC is in the same
domain and doesn't need to include Path URIs with a 
>flow token).  Note that this implies that whatever the proxy puts in
the Via (IP address or FQDN), it must put the same 
>hostname in the Path header (but there is no need for a complete URI
comparison).  If the first hop is not correctly 

[CHH] Isn't it much easier to mandate the outbound proxy to always
insert a Path header?

OR, another possibility is that the outbound proxy, if it detects that
the UAC supports outbound, insert some option-tag of itself in the
Supported header, to indicate to the registrar that it supports
outbound. Then the registrar does not need start looking at the Path
headers.

Regards,

Christer

The implication of this is that an outbound-proxy that supports outbound
needs to support Path and flow tokens for registrations to all foreign
domains.  Inside the same domain, the first-hop proxy and the registrar
can still use Path to communicate with each other, but they can use some
other private mechanism to disaggregate this functionality.

thanks,
-rohan

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol Use
[email-masked] for questions on current sip Use
[email-masked] for new developments on the application of sip

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 9 Aug 2006 11:49:35 -0700

I think we need to work on this proposal before I really understand  
where it is needed and what it protects from. What happens if the  
proxy does not insert a flow token? What proxies are in a foreign  
domain and why do how do they handle things that differently than one  
that is not. This would break some of the proposal for high  
reliability. I think the authors should get together and come up with  
a proposal for what we are talking about here.

On Aug 8, 2006, at 7:38 AM, Rohan Mahy wrote:

> The issues on slide 9 (how does a registrar verify that an edge  
> proxy supports outbound) and slide 10 (what does "Supported:  
> outbound" mean) deal with detecting that all the required hops  
> support outbound.  Slide 9 specifically uncovered a problem with  
> outbound proxies that add a Path URI but don't include a flow token.
>
> The proposed solution is as follows.  If a proxy inserts a Path  
> header with a flow token consistent with the rules described in  
> outbound, it MUST add the ;ob parameter to the proxy URI that has  
> the flow token.
>
> parameter.  If there are any Path URIs without the ob parameter,  
> the registrar does not rFrom [email-masked] Wed Aug 09 14:51:29 2006
From: Cullen Jennings <[email-masked]>
Subject: Re: [Sip] Outbound issues: slides 9 and 10 
Date: Wed, 9 Aug 2006 11:49:35 -0700
To: Rohan Mahy <[email-masked]>
Cc: IETF SIP List <[email-masked]>

I think we need to work on this proposal before I really understand  
where it is needed and what it protects from. What happens if the  
proxy does not insert a flow token? What proxies are in a foreign  
domain and why do how do they handle things that differently than one  
that is not. This would break some of the proposal for high  
reliability. I think the authors should get together and come up with  
a proposal for what we are talking about here.

On Aug 8, 2006, at 7:38 AM, Rohan Mahy wrote:

> The issues on slide 9 (how does a registrar verify that an edge  
> proxy supports outbound) and slide 10 (what does "Supported:  
> outbound" mean) deal with detecting that all the required hops  
> support outbound.  Slide 9 specifically uncovered a problem with  
> outbound proxies that add a Path URI but don't include a flow token.
>
> The proposed solution is as follows.  If a proxy inserts a Path  
> header with a flow token consistent with the rules described in  
> outbound, it MUST add the ;ob parameter to the proxy URI that has  
> the flow token.
>
> parameter.  If there are any Path URIs without the ob parameter,  
> the registrar does not return Supported: outbound.  Furthermore,  
> the registrar needs to check that the first hop after the UAC is  
> represented in the Path list (unless the registrar recognizes that  
> the first hop after the UAC is in the same domain and doesn't need  
> to include Path URIs with a flow token).  Note that this implies  
> that whatever the proxy puts in the Via (IP address or FQDN), it  
> must put the same hostname in the Path header (but there is no need  
> for a complete URI comparison).  If the first hop is not correctly  
> represented, the registrar ignores the reg-id parameter and does  
> not return Supported: outbound.
>
> outbound needs to support Path and flow tokens for registrations to  
> all foreign domains.  Inside the same domain, the first-hop proxy  
> and the registrar can still use Path to communicate with each  
> other, but they can use some other private mechanism to  
> disaggregate this functionality.
>
> thanks,
> -rohan
>
>

---

From: Rohan Mahy <[email-masked]>
Date: Wed, 9 Aug 2006 15:59:30 -0700

Christer, please read the slides.  The issue we are trying to detect is 
described in slide 9.  The UA sends through an outbound-proxy that adds 
a Path, but does not support outbound.  The registrar needs to detect 
that.

thanks,
-rohan

On Aug 9, 2006, at 9:46, Christer Holmberg ((JO/LMF)) wrote:
> outbound

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Thu, 10 Aug 2006 08:19:18 +0200

Hi Rohan,

>Christer, please read the slides.  The issue we are trying to detect is
described in slide 9.  The UA sends through an 
>outbound-proxy that adds a Path, but does not support outbound.  The
registrar needs to detect that.

I am not arguing against that. I am simply commenting on the proposed
mechanisms that YOU wrote.

YOU said that ALL Path headers (not only the one inserted by the
outbound proxy) must contain the ob parameter, and I question that.

YOU said that the registrar must start comparing Vias with Paths, and I
propose a way to avoid that.

Regards,

Christer

On Aug 9, 2006, at 9:46, Christer Holmberg ((JO/LMF)) wrote:
> supports outbound) and slide 10 (what does >"Supported: outbound" 
> mean) deal with detecting that all the required hops support outbound.

> Slide
>> header
> multiple proxies which insert a Path header. Do all these proxies 
> really need to support outbound?
>

> all foreign domains.  Inside the same domain, the first-hop proxy and 
> the registrar can still use Path to communicate with each other, but 
> they can use some other private mechanism to disaggregate this 
> functionality.
>
> thanks,
> -rohan
>
>

---

From: Rohan Mahy <[email-masked]>
Date: Thu, 10 Aug 2006 07:57:12 -0700

> propose a way to avoid that.

Right.  You should be able to compare only the first Path and the first 
Via.  I guess there is no reason for the other Path headers to have 
;ob.

thanks,
-rohan

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Mon, 14 Aug 2006 12:39:25 +0200

Hi Rohan, 

>>>Christer, please read the slides.  The issue we are trying to detect 
>>>is described in slide 9.  The UA sends through an
>>YOU said that the registrar must start comparing Vias with Paths, and 
>>I propose a way to avoid that.
>
Via.  I guess there is no reason for the other Path headers to have ;ob.

Wouldn't it be easier, and "cleaner", to say that the outbound proxy
MUST always (no matter what domain it belongs to) Path with "ob"?

Regards,

Christer

>>> proxy