Subject: [sipcore] I-D Action: draft-ietf-sipcore-sip-websocket-09.txt

From: [email-masked]
Date: Wed, 12 Jun 2013 18:17:08 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Session Initiation Protocol Core Working Group of the IETF.

	Title           : The WebSocket Protocol as a Transport for the Session Initiation Protocol (SIP)
	Author(s)       : Inaki Baz Castillo
                          Jose Luis Millan Villegas
                          Victor Pascual
	Filename        : draft-ietf-sipcore-sip-websocket-09.txt
	Pages           : 25
	Date            : 2013-06-12

Abstract:
   The WebSocket protocol enables two-way realtime communication between
   clients and servers in web-based applications.  This document
   specifies a WebSocket sub-protocol as a reliable transport mechanism
   between SIP (Session Initiation Protocol) entities to enable usage of
   SIP in web-oriented deployments.  This document normatively updates
   RFC 3261.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sipcore-sip-websocket

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-sipcore-sip-websocket-09

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-sipcore-sip-websocket-09

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Thu, 13 Jun 2013 03:22:43 +0200

Hi all,

This new revision addresses all the issues reported in the WG since
previous 08 revision. The changelog in revision 09 is the following:

- Improved section "Handshake" (under "The WebSocket SIP
Sub-Protocol") by mentioning the error handling when establishing a
WebSocket connection (thanks to Suresh Krishnan).

- Mention to RFC 4168 (SIP SCTP) removed from the "SIP URI Transport
Parameter" section (reported by Suresh Krishnan).

- "SIP Transport Implementation Requirements" section clarified by
removing the "MAY" keyword (reported by Suresh Krishnan), and text
from RFC 3261 section 18 amended (thanks to Barry Leiba).

- Text about certificate validation in secure WebSocket clarified in
section "Secure WebSocket Connection" within "Security Considerations"
(thanks to  Richard Barnes).

- Section "Authentication" made normative and text about SIP/Web
authentication requirement improved.

- New appendix "Authentication Use Cases".

Really thanks a lot for your help and comments.

2013/6/13  <[email-masked]>:
> _______________________________________________
> sipcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipcore

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: "Parthasarathi R" <[email-masked]>
Date: Tue, 18 Jun 2013 23:33:35 +0530

Hi Inaki & all,

IIUC, The below text in Sec 7 of the draft:

"If no authentication is done at WebSocket level then SIP Digest
   authentication is required for every SIP request coming over the
   WebSocket connection."

has to be changed as Normative statement as follows:

"If no authentication is done at WebSocket level then SIP Digest
   authentication MUST be done for every SIP request coming over the
   WebSocket connection."

Please let me know in case I'm missing something.

Thanks
Partha

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Iñaki Baz Castillo
> Sent: Thursday, June 13, 2013 6:53 AM
> To: SIPCORE (Session Initiation Protocol Core) WG
> Subject: Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-websocket-
> 09.txt
> 
> Hi all,
>

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Wed, 19 Jun 2013 00:04:53 +0200

Right. I will modify it. Anyhow, I don't know if more changes are
required in that "Authentication" section (due to pending issues in
another mail thread).

Thanks a lot.

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: Saúl Ibarra Corretgé <[email-masked]>
Date: Wed, 19 Jun 2013 09:14:16 +0200

Hi,

After reading those 2 paragraphs a few times I have a question about some corner case (below)

>> Please let me know in case I'm missing something.

Why is authentication a MUST? Lets assume that I'm using UDP and my proxy establishes a WS connection with a foreign domain's proxy because of NAPTR and my proxy supports acting as a WS client. It obviously won't be able to authenticate. If this scenario supposed to be covered?

Thanks,

--
Saúl Ibarra Corretgé
AG Projects

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Wed, 19 Jun 2013 13:32:09 +0200

> Why is authentication a MUST? Lets assume that I'm using UDP and my proxy establishes a WS connection with a foreign domain's proxy because of NAPTR and my proxy supports acting as a WS client. It…

Honestly I agree. I cannot find in RFC 3261 (or other RFCs) a
normative statement mandating authentication, regardless the request
comes from a UA.

In another thread we are discussing about MTI authentication
mechanisms that must be implemented by SIP WS Clients and Servers.
IMHO that is correct, but mandating SIP authentication or WWW
authentication for ALL the scenarios seem innapropriate for me. I come
back to an use case:

A website (a shop) offers a widget in which the visitor can click and
made a SIP call (+WebRTC) that will end in the callcenter of the
company, answered by an agent that will inform the user about the
product he is interested in. Why do we require WWW or SIP
authentication in this scenario?

If WG agrees with this, I will remove the normative statements in
"Authentication" section, and instead address the MTI authentication
mechanisms.

--
Iñaki Baz Castillo
<[email-masked]>

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Wed, 19 Jun 2013 12:06:09 +0000

I would not use RFC 3261 as justification for what should, or should not, be said about authentication. The current RFC 3261 would probably fail a security directorate review if it was attempted to be approved as an RFC now.

(I'd also point out that for any security consideration of RFC 3261, one should also read RFC 5630.)

So I would suggest you conduct an independent security evaluation of what is needed.

> authentication in this scenario?

I'd suggest that the issue to be discussed is what happens when the action described results in a transaction of some form to a third party (in the SIP case a call). The visitor then includes information that will be relayed to the third party. Who does the third party rely on to ensure that information is authentically given by the visitor.

Regards

Keith

> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Iñaki Baz Castillo
> Sent: 19 June 2013 12:32
> To: Saúl Ibarra Corretgé
> Cc: SIPCORE (Session Initiation Protocol Core) WG; Parthasarathi R
> Subject: Re: [sipcore] No WebSocket level authentication scenario [was RE:
> I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]
> 
> > Why is authentication a MUST? Lets assume that I'm using UDP and my
> proxy establishes a WS connection with a foreign domain's proxy because of
> NAPTR and my proxy supports acting as a WS client. It obviously won't be
> able to authenticate. If this scenario supposed to be covered?
>

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Thu, 20 Jun 2013 00:10:43 +0200

Thanks a lot Keith, it's clear. I will address it in next revision.

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: Paul Kyzivat <[email-masked]>
Date: Thu, 20 Jun 2013 12:07:18 -0400

> So I would suggest you conduct an independent security evaluation of what is needed.

I think we are in the midst of one with Stephen Farrell.

> I'd suggest that the issue to be discussed is what happens when the action described results in a transaction of some form to a third party (in the SIP case a call). The visitor then includes infor…

I'm inclined to support Iñaki, that authentication of any sort shouldn't 
be Mandatory to *Use*.  Individual applications can decide when they 
have uses that require authentication and when they don't.

	Thanks,
	Paul

---

From: "Parthasarathi R" <[email-masked]>
Date: Tue, 25 Jun 2013 06:17:55 +0530

Paul,

In case it is not mandatory to use authentication, the following statement
in Sec 7 of the draft is not correct:

"  If no authentication is done at WebSocket level then SIP Digest
   authentication is required for every SIP request coming over the
   WebSocket connection."

Please let me know your comment on the same.

Thanks
Partha

> Behalf Of Paul Kyzivat
> Sent: Thursday, June 20, 2013 9:37 PM
> To: [email-masked]
> Subject: Re: [sipcore] No WebSocket level authentication scenario [was
> RE: I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]
> 
> > I would not use RFC 3261 as justification for what should, or should
> not, be said about authentication. The current RFC 3261 would probably
> fail a security directorate review if it was attempted to be approved
> as an RFC now.
> >
> > I'd suggest that the issue to be discussed is what happens when the
> action described results in a transaction of some form to a third party
> (in the SIP case a call). The visitor then includes information that
> will be relayed to the third party. Who does the third party rely on to
> ensure that information is authentically given by the visitor.
>

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 26 Jun 2013 11:16:05 -0400

Partha,

Again, I'm not the one to answer. I'm just the chair, not the author.

	Thanks,
	Paul