Subject: [sipcore] Half-outbound thoughts

From: "Olle E. Johansson" <[email-masked]>
Date: Fri, 10 Jun 2016 11:46:16 +0200

Friends,
I’ve tried to collect my thoughts about TLS and Outbound in a small brainstorm-presentation.

http://www.slideshare.net/oej/sip-half-outbound-random-notes

The chairs have alerted me to the fact that this may not be a SIPcore issue which I agree with, but I think this is the proper starting point for a general discussion between SIP people before we either drop the issue or drag it into dispatch. My apologies to the chairs for using this attractive forum :-)

In short:

- very few seems to implement full outbound
- some parts of outbound seems used
- which parts is not documented
- TLS between UA and server has a clear problem if outbound is not used

I am toying with an idea for a simple extension that puts the connection/flow management on the UA,
allows the server to reuse the inbound TLS connection (without a client cert) after auth for outbound
requests and also allows the server to remove associations in the location database at connection close.

I think this documents what’s in use and formalises it with an extension tag.

Please check my presentation and give me feedback.

Thanks!
/O

---

From: Christer Holmberg <[email-masked]>
Date: Fri, 10 Jun 2016 10:10:28 +0000

Hi O,

A couple of questions on the slides:

Q1: Number of flows

You claim that Outbound mandates at least two flows.

I can find text saying that a UA must, as a minimum, support a set of two
outbound proxy URIs, and while the whole idea of Outbound is having
multiple flows I don¹t find any text saying that one must configure two
(or more) outbound proxy URIs.

Q2: Flow-management

Slide #14 says ³No flow-management². What is meant by that? That the
keep-olives aren¹t needed?

Regards,

Christer

On 10/06/16 12:46, "sipcore on behalf of Olle E. Johansson"
<[email-masked] on behalf of [email-masked]> wrote:

>Friends,
>I¹ve tried to collect my thoughts about TLS and Outbound in a small
>brainstorm-presentation.
>
>The chairs have alerted me to the fact that this may not be a SIPcore
>issue which I agree with, but I think this is the proper starting point
>for a general discussion between SIP people before we either drop the
>issue or drag it into dispatch. My apologies to the chairs for using this
>attractive forum :-)
>
>In short:
>
>I think this documents what¹s in use and formalises it with an extension
>tag.
>
>_______________________________________________
>sipcore mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/sipcore

---

From: "Olle E. Johansson" <[email-masked]>
Date: Fri, 10 Jun 2016 13:04:48 +0200

> On 10 Jun 2016, at 12:10, Christer Holmberg <[email-masked]> wrote:
> 
> Hi O,
> 
> multiple flows I donąt find any text saying that one must configure two
We’ve discussed this many times at SIPit and have parsed TWO as a 
must. I think you may be right though, that two is not required to run,
but the client must support using it. My failure.

Additional quote:

"If the set has more than
   one URI, the UAC MUST send a REGISTER request to at least two of the
   default outbound proxies from the set. “

I will update the slides
> 
> 
> Q2: Flow-management
> 
> Slide #14 says łNo flow-management˛. What is meant by that? That the
> keep-olives arenąt needed?
> 
That’s very badly written by me. We need flow management, but not in
the outbound-style, with flow tokens and all that. Will update.

Thank you for very good feedback!

/O
>> Iąve tried to collect my thoughts about TLS and Outbound in a small
>> brainstorm-presentation.
>> 
>> I think this documents whatąs in use and formalises it with an extension
>> tag.
>>

---

From: "Olle E. Johansson" <[email-masked]>
Date: Fri, 10 Jun 2016 14:44:19 +0200

> On 10 Jun 2016, at 13:04, Olle E. Johansson <[email-masked]> wrote:
> 
> 
An updated version (v1.1)  is now available at
http://www.slideshare.net/oej/sip-half-outbound-random-notes

/O

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 10 Jun 2016 16:00:01 -0400

> (or more) outbound proxy URIs.

+1.

I just recently had occasion to review outbound for use in a specialized 
context, and also reached this conclusion. I think it can be used as-is 
for cases with only one flow.

The key is that you must *support* multiple flows, but the use of them 
is governed by the number of addresses that are configured. If only one 
is configured then you only have one flow.

	Thanks,
	Paul

---

From: Christer Holmberg <[email-masked]>
Date: Sat, 11 Jun 2016 06:54:29 +0000

Hi,

Another question for clarification.

Q3:

Slide #2 talks about "outbound requests". What does "outbound" refer to? Requests somehow associated with the outbound mechanism, or the direction of the requests?

If it's about the direction, shouldn't it then me "inbound", as the requests is from the server to the UA?

If it's about requests associated with the outbound mechanism, I think you need to clarify a bit what exactly you mean by that.

Regards,

Christer

-----Original Message-----
From: Olle E. Johansson [mailto:[email-masked]] 
Sent: 10 June 2016 15:44
To: Christer Holmberg <[email-masked]>
Cc: Olle E Johansson <[email-masked]>; SIPCORE <[email-masked]>
Subject: Re: [sipcore] Half-outbound thoughts

>> I can find text saying that a UA must, as a minimum, support a set of 
>> two outbound proxy URIs, and while the whole idea of Outbound is 
>> having multiple flows I donąt find any text saying that one must 
>> configure two (or more) outbound proxy URIs.
> must. I think you may be right though, that two is not required to 
> run, but the client must support using it. My failure.
> 
> Additional quote:
> 
An updated version (v1.1)  is now available at http://www.slideshare.net/oej/sip-half-outbound-random-notes

/O
>>> The chairs have alerted me to the fact that this may not be a 
>>> SIPcore issue which I agree with, but I think this is the proper 
>>> starting point for a general discussion between SIP people before we 
>>> either drop the issue or drag it into dispatch. My apologies to the 
>>> chairs for using this attractive forum :-)
>>> 
>>> In short:
>>> 
>>> I am toying with an idea for a simple extension that puts the 
>>> connection/flow management on the UA, allows the server to reuse the 
>>> inbound TLS connection (without a client
>>> cert) after auth for outbound
>>> I think this documents whatąs in use and formalises it with an 
>>> extension tag.
>>>

---

From: "Olle E. Johansson" <[email-masked]>
Date: Sun, 12 Jun 2016 12:03:25 +0200

> On 11 Jun 2016, at 08:54, Christer Holmberg <[email-masked]> wrote:
> 
> Hi,
> 
Ok, I’ll take a look.

Thank you!
/O