Subject: RE: Session timer

From: "Donovan, Steven R." <[email-masked]>
Date: Tue, 20 Jul 1999 14:30:49 +0000

Gonzalo,

There are other ways to control a prepaid service.  The SIP messaging isn't
suited to controlling or reporting on the length of a media session, given
that the media generally takes a separate path from the SIP signaling.

I would like to hear from other's on the list as to whether it is a bad idea
to have a SIP proxy originating BYE requests (or any requests in general).
If there is consensus then I will remove this working from the session timer
draft.

Steve

-----Original Message-----
From: Gonzalo Camarillo [mailto:[email-masked]]
Sent: Tuesday, July 20, 1999 12:23 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: Session timer

Hi Jonathan,

[email-masked] wrote:
> 
> Gonzalo Camarillo wrote:
> >
> > Hi,
> >
> > About the draft about session timer.
> > I think that it is a good idea. In a pre-paid call, the server could
> > tear down the connection when the user has run out of money... the
> > problem is how to do that.
> >
> > In the draft, the proxy server sends BYE request. This sounds bad to me,
> > since in a race condition, one of the User Agents, could issue a request
> > with the same CSeq that the BYE generated by the proxy, and we would
> > have two messages with the same Cseq number that are completely
> > different.
> >
> > It may be solved with Record-Route header... so, if all the traffic goes
> > through the proxy, it can take care of all the mess that its BYE can
> > trigger...
> 
> No. The proxy can never generate a BYE in a system with any security. It
> will fail authentication.

Another reason to add to the ones I said to try to avoid BYEs sent by a
proxy... ( as I said before it sounds like a bad idea)

> In any case, the proxy cannot "force" the UA
> to end the call if it doesn't want.

That was my feeling also... anyway, if I am in the middle of a
conversation and my pre-paid card is out of money, how can somebody
force me to stop speaking??

If nobody can, everybody is going to buy 0.20$ telephone cards, just
enough to begin the conversation :o)

> The purpose of the session timer is
> not for services like pre-paid calling cards, but merely as a heartbeat
> timer for SIP sessions.

For this purpose it should work fine...

Regards,

Gonzalo

> When the keepalive is missed for some number of
> intervals, the session is assumed dead, and a proxy (and UA) can safely
> destroy state for the call. No BYE should be sent by any parties.
> 
> -Jonathan R.
> --
> Jonathan D. Rosenberg                       Lucent Technologies
> Member of Technical Staff                   101 Crawfords Corner Rd.
> High Speed Networks Research                Holmdel, NJ 07733
> FAX: (732) 834-5379                         Rm. 4C-526
> EMAIL: [email-masked]
> URL: http://www.cs.columbia.edu/~jdrosen

-- 
Gonzalo Camarillo         Phone :  +358  9 299 33 71
Oy L M Ericsson Ab        Mobile:  +358 40 702 35 35
Telecom R&D               Fax   :  +358  9 299 31 18
FIN-02420 Jorvas          Email :  [email-masked]
Finland

---

From: "Adam B. Roach" <[email-masked]>
Date: Tue, 20 Jul 1999 13:33:11 -0500 (CDT)

>If there is consensus then I will remove this working from the session timer

More than being a "good" or "bad" idea, I think the main consideration
should be that it won't generally work. Many of the security provisions
put in to the protocol are aimed at keeping proxies from meddling in
sessions. If a given session is encrypted end-to-end, a proxy generated
BYE will be rejected.

But to answer your intended question: I think it is better to assume
that, since the session timer has expired, all functioning nodes will
automatically drop the session without prompting from a proxy.

--
Adam Roach, Ericsson Inc. |  Ph: +1 972 583 7594 | 1010 E. Arapaho, MS L-04
[email-masked]   | Fax: +1 972 669 0154 | Richardson, TX 75081 USA