Subject: [SIP] Multicast UDP Authentication

From: Phil Hoffer <[email-masked]>
Date: Wed, 10 May 2000 12:08:36 +0100

Hi,

The BIS draft modified paragraph 10.2.2 Multicast UDP, to include
the 401 status code in the following sentence ....

"To avoid response implosion, servers MUST NOT answer multicast
requests with a status code other than 2xx, 401 or 6xx."

Should the last sentence of the same paragraph also be modified
to read .....

"A proxy or UAC SHOULD send a CANCEL on receiving the first 2xx,
401 or 6xx response to a multicast request"
---
 -

Without the addition of the 401 to the above sentence, the UAC
processing of multiple responses from a multicast request becomes
confused, as a 401 can arrive first.

Thanks In Advance
Phil

--
Phil Hoffer                         Ubiquity Software Corporation
Software Developer                  Ubiquity House
Tel: +44 (0) 1633-765600            Langstone Park
Fax: +44 (0) 1633-765601            Newport   NP18 2LH
URL: http://www.ubiquity.net

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 10 May 2000 07:59:51 -0400

Yes; changed.

---

From: Phil Hoffer <[email-masked]>
Date: Wed, 10 May 2000 13:00:07 +0100

Hi Henning,

Thanks for the quick reply.

Following on from this .....

I believe a decision was made post bake off to allow a registrar to
return a 407, in response to a register request.

This of course has implications with respect to the handling of multicast
registers, as the paragraphs quoted only refer to 401.

I think the options are to:

a) Reverse the post bake off decision and state that a registrar SHOULD
ONLY return 401 if it requires authentication.

b) Modify the quoted paragraphs to also include a 407 response.

What do you think?

Thanks In Advance
Phil

---

From: Phil Hoffer <[email-masked]>
Date: Wed, 10 May 2000 14:35:14 +0100

Hi again,

Is it possible for a proxy server to proxy a multicast request?

If so then that would suggest that Proxy-Authenticate (407) might
be required in order to achieve this.

Therefore option b) would seem reasonable.

Thoughts??

Regards
Phil

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 10 May 2000 12:20:49 -0400

> return a 407, in response to a register request.

No.

A registrar *terminates* the request. It does not proxy it. Therefore,
it uses 401. A proxy which sends a REGISTER to a registrar is *proxying*
the request, and thus uses 407, NOT 401. That was the clarification made
during the bakeoff.

> b) Modify the quoted paragraphs to also include a 407 response.

Actually, the quoted paragraphs need to be modified to handle any
response code for which a subsequent request is needed and requested.
This includes 401, 407, and 484.

-Jonathan R.
-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (732) 741-4778
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 10 May 2000 19:11:49 -0400

> Is it possible for a proxy server to proxy a multicast request?

Of course.

> Therefore option b) would seem reasonable.

Yes.

-Jonathan R.