Subject: [SIP] SIP tunneled over HTTP

From: [email-masked]
Date: Wed, 18 Oct 2000 14:03:10 +0200

The documents at http://www.cs.columbia.edu/~hgs/sip/drafts_firewall.html
discuss the issue of SIP through firewalls at detail for SIP associated
with VoIP and similar media. Indeed, as the draft at
http://www.cs.columbia.edu/~hgs/sip/drafts/draft-rosenberg-sip-firewalls-00.txt

points out, the main problem is not SIP but the media.

One of the advantages of SOAP and similar protocols is to tunnel everything
over HTTP. It does get kind of silly to play a cat-and-mouse game with the
firewall administrator, but SOAP has chosen this approach (although  the
possibility of yet another layer of blocking, in which the firewall can
actually block certain SOP messages, has been considered; you could take
the cat-and-mouse game one more level and tunnel firewall-forbidden SOAP
over firewall-allowed SOAP).

Given media that themselves use HTTP, what about the possibility of
tunneling SIP over HTTP (using the usual techniques of tunneling: place SIP
headers+body as part of the body of HTTP)? There are problems. HTTP is
request-response, so we have to consider how to get notifications from
server-to-client. We could run an HTTP-server on the client too, but as the
above-mentioned draft mentions, some firewalls do not allow arbitrary
incoming HTTP to port 80.

What I am discussing here is similar, but not identical, to the
"non-solutions" mentioned in the Section 7 of the draft. I admit it's slow,
clumsy, and bad for security, but since HTTP-tunneling is at least
reasonable enough to be considered by SOAP people, among others, I wonder
if it has been considered by SIP people.

Joshua Fox

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 18 Oct 2000 09:22:46 -0400

> if it has been considered by SIP people.

Fortunately, such kludges require no protocol support, so anybody is
free to invent and implement them without the assistance of the IETF.
That way, we don't get blamed if you get fired for violating your
company's security policy or get your security clearance revoked if you
work at a government lab (unless your name is Deutsch, in which case you
can probably tunnel SIP on your personal laptop). Just run IP-over-HTTP,
and you don't even have to do this for each protocol.

See http://www.linux.org/docs/ldp/howto/mini/Firewall-Piercing-6.html or
http://www.nocrew.org/software/httptunnel.html

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

---

From: Jiri Kuthan <[email-masked]>
Date: Wed, 18 Oct 2000 16:36:10 +0200

Actually, your idea has already been documented in 
draft-eastlake-ip-mime-03.txt.

Jiri

-- 
Jiri Kuthan         http://www.fokus.gmd.de/usr/kuthan
Internet Telephony: http://www.fokus.gmd.de/glone/projects/ipt