Subject: RE: [SIP] SIP tunneled over HTTP

From: [email-masked]
Date: Wed, 18 Oct 2000 14:58:18 +0100

Joshua,

An interesting idea - however I think we need to be clear about the type of
media involved. If it is text, graphic images or half duplex sound then we
can probably get away with this type of approach - some of the security
experts may raise additional concerns though because tunnelling kind of
defeats the idea of the firewall in the first place. However if we are
talking about real-time full duplex streamed audio and video then there are
QoS concerns that may be hard to overcome with the tunnelling approach.

regards

Richard

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, October 18, 2000 1:03 PM
To: [email-masked]
Subject: [SIP] SIP tunneled over HTTP

The documents at http://www.cs.columbia.edu/~hgs/sip/drafts_firewall.html
discuss the issue of SIP through firewalls at detail for SIP associated
with VoIP and similar media. Indeed, as the draft at
http://www.cs.columbia.edu/~hgs/sip/drafts/draft-rosenberg-sip-firewalls-00.
txt

points out, the main problem is not SIP but the media.

One of the advantages of SOAP and similar protocols is to tunnel everything
over HTTP. It does get kind of silly to play a cat-and-mouse game with the
firewall administrator, but SOAP has chosen this approach (although  the
possibility of yet another layer of blocking, in which the firewall can
actually block certain SOP messages, has been considered; you could take
the cat-and-mouse game one more level and tunnel firewall-forbidden SOAP
over firewall-allowed SOAP).

Given media that themselves use HTTP, what about the possibility of
tunneling SIP over HTTP (using the usual techniques of tunneling: place SIP
headers+body as part of the body of HTTP)? There are problems. HTTP is
request-response, so we have to consider how to get notifications from
server-to-client. We could run an HTTP-server on the client too, but as the
above-mentioned draft mentions, some firewalls do not allow arbitrary
incoming HTTP to port 80.

What I am discussing here is similar, but not identical, to the
"non-solutions" mentioned in the Section 7 of the draft. I admit it's slow,
clumsy, and bad for security, but since HTTP-tunneling is at least
reasonable enough to be considered by SOAP people, among others, I wonder
if it has been considered by SIP people.

Joshua Fox

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip