Re: Using TLS in the first hop - Bug in RFC 5630

But that's not the only use-case for Contact - the Contact URI of Alice can=
 be used at any time later for an out-of-dialog request to Alice, and at th=
at point it suddenly needs a full sips path to Alice.  For example in a REF=
ER case.

-hadriel


On Sep 15, 2011, at 10:25 AM, I=F1aki Baz Castillo wrote:

> 2011/9/15 Olle E. Johansson <[email protected]>:
>> This means thet the request URI of the ACK will be using SIPS, and then =
section 8.1.1.8 comes into play
>> and requires the other side to also use a SIPS uri in their contact.
>> =

>> In this case, both UAs need a TLS certificate.
> =

> No, that's incorrect. I show two call flows in which TLS is just used
> by one of the enpoints.
> =

> =

> =

> CASE 1)
> - Alice uses TLS.
> - Bob uses UDP.
> - Proxy/registrar does loose-routing.
> - Alice calls Bob, Bob answers and later Bob hangs up.
> =

> =

> F1 INVITE Alice -> SIP Proxy (transport TLS)
> =

> INVITE sip:[email protected] SIP/2.0
> Via: SIP/2.0/TLS 93.12.40.105:20565;branch=3Dz9hG4bK56sdasks
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected]
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> Max-Forwards: 70
> Contact: <sips:[email protected]:20565;transport=3Dtcp>
> Content-Type: application/sdp
> =

> =

> F2 100 Trying SIP Proxy -> Alice (transport TLS)
> =

> SIP/2.0 100 Trying
> Via: SIP/2.0/TLS 93.12.40.105:20565;branch=3Dz9hG4bK56sdasks
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected]
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> =

> =

> F3 INVITE SIP Proxy -> Carol (transport UDP)
> =

> INVITE sip:[email protected]:5060 SIP/2.0
> Via: SIP/2.0/UDP 100.100.100.100;branch=3Dz9hG4bKhjhjqw32c
> Via: SIP/2.0/TLS 93.12.40.105:20565;branch=3Dz9hG4bK56sdasks
> Record-Route: <sip:100.100.100.100;transport=3Dudp>,
>  <sips:100.100.100.100;transport=3Dtcp>
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected]
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> Max-Forwards: 69
> Contact: <sips:[email protected]:20565;transport=3Dtcp>
> Content-Type: application/sdp
> =

> =

> F4 200 OK Carol -> SIP Proxy (transport UDP)
> =

> SIP/2.0 200 OK
> Via: SIP/2.0/UDP 100.100.100.100;branch=3Dz9hG4bKhjhjqw32c
> Via: SIP/2.0/TLS 93.12.40.105:20565;branch=3Dz9hG4bK56sdasks
> Record-Route: <sip:100.100.100.100;transport=3Dudp>,
>  <sips:100.100.100.100;transport=3Dtcp>
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected];tag=3Dbmqkjhsd
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> Max-Forwards: 69
> Contact: <sip:[email protected]:5060;transport=3Dudp>
> Content-Type: application/sdp
> =

> =

> F5 200 OK SIP Proxy -> Alice (transport TLS)
> =

> SIP/2.0 200 OK
> Via: SIP/2.0/TLS 93.12.40.105:20565;branch=3Dz9hG4bK56sdasks
> Record-Route: <sip:100.100.100.100;transport=3Dudp>,
>  <sips:100.100.100.100;transport=3Dtcp>
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected];tag=3Dbmqkjhsd
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> Max-Forwards: 69
> Contact: <sip:[email protected]:5060;transport=3Dudp>
> Content-Type: application/sdp
> =

> =

> F6 ACK Alice -> SIP Proxy (transport TLS)
> =

> ACK sip:[email protected]:5060;transport=3Dudp SIP/2.0
> Via: SIP/2.0/TLS 93.12.40.105:20565;branch=3Dz9hG4bKhgqqp090
> Route: <sips:100.100.100.100;transport=3Dtcp>,
>  <sip:100.100.100.100;transport=3Dudp>
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected];tag=3Dbmqkjhsd
> Call-ID: asidkj3ss
> CSeq: 1 ACK
> Max-Forwards: 70
> =

> =

> F7 ACK SIP Proxy -> Carol (transport UDP)
> =

> ACK sip:[email protected]:5060;transport=3Dudp SIP/2.0
> Via: SIP/2.0/UDP 100.100.100.100;branch=3Dz9hG4bKhwpoc80zzx
> Via: SIP/2.0/TLS 93.12.40.105:20565;branch=3Dz9hG4bKhgqqp090
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected];tag=3Dbmqkjhsd
> Call-ID: asidkj3ss
> CSeq: 1 ACK
> Max-Forwards: 69
> =

> =

> F8 BYE Carol -> SIP Proxy (transport UDP)
> =

> BYE sips:[email protected]:20565;transport=3Dtcp SIP/2.0
> Via: SIP/2.0/UDP 77.123.45.23;branch=3Dz9hG4bKbiuiansd001
> Route: <sip:100.100.100.100;transport=3Dudp>,
>  <sips:100.100.100.100;transport=3Dtcp>
> From: sip:[email protected];tag=3Dbmqkjhsd
> To: sip:[email protected];tag=3Dasdyka899
> Call-ID: asidkj3ss
> CSeq: 1201 BYE
> Max-Forwards: 70
> =

> =

> F9 BYE SIP Proxy -> Alice (transport TLS)
> =

> BYE sips:[email protected]:20565;transport=3Dtcp SIP/2.0
> Via: SIP/2.0/TLS 100.100.100.100;branch=3Dz9hG4bKmma01m3r5
> Via: SIP/2.0/UDP 77.123.45.23;branch=3Dz9hG4bKbiuiansd001
> From: sip:[email protected];tag=3Dbmqkjhsd
> To: sip:[email protected];tag=3Dasdyka899
> Call-ID: asidkj3ss
> CSeq: 1201 BYE
> Max-Forwards: 69
> =

> =

> F10 200 OK Alice -> SIP Proxy (transport TLS)
> =

> SIP/2.0 200 OK
> Via: SIP/2.0/TLS 100.100.100.100;branch=3Dz9hG4bKmma01m3r5
> Via: SIP/2.0/UDP 77.123.45.23;branch=3Dz9hG4bKbiuiansd001
> From: sip:[email protected];tag=3Dbmqkjhsd
> To: sip:[email protected];tag=3Dasdyka899
> Call-ID: asidkj3ss
> CSeq: 1201 BYE
> =

> =

> F11 200 OK SIP Proxy -> Carol (transport UDP)
> =

> SIP/2.0 200 OK
> Via: SIP/2.0/UDP 77.123.45.23;branch=3Dz9hG4bKbiuiansd001
> From: sip:[email protected];tag=3Dbmqkjhsd
> To: sip:[email protected];tag=3Dasdyka899
> Call-ID: asidkj3ss
> CSeq: 1201 BYE
> =

> =

> =

> =

> =

> =

> =

> CASE 2)
> - Alice uses TLS.
> - Bob uses UDP.
> - Proxy/registrar does loose-routing.
> - Bob calls Alice, Alice answers and later Alice hangs up.
> =

> =

> F1 INVITE Bob -> SIP Proxy (transport UDP)
> =

> INVITE sip:[email protected] SIP/2.0
> Via: SIP/2.0/UDP 77.123.45.23:5060;branch=3Dz9hG4bK56sdasks
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected]
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> Max-Forwards: 70
> Contact: <sip:[email protected]:5060;transport=3Dudp>
> Content-Type: application/sdp
> =

> =

> F2 100 Trying SIP Proxy -> Bob (transport TLS)
> =

> SIP/2.0 100 Trying
> Via: SIP/2.0/UDP 77.123.45.23:5060;branch=3Dz9hG4bK56sdasks
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected]
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> =

> =

> F3 INVITE SIP Proxy -> Alice (transport TLS)
> =

> INVITE sips:[email protected]:20565 SIP/2.0
> Via: SIP/2.0/TLS 100.100.100.100;branch=3Dz9hG4bKhjhjqw32c
> Via: SIP/2.0/UDP 77.123.45.23:5060;branch=3Dz9hG4bK56sdasks
> Record-Route: <sips:100.100.100.100;transport=3Dtcp>,
>  <sip:100.100.100.100;transport=3Dudp>
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected]
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> Max-Forwards: 69
> Contact: <sip:[email protected]:5060;transport=3Dudp>
> Content-Type: application/sdp
> =

> =

> F4 200 OK Alice -> SIP Proxy (transport TLS)
> =

> SIP/2.0 200 OK
> Via: SIP/2.0/TLS 100.100.100.100;branch=3Dz9hG4bKhjhjqw32c
> Via: SIP/2.0/UDP 77.123.45.23:5060;branch=3Dz9hG4bK56sdasks
> Record-Route: <sips:100.100.100.100;transport=3Dtcp>,
>  <sip:100.100.100.100;transport=3Dudp>
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected];tag=3Dbmqkjhsd
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> Max-Forwards: 69
> Contact: <sips:[email protected]:20565;transport=3Dtcp>
> Content-Type: application/sdp
> =

> =

> F5 200 OK SIP Proxy -> Bob (transport UDP)
> =

> SIP/2.0 200 OK
> Via: SIP/2.0/UDP 77.123.45.23:5060;branch=3Dz9hG4bK56sdasks
> Record-Route: <sips:100.100.100.100;transport=3Dtcp>,
>  <sip:100.100.100.100;transport=3Dudp>
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected];tag=3Dbmqkjhsd
> Call-ID: asidkj3ss
> CSeq: 1 INVITE
> Max-Forwards: 69
> Contact: <sips:[email protected]:20565;transport=3Dtcp>
> Content-Type: application/sdp
> =

> =

> F6 ACK Bob -> SIP Proxy (transport UDP)
> =

> ACK sips:[email protected]:20565;transport=3Dtcp SIP/2.0
> Via: SIP/2.0/TLS 77.123.45.23:5060;branch=3Dz9hG4bKhgqqp090
> Route: <sip:100.100.100.100;transport=3Dudp>,
>  <sips:100.100.100.100;transport=3Dtcp>
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected];tag=3Dbmqkjhsd
> Call-ID: asidkj3ss
> CSeq: 1 ACK
> Max-Forwards: 70
> =

> =

> F7 ACK SIP Proxy -> Alice (transport TLS)
> =

> ACK sips:[email protected]:20565;transport=3Dtcp SIP/2.0
> Via: SIP/2.0/TLS 100.100.100.100;branch=3Dz9hG4bKhwpoc80zzx
> Via: SIP/2.0/UDP 77.123.45.23:5060;branch=3Dz9hG4bKhgqqp090
> From: sip:[email protected];tag=3Dasdyka899
> To: sip:[email protected];tag=3Dbmqkjhsd
> Call-ID: asidkj3ss
> CSeq: 1 ACK
> Max-Forwards: 69
> =

> =

> F8 BYE Alice -> SIP Proxy (transport TLS)
> =

> BYE sip:[email protected]:5060;transport=3Dudp SIP/2.0
> Via: SIP/2.0/TLS 77.123.45.23;branch=3Dz9hG4bKbiuiansd001
> Route: <sips:100.100.100.100;transport=3Dtcp>,
>  <sip:100.100.100.100;transport=3Dudp>
> From: sip:[email protected];tag=3Dbmqkjhsd
> To: sip:[email protected];tag=3Dasdyka899
> Call-ID: asidkj3ss
> CSeq: 1201 BYE
> Max-Forwards: 70
> =

> =

> F9 BYE SIP Proxy -> Bob (transport UDP)
> =

> BYE sip:[email protected]:5060;transport=3Dudp SIP/2.0
> Via: SIP/2.0/UDP 100.100.100.100;branch=3Dz9hG4bKmma01m3r5
> Via: SIP/2.0/TLS 77.123.45.23;branch=3Dz9hG4bKbiuiansd001
> From: sip:[email protected];tag=3Dbmqkjhsd
> To: sip:[email protected];tag=3Dasdyka899
> Call-ID: asidkj3ss
> CSeq: 1201 BYE
> Max-Forwards: 69
> =

> =

> F10 200 OK Bob -> SIP Proxy (transport UDP)
> =

> SIP/2.0 200 OK
> Via: SIP/2.0/UDP 100.100.100.100;branch=3Dz9hG4bKmma01m3r5
> Via: SIP/2.0/TLS 77.123.45.23;branch=3Dz9hG4bKbiuiansd001
> From: sip:[email protected];tag=3Dbmqkjhsd
> To: sip:[email protected];tag=3Dasdyka899
> Call-ID: asidkj3ss
> CSeq: 1201 BYE
> =

> =

> F11 200 OK SIP Proxy -> Alice (transport TLS)
> =

> SIP/2.0 200 OK
> Via: SIP/2.0/TLS 77.123.45.23;branch=3Dz9hG4bKbiuiansd001
> From: sip:[email protected];tag=3Dbmqkjhsd
> To: sip:[email protected];tag=3Dasdyka899
> Call-ID: asidkj3ss
> CSeq: 1201 BYE
> =

> =

> =

> =

> These flows are inspired in real scenarios, so both are real and working =
flows.
> =

> =

> -- =

> I=F1aki Baz Castillo
> <[email protected]>
> _______________________________________________
> Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
> This list is essentially closed and only used for finishing old business.
> Use [email protected] for questions on how to develop a SI=
P implementation.
> Use [email protected] for new developments on the application of sip.
> Use [email protected] for issues related to maintenance of the core SIP sp=
ecifications.

_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is essentially closed and only used for finishing old business.
Use [email protected] for questions on how to develop a SIP =
implementation.
Use [email protected] for new developments on the application of sip.
Use [email protected] for issues related to maintenance of the core SIP spec=
ifications.