Subject: RE: CPLng (was [IPTEL] agenda items)

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 29 Nov 2000 23:34:30 -0500

Lets slow down here.

We have wandered into "syntax no-mans land", a bad place where many working
groups spend way too much time.

I'm not yet sure what problem is being solved. Lets get agreement on what we
need this for, what fields we want to run checks against, whether the checks
are against lists inside the script or externally referenced, the general
model for how this works (i.e., can we use the lookup/location model of
modification of an implicit global variable) and so on. Once we know WHAT we
want to do, and agree to define a CPL extension to do it, we can sketch out
syntax.

So, the next person that posts a note on syntax for this thing is going to
get a really big flame from me.

-Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

> -----Original Message-----
> From: Jiri Kuthan [mailto:[email-masked]]
> Sent: Wednesday, November 29, 2000 12:24 PM
> To: Henning G. Schulzrinne
> Cc: Jonathan Lennox; Jonathan Rosenberg; [email-masked]'
> Subject: Re: CPLng (was [IPTEL] agenda items)
> 
> 
> So this is the escape-free alternative:
> 
>   Adding new parameters to address and string switches. The parameters
>   indicate that a value is a URL pointing to a list of values 
> separated
>   by a well-known delimiter. The condition matches if any of 
> list items
>   matches.
> 
> Examples:
>   <address is_anyof="http://www.nospam.org/badguys.txt">
>   <subject contains_anyof="ftp://www.nospam.org/dirtywords.txt">
> 
> Can we agree on this?
> 
> If so, how do will we deal with error handling? Does 
> indication of timeout
> and subaction for processing of failed list access sound reasonable?
> I.e., something like 
>   <address is_anyof="http://www.nospam.org/badguys.txt" 
> 	   timeout="10" error_handler="drop_call_and_log">
> 
> Jiri
> 
> "Henning G. Schulzrinne" wrote:
> > 
> > I made my point a few times that I find syntax within "" arguments
> > dangerous and a recipe for escaping and parsing nightmares. 
> I'm not sure
> > what else to say. No, I still don't find the syntax 
> acceptable. CPL can
> > be written by vi, but that is, in the long run, not 
> necessarily going to
> > be the most common means, so I see no need to optimize for that.
> 

_______________________________________________
IPTEL mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/iptel

---

From: Jiri Kuthan <[email-masked]>
Date: Thu, 30 Nov 2000 22:16:53 +0100

Jonathan Rosenberg wrote:
[...]
> modification of an implicit global variable) and so on. 

Sorry for that.

Particularly, I've had spam protection in my mind. In this case, there is
some 3rd party, that collects address of well-known spammers and is trusted 
by author of a CPL script. Without the ability to refer to such an external
database, users have to download the database, generate a script out of
it and upload it to a CPL server. The resulting CPL scripts become 
pretty long and difficult to read. They may be easily out of sync.

So what I'd like to have is the ability to check caller's address against 
an external list in a CPL script.

Does this sound reasonable?

Jiri

P.S. Just in case, you do not want to trust what you see in From: field
     you may want to go for the authentication switching.

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Thu, 30 Nov 2000 16:49:15 -0500

> Does this sound reasonable?

If you're sending an HTTP request, you might as well forward the SIP
request to the spam-checking entity (the only difference is the trust
relationship: the company offering the spam-filter service may not want
you to have access to the list and you may not want to route all your
calls to the spam-filter company...) 

>      you may want to go for the authentication switching.

In the absence of PKI, I have a hard time picturing most calls being
authenticated. There will be high-priority "friends & family" calls that
are authenticated, but there seems to be a vast gray area of non-spam,
first-time callers. Might be easiest to do "don't call me, I'll call
you", i.e., just returning the INVITE immediately to make sure the
caller is who he claims to be.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs