Subject: Question about UDP, Via: header, and received= attribute.

From: Kim Liu <[email-masked]>
Date: Fri, 18 Feb 2000 09:42:13 -0500

This is a question regarding UDP connections and the received tag in
Via header fields (6.40.2 of the draft I believe.)  I did not see this
answered off hand in the clarifications or elsewhere.

Section 6.40.2 states that a proxy should check that the address in 
the last Via: header matches the address that the request was actually
received from.  If the addresses do not match, the proxy must add the
received tag with the address that the request was actually received
from.  

My problem is with what happens if the address/hostname in the Via
header matches several IP addresses, including the one actually used
to send it, but not all of the addresses are routable, preferred, or
public.

That is, suppose a server receives a Via header like:

  Via: SIP/2.0/UDP aka.generic.com:5060

in a UDP packet with an originating address of 10.100.100.100.
The server looks up the IP addresses for aka.generic.com to see
whether or not 10.100.100.100 is one of its addresses.  The
returned addresses for aka.generic.com are:

  192.168.128.1, 192.168.128.2, 192.168.128.3, 192.168.128.3, and
  10.100.100.100.

So, since the 10.100.100.100 address is present, no received tag is
added to the Via field.  Now, when the response comes back through
the proxy, and the proxy tries to forward it back along the Via
lines, which IP address should the proxy choose to send the UDP
message to?  (Of course, the 192.* addresses might be public
interfaces, and the 10.100.100.100 address is on a private network
to keep call information private, etc.)  Could a recieved= tag 
be added to the Via: header anyways to be used to tell the proxy
exactly which IP address the response should be sent to?  

(Hmmm. This almost but does not quite feel like a security issue.
If a target server has an IP address of 10.10.10.10, an attacker
sets up a DNS entry for bogus.someplace.com that has IP addresses
10.10.10.10 and 20.20.20.20, then sends a packet from 20.20.20.20
with a Via line specifying bogus.someplace.com as the return hop.)

Also, I think I may have seen this question earlier, but I cannot
find it now (is there a mailing list archive somewhere?) -- how does
the Via:/received affect loop detection?  The example given in 
the draft indicates that one use of the received tag was for when
a SIP request is passing through NAT.  When checking for loops
and a received tag is present, should only the address in the 
received tag be checked?  (For instance, one organization is 
using the 10.* network behind NAT, and a SIP request is sent
across the public network to a second organization which also uses
the 10.* network behind NAT.  The SIP servers in the second 
organization see a Via header:

  Via: SIP/2.0/UDP 10.10.10.10:5060; received=200.200.200.200

If the second organization using the 10.* network also has a SIP
server at 10.10.10.10, will this show up as an accidental loop 
detection?

Thanks,
Kim Liu

---

From: Christer Holmberg <[email-masked]>
Date: Fri, 18 Feb 2000 19:36:30 +0200

Hi,

I have a question about the syntax of the display-name.

According to the draft, the syntax is:

display-name = *token | quoted-string

My question concerns the case when we do NOT use quotes. Then, we should
only be allowed to use token characters, which don't allow space
characters, but in many of the examples I've seen we have, for example,
a name, a space(!), and a family name - and this without quotes.

eg.

To: T.<SP>Watson ...

Regards,

Christer Holmberg
Ericsson Finland

---

From: Anders Kristensen <[email-masked]>
Date: Fri, 18 Feb 2000 18:04:31 +0000

> a name, a space(!), and a family name - and this without quotes.

*token matches zero or more tokens. The grammar allows whitespace
between these tokens - see the comments on implied LWS in appendix C of
rfc 2543.

Anders

-- 
Anders Kristensen <[email-masked]>,
http://www-uk.hpl.hp.com/people/ak/
Hewlett-Packard Labs, Bristol, UK

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 23 Feb 2000 02:35:04 -0500

>   192.168.128.1, 192.168.128.2, 192.168.128.3, 192.168.128.3, and

I would not recommend that. The reason for having a hostname in the Via
field as an option is to add a layer of indirection. This would allow a
set of proxy servers to be used for load balancing purposes through DNS
round robining. In many cases, its not actually important for the
response to even go back to the same server the request came from (not
important at all for stateless proxies). Thus, my recommendation would
be:

  If the Via contains a hostname, and the IP address the request came
from is one of the addresses returned   from DNS query for that
hostname, no received tag is added.

If your proxy is such that responses should always be sent to just that
proxy, well, then don't put multiple addresses for it in DNS, or don't
put a hostname in the Via header.

Also, in your example above, DNS queries from outside the network the
server sits in are never going to return a net 10 address. Thus, if a
request has passed through a NAT, and the source IP address is a net 10
address, and the Via header contained a hostname, you can be sure the
received tag will be inserted. This is also what you want.

> find it now (is there a mailing list archive somewhere?)

Yes. Its linked from the sip page at IETF. Its:
http://www.bell-labs.com/mailing-lists/sip 

> -- how does
> the Via:/received affect loop detection? 

It doesn't.

> The example given in
> received tag be checked?  

The received tag is not used for loop detection. A proxy looks for Via
fields that contain its own address that it inserted into the sent-by
field. Some recent posts to the list discuss additional checks that must
be made to avoid false classification of loops when calls are forwarded
to other users on the same network.

-Jonathan R.

-- 
Jonathan D. Rosenberg                       200 Executive Drive
Chief Scientist                             Suite 120 
dynamicsoft                                 West Orange, NJ 07052
[email-masked]                     FAX:   (732) 741-4778
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com