Subject: RE: [SIP] Request/Responses from other addresses

From: "Fairlie-Cuninghame, Robert" <[email-masked]>
Date: Mon, 5 Jun 2000 20:13:35 -0700

> > For security purposes, actually, you really do need to check that the
> > CANCEL came from the same place as the request being cancelled (see the
> > minutes of the security task force on this). CANCELs cannot usefully be
> > authenticated directly, since they may come from proxies. That aside,
> > CANCEL can come from anywhere.
> >
I take it then that this doesn't apply to BYE requests because they can be
authenticated directly? Is there a weaker source address check you could
apply in the absence of authentication? I can't think of any infallible
ones. Requests will not always come from the original source address and the
Contact address doesn't necessarily infer that the source of future requests
will be from that address... although it would help if we could assume that!

So I guess that without authentication, SIP is very vulnerable to someone
sniffing packets and then generating their own requests to re-INVITE the
call to themselves.

Am I missing something?

Robert.

-----Original Message-----
From:	Jonathan Rosenberg [mailto:[email-masked]]
Sent:	Tuesday, June 06, 2000 6:11 AM
To:	McMurry, Kathleen
Cc:	Sean Olson; [email-masked]
Subject:	Re: [SIP] Request/Responses from other addresses

"McMurry, Kathleen" wrote:
> 
> > > By different address you mean different source IP address, I'm
> assuming(?)
> > > (A different From: of course would not cause a problem -- the proxy
> could return a 481)
> > >
> > > I see no reason to state absolutely that the CANCEL or final response
> MUST come from
> > > the same IP address. There are obvious applications for exactly this
> scenario.
> >
> > As for responses, I'm really not sure. The spec says nothing about this,
> > as we had not considered it. It clearly requires some out-of-band
> > communications between the entity which received the request, and the
> > one which sent the response. I'm not sure what the application of that
> > would be. That aside, there may be problems. For requests sent over TCP,
> > the response is supposed to go over the same connection. Clearly it
> > cannot if the response is generated somewhere else. I suspect some
> > proxies may be upset if the connection to the server is open, and the
> > response comes on a different connection, opened just to send the
> > response. In the case of UDP, this will probably work, but you never
> > know.
> 
> Wouldn't you have the same security concerns with the response, since it
> would allow an entity to redirect a call that was not sent to it?

Yes, actually. Like CANCEL, a redirect response can be generated by a
proxy and also by a user agent. So, doing source address checks there is
probably a good idea. 

-Jonathan R.
-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 06 Jun 2000 00:20:53 -0400

"Fairlie-Cuninghame, Robert" wrote:
> authenticated directly?

Yes.

> Is there a weaker source address check you could
> ones.

THere is no such thing as infallible security anyway.

> Requests will not always come from the original source address and the

In the case of mobility, the address definitely won't be the same.

> sniffing packets and then generating their own requests to re-INVITE the

Yes; but thats why we have it. 

-Jonathan R.