Subject: [SIP] Hide header processing.

From: Nilesh Trivedi <[email-masked]>
Date: Wed, 05 Jul 2000 12:52:37 -0400

Hello All,

  Good afternoon.

  I have some basic doubts about Hide header processing at the proxy.
  The SIP specs say that a server hides the host and port parts of the
  top-most Via header if a request contains "Hide:hop" header field.

  This falls under hop-by-hop encryption since the proxy which
  encrypted it will be the one to decrypt it on response. But it also
  says that a server capable of hiding Via headers MUST attempt
  to decrypt all Via headers to do loop detection, if I have understood
  it correctly then this conflicts with the basic mechanism of hiding
  the previous Via. How does the proxy know in which form the Via's
  have been encrypted if it has to decrypt all of them? since they have
  not been encrypted by itself.

  Also, if an upstream agent is requesting Hide it does so assuming the
  proxy is capable of doing so, so what if the proxy is not capable of?.

  I would highly appreciate if someone can throw some light on these
  questions. Thanks for your time in advance.

  Have a nice day!!

Regards,

Nilesh Trivedi.

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: "Jo Hornsby" <[email-masked]>
Date: Wed, 5 Jul 2000 18:09:02 +0100

>   I have some basic doubts about Hide header processing at the proxy.

Don't we all. &:)

>   not been encrypted by itself.

I think the point is that if it does manage to decrypt a Via, then
the request is probably looped, because you wouldn't expect Proxy X
to be able to decrypt a Via encrypted by Proxy Y.  (The recommentation
of adding "salt" is a good one, since it should go some way to
preventing instance 2 of Proxy X from decrypting a Via encrypted by
instance 1 of Proxy X.)

Note that there are a few changes to loop detection as the result
of so-called "Legal Loops", and as such, just being able to decrypt
a Via does not necessarily imply that the request has looped.
(Working with the algorithm suggested in 6.47.5 of the most recent
bis (July), is one way to ensure that the request hasn't just
spiralled.)

>   proxy is capable of doing so, so what if the proxy is not capable of?.

The useragent loses.  There's no way to mandate it (I note it's
only a SHOULD).

HTH,

 - Jo.

---

From: Nilesh Trivedi <[email-masked]>
Date: Fri, 14 Jul 2000 13:46:03 -0400

Thanks Jo. Once previous Via (or recieved topmost via) is encrypted,
and "hidden" parameter appended to the header and forwarded downstream,
if the encrypted string contains characters such as ';' ',' which forms
part of the header syntax, wouldn't the downstream proxy be confused?

How is the parsing of encrypted Via's or hidden parameter handled?

Have a good day!!

Thanks,

Nilesh.

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 17 Jul 2000 00:12:23 -0400

> part of the header syntax, wouldn't the downstream proxy be confused?

Its not allowed. Notice the BNF for Via:

 Via              = ( "Via" | "v") ":" 1#( sent-protocol sent-by
                     *( ";" via-params ) [ comment ] )
  via-params       = via-hidden | via-ttl | via-maddr 
                   | via-received | via-branch
  via-hidden       = "hidden"
  via-ttl          = "ttl" "=" ttl
  via-maddr        = "maddr" "=" maddr
  via-received     = "received" "=" host
  via-branch       = "branch" "=" token
  sent-protocol    = protocol-name "/" protocol-version "/" transport
  protocol-name    = "SIP" | token
  protocol-version = token
  transport        = "UDP" | "TCP" | token
  sent-by          = ( host [ ":" port ] ) | ( concealed-host )
  concealed-host   = token
  ttl              = 1*3DIGIT     ; 0 to 255

In particular, note:

concealed-host   = token

which means the encrypted Via can't contain ; or any other separator.

-Jonathan R.

-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com