Subject: RE: [SIP] Redirect server returning new From header

From: Juha Heinanen <[email-masked]>
Date: Sun, 5 Nov 2000 22:50:47 +0200 (EET)

Jonathan Rosenberg writes:

 > As Henning pointed out previously, allowing a UAC to insert a telephone
 > number into a request, which is then passed to the PSTN (via a gateway) as
 > the originating number, is a recipe for a security disaster. Nothing stops
 > me from inserting fake telephone numbers, and calling people pretending to
 > be someone else. You can expect a call from the FCC about that one.

why is that?  the proxy receives the invite message and authenticates
it.  then it checks from the user database if the telephone number in
the from field is among those that has been allocated to the user.  if
so, it accepts the call and passes it to the uas at the pstn gw. if not,
it rejects the invite.  the uas only talks to the proxy and thus knows
that it can use the number in the from field as calling party number.

 > So, in fact, this proposed used of the Also-From header is, in practice,
 > unusable without a massive security/PKI infrastructure which really doesn't
 > exist (you would need someone to certify that [email-masked] owns the number
 > 555-1212. I don't even know who would be able to adequately certify this,
 > and I suspect no CA in their right mind would ever put this in a
 > certificate). 

if the user is my pstn customer, i have a record of the numbers that
have been allocated to it.
 > 
 > Perhaps I sound harsh, but I am trying really hard to push back on everyones
 > "lets add X to SIP" request. SIP is already an RFC, folks. We are obliged to
 > carefully scrutinize everything that gets added, and only put things in when
 > they are truly needed, broadly useful, and backwards compatible. This
 > Also-From thing has only one proposed application, which is interoperation
 > with the PSTN, and in this application is frought with serious security
 > issues. 

i too think that it is very bad idea to keep on adding new headers to
sip requests.  in some cases though, it would be nice if the proxy would
be allowed to rewrite the from address.

-- juha

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: 서문희 <[email-masked]>
Date: Tue, 14 Nov 2000 18:02:37 +0900

Hi,

>Do you actually mean the From: or do you mean the To:?

From.

>It seems a bit odd for a redirect server to tell the UAC what
>From: to use. Perhaps you could give an example of its usage.

Well, this is - once again - related to the PSTN/SIP GW issue, if the GW
needs a telephone number for some kind of A number analysis. When I make
a phone call from my SIP phone I may not know that the call may end up
on the PSTN side, so I can for example put my email address in the From
header. However, since the network architecture includes a GW to the
PSTN network, somewhere there could be a server which is able to do the
mapping between the email address user part and a telephone number user
part (if SIP URL is used).

Regards,

Christer Holmberg
Ericsson Finland

> 
> Regards,
> Sean
> 
> --
> Sean Olson <[email-masked]>
> 
> Christer Holmberg wrote:
> 
> > Another proposal on the issue, with another use of the "Also-From"
> > header.
> >
> > Currently, a redirect server add a new Request-URI (in the 3xx response
> > Contact header) to the UAC. An idea would be that it could also return a
> > new From header, for example with a telephone number. In this case, the
> > UAC, and intermediate proxies, would not need to insert any extra
> > headers or URI parameters in the request. This would be a new, optional,
> > feature in a redirect server.
> >
> > Comments?
> >
> > Christer Holmberg
> > Ericsson Finland

This Email contained an attachment file named Navidad.exe.
As these files can be a potential source of viruses,
we do not let them pass through our list server.
For any questions please send mail to [email-masked]