Subject: Re: [sipcore] SIP Push Change Proposal: Proxy forwarding SIP request towards UA once it receives REGISTER request, without waiting for REGISTER response - Pull request

From: Christer Holmberg <[email-masked]>
Date: Sat, 11 Aug 2018 17:59:51 +0000

Hi,

I have updated the pull request with a commit allowing the SIP request to be forwarded without waiting for the REGISTER response, if the proxy is able to authenticate the UA.

https://github.com/cdh4u/draft-sip-push/pull/18/commits/398311a6e30ca7b27c4f4a48971a170c3225c72b

Regards,

Christer

From: sipcore [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: 11 August 2018 14:42
To: Roman Shpount <[email-masked]>
Cc: [email-masked]
Subject: Re: [sipcore] SIP Push Change Proposal: Proxy forwarding SIP request towards UA once it receives REGISTER request, without waiting for REGISTER response

Hi,

The PRID is unique.

Anyway, I didn’t mean to say that the PRID solves the security issue, I just wanted to point out that a malicious user would need it in order to hi jack.

Regards,

Christer

From: Roman Shpount [mailto:[email-masked]]
Sent: 11 August 2018 14:37
To: Christer Holmberg <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sipcore] SIP Push Change Proposal: Proxy forwarding SIP request towards UA once it receives REGISTER request, without waiting for REGISTER response

Chris,

I am not sure if PRID is long enough to be considered cryptographically secure. In any case, including a cryptographically secure token in contact should be sufficient to solve this issue.

Regards,

_____________
Roman Shpount

On Sat, Aug 11, 2018 at 2:32 PM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

One more note on this.

In addition to the contact address, a malicious user would also need to have access to the PRID.

Regards,

Christer

From: Roman Shpount [mailto:[email-masked]<mailto:[email-masked]>]
Sent: 09 August 2018 18:51

To: Christer Holmberg <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sipcore] SIP Push Change Proposal: Proxy forwarding SIP request towards UA once it receives REGISTER request, without waiting for REGISTER response

Hi Christer,

This is fine. We can specify that REGISTER message MUST be authenticated before any stored messages are sent over this connection. This authentication can either be based on success response to REGISTER message, or some other mechanism, such as security token.

Regards,

_____________
Roman Shpount

On Thu, Aug 9, 2018 at 6:43 PM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi Roman,

I am not suggesting that we define a mechanism, or define what mechanism to use (different environments and architectures may use different ones) simply that we would allow forwarding the request if such mechanism is in place.

Regards,

Christer

From: Roman Shpount [mailto:[email-masked]<mailto:[email-masked]>]
Sent: 09 August 2018 18:39
To: Christer Holmberg <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sipcore] SIP Push Change Proposal: Proxy forwarding SIP request towards UA once it receives REGISTER request, without waiting for REGISTER response

Christer,

In our implementation of something similar, we sent update SIP nonce in the push message. Proxy server had access to the credentials digest, so when REGISTER message was received, it was immediately authenticated and stored messages were sent to the client.

I am sure there can be other ways to implement the same thing. One possible solution is to require some sort of securely generated token added to the contact that can be used to validate that REGISTER message came from the same UA. Another solution is to use TLS connection ticket to store signed UA contact and use it to make sure this is the same UA (in which case you might not even need to receive and process the REGISTER message at all). In any case, if we want to change sending stored message before success response to the REGISTER message, we will need to add some sort of authentication protection to prevent connection hijack.

Regards,

_____________
Roman Shpount

On Thu, Aug 9, 2018 at 6:14 PM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi Roman,

> SIP Push is supposed to be used in combination with server side NAT traversal. REGISTER message is used to re-establish connection
> from the client to the proxy so that message can be sent to the client. Proxy stores connection information from which the REGISTER
> message was received (remote transport, address and port) and forwards all messages for the associated registration over this connection.
> So, if registration for the same contact is sent from a different origination address/port, all messages for this contact will be sent to the new
> destination. If REGISTER message is not authenticated before connection information is updated, messages associated with the registration
> can be redirected to the attacker which can be used to intercept calls.

You are right.

But, what if the signalling between the UA and the proxy is protected (e.g, using an IPSec tunnel), or the proxy has other means to ensure that the REGISTER comes from the same UA as the previous REGISTER (with the same contact)?

Regards,

Christer

Regards,

_____________
Roman Shpount

On Thu, Aug 9, 2018 at 5:23 PM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi Roman,

How would it hijack the call?  If the malicious party inserts its own contact the proxy will not forward the request, as the R-URI does not match the contact.

Regards,

Christer
Sent from my iPhone

On 9 Aug 2018, at 16.56, Roman Shpount <[email-masked]<mailto:[email-masked]>> wrote:
Christer,

If proxy does not wait for REGISTER message response, then REGISTER message is not yet authenticated. In this case, malicious party can use such REGISTER message to hijack the flow and take over the call.

Regards,

_____________
Roman Shpount

On Thu, Aug 9, 2018 at 4:44 PM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

Currently the SIP Push specification says that, when the "push proxy" receives a REGISTER request from a UA (triggered by the push notification) I will wait for the REGISTER response before it forwards a SIP request towards the UA, to make sure that the contact in the REGISTER request has been accepted by the registrar.

Ben commented that proxies don’t normally do that (they will forward SIP requests using the routing information within the request) and asked whether there is a technical reason why the push proxy waits for the REGISTER response.

From a push perspective, there is no technical reason to wait for the REGISTER response. The push proxy can forward the SIP request towards the UA as soon as it receives the REGISTER request (assuming the contact in the REGISTER request matches the R-URI of the SIP request).

My suggestion is that we change the behaviour, so that the proxy forwards the SIP request as soon as it receives the REGISTER request. It simplifies things, and it also ensures that the SIP request reaches the UA faster (as the push proxy does not need to wait for the REGISTER response).

Does anyone object to such change?

Regards,

Christer

_______________________________________________
sipcore mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sipcore