Re: [Sip] Re: draft-ietf-sip-gruu-09

Jonathan Rosenberg wrote:
> Cullen Jennings wrote:

>> Section 6, page 12, 4th para or so ... you are talking about mid- 
>> dialog requests. Might be nice to mention how a transaction stateful  
>> proxy knows if something is a middialog request or not.
> 
> These days I recommend topmost route URI over tags, since its easy to 
> fool a proxy into thinking something is a mid-dialog request by faking a 
> tag. Its harder to fake a route URI.
> 
> Text now reads:
> 
> <t> Mid-dialog requests will also be sent to GRUUs, as they are
> included as the remote-target in dialog-forming and target refresh
> requests and responses. However, in those cases, a proxy SHOULD only
> apply services that are meaningful for mid-dialog requests, generally
> speaking. This excludes screening functions, as well as forwarding
> ones. A proxy can determine that a request is a mid-dialog request
> based on the Route header field in the request it receives. If the
> topmost URI matches one that the proxy placed into the Record-Route
> header field of a dialog-forming request, then the request is a
> mid-dialog request. </t>

Is it really harder to fake?

Suppose Alice is permitted to call Bob, but not to subscribe to the reg 
event package. So Alice first calls Bob, and notes the Record-Route that 
results. Then in a separate dialog, Alice sends a SUBSCRIBE to the reg 
event package, including a Route header with a URI of Bob's home proxy 
extracted from the old R-R.

Seems like this strategy also requires some protection against a "replay 
attack" like this.

But that isn't really an issue for this draft.

	Paul

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sipping@ietf.org for new developments on the application of sip