Subject: [Sipping] Question Regarding Contact Header Topology Hiding

From: "Gilad Shaham" <[email-masked]>
Date: Thu, 14 Jun 2007 16:19:49 +0100

draft-ietf-sipping-sbc-funcs-03 mentions the Contact header as one of
the possible options for topology hiding.

My question is -  what would count as a contact header that requires
topology hiding?

A contact that contains an IP address is probably such a contact.

What if the contact is an AOR obtained from the registration such as:

sip:[email-masked];gr=h4f6d2yggk4

It sounds to me as the later example does not expose the underlying
topology. So is this true, topology hiding should only hide contact
headers with IP addresses? Any other cases?

Thanks,

Gilad

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Vinay Pande \(vipande\)" <[email-masked]>
Date: Thu, 14 Jun 2007 10:05:55 -0700

Hi Gilad,
 
Just a thought -- Assume this traffic hits an SBC which is transiting
VoIP traffic from provider 1 to provider 2 and it does not hide the
Contact details in INVITE etc.
Wouldnt it amount to disclosing whose traffic you are transiting? That
could open up door for "guessing" the topology behind this SBC and
possibly some targetted DoS attacks to that inside FQDN whose traffic
this SBC was transiting. If the SBC overrides Contact headers with its
own FQDN/IP, that possibility is reduced.
 
My 2 cents.
 
Thanks,
Vinay

________________________________

From: Gilad Shaham [mailto:[email-masked]] 
Sent: Thursday, June 14, 2007 8:20 AM
To: [email-masked]
Subject: [Sipping] Question Regarding Contact Header Topology Hiding

Thanks,

Gilad