Subject: Re: [Sip] Comments on rosenberg-sip-identity-coexistence

From: Cullen Jennings <[email-masked]>
Date: Sun, 2 Jul 2006 10:02:27 -0700

On Jun 30, 2006, at 12:57 PM, Hadriel Kaplan wrote:

>
>> From: Cullen Jennings [mailto:[email-masked]]
>>
>> I think one of the major reason for creating PAI was to provide
>> malicious call trace for anonymous calls. I don't think it was for
>> dealing with spoofing the From header. If that was the goal, we could
>> have solved it just by having device that ends up inserting the PAI
>> just reject any request that has spoofed From headers.
>
> I agree with you, but it is used for detecting suspicious From  
> headers even
> for non-anonymous calls.  Obviously if the proxy inserting the PAI  
> _knows_ a
>> From is spoofed, it could/should reject it.  But if the proxy does  
>> _not_
> know whether the From is spoofed or not, it just doesn't insert the  
> PAI.
> For example, ingress proxy receives a request from another domain -  
> if it
> trusts the domain it passes the PAI (or inserts one).  If it does  
> not trust
> the domain, it removes PAI, but doesn't want to reject the request  
> (else it
> wouldn't accept requests from such untrusted domains to begin with).

I see your point, I can see how a proxy that is deciding not to  
remove a PAI might not know a From was spoofed. I don't see how a  
proxy that was going to *insert* a PAI would know what to put in the  
PAI and not be able to know if a PAI was spoofed. 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Hadriel Kaplan" <[email-masked]>
Date: Wed, 5 Jul 2006 12:33:11 -0400

> -----Original Message-----
> Sent: Sunday, July 02, 2006 1:02 PM
> 

I'm not sure I follow - maybe you meant the word "From" instead of "PAI" in
the "if a PAI was spoofed" bit?  
I meant in the context of implicitly trusted connections.  For example: an
operator receiving a request from a directly-attached business customer
proxy, where the operator's ingress proxy may insert a PAI of
[email-masked] based on the From, even though company.com's egress proxy
did not insert the PAI itself.  Obviously for an anonymous request the
ingress proxy would not know enough to put that URI in, and it's certainly
the case that it can't be 100% sure that the request really came from bob to
begin with (e.g., the company proxy could be hijacked, etc.).  But that
could be the case with Identity in use as well.

-hadriel

---

From: Cullen Jennings <[email-masked]>
Date: Mon, 31 Jul 2006 08:08:39 -0700

> could be the case with Identity in use as well.

Oops - yes I meant From.