Subject: [Sip] The "localhost attack"

From: Jeroen Van Bemmel <[email-masked]>
Date: Thu, 27 Jul 2006 09:31:56 +0200

Would be interested to know how proxies treat the following request:

CANCEL sip:[email-masked]
Via: {valid data};branch={cookie}random
Route: <sip:127.0.0.1;lr>
{rest valid data}

Same for "localhost", "[::1]" and other IPv6 local addresses, and other requests than CANCEL

Regards,

Jeroen

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jiri Kuthan <[email-masked]>
Date: Thu, 27 Jul 2006 10:33:45 +0200

That's not a protocol aspect. That's an aspect of server's policy. That's because use
of localhost in Route may be perfectly valid in some cases. My suggestion for users 
of SIP servers is then to ask their favorite vendors about what types of policies they 
can set to deal with this case, if it is not desired.

-jiri

--
Jiri Kuthan            http://iptel.org/~jiri/