Subject: [Sip] Use case: Location server with SIPS and SIP

From: Dean Willis <[email-masked]>
Date: Tue, 17 Apr 2007 12:55:41 -0500

The "sips" thread is getting too darned long to follow.

I'll try and clearly state my issue, because I think it's gotten  
muddled up.

Let's assume a very simple model with two users, Alice and Bob, and a  
registrar/location server to which Bob registers.

Bob registers a SIPS contact with the LS.

Alice sends an authenticated INVITE to the LS. The R-URI of this  
INVITE is Bob's AOR expressed as a SIP AOR.

The LS returns a 302 with a SIPS contact for Bob.

Alice's UA doesn't understand SIPS, so it sends a SIP INVITE to Bob's  
Contact.

Whether or not Bob's UA rejects the INVITE, information potentially  
sensitive to Bob has been disclosed outside of the authorization model.

Does the preceding violate the current specification? If so, in what  
way?

Consider also that the LS could be replaced by an LDAP database, or  
by the REGISTER-as-lookup mechanism of dSIP, or any number of other  
analogous location-query protocols.

--
Dean

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Spencer Dawkins <[email-masked]>
Date: Tue, 17 Apr 2007 13:10:28 -0500

Hi, Dean,

I am also somewhat confused at this point.

Just for my background, are you assuming that a registrar is always present 
in your use case?

Thanks,

Spencer

> I'll try and clearly state my issue, because I think it's gotten  muddled 
> up.
>
>
> Alice sends an authenticated INVITE to the LS. The R-URI of this  INVITE 
> is Bob's AOR expressed as a SIP AOR.
>
> Does the preceding violate the current specification? If so, in what  way?
>
> Consider also that the LS could be replaced by an LDAP database, or  by 
> the REGISTER-as-lookup mechanism of dSIP, or any number of other

---

From: "Francois Audet" <[email-masked]>
Date: Tue, 17 Apr 2007 13:22:18 -0500

See below. 

> -----Original Message-----
> From: Dean Willis [mailto:[email-masked]] 
> Sent: Tuesday, April 17, 2007 10:56
> To: IETF SIP List
> Subject: [Sip] Use case: Location server with SIPS and SIP
> 
> 
> I'll try and clearly state my issue, because I think it's 
> gotten muddled up.
> 
> 
> Let's assume a very simple model with two users, Alice and 
> Bob, and a registrar/location server to which Bob registers.
> 
> Alice sends an authenticated INVITE to the LS. The R-URI of 
> this INVITE is Bob's AOR expressed as a SIP AOR.
> 
> Alice's UA doesn't understand SIPS, so it sends a SIP INVITE 
> to Bob's Contact.
> 
> Whether or not Bob's UA rejects the INVITE, information 
> potentially sensitive to Bob has been disclosed outside of 
> the authorization model.
> 
> 

There is a violation of RFC 3261 in your model.

If Alice receives a 3XX with a SIPS contact, it shouldn't 
"try SIP". That is a violation of 3261. 

That being said, as we know, not all UACs are perfect. If
it blindly ignores the scheme, it is possible that it will 
send a new INVITE with the wrong scheme. This is functionaly the
same scenario is the dumb user who sees a SIPS scheme, ignores it
and use sip instead.

There is nothing that can be done to stop the "damage" being done
until we reach either Bob's proxy or Bob's UA.

Bob proxy may have a rule to reject anything not SIPS. Or Bob's UAS's
may reject otherwise.

> Consider also that the LS could be replaced by an LDAP 
> database, or by the REGISTER-as-lookup mechanism of dSIP, or 
> any number of other analogous location-query protocols.

I don't think it would change anything to the description above.

---

From: Paul Kyzivat <[email-masked]>
Date: Tue, 17 Apr 2007 14:23:49 -0400

> is Bob's AOR expressed as a SIP AOR.

And it likely is sent over an unsecured path.

> The LS returns a 302 with a SIPS contact for Bob.

Which also travels over the unsecured path. Its potentially been 
compromised regardless of whether Alice downgrades and calls it or not.

Yet this is a *feature* in the case that Alice supports sips. So I think 
it must be a *policy* of the LS whether or not to return the contacts in 
a 3xx.

(In this case an alternative to returning a 302 with Bob's contact is 
for the LS to return a 302 with the sips form of the AOR.)

	Paul

---

From: "Francois Audet" <[email-masked]>
Date: Tue, 17 Apr 2007 13:26:26 -0500

Yes, Paul has a good point (I was talking about policies on the
terminating
side).

If Alice's proxy has a policy of not delivering Contacts with SIPS to
endpoints
it knows don't support SIPS (or doesn't allow it ever), it can send a
404.

That is also described in the current draft. 

> From: Paul Kyzivat [mailto:[email-masked]] 
> Sent: Tuesday, April 17, 2007 11:24
> To: Dean Willis
> Cc: IETF SIP List
> Subject: Re: [Sip] Use case: Location server with SIPS and SIP
> 
> 
> 
> Dean Willis wrote:
> > 
> Bob, and a 
> Which also travels over the unsecured path. Its potentially 
> been compromised regardless of whether Alice downgrades and 
> calls it or not.
> 
> Yet this is a *feature* in the case that Alice supports sips. 
> So I think it must be a *policy* of the LS whether or not to 
> return the contacts in a 3xx.
> 
> (In this case an alternative to returning a 302 with Bob's 
> contact is for the LS to return a 302 with the sips form of the AOR.)
> 
> 	Paul
> 
> database, or by 
> > This list is for NEW development of the core SIP Protocol Use 
> > [email-masked] for questions on current sip Use 
> > [email-masked] for new developments on the application of sip
> > 
> 
> This list is for NEW development of the core SIP Protocol Use 
> [email-masked] for questions on current sip

---

From: Michael Thomas <[email-masked]>
Date: Tue, 17 Apr 2007 12:02:13 -0700

> Alice's UA doesn't understand SIPS, so it sends a SIP INVITE to Bob's 
Wait a minute: is this to imply that there would be nothing wrong with
Alice changing a SIP-PRETZELOGIC URI into a SIP URI either? I'm pretty
sure that's where this goes off the rails; Alice is doing something pretty
bone headed trying to educe a relationship between the two schemes.

       Mike

---

From: "Hisham Khartabil" <[email-masked]>
Date: Wed, 18 Apr 2007 15:40:47 +1000

> The LS returns a 302 with a SIPS contact for Bob.

Why contact? I would mandate the proxy to send the AoR (sip or sips).
Bob's LS is silly for sending the sips contact. Bob should be
dissatisfied with his service provider's security and change
providers.

Hisham

---

From: Dean Willis <[email-masked]>
Date: Wed, 18 Apr 2007 10:26:15 -0500

On Apr 17, 2007, at 1:10 PM, Spencer Dawkins wrote:

> Just for my background, are you assuming that a registrar is always  
> present in your use case?

No, I'm assuming that some mechanism OTHER than an outbound proxy is  
used to allow Alice to discover Bob's Contact.

A registrar is one such mechanism. A P2P overlay is another.

--
Dean