Subject: RE: [Sip] Authentication for re-INVITE.

From: KANUMURI Sreeram <[email-masked]>
Date: Tue, 9 Jul 2002 10:19:37 -0400

> 
> I don't think proxy needs to authenticate re-invite, as re-invite is used
> for changing session parameters of an existing call

>>For this very reason you should reauthenticate...so that someone doesnt
>>spoof a forged INVITE with bad parameters within it back to the client.

TRUE but can you tell me how can "someone  spoof a forged INVITE" ??
like the call is established between the end users and it is olny session
parameters change.
As there is Already the authentication done.
olny the UA in the call can change teh parameters with a new invite.....??

so can u make me  clearer??

Sreeram

> 
> Ranjit
> ----- Original Message -----
> From: ShavinderPal Singh <[email-masked]>
> To: <[email-masked]>; Jonathan Rosemberg <[email-masked]>
> Sent: Monday, July 08, 2002 5:21 PM
> Subject: [Sip] Authentication for re-INVITE.
> 
> >
> > Is a SIP proxy supposed to Authenticate a re-INVITE also? If no, then if
> > some proxy in Authenticating and it asks for Auth Info from the UA, what
> > is the UA supposed to do? Is it mandatory that it should send the Auth
> > Info?
> >
> > Please suggest!
> >
> > Thanks & Regards
> > s
> >
> > Ph.: 091-124-6383474 (e 250)
> > __________________________________________
> > I had a good grip on life, but then the handle broke.
> >
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol
> > Use [email-masked] for questions on current sip
> > Use [email-masked] for new developments on the application of sip
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Chris Martin <[email-masked]>
Date: Tue, 09 Jul 2002 18:36:02 -0500

Spoofing is very simple without some form of authentication, merely
crafting a SIP packet with a an ethernet source IP address and
corresponding SIP information within the SIP/SDP body one could cause
many things to go wrong with an established call, ranging from denial of
service to redirection.