Subject: [sipcore] How does SIP verify whether or not Proxy is legimate?

From: Couret Tabt <[email-masked]>
Date: Fri, 3 Feb 2012 15:14:58 +0900

Dear folks,

In SIP, if a UA received INVITE request, though a Proxy, maybe that is
from another domain
,then how does the UA check whether or not it is the right proxy in that domain?

If UA CANNOT check it, spoofing of proxy is possible.

If you know that, please let me know.

Thanks in advance,
Tabt

---

From: Brett Tate <[email-masked]>
Date: Fri, 3 Feb 2012 04:05:27 -0800

The basic answer is that SIP currently relies upon transitive trust relationships when middle boxes are involved.  Some of the security mechanisms and limitations are discussed within RFC 3261 section 26.  RFC 5630 updates RFC 3261 and provides some details concerning SIPS and TLS.  RFC 4474 may also be insightful.

And since you mentioned inter-domain SIP, you might find the following working groups useful.
http://tools.ietf.org/wg/drinks/
http://tools.ietf.org/wg/speermint/

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Couret Tabt
> Sent: Friday, February 03, 2012 1:15 AM
> To: [email-masked]
> Subject: [sipcore] How does SIP verify whether or not Proxy is
> legimate?
> 
> Dear folks,
>

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Fri, 03 Feb 2012 08:24:55 -0600

On 02/03/2012 12:14 AM, Couret Tabt wrote:
> In SIP, if a UA received INVITE request, though a Proxy, maybe that
> is from another domain ,then how does the UA check whether or not it
> is the right proxy in that domain?
>

In addition to the resources that Brett mentioned, you may also
want to eyeball rfc5922.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{bell-labs.com,acm.org} / [email-masked]
Web:   http://ect.bell-labs.com/who/vkg/

---

From: "Worley, Dale R (Dale)" <[email-masked]>
Date: Fri, 3 Feb 2012 10:59:53 -0500

> From: Couret Tabt [[email-masked]]
> 

As SIP was originally designed, this did not matter, because the UA
was responsible for determining if the INVITE is "legitimate".

(Do you ask, when a call arrives at your house, "Is this call legitimate?"
Do you demand that the PSTN assure that the call is "legitimate"?)

Work has been done since then to to add facilities to SIP to allow
the UA to delegate any call screening to a proxy, and to support
transitive trust between proxies.

Dale