[Users] Hiding Contact or Via fields

[Bogdan-Andrei Iancu]

Hi Marco,


Marco Meinardi wrote:

> Dear Sirs,
>
> being new to SIP and OpenSer, I have read the SIP introduction and 
> Admin's Guide, but there still is an issue that I could not find 
> information about.
>
> I would like to set up a SIP infrastructure made of many UAs and one 
> SIP proxy (OpenSer). I want to bypass any NAT configuration so that I 
> will use UAs with STUN support and mediaproxy module on OpenSer; I 
> will perform billing (accounting) on the SIP proxy, so I will use 
> record route on OpenSer.
>
> I want to make sure that my accounting will *never* be bypassed. This 
> seems quite difficult because the fields 'Contact' and 'Via' contain 
> the real address of the UA (or the translated one in case of NAT 
> configuration) and the SIP header will be fowarded to the other UA. 
> Sniffing the network for SIP packets, any user will be able to know 
> the real address of the UA and make direct call bypassing the SIP proxy.

indeed, sequential request may by-pass proxies on the path (even if RR 
was used). For fixed entities like GWs, you can avoid this by 
configuring the GW to accept requests only form your proxy (which will 
act as a border controller for your domain). Even if a client will try 
to send directly to GW, it will be blocked.

>
> How could I secure this situation, avoiding to forward Contact and Via 
> fields containing the real UA address? I was thinking if it is 
> possible to replace UA address with SIP proxy address, or would I 
> break any protocol rule?

there is no such support for the moment. VIA and Contact are key routing 
elements and playing with them might get things broken.  also you have 
to consider that contact is a per-dialog information and if you change 
it, you need to remember the original value across the entire dialog.

regards,
bogdan