Fr-Soltanzadeh created an issue (kamailio/kamailio#4148)
<!-- Kamailio Project uses GitHub Issues only for bugs in the code or feature requests. Please use this template only for feature requests.
If you have questions about using Kamailio or related to its configuration file, ask on sr-users mailing list:
* https://lists.kamailio.org/mailman3/postorius/lists/sr-users.lists.kamailio....
If you have questions about developing extensions to Kamailio or its existing C code, ask on sr-dev mailing list:
* https://lists.kamailio.org/mailman3/postorius/lists/sr-dev.lists.kamailio.or...
Please try to fill this template as much as possible for any issue. It helps the developers to troubleshoot the issue.
If you submit a feature request (or enhancement) add the description of what you would like to be added.
If there is no content to be filled in a section, the entire section can be removed.
Note that a feature request may be closed automatically after about 2 months if there is no interest from developers or community users to implement it, being considered expired. In such case can be reopened by writing a comment that includes the token `/notexpired`. About two weeks before considered expired, the item is marked with the label `stale`, trying to notify the submitter and everyone else that might be interested in it. To remove the label `stale`, write a comment that includes the token `/notstale`. Also, any comment postpone the `expire` timeline, being considered that there is interest in the proposed feature request.
You can delete the comments from the template sections when filling.
You can delete next line and everything above before submitting (it is a comment). -->
### Description
<!-- Explain what you did, what you expected to happen, and what actually happened. --> Kamailio's topoh and topos modules currently hide/strip certain SIP headers but do not mask IP addresses in the From, To, and Request-URI headers. This feature request proposes extending these modules to hide or replace IP addresses for improved privacy and security.
### Expected behavior When enabled, Kamailio should replace IPs in:
From header To header Request-URI
This should work without breaking SIP message integrity or routing. #### Actual observed behavior Currently, IP addresses in these headers remain visible, exposing topology information(172.16.100.88 in this example). ``` Request-Line: INVITE sip:9121001111@172.16.100.88 SIP/2.0 Message Header Record-Route: sip:10.14.17.83:5060;r2=on;lr;did=24f.c2e1 Record-Route: sip:127.0.0.8;line=sr-erOb.UMbIUMBIUMZIUpA.Z1TwVXL.rlT.rHP8mBTyxnLnAjOaG** Record-Route: sip:127.0.0.8;line=sr-erOb.UMbIUMBIUMZIUpB.UNbyUuEeU1X7r5E741E8xODwd1B8Y5TyUN* Record-Route: sip:127.0.0.8;line=sr-erOb.UMbIUMBIUMZIUpB.Z1TwVXL.rlT.rHP8mBTyxnLaUn3 Record-Route: sip:127.0.0.8;line=sr-erOb.UMbIUMBIUMZIUpT.UNbyUuEeU1X7r5E741E8xODwd1B8YfUaAul Record-Route: sip:127.0.0.8;line=sr-erOb.UMbIUMBIUMZIUpT.UNbyUMEo4jt7Cyb7ZjBw-HceA9TaU3s7U9ceU9DhVGXaUHRIRaAamM* Record-Route: sip:127.0.0.8;line=sr-erOb.UMbIUMBIUMZIUp5.UNbyUMEo4jt7Cyb7ZjBw-HceA9TaU3s7U9ceU9DhVGXaUHRIUyU8UM* Record-Route: sip:127.0.0.8;line=sr-erOb.UMZaY5lyY5lamuL.mpEeU1X7r5E741E8xODwd1B8Y5Anrnl Via: SIP/2.0/UDP 10.14.17.83:5060;branch=z9hG4bKa514.f0b2dd496995e05c455b7c66f29e298a.0 Via: SIP/2.0/UDP 127.0.0.8;branch=z9hG4bKsr-NBOGIA1LaFXkHKupaduLadGLadeL.mGvyduram9TexXTomB3amnb.3H1wVHPoU9YeRKLnrpXzUO2HAHYSrM3adGLamyDaADZaUKt8m8UyAKUyUN5amGB8UKOarKDaAnBamnLau** Via: SIP/2.0/UDP 127.0.0.8;branch=z9hG4bKsr-NBOGIA1LaFXkHKupaduLadGLadeL.m1vyduram9TexXTomB3amnb.rjTnVfUhm3v.Vt4yxjIndNlyFfY8mpfnUnT8daf8VjYaU6D.xkO8m6R8der8dyUaAnZaS5b.rDXab** Via: SIP/2.0/UDP 127.0.0.8;branch=z9hG4bKsr-NBOGIA1LaFXNdKapaduLadGLadeL.mpvydurad9TexXTomBram1Z.m9YeRKLnrpXzUO2HAHYSrM3adGL8x8OyUeb.mD58mMZ8mjtnVNZax8R8dyU8dpByRNryVNLau** Via: SIP/2.0/UDP 127.0.0.8;branch=z9hG4bKsr-NBOGIA1LaFXkHKupadDTIUMr.F5TaF55ym2raUMB.d9T8VyOh-8O8mBl.d1Ladn5IU1bIUpB.Zjb7ZjBwdnTadGf.rjTnVfUhm3v.Vt4yxjINxPUad6OydaTnrNryrNBadyD.mabyrHtameZaVNbnAjYab** Max-Forwards: 66 From: sip:9122001003@172.16.100.88;tag=973f3044c163413fb5e7075113f96a7b To: sip:9121001111@172.16.100.88 Contact: sip:127.0.0.8;line=sr-erOb.UDlaU1bamMbamyuadDTIUMr.F5TaF55ym2raUMB.d9snp** Call-ID: !!:yrnlaAtYadHOnRyRymjOydpT.d1faVKUymkRamalnAu* CSeq: 9661 INVITE Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS Supported: replaces, 100rel, timer, norefersub Session-Expires: 1800 Min-SE: 90 User-Agent: MicroSIP/3.21.5 Content-Type: application/sdp Content-Length: 338 Message Body
``` #### Debugging Data
``` (paste your debugging data here) ```
#### Log Messages
<!-- Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site). -->
``` (paste your log messages here) ```
#### SIP Traffic
<!-- If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site). -->
``` (paste your sip traffic here) ```
### Possible Solutions
<!-- If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a improvement. --> * Introduce a new configuration parameter in topoh and topos that enables masking or encoding of IP addresses in From, To, and Request-URI. * Ensure proper handling of subsequent SIP messages like ACK, BYE, and re-INVITE to maintain end-to-end communication.
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
``` kamailio 6.0.0 ```
* **Operating System**:
<!-- Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...; Kernel details (output of `uname -a`) -->
``` uname ubuntu:22.04 ```