PM10744: SIP logging does not support hiding specific header fields

APAR status

• Closed as program error.

Error description

• When enabling SIP trace; sensitive information may be printed
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  SIP (Session Initiation Protocol) users of  *
  *                  IBM WebSphere Application Server using      *
  *                  Basic authentication                        *
  ****************************************************************
  * PROBLEM DESCRIPTION: The server writes all fields of a SIP   *
  *                      message to the log when SIP tracing     *
  *                      is enabled using Basic authentication   *
  *                      (not digest)                            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The problem occurs when the server receives a SIP message from
  the network, or sends a SIP message out to the network, and
  full SIP trace logging is enabled. The entire SIP message is
  written in the trace file, along with all header fields and
  the message body, including information that may be
  considered sensitive.
  
  For example, if you set the trace level in the application
  server to com.ibm.ws.sip.*=all, and the server receives a SIP
  "instant message", the message body is written to the trace
  log file:
  
  MESSAGE sips:user2@domain.com SIP/2.0
  Via: SIP/2.0/TLS user1pc.domain.com;branch=z9hG4bK776sgdkse
  Max-Forwards: 70
  From: sips:user1@domain.com;tag=49583
  To: sips:user2@domain.com
  Call-ID: asd88asd77a@1.2.3.4
  CSeq: 1 MESSAGE
  Content-Type: text/plain
  Content-Length: 33
  
  Hey buddy, can you keep a secret?
  
  
  This SIP message was sent securely over the network to the
  server, but having full SIP tracing enabled, it is written in
  cleartext form to the server's trace log.
  

Problem conclusion

• The problem is fixed by introducing 3 new custom properties in
  the SIP container that control the message fields that are
  hidden in the trace log:
  
  o javax.sip.hide.message.body - A flag (true/false)
  specifying whether or not to hide the SIP message content.
  o javax.sip.hide.message.headers - A comma-separated list of
  header field names that will be hidden.
  o javax.sip.hide.request.uri - A flag specifying whether or
  not to hide the request URI.
  
  For example, consider these settings:
  javax.sip.hide.message.body=true
  javax.sip.hide.message.headers=From,To
  javax.sip.hide.request.uri=true
  
  With this configuration, the same message from the example above
  would be printed to the trace log exactly like this:
  
  MESSAGE <hidden request URI> SIP/2.0
  Via: SIP/2.0/TLS user1pc.domain.com;branch=z9hG4bK776sgdkse
  Max-Forwards: 70
  From: <hidden value>
  To: <hidden value>
  Call-ID: asd88asd77a@1.2.3.4
  CSeq: 1 MESSAGE
  Content-Type: text/plain
  Content-Length: 33
  
  <hidden body>
  
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 7.0.0.11.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PM08892

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  CEA FEATUREPACK

• Fixed component ID

  5724J0855

Applicable component levels

• R700 PSY

     UP