Under Review Multiple values in single-value header Identity

[jason7sc]

Recently started receiving this error from 3CX when incoming INVITE requests have multiple values in the "Identity" header:

SIP/2.0 400 Bad Request(Multiple values in single-value header Identity)

Notably, this appears to only happen with T-Mobile calls. Here is an example of the "Identity" header in the INVITE request (certain values redacted):
Identity:[REDACTED];info=<https://t-mobile-sticr.fosrvt.com/[REDACTED].pem>;alg=ES256;ppt="shaken"

According to RFC8224, multiple values are allowed in the "Identity" header. Example provided on page 13 of RFC8224:
Identity: ..rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYsojNCpTzO3QfPOlckGaS6hEck7w;info=<https://cert.example.org/passport.cer>

Is this a bug with 3CX's handling of the "Identity" header? Or is this an issue with the carrier?

Edit: Build 18.0.2.307 for reference.

Thanks!

 

[YiannisH_3CX]

Hi @jason7sc

Let us look into this and we will get back to you as I have not seen anything similar before.

 

[jason7sc]

Hi @YiannisH_3CX

Thanks for looking into this, I appreciate it.

To provide some additional context after doing some more digging... This issue surfaced on 12/09/21 (6 days ago) and the difference between the successful requests and failed requests is that the "Identity" header is duplicated in the failure scenario.

According to the RFC, the "Identity" header is allowed to appear more than once, however, I'm wondering if the duplication of the header is causing the issue with 3CX.

I'm using Telnyx as the SIP provider and have reached out to them for additional information.

I'm curious if anyone else has experienced this issue? If not, is anyone able to view their INVITE headers and determine if duplicate "Identity" headers exist and 3CX successfully processed the request?

 

[YiannisH_3CX]

I am wondering if you enabled something in the Telnyx portal that might have caused this as I just tested a few calls from Telnyx and I do not see a Identity header.
Did you enable STIR/SHAKEN?

 

[jason7sc]

I have not changed or configured anything in Telnyx recently. I believe STIR/SHAKEN is enabled across the board for Telnyx as its now a requirement for telecommunications (US).

From Telnyx’s website:

For inbound calls that have been signed by the originating provider, Telnyx is passing the identity header along the PSTN to the recipient.

So it sounds like only signed calls will receive the “Identity” header.


The only failed requests I’ve seen are originating from the T-Mobile network. I’m still receiving hundreds of successful calls from other networks/carriers/providers.

Before calls were failing, I had hundreds of successful calls originating from T-Mobile with the “Identity” header (only 1 instance of the header). The only change I can see is that now the header is duplicated.

It sounds like this may ultimately be caused by an upstream issue (Telnyx/T-Mobile), however, I figured it may be something 3CX could account for and prevent a failure/disconnection, especially since the RFC allows multiple instances of the header.

 

[jason7sc]

I haven't had any failed T-Mobile calls today. All the INVITE requests I've inspected for T-Mobile have a single "Identity" header and the calls succeed. I haven't changed anything on 3CX or Telnyx, so an upstream change must have occurred since yesterday.

I'll continue to investigate with Telnyx and reply if a resolution is found or if the issue shows up again. Still, I think it could be useful for 3CX to handle the duplicate headers so calls don't fail (maybe use the first/last instance of the header).

 

[YiannisH_3CX]

Thank you for the update. We are still looking into this so let us know if you have any more issues.