Subject: [SIP] A warning to implementors

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 14 Sep 2000 01:21:41 -0400

Folks,

In our tests in our labs of various SIP devices, we have been increasing
discovering that people have introduced arbitrary length restrictions on
various SIP fields. For example, we have discovered that one vendor limits
the length of the branch ID to 16 bytes. If it gets more than that, it
rejects the request. We ran into this when trying to test out the recent
proposal for adding uniqueness to the branch ID. Very bad.

I cannot emphasize enough the scope of this implementation error. It is a
recipe for interoperability nightmares. Over time, people find additional
uses and data types they would like to stick in various fields. Branch ID is
one that is particularly nice, for example. As these field usages get
larger, and press against these artificial barriers, you severely limit the
growth of the protocol, and its overall interoperability. These problems are
extremely hard to find and always come up years later.

The SIP spec in no way whatsoever says that tokens and other assorted
constructions are limited in length. If your implementation barfs on things
like this, it is NON-COMPLIANT to rfc2543. Please, folks, fix these things.

Thanks,
Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Fri, 15 Sep 2000 18:11:59 -0500

Jonathan,

Jonathan Rosenberg wrote:               (Thu, 14 Sep 2000 01:21:41)
[snip]
> like this, it is NON-COMPLIANT to rfc2543. Please, folks, fix these things.
                   ^^^^^^^^^^^^^
                   Please define...

-- 
Brian F. G. Bidulock
[email-masked]

---

From: "Eric Burger" <[email-masked]>
Date: Fri, 15 Sep 2000 13:06:24 -0400

I agree that an arbitrary limit of 16 characters is simply wrong. However,
saying that the field length should be unbounded is not a good idea, either.

Arbitrary-length fields are not really consistent with Section 3 of RFC
2543.  This section suggests a maximum SIP message length of 1500 bytes (the
LAN MTU). Such a suggestion is very important for embedded applications and
UDP applications.  I would go so far as to suggest that we set a maximum
length to a SIP header field of 1000 bytes.  This enables fixed-memory,
embedded applications to run without barfing. 1000 bytes is effectively
infinite.  If you don't like 1000 bytes, how about 4095?  The point is to
have some bound, even if it looks unreasonably big.

The only place I can find where we could realistically run in to problems
with this are the Response-Key: or Authorization: fields.

----- Original Message -----
From: "Jonathan Rosenberg" <[email-masked]>
To: "'sip (E-mail)'" <[email-masked]>;
<[email-masked]>
Sent: Thursday, September 14, 2000 1:21 AM
Subject: [SIP] A warning to implementors

[snip]
[snip]