Subject: [Sip] Open Issue #231: Stateless UAS

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 6 Dec 2001 16:01:13 -0500

Issue:

A stateless UAS is a UAS that doesn't maintain transaction state. It
effectively regenerates the response for each request retransmission, and
resends it. A stateless UAS is really needed to protect against SYN "style"
attacks using SIP. Without it, an authenticated attacker could send requests
to a SIP proxy, causing the SIP proxy to establish transaction state. You
should never create state for unauthenticated requests. The spec talks about
this behavior, but doesn't give details.

However, details would be helpful. There are some important things you need
to do to properly build a stateless UAS:

  * eat ACK requests
  * ignore CANCEL
  * statelessly construct To tags

None of these are documented at the moment. Should they be?

Discussion points:

Do we need yet another element? 

Unfortunately, we do, since it is already mentioned, but without sufficient
detail for correct and interoperable implmenetation. Therefore, we need to
provide sufficient detail for this to be done properly by an implementation.

Proposal:

Add text describing this behavior

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 27 Dec 2001 02:34:45 -0500

There was no comments on this proposal either way. I interpret silence 
as consensus. Text will be added describing this behavior.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com