Subject: [Sip] RFC3261 SIP DoS protection additions

From: "Jeroen van Bemmel" <[email-masked]>
Date: Sat, 17 Dec 2005 14:35:44 +0100

2 comments on RFC3261 (in particular: section 26.3.2.4 on DoS protection):

1. IMO it should be recommended (i.e. SHOULD) to send 487 responses for CANCEL statelessly. If not, a DoS attack using CANCEL messages with non-existing via branches could be used to make a server run out of transaction resources (since each servertransaction will linger for 32 seconds). CANCEL cannot be challenged, so the recommendation of section 26.3.2.4 to challenge questionable requests does not apply here

2. For the same reason, IMO it should be recommended to not do loop detection for CANCEL requests (i.e. SHOULD NOT) in stateful proxies. Loop detection processing can be relatively expensive, and is not needed for CANCELs in this case as stateful proxies forward them hop-by-hop (any loop would end with a 487)

Regards,

jeroen

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: David R Oran <[email-masked]>
Date: Sat, 17 Dec 2005 09:01:16 -0500

On Dec 17, 2005, at 8:35 AM, Jeroen van Bemmel wrote:

> 1. IMO it should be recommended (i.e. SHOULD) to send 487 responses  
> for CANCEL statelessly. If not, a DoS attack using CANCEL messages  
> with non-existing via branches could be used to make a server run  
> out of transaction resources (since each servertransaction will  
> linger for 32 seconds). CANCEL cannot be challenged, so the  
> recommendation of section 26.3.2.4 to challenge questionable  
> requests does not apply here
>
I agree.

> 2. For the same reason, IMO it should be recommended to not do loop  
> detection for CANCEL requests (i.e. SHOULD NOT) in stateful  
> proxies. Loop detection processing can be relatively expensive, and  
> is not needed for CANCELs in this case as stateful proxies forward  
> them hop-by-hop (any loop would end with a 487)
>
Here I disagree, since the cost of loop detect (depending on  
implementation technique) can be nearly free if integrated with the  
dialog matching code.

---

From: "Jeroen van Bemmel" <[email-masked]>
Date: Sat, 17 Dec 2005 15:05:36 +0100

David,

>> detection for CANCEL requests (i.e. SHOULD NOT) in stateful  proxies. 
>> Loop detection processing can be relatively expensive, and  is not needed 
>> for CANCELs in this case as stateful proxies forward  them hop-by-hop 
>> (any loop would end with a 487)
>>

Sorry, I should have been more specific here: I had a transaction-stateful, 
dialog-stateless proxy in mind

Regards,

jeroen