Subject: RE: [SIP] Session timer considered harmful (was RE: draft-ietf-si p-session- timer: refresh rate)

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 4 Apr 2001 10:04:57 -0400

> -----Original Message-----
> From: Dean Willis [mailto:[email-masked]]
> Sent: Wednesday, April 04, 2001 3:16 AM
> To: Jonathan Rosenberg; [email-masked]; [email-masked]
> Subject: Re: [SIP] Session timer considered harmful (was RE:
> draft-ietf-sip-session- timer: refresh rate)
> 
> 
> 
> Yes, but if each of the proxies along the path knows what its 
> safe "lower
> bound" on retransmits is and refuses to pass a session timer 
> with a value
> lower than the safety threshold, the attack can be avoided. 
> This isn't a
> protocol change.

No, thats not true. Consider the case of:

UA1 -> P1 -> P2 -> P3 -> UA2

UA1 requests session timer. Its OK to P1. Goes to P2, which thinks it too
low. P2 increases it. Now the request goes to P3, which reduces it to an
even lower value. This is forwarded to UA2, which reflects it in the
response, and its forwarded upstream towards UA1. I guess P2 could discard
the response, but thats not really a good thing, since the transaction will
end up timing out. Even then, rogue P1 could reduce the timer value in the
response once its passed P2.

-Jonathan R.
---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 05 Apr 2001 08:52:24 +0300

Hi,

>>safe "lower bound" on retransmits is and refuses to pass a session timer
>>with a value lower than the safety threshold, the attack can be avoided.
>>This isn't a protocol change.
> 

Even if P1, P2 and P3 acceptes the session timer value, the re-INVITEs
between UA1 and UA2 may
then go via another proxy (unless P1, P2 and P3 inserted themselves in
the route), P4, which then can not handle the value chosen.

However, I still don't think that setting a minimum value is the right
thing to do, because the correct value depends on so many things,
including the size and architecture of the network, the reliability of
the network and the proxies, call priorities etc etc etc. Instead I
think that it should be more clear pointed out what the purpose of the
session timer really is, why a low timer value is bad and a high timer
value is good enough for the purpose.

Also, sending session-timer re-INVITEs every second is not the only way
to overload a SIP network. I can even happen in a "normal" situation,
when a big-capacity-GHz-multiprocessor proxy forwards huge amounts of
initial INVITEs (or any other kind of requests) to a
I-did-it-during-the-coffe-break Commodore64 proxy...  So, I still think
it's up to the network operator to build his network, and route his
traffic, so that this doesn't happen. And, in the case of inter-operator
traffic there probably will be all kind of agreements between the two
operators (charging, routing, whatever...), so a minimum session-timer
value could just be one of those agreements.

And, if a proxy still receives re-INVITEs more often that it wants/can
handle, we could define a "session-timer value too low" error response,
or something...

Regards,

Christer Holmberg
Ericsson Finland

---

From: "Dean Willis" <[email-masked]>
Date: Mon, 9 Apr 2001 17:43:21 -0500

Lower "sanity" bounds in UA1 or UA2 have the opportunity to correct the
situation.

An interesting point -- (in the absence of reply modification) the
session-timer approval process appears to give the proxy closest to the
terminating UA significantly more "say" about the session timer value. Of
course, a rogue proxy could just retransmit INVITES as often as it wants, no
need to have the UA do it on its behalf by munging session-timer  . . . so
perhaps we're barking a a tree with too many squirrels in it . . .

However, another edge condition may result -- perhaps one proxy tolerates a
session-timer value (T)  in the range A<T<B, and another tolerates C<T<D,
where A<B<C<D. That is to say, it is possible that NO value of session-timer
is acceptable to all proxies. On the other hand, NO negotation protocol can
meet these requirements . . . . so I guess we need bidirectional negotation
to be able to detect it.

--
Dean

----- Original Message -----
From: "Jonathan Rosenberg" <[email-masked]>
To: "'Dean Willis'" <[email-masked]>; "Jonathan Rosenberg"
<[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Wednesday, April 04, 2001 9:04 AM
Subject: RE: [SIP] Session timer considered harmful (was RE:
draft-ietf-sip-session- timer: refresh rate)