Subject: RE: [SIP] Session timer considered harmful (was RE: draft-ietf-si p-session- timer: refresh rate)

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 4 Apr 2001 02:28:30 -0400

> -----Original Message-----
> From: Dean Willis [mailto:[email-masked]]
> Sent: Tuesday, March 27, 2001 4:23 PM
> To: Jonathan Rosenberg; [email-masked]; [email-masked]
> Subject: Re: [SIP] Session timer considered harmful (was RE:
> draft-ietf-sip-session- timer: refresh rate)
> 
> 
> 
> I would suggest an even simpler approach -- guidance to 
> implementors that
> suggests they implement a configuration variable to treat 
> session-timer
> values below that variable's value as having that value, and 
> guidance to
> operators on the tuning of that value. As session-timer is 
> only intended as
> a guideline for how long state should be kept on an inactive 
> call, there's
> no real harm in (beyond state preservation load) in keeping 
> it a little
> longer. This allows the lower-bound in effect to be defined on a a
> per-network, per device basis and adjusted for operator requirements.

The problem is that session timers affect the proxies and UA's in other
networks. So, if foo.com owns a gateway, and for it, a session timer of 1ms
was OK, since it uses OC-192 interface cards and a 100 processor box, other
proxies on the path may not have such compute and I/O power, in which case
1ms is not OK for them.

> 
> If someone's rogue UAC decides to start resending INVITES every few
> milliseconds, no specification can stop it from doing so. 
> That's like trying
> to legislate rainfall . . .

Of course. The case I am concerned about is using a regular UA, compliant to
session timer, as a point of amplification for a DoS attack. 

-Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

---

From: "Dean Willis" <[email-masked]>
Date: Wed, 4 Apr 2001 02:15:43 -0500

Yes, but if each of the proxies along the path knows what its safe "lower
bound" on retransmits is and refuses to pass a session timer with a value
lower than the safety threshold, the attack can be avoided. This isn't a
protocol change.

And if the carrier-operated gateway at the other end of the attack call is
configured with a lower-bound on session timer values, it won't respect
session timer settings below this threshold and won't cause the retransmit
storm an attacker is attemping to induce.

It all comes down to the "good guys" systems 1) being configured reasonably,
and 2) being able to reject unreasonable requests. What the "bad guy" does
we can't control . . .

--
Dean

----- Original Message -----
From: "Jonathan Rosenberg" <[email-masked]>
To: "'Dean Willis'" <[email-masked]>; "Jonathan Rosenberg"
<[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Wednesday, April 04, 2001 1:28 AM
Subject: RE: [SIP] Session timer considered harmful (was RE:
draft-ietf-sip-session- timer: refresh rate)