Subject: [Megaco] Error 402 Unauthorized

From: Sachin <[email-masked]>
Date: Wed, 16 Jul 2008 13:02:59 +0530

Hi,

MG has no knowledge of association with the MGC. MGC sends any command to
that gateway. The expected reply to this is an error 402.

The MG in the current scenario should not accept any transaction from the
MGC. So at what level the error 402 to be sent, is it at transaction level
or at the command level.

Please help.

Thanks
Sachin
_______________________________________________
Megaco mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/megaco

---

From: "Raphael Tryster" <[email-masked]>
Date: Wed, 16 Jul 2008 17:39:48 +0300

You answered it yourself, didn't you?  The error is at the transaction
level, so the reply should be at the transaction level too.
 
However, you may wish to consider an alternative.  In 2002, I asked the
following question:
 
I have seen a number of discussions in the archive about the following
statement: 
"Responses must be sent to the address and port from which the
corresponding commands were sent". 
The discussions relate mostly to failover and handover situations, but I
could not find any discussion of what happens when a rogue MGC sends a
command to an MG with which it has not established a control
association.   One rule that may be relevant here is:

"It is possible that the reply to a ServiceChange with Restart will be
lost, and a command will be received by the MG prior to the receipt of
the ServiceChange response.  The MG shall issue error 505 - Command
Received before Restart Response".

Does the MG send error 505 if it has not received a restart response
from the SENDING MGC, or from ANY MGC?  If the answer is ANY MGC, how
does the MG protect itself from being sent commands by unauthorized
entities?

Tom Taylor replied:

The MG sends 505 to the MGC to which it has sent a ServiceChange
registration.  To any other MGC it would send 402 Unauthorized, if it
sends anything at all.  I'm not sure it should send anything, because
rogue commands could constitute a Denial of Service attack.  Remember
that we expect Megaco commands to pass over an established security
association (which brings to mind that some day we should add security
considerations to the ATM transport annex, Annex I).

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf
Of Sachin
Sent: Wednesday, July 16, 2008 10:33 AM
To: [email-masked]
Subject: [Megaco] Error 402 Unauthorized

Hi,
 
MG has no knowledge of association with the MGC. MGC sends any command
to that gateway. The expected reply to this is an error 402. 
 
The MG in the current scenario should not accept any transaction from
the MGC. So at what level the error 402 to be sent, is it at transaction
level or at the command level.
 
Please help.
 
Thanks
Sachin
**********************************************************************************************
IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the 
named recipient(s) only.
If you have received this email in error, please notify the system manager or the sender immediately and do 
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. ***
**********************************************************************************************