Subject: [Sip] Fw: [Sip-implementors] sip-session-timer-11: Problem with responses from roughe UAS

From: "Nataraju A.B." <[email-masked]>
Date: Tue, 23 Sep 2003 09:04:46 +0530

I am raising this issue since there was no response in implementers mailing list..

----- Original Message ----- 
From: Nataraju A.B. 
To: Mailing List SIP 
Sent: Monday, September 22, 2003 8:37 AM
Subject: [Sip-implementors] sip-session-timer-11: Problem with responses from roughe UAS

11.2 Inside Attacks 
<< consider the case of a rogue UAS that wishes to force a UAC to 
   generate refreshes at a rapid rate. In that case, the UAC has to 
   support session timer. The initial INVITE arrives at the rogue UAS, 
   which returns a 2xx with a very small session interval. The UAC uses 
   this timer, and quickly sends a refresh. Section 7.1 requires the 
   UAC to copy the current session interval into the Session-Expires 
   header field in the request. This enables the proxies to see the 
   current value. The proxies will reject this request, and provide a 
   Min-SE with a higher minimum. The UAC will then use this higher 
   minimum. Note, that if the proxies did not reject the request, but 
   rather proxied the request with a Min-SE header field, an attack 
   would still be possible. The UAS could discard this header field in 
   a 2xx response, and force the UAC to continue to generate rapid 
   requests.  >>

In this case the proxies or UAC does not check the SE header in the 2xx response is greater than its locally defined Min-SE value or NOT. If so it would have been better.

In the current design, unnecessarily the UAC & proxy's resources will be wasted in negotiating the Min-SE in every session refresh request.

Instead I propose to forward the 2xx response ONLY in case SE value in response is greater than its Min-SE(configured value) else drop the response. because there is no point in stablishing a connection with a roughe UAS. 

In addition I have one more query :: In most of the scenarios which I came across in the draft Min-SE and SE values in teh session refresh request will be same. 
I feel session refresh request could just carry the increased SE value no need for carrying the Min-SE value also. In this case Min-SE does not serve any purpose (I assume so). 

Am I missing anywhere ???

Regards,
-------------------------------------------
Nataraju A.B.
Huawei Technologies India Pvt. Ltd.,
Tel : +91-98455-95744
-------------------------------------------    

--------------------------------------------------------------------------------

_______________________________________________
Sip-implementors mailing list
[email-masked]
http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors