Subject: [sipcore] RFC4028 : bug in 11 Security Considerations (once again)

From: OKUMURA Shinji <[email-masked]>
Date: Tue, 30 Jun 2020 18:30:07 +0900

Since the subject and the discussion have diverged, I will sort out the topic once again.

The issue I raised:

11.  Security Considerations
    Next, consider the case of a rogue UAS that wishes to force a UAC to
    generate refreshes at a rapid rate.  In that case, the UAC has to
    support session timer.  The initial INVITE arrives at the rogue UAS,
    which returns a 2xx with a very small session interval.  The UAC uses
    this timer and quickly sends a refresh.  Section 7.4 requires that
    the UAC copy the current session interval into the Session-Expires
    header field in the request.  This enables the proxies to see the
    current value.  The proxies will reject this request and provide a
    Min-SE with a higher minimum, which the UAC will then use.  Note,
    that if the proxies did not reject the request, but rather proxied
    the request with a Min-SE header field, an attack would still be
    possible.  The UAS could discard this header field in a 2xx response
    and force the UAC to continue to generate rapid requests.

If the rogue UAS returns again a 2xx with a very small session interval, the attack will continue.

My suggestion:
The UAC compares the SE-value in 2xx response with the maximum value of the Min-SE. If the SE-value is less than the maximum MSE-value, then the UAC should consider the SE-value as the maximum MSE-value.

Other suggestion:
The UAC should immediately terminate a call.

How is it?

Regards,
Shinji

---

From: Roman Shpount <[email-masked]>
Date: Tue, 30 Jun 2020 13:22:18 -0400

How does UAC know the maximum value of the Min-SE?

If we require UAS return Min-SE in 2XX and for proxies to verify that
Min-SE is equal or higher then the value they have set, then it would be
possible to enforce this rule. Otherwise, the value Min-SE set by the proxy
and ignored by UAS would only be known to the proxy.
_____________
Roman Shpount

On Tue, Jun 30, 2020 at 5:30 AM OKUMURA Shinji <[email-masked]>
wrote:

> The UAC compares the SE-value in 2xx response with the maximum value of
> the Min-SE. If the SE-value is less than the maximum MSE-value, then the
> UAC should consider the SE-value as the maximum MSE-value.
>
> Other suggestion:
> _______________________________________________
> sipcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipcore
>