RFC 6026
Correct Transaction Handling for 2xx Responses to Session Initiation Protocol (SIP) INVITE Requests
RFC 6026 Part 1 🦋✨
Okay bestie, this one is Correct Transaction Handling for 2xx Responses to Session Initiation Protocol (SIP) INVITE Requests 💖 It's a Standards Track doc from September 2010, ISSN 2070-1721. The authors are R. Sparks (Tekelec) and T. Zourzouvillys (Skype) 👑. It updates RFC 3261 and doesn't obsolete anything 🧚.
Abstract 🌸
This doc is a normative update to [RFC3261] (SIP) that fixes a mistake in how 2xx class responses to INVITE requests are handled. Elements that follow RFC 3261 to the letter will misidentify retransmissions of the request as a brand new, unassociated request 🙈. The fix changes the INVITE transaction state machines. It also changes how responses that can't be matched to an existing transaction get handled, because that's a security risk 💀.
Status of This Memo 📜
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741 ✨.
For the current status, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc6026 🔗.
Copyright Notice 🎀
Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they're in effect on the date this document was published. Please read these carefully, because they spell out your rights and restrictions for this document 🫶. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License.
Table of Contents 🗺️
1. Introduction ....................................................3
2. Conventions and Definitions .....................................3
3. Reason for Change ...............................................3
4. Summary of Change ...............................................4
5. Consequences if Not Implemented .................................4
6. The Change ......................................................4
7. Change Details ..................................................5
7.1. Server Transaction Impacts .................................5
7.2. Client Transaction Impacts .................................9
7.3. Proxy Considerations ......................................10
8. Exact Changes to RFC 3261 ......................................11
8.1. Page 85 ...................................................11
8.2. Page 107 ..................................................11
8.3. Page 114 ..................................................11
8.4. Pages 126 through 128 .....................................12
8.5. Pages 134 to 135 ..........................................15
8.6. Page 136 ..................................................15
8.7. Page 137 ..................................................17
8.8. Page 141 ..................................................17
8.9. Page 144 ..................................................18
8.10. Page 146 .................................................18
8.11. Page 265 .................................................18
9. IANA Considerations ............................................18
10. Security Considerations .......................................19
11. Acknowledgments ...............................................20
12. Normative References ..........................................201. Introduction ✨
This doc describes an essential fix to the Session Initiation Protocol (SIP), which is defined in [RFC3261] 💖. The change tackles a mistake in how 2xx class responses to INVITE requests are handled. That mistake makes retransmissions of the INVITE get treated as new requests 😭. It also forbids forwarding stray INVITE responses 🚫.
2. Conventions and Definitions 📚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🎀.
3. Reason for Change 🤔
INVITE in SIP has one main job: setting up new sessions. These "initial" INVITEs can fork at intermediaries, and more than one receiving endpoint might decide to accept the request 🍓. SIP is designed so the requester gets all of those success responses, and that's iconic 👑.
Two sets of requirements in [RFC3261] work together so the requester can process multiple 2xx responses correctly 💅. First, every element has to immediately destroy any INVITE client transaction state as soon as it forwards a matching 2xx class response. This applies to both UAs (user agents) and proxies. Proxies forward the response upstream, and the transaction layer at a user agent forwards it up to its "UA core" 🦋. Second, every proxy has to statelessly forward upstream any 2xx class responses that don't match an existing transaction. These are also called stray responses 🌸. The transaction layer at user agents is required to forward these responses to its UA core too. Logic in the UA core is what takes care of acknowledging each of these responses 🧚.
This way of specifying the behavior was picked over changing the INVITE client transaction state machines, because it seemed like a simpler way to write the correct behavior 🌈.
Over time, implementers showed that the existing text is wrong 😭. Once any element with a server transaction (say, a proxy in the path of the INVITE) deletes that transaction state, any retransmission of the INVITE gets treated as a new request. It could then be forwarded to different locations than the original 💀. Lots of implementations in the wild have made proprietary tweaks to their transaction logic to dodge this error 🙈.
The rule to statelessly forward stray responses has also been flagged as a security risk 🚨. Because of it, elements that comply with [RFC3261] are made to do work (forwarding packets) that isn't protected by the admission policies applied to requests. That can be abused. For example, a SIP proxy could be used as an anonymizing forwarder of packets in a distributed denial-of-service attack 😱. General Internet endpoints can also team up to tunnel non-SIP content through such proxies by wrapping it in a SIP response envelope 🕵️♀️.
On top of that, [RFC3261] says that if an unrecoverable transport error is hit while sending a response in a client transaction, the transaction has to move immediately into the "Terminated" state. The result is that any retransmitted INVITE requests received after such an error will be processed as new requests instead of being absorbed as retransmissions 💀.
4. Summary of Change 📝
This correction document updates [RFC3261]. It adds a state and changes the transitions in the INVITE client state machine so that the INVITE client transaction stays in place to receive multiple 2xx responses ✨. It adds a state to the INVITE server state machine to absorb retransmissions of the INVITE after a 2xx response has been sent 🫶. It also changes state transitions in the INVITE server state machine so retransmissions of the INVITE request get absorbed after an unrecoverable transport error when sending a response 🎀. Finally, it forbids forwarding stray responses to INVITE requests (not just 2xx responses), which RFC 3261 requires 🚫.
5. Consequences if Not Implemented 💔
Implementations that strictly conform to [RFC3261] will process retransmitted initial INVITE requests as new requests 😭. Proxies might forward them to different locations than the original. Proxies can also be used as anonymizing forwarders of bulk traffic 💀. Implementations will process any retransmitted INVITE request as a new request after an attempt to send a response results in an unrecoverable error 🙈.
6. The Change 🔥
An element sending or receiving a 2xx to an INVITE transaction MUST NOT destroy any matching INVITE transaction state. This state is necessary so retransmissions of the request, and the retransmission of the 2xx and ACK that follow, get processed correctly 👑.
An element that runs into an unrecoverable transport error while trying to send a response to an INVITE request MUST NOT immediately destroy the associated INVITE server transaction state. This state is necessary so retransmissions of the request get processed correctly 💅.
When receiving any SIP response, a transaction-stateful proxy MUST compare the transaction identifier in that response against its existing transaction state machines. The proxy MUST NOT forward the response if there is no matching transaction state machine 🚫.
When receiving an ACK that matches an existing INVITE server transaction, and that does not contain a branch parameter with the magic cookie defined in RFC 3261, the matching transaction MUST be checked to see if it's in the "Accepted" state. If it is, then the ACK must be passed directly to the transaction user instead of being absorbed by the transaction state machine ✨. This is needed because requests from RFC 2543 clients won't include a unique branch parameter, and the ways of calculating the transaction ID from such a request come out the same for both INVITEs and ACKs 🧚.
7. Change Details 🔍
These changes affect requirements in several sections of RFC 3261. The exact effect on that text is spelled out in Section 8. This section walks through the details of the change, focusing on the impact on the INVITE state machines, in a more succinct way so it's easier to review and implement 🌸.
7.1. Server Transaction Impacts ✨
okay so the server side is where the glow-up happens 💖 we're adding a brand new state called "Accepted" to the INVITE server transaction state machine so a SIP element can tell when an INVITE is just a retransmission and not a brand-new request 🎀 there's also a new timer, Timer L, which is what finally lets the state machine actually end 🦋 a server transaction chilling in "Proceeding" moves to "Accepted" when it sends a 2xx response, and it stays there just long enough to soak up any retransmissions of the INVITE 🧚
if the SIP element's TU (Transaction User) issues a 2xx response for this transaction while the state machine is in "Proceeding", the state machine MUST transition to the "Accepted" state and set Timer L to 64*T1, where T1 is the round-trip time estimate defined in Section 17.1.1.1 of [RFC3261] 💅
while in "Accepted", any retransmissions of the INVITE that come in will match this transaction state machine and get absorbed without changing its state 🫶 they don't get passed up to the TU, so the TU never sees them 🙈 now, RFC 3261 requires the TU to periodically retransmit the 2xx response until it receives an ACK. the server transaction MUST NOT generate 2xx retransmissions on its own 💀 so any retransmission of the 2xx response that the TU hands to the transaction while in "Accepted" MUST be passed to the transport layer for transmission. and any ACKs that come in from the network while in "Accepted" MUST be passed directly to the TU and not absorbed 🔥
when Timer L fires and the state machine is in "Accepted", the machine MUST transition to the "Terminated" state 😭 once it's "Terminated", it MUST be destroyed immediately, no cap 🌸 Timer L basically marks how long the server transaction could be getting 2xx responses from the TU to retransmit while it waits for that ACK 👑
a server transaction MUST NOT throw away its transaction state just because it ran into a non-recoverable transport error while sending a response. instead, the associated INVITE server transaction state machine MUST remain in its current state. (timers will eventually move it to "Terminated" on their own.) this way, retransmissions of the INVITE get absorbed instead of being treated as a new request, which is literally the whole point 🎀
figures 1 and 2 show the parts of the INVITE server state machine that changed, and the full new INVITE server state machine is in Figure 5 🦋
BEFORE AFTER
+-----------+ +-----------+
| | | |
| Proceeding| | Proceeding|
| | | |
| | | |
| | | |
| | | |
+-----------+ +-----------+
|2xx from TU |2xx from TU
|send response |send response
+-------------->+ +------->+
| |
| |
| |
| | Transport
| INVITE | Error
| - | Inform TU
| +-----+ | +--+
| | | V | v
| | +------------+
| | | |<--+
| +->| Accepted | | ACK
| | |---+ to TU
| +------------+
| | ^ |
| +--+ | |
| | +-----+
| | 2xx from TU
| | send response
| |
| | Timer L fires
| | -
| |
| V
+-----------+ | +------------+
| | | | |
| Terminated|<-----------+ | Terminated |
| | | |
+-----------+ +------------+
Figure 1: Changes to the INVITE server transaction state machine
when sending 2xx
BEFORE AFTER
+-----------+ +------------+
| | | |
| Proceeding| | Proceeding | Transport Err.
| | | | Inform TU
| | Transport Err. | |----------+
| | Inform TU | | |
| |--------------->+ | |<---------+
+-----------+ | +------------+
|
|
|
|
| Transport Err.
+-----------+ | +-----------+ Inform TU
| | | | |---------+
| Completed | | | Completed | |
| | | | |<--------+
+-----------+ | +-----------+
| |
| |
+------------------>+
Transport Err.|
Inform TU |
|
|
|
|
|
|
|
|
|
+-----------+ |
| | |
| Terminated|<---------------+
| |
+-----------+
Figure 2: Changes to the INVITE server transaction state machine on
encountering transport error7.2. Client Transaction Impacts 🎀
okay so on the client side, the goal is to tell real retransmissions of 2xx responses apart from stray 2xx responses 🕵️♀️ the INVITE client state machine no longer jumps straight to "Terminated" when a 2xx comes in. instead it moves to a new "Accepted" state and hangs out there for a while, set by a new timer M. during that time it can pass to the TU any retransmissions of the 2xx response, plus any extra 2xx responses from other branches of a downstream fork of the matching request 🌈
if a 2xx comes in while the client INVITE state machine is in "Calling" or "Proceeding", it MUST transition to "Accepted", pass the 2xx response up to the TU, and set Timer M to 64*T1 ✨ a 2xx received while in "Accepted" MUST be passed to the TU, and the machine stays in "Accepted" 💜 the client transaction MUST NOT generate an ACK to any 2xx response on its own. the TU responsible for the transaction is the one that generates the ACK 🫶
when Timer M fires and the state machine is in "Accepted", the machine MUST transition to "Terminated" 😭 and once it's "Terminated", it MUST be destroyed immediately 🦋
any response that doesn't match an existing client transaction state machine is simply dropped 🙅♀️ (implementations are totally free to log stuff or do other implementation-specific things with those responses, but the implementer should be sure to think about what happens when there are large numbers of malicious stray responses. this is a real concern and not a vibe 💀)
it's not necessary to keep client transaction state around when unrecoverable transport errors are detected. the existing requirements already make sure the TU gets notified, and the new requirements in this document make sure any retransmitted response that shows up gets dropped, since there won't be any matching transaction state left 🧚
figure 3 shows the part of the INVITE client state machine that changed, and the full new INVITE client state machine is in Figure 5 🌸
+-----------+ +-----------+
| | | |
| Calling | | Calling |
| |----------->+ | |-----------+
+-----------+ 2xx | +-----------+ 2xx |
2xx to TU | 2xx to TU |
| |
| |
| |
| |
+-----------+ | +-----------+ |
| | | | | |
|Proceeding |----------->| |Proceeding |---------->|
| | 2xx | | | 2xx |
+-----------+ 2xx to TU | +-----------+ 2xx to TU |
| |
| |
| |
| V
| +-----------+
| | |
| | Accepted |
| +---| |
| 2xx | +-----------+
| 2xx to TU | ^ |
| | | |
| +-----+ |
| |
| +-----------------+
| | Timer M fires
| | -
| V
+-----------+ | +-----------+
| | | | |
| Terminated|<-----------+ | Terminated|
| | | |
+-----------+ +-----------+
Figure 3: Changes to the INVITE client transaction state machine7.3. Proxy Considerations 🧚♀️
this doc changes how transaction-stateful proxies behave so they stop forwarding stray INVITE responses 🙅♀️ when a transaction-stateful proxy gets any SIP response, it MUST compare the transaction identifier in that response against its existing transaction state machines 🔍 and if there's no matching transaction state machine, the proxy MUST NOT forward the response 💅
8. Exact Changes to RFC 3261 ✨
okay so this section is the receipts 🧾 it does the SAME changes as the ones we just covered, but this time it shows you exactly which words in RFC 3261 get swapped out. the doc deliberately leaves out a Figure 4 and a Figure 6 so that the labels on Figures 5 and 7 match the labels of the figures they're replacing in RFC 3261. the way that's so thoughtful 🥹🎀
8.1. Page 85 🌸
Section 13.3.1.4, paragraph 4, is replaced entirely by:
Once the response has been constructed, it is passed to the INVITE
server transaction. In order to ensure reliable end-to-end
transport of the response, it is necessary to periodically pass
the response directly to the transport until the ACK arrives. The
2xx response is passed to the transport with an interval that
starts at T1 seconds and doubles for each retransmission until it
reaches T2 seconds (T1 and T2 are defined in Section 17).
Response retransmissions cease when an ACK request for the
response is received. This is independent of whatever transport
protocols are used to send the response.8.2. Page 107 🦋
Section 16.7, paragraphs 1 and 2, are replaced entirely by:
When a response is received by an element, it first tries to
locate a client transaction (Section 17.1.3) matching the
response. If a transaction is found, the response is handed to
the client transaction. If none is found, the element MUST NOT
forward the response.8.3. Page 114 💅
Section 16.7, part 9, first paragraph. Replace this sentence:
If the server transaction is no longer available to handle the
transmission, the element MUST forward the response statelessly by
sending it to the server transport.with
If the server transaction is no longer available to handle the
transmission, the response is simply discarded.8.4. Pages 126 through 128 👑
Section 17.1.1.2. Replace paragraph 7 (starting "When in either") through the end of the section with:
When in either the "Calling" or "Proceeding" states, reception of
a response with status code from 300-699 MUST cause the client
transaction to transition to "Completed". The client transaction
MUST pass the received response up to the TU, and the client
transaction MUST generate an ACK request, even if the transport is
reliable (guidelines for constructing the ACK from the response
are given in Section 17.1.1.3), and then pass the ACK to the
transport layer for transmission. The ACK MUST be sent to the
same address, port, and transport to which the original request
was sent.
The client transaction MUST start Timer D when it enters the
"Completed" state for any reason, with a value of at least 32
seconds for unreliable transports, and a value of zero seconds for
reliable transports. Timer D reflects the amount of time that the
server transaction can remain in the "Completed" state when
unreliable transports are used. This is equal to Timer H in the
INVITE server transaction, whose default is 64*T1, and is also
equal to the time a UAS core will wait for an ACK once it sends a
2xx response. However, the client transaction does not know the
value of T1 in use by the server transaction or any downstream UAS
cores, so an absolute minimum of 32 s is used instead of basing
Timer D on T1.
Any retransmissions of a response with status code 300-699 that
are received while in the "Completed" state MUST cause the ACK to
be re-passed to the transport layer for retransmission, but the
newly received response MUST NOT be passed up to the TU.
A retransmission of the response is defined as any response that
would match the same client transaction based on the rules of
Section 17.1.3.
If Timer D fires while the client transaction is in the
"Completed" state, the client transaction MUST move to the
"Terminated" state.
When a 2xx response is received while in either the "Calling" or
"Proceeding" states, the client transaction MUST transition to the
"Accepted" state, and Timer M MUST be started with a value of
64*T1. The 2xx response MUST be passed up to the TU. The client
transaction MUST NOT generate an ACK to the 2xx response -- its
handling is delegated to the TU. A UAC core will send an ACK to
the 2xx response using a new transaction. A proxy core will
always forward the 2xx response upstream.
The purpose of the "Accepted" state is to allow the client
transaction to continue to exist to receive, and pass to the TU,
any retransmissions of the 2xx response and any additional 2xx
responses from other branches of the INVITE if it forked
downstream. Timer M reflects the amount of time that the
transaction user will wait for such messages.
Any 2xx responses that match this client transaction and that are
received while in the "Accepted" state MUST be passed up to the
TU. The client transaction MUST NOT generate an ACK to the 2xx
response. The client transaction takes no further action.
If Timer M fires while the client transaction is in the "Accepted"
state, the client transaction MUST move to the "Terminated" state.
The client transaction MUST be destroyed the instant it enters the
"Terminated" state.Replace Figure 5 with:
|INVITE from TU
Timer A fires |INVITE sent Timer B fires
Reset A, V or Transport Err.
INVITE sent +-----------+ inform TU
+---------| |--------------------------+
| | Calling | |
+-------->| |-----------+ |
300-699 +-----------+ 2xx | |
ACK sent | | 2xx to TU | |
resp. to TU | |1xx | |
+-----------------------------+ |1xx to TU | |
| | | |
| 1xx V | |
| 1xx to TU +-----------+ | |
| +---------| | | |
| | |Proceeding | | |
| +-------->| | | |
| +-----------+ 2xx | |
| 300-699 | | 2xx to TU | |
| ACK sent, +--------+ +---------------+ |
| resp. to TU| | |
| | | |
| V V |
| +-----------+ +----------+ |
+------------->| |Transport Err. | | |
| Completed |Inform TU | Accepted | |
+--| |-------+ | |-+ |
300-699 | +-----------+ | +----------+ | |
ACK sent| ^ | | | ^ | |
| | | | | | | |
+----+ | | | +-----+ |
|Timer D fires | Timer M fires| 2xx |
|- | - | 2xx to TU |
+--------+ | +-----------+ |
NOTE: V V V |
Transitions +------------+ |
are labeled | | |
with the event | Terminated |<-----------------------+
over the action | |
to take. +------------+
Figure 5: INVITE client transaction8.5. Pages 134 to 135 🌈
Section 17.2.1, paragraph 4, is replaced with:
If, while in the "Proceeding" state, the TU passes a 2xx response
to the server transaction, the server transaction MUST pass this
response to the transport layer for transmission. It is not
retransmitted by the server transaction; retransmissions of 2xx
responses are handled by the TU. The server transaction MUST then
transition to the "Accepted" state.8.6. Page 136 🧚
Replace Figure 7 with:
|INVITE
|pass INV to TU
INVITE V send 100 if TU won't in 200 ms
send response+------------+
+--------| |--------+ 101-199 from TU
| | | | send response
+------->| |<-------+
| Proceeding |
| |--------+ Transport Err.
| | | Inform TU
| |<-------+
+------------+
300-699 from TU | |2xx from TU
send response | |send response
+--------------+ +------------+
| |
INVITE V Timer G fires |
send response +-----------+ send response |
+--------| |--------+ |
| | | | |
+------->| Completed |<-------+ INVITE | Transport Err.
| | - | Inform TU
+--------| |----+ +-----+ | +---+
| +-----------+ | ACK | | v | v
| ^ | | - | +------------+
| | | | | | |---+ ACK
+----------+ | | +->| Accepted | | to TU
Transport Err. | | | |<--+
Inform TU | V +------------+
| +-----------+ | ^ |
| | | | | |
| | Confirmed | | +-----+
| | | | 2xx from TU
Timer H fires | +-----------+ | send response
- | | |
| | Timer I fires |
| | - | Timer L fires
| V | -
| +------------+ |
| | |<----+
+------->| Terminated |
| |
+------------+
Figure 7: INVITE server transaction8.7. Page 137 🎀
Okay so in Section 17.2.1 we're swapping out the last paragraph (the one starting with "Once the transaction") for a new one. Here's the vibe:
The whole point of the "Accepted" state is to soak up retransmissions of an INVITE request that's already been accepted 💜. Those retransmissions get absorbed completely inside the server transaction, so they never bubble up to the TU. Why? Because any downstream UAS cores that accepted the request already took responsibility for reliability and will resend their 2xx responses if needed. Iconic teamwork 🫶.
While we're in the "Accepted" state, if the TU hands over a 2xx response, the server transaction MUST pass that response to the transport layer for transmission. No skipping!
When the INVITE server transaction enters the "Accepted" state, Timer L MUST be set to fire in 64*T1 for all transports. This number lines up with two things. First, Timer B in the next upstream client state machine, which is how long the previous hop waits for a response when no provisionals have been sent. Second, how long this UAS core (or any downstream one) might keep retransmitting the 2xx while it waits for an ACK. Perfectly matched 🔥.
If an ACK shows up while the INVITE server transaction is in the "Accepted" state, then the ACK must be passed up to the TU. And if Timer L fires while we're still in "Accepted," the transaction MUST transition to the "Terminated" state.
Once the transaction hits "Terminated," it MUST be destroyed immediately. Bye bye 👋.
8.8. Page 141 🌸
In Section 17.2.4, we're replacing the second paragraph. The new version goes like this: first, the procedures in [4] get followed, which try to deliver the response to a backup. If all of those fail, based on the definition of failure in [4], the server transaction SHOULD inform the TU that a failure has occurred, and it MUST remain in the current state 🥺.
8.9. Page 144 🦋
In Section 18.1.2, the second paragraph gets swapped out. The client transport uses the matching procedures of Section 17.1.3 to try to match the response to an existing transaction. If there's a match, the response MUST be passed to that transaction. If there's no match, any element other than a stateless proxy MUST silently discard the response. Stateless proxies are the exception here, so they don't get the same treatment 💅.
8.10. Page 146 🧚
In Section 18.2.1, the last paragraph is getting replaced. Next, the server transport tries to match the request to a server transaction, using the matching rules described in Section 17.2.3. If it finds a matching server transaction, the request is passed to that transaction for processing. If nothing matches, the request is passed to the core, which might decide to build a new server transaction for that request ✨.
8.11. Page 265 🌈
We're adding two new rows to Table 4. Here they are, exactly as they should look:
Timer L 64*T1 Section 17.2.1 Wait time for
accepted INVITE
request retransmits
Timer M 64*T1 Section 17.1.1 Wait time for
retransmission of
2xx to INVITE or
additional 2xx from
other branches of
a forked INVITE9. IANA Considerations 📚
IANA has an update for the SIP Parameters: Method and Response Codes registry. Here's the before and after. Before, the INVITE entry just pointed at [RFC3261]:
Methods Reference
------- ---------
INVITE [RFC3261]After, it also picks up [RFC6026]:
Methods Reference
------- ---------
INVITE [RFC3261][RFC6026]10. Security Considerations 🔒
This document makes two changes to the Session Initiation Protocol to deal with the error discussed in Section 3. It changes how both the client and server INVITE transaction state machines behave, and it changes how "stray" responses (the ones that don't match any existing transaction) get handled at transaction-stateful elements.
The changes to the state machines make elements hold onto each accepted INVITE transaction state for 32 seconds longer than RFC 3261 specified. This has a direct impact on how much work an attacker leaning on state exhaustion has to put in against the system. That said, this extra state is necessary for correct operation 😬. There's some discussion of avoiding state exhaustion and other denial-of-service attacks in RFC 3261, Section 26.3.2.4.
RFC 3261 required SIP proxies to forward any stray 2xx class responses to an INVITE request upstream statelessly. That means conformant proxies can be forced to forward packets (ones that look enough like SIP responses) to destinations the sender picks. Section 3 covers some of the malicious behavior this makes possible. This document reverses the stateless forwarding requirement, so forwarding stray responses becomes a violation of the specification 🚫.
RFC 3261 defines a "stateless proxy," which forwards requests and responses without creating or maintaining any transaction state. The requirements introduced in this document don't change how these elements behave in any way. Stateless proxies are inherently vulnerable to the abuses discussed in Section 3. One way operators might reduce that vulnerability is by carefully controlling which peer elements can send traffic to a given stateless proxy.
The changes in this document are backward-compatible. Transaction behavior will be no less correct, and possibly more correct, when only one peer in a transaction implements these changes. Apart from the considerations mentioned earlier in this section, bringing elements that implement these changes into deployments with RFC 3261 implementations adds no additional security concerns 🫶.
11. Acknowledgments 💖
Pekka Pessi reported the improper handling of INVITE retransmissions 🙌. Brett Tate did a careful review that uncovered the need for the "Accepted" state and for Timer M in the client transaction state machine. Jan Kolomaznik noticed that a server transaction should let a TU know about transport errors when it tries to send a 2xx class response. Michael Procter corrected several nits. Iconic squad 👑.
12. Normative References 📖
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
A., Peterson, J., Sparks, R., Handley, M., and E.
Schooler, "SIP: Session Initiation Protocol", RFC 3261,
June 2002.Authors' Addresses 🎀
Robert Sparks
Tekelec
17210 Campbell Road
Suite 250
Dallas, Texas 75252
USA
EMail: RjS@nostrum.com
Theo Zourzouvillys
Skype
3rd Floor
8000 Marina Blvd
Brisbane, California 84005
US
EMail: theo@crazygreek.co.ukThat's the whole RFC, bestie 🌈💖✨
📦 where this page comes from
- ietf: rfc6026 2010-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms