RFC 7332

RFC 7332 🎀 is a Standards Track doc from the IETF, ISSN 2070-1721, dated August 2014. The authors are Hadriel Kaplan (Oracle) and Victor Pascual (Quobis) 💅. Its title is Loop Detection Mechanisms for Session Initiation Protocol (SIP) Back-to-Back User Agents (B2BUAs) 🦋. The title block doesn't list anything it obsoletes or updates ✨.

---

Abstract ✨

okay so SIP B2BUAs can cause endless SIP request routing loops 😭 because, as User Agent Clients, they can generate SIP requests with brand-new Max-Forwards values. This doc talks through why loop detection is so tricky for B2BUAs and lays out what they need to do to stop infinite loops 🛑.

---

Status of This Memo 💌

This is an Internet Standards Track document ✨.

This doc is a product of the Internet Engineering Task Force (IETF) 🌸. It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741 📚.

You can check the current status of this document, any errata, and how to send feedback at http://www.rfc-editor.org/info/rfc7332 🔗.

---

Copyright Notice 🧾

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved 💜.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as in effect on the date of publication of this document. Please review these documents carefully, because they describe your rights and restrictions with respect to this document. Code components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and are provided without warranty as described in the Simplified BSD License 🫶.

---

Table of Contents 🗂️

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Conventions . . . . . . . . . . . . . . . . . . . . . . . . .   2
3.  Background  . . . . . . . . . . . . . . . . . . . . . . . . .   3
4.  B2BUA Loop-Detection Behavior . . . . . . . . . . . . . . . .   3
5.  B2BUA Max-Forwards Behavior . . . . . . . . . . . . . . . . .   4
6.  B2BUA Max-Breadth Behavior  . . . . . . . . . . . . . . . . .   4
7.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
8.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .   5
9.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   5

---

1. Introduction 🌈

SIP has a way to stop infinite request forwarding loops in [RFC3261], and another way to handle parallel forking amplification floods in [RFC5393] 🌊. Neither doc normatively defines specific behavior for B2BUAs though, which is the gap we're filling 🙈.

Unbounded SIP request loops have actually happened in real SIP deployments a bunch of times 😩. Loops are usually caused by misconfiguration, but the reason they've been unbounded (aka never-ending) is that they cross B2BUAs that reset the Max-Forwards value in the SIP requests they generate on their User Agent Client (UAC) side. That behavior is technically legal under [RFC3261] because a B2BUA is a UAC, but those unbounded loops have caused service outages and make troubleshooting really hard 💀.

[RFC5393] also gives us a way to limit the impact of parallel forking amplification, using a "Max-Breadth" header field 🍓. If a B2BUA doesn't pass this header field on, parallel forking amplification isn't mitigated by the [RFC5393] mechanism.

This document defines normative requirements for the Max-Forwards and Max-Breadth header field behaviors of B2BUAs, so that loops and parallel forking amplification get mitigated 💖.

2. Conventions 📝

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [RFC2119] 🔑.

The B2BUA terminology and taxonomy used in this doc is based on [RFC7092] 🧚.

3. Background 🧠

So with B2BUAs, the SIP protocol scope ends at the User Agent Server (UAS) side, and a brand-new one begins on the UAC side 🪄. That means a B2BUA can totally choose what it wants to do on its UAC side, separately from its UAS side, and still be compliant with [RFC3261] and its extensions. For example, any B2BUA type defined in [RFC7092] other than Proxy-B2BUA can create the SIP request on its UAC side without copying any of the Via header field values it received on its UAS side. There are valid reasons to do that 🤷‍♀️. The catch is that it blocks the Via-based loop-detection mechanism defined in [RFC3261] and updated by [RFC5393] from catching SIP request loops any earlier than when they hit the Max-Forwards limit 😤.

Some B2BUA vendors have tried detecting request loops in other ways 👀: by keeping track of how many outstanding dialog-forming requests exist for a given caller/called URI pair; or by detecting when they receive and send their own media addressing information too many times in certain cases, when they're a signaling/media-plane B2BUA; or by encoding a request instance identifier in some field they believe will pass through other nodes, and then detecting when they see the same value too many times.

BUT all of these methods are brittle and prone to error 😭. They're brittle because it's super hard to accurately define when a value has been seen "too many times". Requests can and do fork before and after B2BUAs process them, and requests legitimately spiral in some cases, which leads to wrong loop determinations. They're prone to error because there can be other B2BUAs in the loop's path that interfere with whichever mechanism is being used 🙅‍♀️.

The real last line of defense against unbounded loops is to limit how many SIP hops any request can traverse, and that's exactly what the SIP Max-Forwards field value is for 🛡️. If B2BUAs were to at least copy and decrement the Max-Forwards header field value from their UAS side to the UAC side, loops wouldn't continue indefinitely 🔁.

4. B2BUA Loop-Detection Behavior 🔍

It is RECOMMENDED that B2BUAs implement the loop-detection mechanism for the Via header field, as defined for a proxy in [RFC5393] ✨.

5. B2BUA Max-Forwards Behavior 🍒

This section applies to dialog-forming and out-of-dialog SIP requests 💅. B2BUAs MAY perform the same actions for in-dialog requests, but doing so may cause issues with devices that set Max-Forwards values based on the number of received Via or Record-Route headers 🙈.

All B2BUA types MUST copy the received Max-Forwards header field from the received SIP request on their UAS side to any request(s) they generate on their UAC side, and decrement the value, as if they were a proxy following the requirements described in [RFC3261] 🔢.

Being a UAS, B2BUAs MUST also check the received Max-Forwards header field and reject or respond to the request if the value is zero, as defined in [RFC3261] 🚫.

If the received request did not contain a Max-Forwards header field, one MUST be created in any request generated on the UAC side, as described for proxies in Section 16.6, Step 3 of [RFC3261]. As in that specification, the value of the new Max-Forwards header SHOULD be 70 ✨.

6. B2BUA Max-Breadth Behavior 🌷

All B2BUA types MUST copy the received Max-Breadth header field from the received SIP request on their UAS side to any request(s) they generate on their UAC side, as if they were a proxy following the requirements described in [RFC5393] 🥰.

B2BUAs of all types MUST follow the requirements imposed on proxies as described in Section 5.3.3 of [RFC5393], including generating the header field if none is received, limiting its maximum value, etc. 📏.

B2BUAs that generate parallel requests on their UAC side for a single incoming request on the UAS side MUST also follow the rules for Max-Breadth handling in [RFC5393] as if they were a parallel forking proxy 🪞.

7. Security Considerations 🔐

The security implications of parallel forking amplification are documented in Section 7 of [RFC5393] 🚨. This document doesn't introduce any additional issues beyond the ones discussed in [RFC5393].

⚠️ Some B2BUAs reset the Max-Forwards and Max-Breadth header field values to obfuscate the number of hops a request has already traversed, as a privacy or security concern. Those goals are at odds with the mechanisms in this document, so administrators get to decide which they think matters more: obfuscation vs. loop detection 👑.

To comply with this RFC, manufacturers MUST comply with the normative rules defined herein by default, but MAY provide user-configurable overrides as they see fit 🛠️.

8. Acknowledgments 🫶

Thanks to Brett Tate (Broadsoft), Andrew Hutton (Unify), and Anton Roman (Quobis) for reviewing the document 💖.

9. References 📚

9.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002.

[RFC5393] Sparks, R., Lawrence, S., Hawrylyshen, A., and B. Campen, "Addressing an Amplification Vulnerability in Session Initiation Protocol (SIP) Forking Proxies", RFC 5393, December 2008.

9.2. Informative References

[RFC7092] Kaplan, H. and V. Pascual, "A Taxonomy of Session Initiation Protocol (SIP) Back-to-Back User Agents", RFC 7092, December 2013.

---

Authors' Addresses 💌

Hadriel Kaplan Oracle

EMail: hadrielk@yahoo.com

Victor Pascual Quobis

EMail: victor.pascual@quobis.com 🌸