Re: Parse error at the message level

Keep in mind that using Option 1 makes DoS attacks very easy -- I flood
your port with short malformed messages, and make you generate responses
to each and every one.  Not only do I waste your time in processing the
garbage sent, but now I make you waste the processing time in generating
a response and an unwitting accomplice by doubling the number of
messages on the network.  Further, by doing this I can make you send
response messages that are much larger than the garbage I send in,
meaning that the responder becomes the one that congests the network the
most.

I would be extremely careful about responding to malformed messages that
don't even get to a TransactionID.  The more compliant a message is to
the protocol, the more effort required to execute an attack and the less
likely it will happen.

Kevin

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf
Of Elad Chomsky
Sent: Tuesday, February 26, 2008 12:34 PM
To: [email protected]
Subject: [Megaco] Parse error at the message level

Hello All,

I was wondering about the correct behavior when a parse error at the
Message level is encountered (i.e. before any transaction request or
reply was parsed).

For example, consider the following message:

    !/3 [XXX 123.123.123.4]:55555
    T = 5 {
      ...
    }

This message should fail parsing, as it contains an illegal mId.


Option 1 is to reply with a message containing only an error descriptor.
Error code #410 seems the most appropriate. It should look something
like this:

    MEGACO/3 [124.124.124.222]:55555
    Error = 410 { "Incorrect identifier: [XXX 123.123.123.4]" }


Option 2 is to simply ignore the offending message and not generate any
reply. One (weak) corroboration to this approach is that the definition
of error #410 is "The transaction request(s) has been disregarded due to
a syntax error..."; and when parsing is aborted it is not known whether
the message contains any transaction requests.


My personal preference is option 1.

Thanks,
Elad

_______________________________________________
Megaco mailing list
[email protected]
http://www.ietf.org/mailman/listinfo/megaco