Re: Error 402 Unauthorized

You answered it yourself, didn't you?  The error is at the transaction
level, so the reply should be at the transaction level too.
 
However, you may wish to consider an alternative.  In 2002, I asked the
following question:
 
I have seen a number of discussions in the archive about the following
statement: 
"Responses must be sent to the address and port from which the
corresponding commands were sent". 
The discussions relate mostly to failover and handover situations, but I
could not find any discussion of what happens when a rogue MGC sends a
command to an MG with which it has not established a control
association.   One rule that may be relevant here is:

"It is possible that the reply to a ServiceChange with Restart will be
lost, and a command will be received by the MG prior to the receipt of
the ServiceChange response.  The MG shall issue error 505 - Command
Received before Restart Response".

Does the MG send error 505 if it has not received a restart response
from the SENDING MGC, or from ANY MGC?  If the answer is ANY MGC, how
does the MG protect itself from being sent commands by unauthorized
entities?

Tom Taylor replied:
 

The MG sends 505 to the MGC to which it has sent a ServiceChange
registration.  To any other MGC it would send 402 Unauthorized, if it
sends anything at all.  I'm not sure it should send anything, because
rogue commands could constitute a Denial of Service attack.  Remember
that we expect Megaco commands to pass over an established security
association (which brings to mind that some day we should add security
considerations to the ATM transport annex, Annex I).



________________________________

From: [email protected] [mailto:[email protected]] On Behalf
Of Sachin
Sent: Wednesday, July 16, 2008 10:33 AM
To: [email protected]
Subject: [Megaco] Error 402 Unauthorized


Hi,
 
MG has no knowledge of association with the MGC. MGC sends any command
to that gateway. The expected reply to this is an error 402. 
 
The MG in the current scenario should not accept any transaction from
the MGC. So at what level the error 402 to be sent, is it at transaction
level or at the command level.
 
Please help.
 
Thanks
Sachin
**********************************************************************************************
IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the 
named recipient(s) only.
If you have received this email in error, please notify the system manager or the sender immediately and do 
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. ***
**********************************************************************************************

_______________________________________________
Megaco mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/megaco