<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi guys,<br><br>What do you think about the RFC 5393 on loop detection and amplification
attack protection? <br><br>The RFC is short and still a proposed
standard but don't you think it could be useful to prevent loop and
amplification attack? Because even if the max-forward field reduces the
loop to ~70 hosts (in most cases) with some techniques we could fork the
message up to 2^70 messages (as described in the RFC) to crash the
servers.<br><br>Basically the server has to do 2 things:<br>* check if it is not already in the via of the message<br>*
the previous check is not enough as a B2BUA could have replaced the via
headers, so the RFC introduces a new field called max-breadth to limit
the forking.<br><br>I have not seen a lot of implementation of this RFC
on the free SIP software and I think it could be a good way to improve
kamailio making a module for it (the easier way to implement this
feature I think).<br><br>In fact I'm in a research internship about VoIP
security and
I have time to develop such a module for kamailio if you think it's a
good idea (I'm looking for some security improvements in free software
solutions so if you have other idea don't hesitate to tell me).<br><br>Cheers,<br><br><br>Tetram </div></body>
</html>