valid. "UTC" and "UCT" are also invalid.
Message Details : baddate
INVITE sip:user@example.com SIP/2.0
To: sip:user@example.com
From: sip:caller@example.net;tag=2234923
Max-Forwards: 70
Call-ID: baddate.239423mnsadf3j23lj42--sedfnm234
CSeq: 1392934 INVITE
Via: SIP/2.0/UDP host.example.com;branch=z9hG4bKkdjuw
Date: Fri, 01 Jan 2010 16:00:00 EST
Contact: <sip:caller@host5.example.net>
Content-Type: application/sdp
Content-Length: 150
v=0
o=mhandley 29739 7272939 IN IP4 192.0.2.5
s=-
c=IN IP4 192.0.2.5
t=0 0
m=audio 49217 RTP/AVP 0 12
m=video 3227 RTP/AVP 31
a=rtpmap:31 LPC
3.1.2.13. Failure to Enclose name-addr URI in <>
This REGISTER request is malformed. The SIP URI contained in the
Contact Header field has an escaped header, so the field must be in
name-addr form (which implies that the URI must be enclosed in <>).
It is reasonable for an element receiving this request to respond
with a 400 Bad Request. An element choosing to be liberal in what it
accepts could infer the angle brackets since there is no ambiguity in
this example. In general, that won’t be possible.
Message Details : regbadct
REGISTER sip:example.com SIP/2.0
To: sip:user@example.com
From: sip:user@example.com;tag=998332
Max-Forwards: 70
Call-ID: regbadct.k345asrl3fdbv@10.0.0.1
CSeq: 1 REGISTER
Via: SIP/2.0/UDP 135.180.130.133:5060;branch=z9hG4bKkdjuw
Contact: sip:user@example.com?Route=%3Csip:sip.example.com%3E
l: 0
3.1.2.14. Spaces within addr-spec
This request is malformed, since the addr-spec in the To header field
contains spaces. Parsers receiving this request must not break. It
is reasonable to reject this request with a 400 Bad Request response.
Elements attempting to be liberal may ignore the spaces.
Message Details : badaspec
OPTIONS sip:user@example.org SIP/2.0
Via: SIP/2.0/UDP host4.example.com:5060;branch=z9hG4bKkdju43234
Max-Forwards: 70
From: "Bell, Alexander" <sip:a.g.bell@example.com>;tag=433423
To: "Watson, Thomas" < sip:t.watson@example.org >
Call-ID: badaspec.sdf0234n2nds0a099u23h3hnnw009cdkne3
Accept: application/sdp
CSeq: 3923239 OPTIONS
l: 0
3.1.2.15. Non-token Characters in Display Name
This OPTIONS request is malformed, since the display names in the To
and From header fields contain non-token characters but are unquoted.
It is reasonable always to reject this kind of error with a 400 Bad
Request response.
An element may attempt to be liberal in what it receives and infer
the missing quotes. If this element were a proxy, it must not
propagate the error into the request it forwards. As a consequence,
if the fields are covered by a signature, there’s not much point in
trying to be liberal - the message should simply be rejected.
Message Details : baddn
OPTIONS sip:t.watson@example.org SIP/2.0
Via: SIP/2.0/UDP c.example.com:5060;branch=z9hG4bKkdjuw
Max-Forwards: 70
From: Bell, Alexander <sip:a.g.bell@example.com>;tag=43
To: Watson, Thomas <sip:t.watson@example.org>
Call-ID: baddn.31415@c.example.com
Accept: application/sdp
CSeq: 3923239 OPTIONS
l: 0
3.1.2.16. Unknown Protocol Version
To an element implementing [RFC3261], this request is malformed due
to its high version number.
The element should respond to the request with a 505 Version Not
Supported error.
Message Details : badvers
OPTIONS sip:t.watson@example.org SIP/7.0
Via: SIP/7.0/UDP c.example.com;branch=z9hG4bKkdjuw
Max-Forwards: 70
From: A. Bell <sip:a.g.bell@example.com>;tag=qweoiqpe
To: T. Watson <sip:t.watson@example.org>
Call-ID: badvers.31417@c.example.com
CSeq: 1 OPTIONS
l: 0
3.1.2.17. Start Line and CSeq Method Mismatch
This request has mismatching values for the method in the start line
and the CSeq header field. Any element receiving this request will
respond with a 400 Bad Request.
Message Details : mismatch01
OPTIONS sip:user@example.com SIP/2.0
To: sip:j.user@example.com
From: sip:caller@example.net;tag=34525
Max-Forwards: 6
Call-ID: mismatch01.dj0234sxdfl3
CSeq: 8 INVITE
Via: SIP/2.0/UDP host.example.com;branch=z9hG4bKkdjuw
l: 0
3.1.2.18. Unknown Method with CSeq Method Mismatch
This message has an unknown method in the start line, and a CSeq
method tag that does not match.
Any element receiving this response should respond with a 501 Not
Implemented. A 400 Bad Request is also acceptable, but choosing a
501 (particularly at proxies) has better future-proof
characteristics.
Message Details : mismatch02
NEWMETHOD sip:user@example.com SIP/2.0
To: sip:j.user@example.com
From: sip:caller@example.net;tag=34525
Max-Forwards: 6
Call-ID: mismatch02.dj0234sxdfl3
CSeq: 8 INVITE
Contact: <sip:caller@host.example.net>
Via: SIP/2.0/UDP host.example.net;branch=z9hG4bKkdjuw
Content-Type: application/sdp
l: 138
v=0
o=mhandley 29739 7272939 IN IP4 192.0.2.1
c=IN IP4 192.0.2.1
m=audio 49217 RTP/AVP 0 12
m=video 3227 RTP/AVP 31
a=rtpmap:31 LPC
3.1.2.19. Overlarge Response Code
This response has a response code larger than 699. An element
receiving this response should simply drop it.
Message Details : bigcode
SIP/2.0 4294967301 better not break the receiver
Via: SIP/2.0/UDP 192.0.2.105;branch=z9hG4bK2398ndaoe
Call-ID: bigcode.asdof3uj203asdnf3429uasdhfas3ehjasdfas9i
CSeq: 353494 INVITE
From: <sip:user@example.com>;tag=39ansfi3
To: <sip:user@example.edu>;tag=902jndnke3
Content-Length: 0
Contact: <sip:user@host105.example.com>
3.2. Transaction Layer Semantics
This section contains tests that exercise an implementation’s parser
and transaction-layer logic.
3.2.1. Missing Transaction Identifier
This request indicates support for RFC 3261-style transaction
identifiers by providing the z9hG4bK prefix to the branch parameter,
but it provides no identifier. A parser must not break when
receiving this message. An element receiving this request could
reject the request with a 400 Response (preferably statelessly, as
other requests from the source are likely also to have a malformed
branch parameter), or it could fall back to the RFC 2543-style
transaction identifier.
Message Details : badbranch
OPTIONS sip:user@example.com SIP/2.0
To: sip:user@example.com
From: sip:caller@example.org;tag=33242
Max-Forwards: 3
Via: SIP/2.0/UDP 192.0.2.1;branch=z9hG4bK
Accept: application/sdp
Call-ID: badbranch.sadonfo23i420jv0as0derf3j3n
CSeq: 8 OPTIONS
l: 0
3.3. Application-Layer Semantics
This section contains tests that exercise an implementation’s parser
and application-layer logic.
3.3.1. Missing Required Header Fields
This request contains no Call-ID, From, or To header fields.
An element receiving this message must not break because of the
missing information. Ideally, it will respond with a 400 Bad Request
error.
Message Details : insuf
INVITE sip:user@example.com SIP/2.0
CSeq: 193942 INVITE
Via: SIP/2.0/UDP 192.0.2.95;branch=z9hG4bKkdj.insuf
Content-Type: application/sdp
l: 152
v=0
o=mhandley 29739 7272939 IN IP4 192.0.2.95
s=-
c=IN IP4 192.0.2.95
t=0 0
m=audio 49217 RTP/AVP 0 12
m=video 3227 RTP/AVP 31
a=rtpmap:31 LPC
3.3.2. Request-URI with Unknown Scheme
This OPTIONS contains an unknown URI scheme in the Request-URI. A
parser must accept this as a well-formed SIP request.
An element receiving this request will reject it with a 416
Unsupported URI Scheme response.
Some early implementations attempt to look at the contents of the To
header field to determine how to route this kind of request. That is
an error. Despite the fact that the To header field and the Request
URI frequently look alike in simplistic first-hop messages, the To
header field contains no routing information.
Message Details : unkscm
OPTIONS nobodyKnowsThisScheme:totallyopaquecontent SIP/2.0
To: sip:user@example.com
From: sip:caller@example.net;tag=384
Max-Forwards: 3
Call-ID: unkscm.nasdfasser0q239nwsdfasdkl34
CSeq: 3923423 OPTIONS
Via: SIP/2.0/TCP host9.example.com;branch=z9hG4bKkdjuw39234
Content-Length: 0
3.3.3. Request-URI with Known but Atypical Scheme
This OPTIONS contains an Request-URI with an IANA-registered scheme
that does not commonly appear in Request-URIs of SIP requests. A
parser must accept this as a well-formed SIP request.
If an element will never accept this scheme as meaningful in a
Request-URI, it is appropriate to treat it as unknown and return a
416 Unsupported URI Scheme response. If the element might accept
some URIs with this scheme, then a 404 Not Found is appropriate for
those URIs it doesn’t accept.
Message Details : novelsc
OPTIONS soap.beep://192.0.2.103:3002 SIP/2.0
To: sip:user@example.com
From: sip:caller@example.net;tag=384
Max-Forwards: 3
Call-ID: novelsc.asdfasser0q239nwsdfasdkl34
CSeq: 3923423 OPTIONS
Via: SIP/2.0/TCP host9.example.com;branch=z9hG4bKkdjuw39234
Content-Length: 0
3.3.4. Unknown URI Schemes in Header Fields
This message contains registered schemes in the To, From, and Contact
header fields of a request. The message is syntactically valid.
Parsers must not fail when receiving this message.
Proxies should treat this message as they would any other request for
this URI. A registrar would reject this request with a 400 Bad
Request response, since the To: header field is required to contain a
SIP or SIPS URI as an AOR.
Message Details : unksm2
REGISTER sip:example.com SIP/2.0
To: isbn:2983792873
From: <http://www.example.com>;tag=3234233
Call-ID: unksm2.daksdj@hyphenated-host.example.com
CSeq: 234902 REGISTER
Max-Forwards: 70
Via: SIP/2.0/UDP 192.0.2.21:5060;branch=z9hG4bKkdjuw
Contact: <name:John_Smith>
l: 0
3.3.5. Proxy-Require and Require
This request tests proper implementation of SIP’s Proxy-Require and
Require extension mechanisms.
Any element receiving this request will respond with a 420 Bad
Extension response, containing an Unsupported header field listing
these features from either the Require or Proxy-Require header field,
depending on the role in which the element is responding.
Message Details : bext01
OPTIONS sip:user@example.com SIP/2.0
To: sip:j_user@example.com
From: sip:caller@example.net;tag=242etr
Max-Forwards: 6
Call-ID: bext01.0ha0isndaksdj
Require: nothingSupportsThis, nothingSupportsThisEither
Proxy-Require: noProxiesSupportThis, norDoAnyProxiesSupportThis
CSeq: 8 OPTIONS
Via: SIP/2.0/TLS fold-and-staple.example.com;branch=z9hG4bKkdjuw
Content-Length: 0
3.3.6. Unknown Content-Type
This INVITE request contains a body of unknown type. It is
syntactically valid. A parser must not fail when receiving it.
A proxy receiving this request would process it just as it would any
other INVITE. An endpoint receiving this request would reject it
with a 415 Unsupported Media Type error.
Message Details : invut
INVITE sip:user@example.com SIP/2.0
Contact: <sip:caller@host5.example.net>
To: sip:j.user@example.com
From: sip:caller@example.net;tag=8392034
Max-Forwards: 70
Call-ID: invut.0ha0isndaksdjadsfij34n23d
CSeq: 235448 INVITE
Via: SIP/2.0/UDP somehost.example.com;branch=z9hG4bKkdjuw
Content-Type: application/unknownformat
Content-Length: 40
<audio>
<pcmu port="443"/>
</audio>
3.3.7. Unknown Authorization Scheme
This REGISTER request contains an Authorization header field with an
unknown scheme. The request is well formed. A parser must not fail
when receiving it.
A proxy will treat this request as it would any other REGISTER. If
it forwards the request, it will include this Authorization header
field unmodified in the forwarded messages.
A registrar that does not care about challenge-response
authentication will simply ignore the Authorization header field,
processing this registration as if the field were not present. A
registrar that does care about challenge-response authentication will
reject this request with a 401, issuing a new challenge with a scheme
it understands.
Endpoints choosing not to act as registrars will simply reject the
request. A 405 Method Not Allowed is appropriate.
Message Details : regaut01
REGISTER sip:example.com SIP/2.0
To: sip:j.user@example.com
From: sip:j.user@example.com;tag=87321hj23128
Max-Forwards: 8
Call-ID: regaut01.0ha0isndaksdj
CSeq: 9338 REGISTER
Via: SIP/2.0/TCP 192.0.2.253;branch=z9hG4bKkdjuw
Authorization: NoOneKnowsThisScheme opaque-data=here
Content-Length:0
3.3.8. Multiple Values in Single Value Required Fields
The message contains a request with multiple Call-ID, To, From, Max-
Forwards, and CSeq values. An element receiving this request must
not break.
An element receiving this request would respond with a 400 Bad
Request error.
Message Details : multi01
INVITE sip:user@company.com SIP/2.0
Contact: <sip:caller@host25.example.net>
Via: SIP/2.0/UDP 192.0.2.25;branch=z9hG4bKkdjuw
Max-Forwards: 70
CSeq: 5 INVITE
Call-ID: multi01.98asdh@192.0.2.1
CSeq: 59 INVITE
Call-ID: multi01.98asdh@192.0.2.2
From: sip:caller@example.com;tag=3413415
To: sip:user@example.com
To: sip:other@example.net
From: sip:caller@example.net;tag=2923420123
Content-Type: application/sdp
l: 154
Contact: <sip:caller@host36.example.net>
Max-Forwards: 5
v=0
o=mhandley 29739 7272939 IN IP4 192.0.2.25
s=-
c=IN IP4 192.0.2.25
t=0 0
m=audio 49217 RTP/AVP 0 12
m=video 3227 RTP/AVP 31
a=rtpmap:31 LPC
3.3.9. Multiple Content-Length Values
Multiple conflicting Content-Length header field values appear in
this request.
From a framing perspective, this situation is equivalent to an
invalid Content-Length value (or no value at all).
An element receiving this message should respond with an error. This
request appeared over UDP, so the remainder of the datagram can
simply be discarded. If a request like this arrives over TCP, the
framing error is not recoverable, and the connection should be
closed.
Message Details : mcl01
OPTIONS sip:user@example.com SIP/2.0
Via: SIP/2.0/UDP host5.example.net;branch=z9hG4bK293423
To: sip:user@example.com
From: sip:other@example.net;tag=3923942
Call-ID: mcl01.fhn2323orihawfdoa3o4r52o3irsdf
CSeq: 15932 OPTIONS
Content-Length: 13
Max-Forwards: 60
Content-Length: 5
Content-Type: text/plain
There’s no way to know how many octets are supposed to be here.
3.3.10. 200 OK Response with Broadcast Via Header Field Value
This message is a response with a 2nd Via header field value’s sent-
by containing 255.255.255.255. The message is well formed; parsers
must not fail when receiving it.
Per [RFC3261], an endpoint receiving this message should simply
discard it.
If a proxy followed normal response processing rules blindly, it
would forward this response to the broadcast address. To protect
against this as an avenue of attack, proxies should drop such
responses.
Message Details : bcast
SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.0.2.198;branch=z9hG4bK1324923
Via: SIP/2.0/UDP 255.255.255.255;branch=z9hG4bK1saber23
Call-ID: bcast.0384840201234ksdfak3j2erwedfsASdf
CSeq: 35 INVITE
From: sip:user@example.com;tag=11141343
To: sip:user@example.edu;tag=2229
Content-Length: 154
Content-Type: application/sdp
Contact: <sip:user@host28.example.com>
v=0
o=mhandley 29739 7272939 IN IP4 192.0.2.198
s=-
c=IN IP4 192.0.2.198
t=0 0
m=audio 49217 RTP/AVP 0 12
m=video 3227 RTP/AVP 31
a=rtpmap:31 LPC
3.3.11. Max-Forwards of Zero
This is a legal SIP request with the Max-Forwards header field value
set to zero.
A proxy should not forward the request and should respond 483 (Too
Many Hops). An endpoint should process the request as if the Max-
Forwards field value were still positive.
Message Details : zeromf
OPTIONS sip:user@example.com SIP/2.0
To: sip:user@example.com
From: sip:caller@example.net;tag=3ghsd41
Call-ID: zeromf.jfasdlfnm2o2l43r5u0asdfas
CSeq: 39234321 OPTIONS
Via: SIP/2.0/UDP host1.example.com;branch=z9hG4bKkdjuw2349i
Max-Forwards: 0
Content-Length: 0
3.3.12. REGISTER with a Contact Header Parameter
This register request contains a contact where the ’unknownparam’
parameter must be interpreted as a contact-param and not a url-param.
This REGISTER should succeed. The response must not include
"unknownparam" as a url-parameter for this binding. Likewise,
"unknownparam" must not appear as a url-parameter in any binding
during subsequent fetches.
Behavior is the same, of course, for any known contact-param
parameter names.
Message Details : cparam01
REGISTER sip:example.com SIP/2.0
Via: SIP/2.0/UDP saturn.example.com:5060;branch=z9hG4bKkdjuw
Max-Forwards: 70
From: sip:watson@example.com;tag=DkfVgjkrtMwaerKKpe
To: sip:watson@example.com
Call-ID: cparam01.70710@saturn.example.com
CSeq: 2 REGISTER
Contact: sip:+19725552222@gw1.example.net;unknownparam
l: 0
3.3.13. REGISTER with a url-parameter
This register request contains a contact where the URI has an unknown
parameter.
The register should succeed, and a subsequent retrieval of the
registration must include "unknownparam" as a url-parameter.
Behavior is the same, of course, for any known url-parameter names.
Message Details : cparam02
REGISTER sip:example.com SIP/2.0
Via: SIP/2.0/UDP saturn.example.com:5060;branch=z9hG4bKkdjuw
Max-Forwards: 70
From: sip:watson@example.com;tag=838293
To: sip:watson@example.com
Call-ID: cparam02.70710@saturn.example.com
CSeq: 3 REGISTER
Contact: <sip:+19725552222@gw1.example.net;unknownparam>
l: 0
3.3.14. REGISTER with a URL Escaped Header
This register request contains a contact where the URI has an escaped
header.
The register should succeed, and a subsequent retrieval of the
registration must include the escaped Route header in the contact URI
for this binding.
Message Details : regescrt
REGISTER sip:example.com SIP/2.0
To: sip:user@example.com
From: sip:user@example.com;tag=8
Max-Forwards: 70
Call-ID: regescrt.k345asrl3fdbv@192.0.2.1
CSeq: 14398234 REGISTER
Via: SIP/2.0/UDP host5.example.com;branch=z9hG4bKkdjuw
M: <sip:user@example.com?Route=%3Csip:sip.example.com%3E>
L:0
3.3.15. Unacceptable Accept Offering
This request indicates that the response must contain a body in an
unknown type. In particular, since the Accept header field does not
contain application/sdp, the response may not contain an SDP body.
The recipient of this request could respond with a 406 Not
Acceptable, with a Warning/399 indicating that a response cannot be
formulated in the formats offered in the Accept header field. It is
also appropriate to respond with a 400 Bad Request, since all SIP
User-Agents (UAs) supporting INVITE are required to support
application/sdp.
Message Details : sdp01
INVITE sip:user@example.com SIP/2.0
To: sip:j_user@example.com
Contact: <sip:caller@host15.example.net>
From: sip:caller@example.net;tag=234
Max-Forwards: 5
Call-ID: sdp01.ndaksdj9342dasdd
Accept: text/nobodyKnowsThis
CSeq: 8 INVITE
Via: SIP/2.0/UDP 192.0.2.15;branch=z9hG4bKkdjuw
Content-Length: 150
Content-Type: application/sdp
v=0
o=mhandley 29739 7272939 IN IP4 192.0.2.5
s=-
c=IN IP4 192.0.2.5
t=0 0
m=audio 49217 RTP/AVP 0 12
m=video 3227 RTP/AVP 31
a=rtpmap:31 LPC
3.4. Backward Compatibility
3.4.1. INVITE with RFC 2543 Syntax
This is a legal message per RFC 2543 (and several bis versions) that
should be accepted by RFC 3261 elements that want to maintain
backwards compatibility.
o There is no branch parameter at all on the Via header field value.
o There is no From tag.
o There is no explicit Content-Length. (The body is assumed to be
all octets in the datagram after the null-line.)
o There is no Max-Forwards header field.
Message Details : inv2543
INVITE sip:UserB@example.com SIP/2.0
Via: SIP/2.0/UDP iftgw.example.com
From: <sip:+13035551111@ift.client.example.net;user=phone>
Record-Route: <sip:UserB@example.com;maddr=ss1.example.com>
To: sip:+16505552222@ss1.example.net;user=phone
Call-ID: inv2543.1717@ift.client.example.com
CSeq: 56 INVITE
Content-Type: application/sdp
v=0
o=mhandley 29739 7272939 IN IP4 192.0.2.5
s=-
c=IN IP4 192.0.2.5
t=0 0
m=audio 49217 RTP/AVP 0
4. Security Considerations
This document presents NON-NORMATIVE examples of SIP session
establishment. The security considerations in [RFC3261] apply.
Parsers must carefully consider edge conditions and malicious input
as part of their design. Attacks on many Internet systems use
crafted input to cause implementations to behave in undesirable ways.
Many of the messages in this document are designed to stress a parser
implementation at points traditionally used for such attacks.
However, this document does not attempt to be comprehensive. It
should be considered a seed to stimulate thinking and planning, not
simply a set of tests to be passed.
5. Acknowledgements
The final detailed review of this document was performed by Diego
Besprosvan, Vijay Gurbani, Shashi Kumar, Derek MacDonald, Gautham
Narasimhan, Nils Ohlmeier, Bob Penfield, Reinaldo Penno, Marc
Petit-Huguenin, Richard Sugarman, and Venkatesh Venkataramanan.
Earlier versions of this document were reviewed by Aseem Agarwal,
Rafi Assadi, Gonzalo Camarillo, Ben Campbell, Cullen Jennings, Vijay
Gurbani, Sunitha Kumar, Rohan Mahy, Jon Peterson, Marc
Petit-Huguenin, Vidhi Rastogi, Adam Roach, Bodgey Yin Shaohua, and
Tom Taylor.
Thanks to Cullen Jennings and Eric Rescorla for their contribution to
the multipart/mime sections of this document and their work
constructing S/MIME examples in [SIP-SEC]. Thanks to Neil Deason for
contributing several messages and to Kundan Singh for performing
parser validation of messages in earlier versions.
The following individuals provided significant comments during the
early phases of the development of this document: Jean-Francois Mule,
Hemant Agrawal, Henry Sinnreich, David Devanatham, Joe Pizzimenti,
Matt Cannon, John Hearty, the whole MCI IPOP Design team, Scott
Orton, Greg Osterhout, Pat Sollee, Doug Weisenberg, Danny Mistry,
Steve McKinnon, and Denise Ingram, Denise Caballero, Tom Redman, Ilya
Slain, Pat Sollee, John Truetken, and others from MCI, 3Com, Cisco,
Lucent, and Nortel.
6. Informative References
[RFC2822] Resnick, P., "Internet Message Format", RFC 2822, April
2001.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,