<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">Perhaps, but it needs to be clarified that such a limit must be implemented in a very specific way. Current implementations of "max stanza size" will likely not prevent this attack from being successful because it is imposed after the stanza is parsed. This attack is targeted at the streaming XML parser.<DIV><BR class="khtml-block-placeholder"></DIV><DIV>As long as there is the ability to set a limit then this attack can be thwarted. </DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Such a limiting mechanism should be implemented at the <A href="http://en.wikipedia.org/wiki/OSI_model%23Layer_4:_Transport_layer">transport</A> level, not at the <A href="http://en.wikipedia.org/wiki/OSI_model%23Layer_5:_Session_layer">session</A> or <A href="http://en.wikipedia.org/wiki/OSI_model%23Layer_6:_Presentation_layer">presentation</A> layers as currently implemented in most XMPP servers.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>While it would perhaps be a good idea to allow the server administrator the ability to disable this mechanism, I think that it should be enabled by default--perhaps set to 100k(an absurdly large size for a stanza).</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>All of these recommendations would be enumerated and described in the proposed best-practice JEP.</DIV><DIV><BR><DIV><DIV>On Mar 27, 2006, at 7:22 AM, Vinod Panicker wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><DIV>On 3/27/06, Robert B Quattlebaum, Jr. <<A href="mailto:darco@deepdarc.com">darco@deepdarc.com</A>> wrote:</DIV> <BLOCKQUOTE type="cite"><DIV>*bump*</DIV><DIV><BR></DIV><DIV>I personally think this is a rather serious issue, perhaps warranting</DIV><DIV>a "Best-practices" JEP for server developers. As XMPP becomes more</DIV><DIV>and more popular, it is only a matter of time before script-kiddies</DIV><DIV>start causing trouble.</DIV><DIV><BR></DIV><DIV>What I'm thinking is a JEP which describes the attack and ways to</DIV><DIV>prevent it from being successful. Then it makes it easy for server</DIV><DIV>authors to communicate if their server is hardened against this type</DIV><DIV>of attack: "AcmeJabD 0.3 is JEP-01xx compliant"...</DIV><DIV><BR></DIV><DIV>Any thoughts? Good idea? Better solution? Am I making this out to be</DIV><DIV>bigger than it actually is?</DIV> </BLOCKQUOTE><DIV><BR></DIV><DIV><snip/></DIV><DIV><BR></DIV><DIV>It's recommended that internet servers have a limit on the amount of</DIV><DIV>data it would accept from a client as a "command". In the case of</DIV><DIV>xmpp, the server could enforce it in terms of bytes received on the</DIV><DIV>connection. Unfortunately, this would be deployment scenario based -</DIV><DIV>since some deployments might require the server to accept a large</DIV><DIV>number of bytes in a single stanza (assuming an extension to the</DIV><DIV>protocol), while others would be happy with say a 10K limit.</DIV><DIV><BR></DIV><DIV>I think that this should be left to the server administrators to</DIV><DIV>configure, but would be a good practice if servers implement this.</DIV><DIV><BR></DIV><DIV>Regards,</DIV><DIV>Vinod.</DIV> </BLOCKQUOTE></DIV><BR></DIV><BR><BR><DIV> <SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><DIV style="font-size: 8px; "><FONT class="Apple-style-span" color="#000000"><SPAN class="Apple-style-span" style="font-size: 8px; "><SPAN class="Apple-style-span" style="font-size: 8px; "><SPAN class="Apple-style-span" style="font-size: 8px; ">__________________</SPAN></SPAN></SPAN></FONT></DIV><DIV style=""><FONT class="Apple-style-span" color="#333333"><FONT class="Apple-style-span" size="6"><SPAN class="Apple-style-span" style="font-size: 24px;; color: rgb(51, 51, 51); "><FONT class="Apple-style-span" face="Cochin"><B style="color: rgb(51, 51, 51); font-family: Cochin; font-size: 24px; font-weight: bold; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Cochin; font-size: 24px; font-weight: bold; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Cochin; font-size: 24px; font-weight: bold; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Cochin; font-size: 24px; font-weight: bold; ">Robert Quattlebaum</SPAN></SPAN></SPAN></B></FONT></SPAN></FONT></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New"><FONT class="Apple-style-span" color="#333333"><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; ">Mobile: </SPAN></SPAN></SPAN><FONT class="Apple-style-span" face="Georgia"><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; ">+1</SPAN></SPAN><FONT class="Apple-style-span" color="#2B2B2B"><SPAN class="Apple-style-span" style="color: rgb(43, 43, 43); font-family: Georgia; "><SPAN class="Apple-style-span" style="color: rgb(43, 43, 43); font-family: Georgia; ">(650) 223-4974</SPAN></SPAN></FONT></SPAN></FONT></FONT></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New"><FONT class="Apple-style-span" color="#333333"><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; ">eMail: </SPAN></SPAN></SPAN><FONT class="Apple-style-span" face="Georgia"><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><A href="mailto:darco@deepdarc.com">darco@deepdarc.com</A></SPAN></SPAN></SPAN></FONT></FONT></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New"><FONT class="Apple-style-span" color="#333333"><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; ">Jabber: </SPAN></SPAN></SPAN><FONT class="Apple-style-span" face="Georgia"><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><A href="mailto:darco@deepdarc.com">darco@deepdarc.com</A></SPAN></SPAN></SPAN></FONT></FONT></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New"><FONT class="Apple-style-span" color="#333333"><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; ">WWW</SPAN><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; "><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Courier New; ">: </SPAN></SPAN><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); ; font-family: Courier New; "><FONT class="Apple-style-span" face="Georgia"><SPAN class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Georgia; "><A href="http://www.deepdarc.com">http://www.deepdarc.com</A>/</SPAN></FONT></SPAN></SPAN></FONT></FONT></DIV><DIV><FONT class="Apple-style-span" color="#333333"><BR style="color: rgb(51, 51, 51); "></FONT><FONT class="Apple-style-span" face="Courier New"><FONT class="Apple-style-span" color="#333333"><BR class="khtml-block-placeholder"></FONT></FONT></DIV><BR class="Apple-interchange-newline"></SPAN></SPAN></SPAN> </DIV><BR></BODY></HTML>