xep-0205.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE xep SYSTEM 'xep.dtd' [
  <!ENTITY % ents SYSTEM 'xep.ent'>
%ents;
]>
<?xml-stylesheet type='text/xsl' href='xep.xsl'?>
<xep>
<header>
  <title>Best Practices to Discourage Denial of Service Attacks</title>
  <abstract>This document recommends a number of practices that can help discourage denial of service attacks on XMPP-based networks.</abstract>
  &LEGALNOTICE;
  <number>0205</number>
  <status>Active</status>
  <type>Informational</type>
  <sig>Standards</sig>
  <approver>Council</approver>
  <dependencies>
    <spec>XMPP Core</spec>
    <spec>XMPP IM</spec>
  </dependencies>
  <supersedes/>
  <supersededby/>
  <shortname>N/A</shortname>
  &stpeter;
  <revision>
    <version>1.0.2</version>
    <date>2021-03-04</date>
    <initials>mw</initials>
    <remark><p>Cross-document editorial adjustments for inclusive language.</p></remark>
  </revision>
  <revision>
    <version>1.0.1</version>
    <date>2018-11-21</date>
    <initials>egp</initials>
    <remark><p>Fix a typo in an example, namespace 'urn:xmpperrors' → 'urn:xmpp:errors'.</p></remark>
  </revision>
  <revision>
    <version>1.0</version>
    <date>2009-01-07</date>
    <initials>psa</initials>
    <remark><p>Per a vote of the XMPP Council, advanced specification to Active; also corrected errors namespace for consistency with XEP-0182.</p></remark>
  </revision>
  <revision>
    <version>0.3</version>
    <date>2008-12-19</date>
    <initials>psa</initials>
    <remark><p>Incorporated Last Call comments: removed paragraph about compression, added paragraph about rate limiting in message or presence amplifiers, corrected simultaneous connections error per revisions to RFC 3920.</p></remark>
  </revision>
  <revision>
    <version>0.2</version>
    <date>2007-07-10</date>
    <initials>psa</initials>
    <remark><p>Add recommendation regarding multiple messages to distinct recipients; removed numerical recommendations since they are a matter of implementation or deployment.</p></remark>
  </revision>
  <revision>
    <version>0.1</version>
    <date>2007-01-31</date>
    <initials>psa</initials>
    <remark><p>Initial published version.</p></remark>
  </revision>
  <revision>
    <version>0.0.2</version>
    <date>2007-01-29</date>
    <initials>psa</initials>
    <remark><p>Incorporated feedback; specified recommendations regarding bandwidths, payload types, and service access.</p></remark>
  </revision>
  <revision>
    <version>0.0.1</version>
    <date>2007-01-21</date>
    <initials>psa</initials>
    <remark><p>First draft.</p></remark>
  </revision>
</header>
<section1 topic='Introduction' anchor='intro'>
  <p>A key factor in the reliability and security of network infrastructure is its resilience in the face of denial of service attacks (see &rfc4732;). Although the existing network of servers and clients that communicate via the Extensible Messaging and Presence Protocol (&xmppcore;) has not yet been subject to such attacks, that is no cause for complacency. Therefore this document specifies a set of best practices that server implementations and deployments can follow in order to reduce the likelihood of denial of service attacks on the Jabber network.</p>
</section1>
<section1 topic='Potential Attacks' anchor='attacks'>
  <p>&rfc4732; defines denial of service as follows:</p>
  <p class='indent'>A Denial-of-Service (DoS) attack is an attack in which one or more machines target a victim and attempt to prevent the victim from doing useful work. The victim can be a network server, client or router, a network link or an entire network, an individual Internet user or a company doing business using the Internet, an Internet Service Provider (ISP), country, or any combination of or variant on these.</p>
  <p>The authors list a number of attacks, of which the following seem most likely against XMPP systems:</p>
  <ol start='1'>
    <li>Exploiting poor software quality (e.g., buffer overlow attacks).</li>
    <li>Exhausting application or operating system resources (e.g., memory, CPU cycles, disk space, configured maximum simultaneous connections).</li>
    <li>Triggering lockouts and quota exhaustion (e.g., quotas associated with the bandwidth limits common in numerous XMPP server implementations.</li>
    <li>Hijacking the TCP connection of a client or server (see &tcprobust;).</li>
    <li>Attacking the Domain Name System (DNS) infrastructure on which XMPP typically depends.</li>
    <li>Poisoning blocklists.</li>
    <li>Amplifying network traffic (this could be done through reflectors such as &xep0045; and &xep0060; services).</li>
  </ol>
</section1>
<section1 topic='Potential Solutions' anchor='solutions'>
  <p>Numerous potential solutions have been suggested to deal with the threat of denial of service attacks against XMPP servers, including the following:</p>
  <ol start='1'>
    <li><p>Limiting the number of connections that a server will accept from a given IP address at any one time. Such a limit may help to prevent automated processes from exhausting the server's resources (such as available ports or XML parser processing resources).</p></li>
    <li><p>Limiting the number of connection attempts (via the TCP binding specified in &rfc6120; or via the &xep0124;) that a server will accept from a given IP address in a given time period. Such a limit may help to prevent automated processes from exhausting the server's resources (such as available ports or XML parser processing capacity).</p></li>
    <li><p>Limiting the number of authentication attempts for a given Jabber ID in a given time period. While such a limit may seem beneficial, in fact it might result in locking out the legitimate owner of a Jabber ID if a malicious entity attempts a large number of illegitimate authentication attempts for the Jabber ID; therefore such a limit is not recommended except as described in Section 6.4.5 of &rfc6120;, and it is instead recommended to limit the number of connections and connection attempts on a per-IP basis.</p></li>
    <li><p>Disallowing unauthenticated connections from clients and from peer servers; as mentioned below, this is required by &rfc6120;.</p></li>
    <li><p>Limiting the number of XMPP resource identifiers allowed to an account at any one time. This may help to prevent a rogue account from creating an unlimited number of sessions and therefore exhausting the resources of the server's session manager.</p></li>
    <li><p>Limiting the absolute size in bytes of XML stanzas accepted by the server, or of particular aspects of an XML stanza (e.g., attribute values, element names, XML character data). Limits on particular aspects of an XML stanza are probably not needed, as long as it is possible to limit the absolute size of each XML stanza, since such a limit may help to prevent exhaustion of server resources (e.g., XML parser processing capacity).</p></li>
    <li><p>Limiting the number of bytes or XML stanzas that a server will accept over a given TCP connection or for a given JabberID in a given time period. Such a limit, which helps to prevent rogue accounts or hijacked clients from flooding the server, is common in existing XMPP server implementations and often goes by the name "karma".</p></li>
    <li><p>Limiting the number of XML stanzas that a connected client may send to different recipients in a given time period. Such a limit may help to prevent automated processes (e.g., bots) from sending unsolicited bulk communications (known in the instant messaging domain as "spim").</p></li>
    <li><p>Limiting or prohibiting the sending of certain stanzas based on payload, type, or other appropriate features.</p></li>
    <li><p>Restricting access to services (such as multi-user chat and publish-subscribe) that enable traffic amplification.</p></li>
    <li><p>More strictly limiting the proposed restrictions depending on connection type, authentication type, or user class.</p></li>
  </ol>
</section1>
<section1 topic='Recommendations' anchor='rec'>
  <p>The following recommendations are presented roughly in order of interaction (e.g., recommendations related to the number of TCP connections or connection attempts are presented before recommendations related to authentication, which are presented before recommendations related to XML stanza handling).</p>
  <section2 topic='Simultaneous Connections' anchor='rec-connections'>
    <p>A server implementation SHOULD enable a server administrator to limit the number of connections that it will accept from a given IP address at any one time. <note>Alternatively, it is possible to limit the number of connections at the TCP layer rather than at the XMPP application layer. Care must be taken in doing so, since limits at the TCP layer might result in an inability to access non-XMPP services.</note></p>
    <p>If an entity attempts to connect but the maximum number of connections has been reached, the receiving server MUST NOT allow the new connection to proceed. There are no XMPP errors associated with this behavior, since it occurs at the binding (TCP or HTTP) level before an XML stream is initiated.</p>
  </section2>
  <section2 topic='Connection Attempts' anchor='rec-attempts'>
    <p>A server implementation SHOULD enable a server administrator to limit the number of connection attempts that it will accept from a given IP address in a given time period (e.g., one hour). <note>Alternatively, it is possible to limit the number of connections at the TCP layer rather than at the XMPP application layer. Care must be taken in doing so, since limits at the TCP layer might result in an inability to access non-XMPP services.</note></p>
    <p>If an entity attempts to connect but the maximum number of connection attempts has been reached, the receiving server MUST NOT allow the new connection to proceed. There are no XMPP errors associated with this behavior, since it occurs at the binding (TCP or HTTP) level before an XML stream is initiated.</p>
  </section2>
  <section2 topic='Unauthenticated Connections' anchor='rec-auth'>
    <p>In accordance with &rfc6120;, a server MUST NOT process XML stanzas (i.e., &MESSAGE;, &PRESENCE;, or &IQ;) from clients that have not yet provided appropriate authentication credentials, and MUST NOT process XML stanzas from peer servers whose identity it has not either authenticated via SASL (see &rfc4422;) or verified via server dialback.</p>
  </section2>
  <section2 topic='Simultaneous Resources' anchor='rec-resources'>
    <p>A server implementation SHOULD enable a server administrator to limit the number of resources it will allow an account to bind at any one time.</p>
    <p>If a connected client attempts to bind a resource but has already reached the configured number of allowable resources, the receiving server MUST return a &constraint; stanza error, where the XMPP &ERROR; element SHOULD also include an application-specific error condition of &lt;resource-limit-exceeded/&gt;, as shown in the following example:</p>
    <example caption='Resource number limit violation'><![CDATA[
<iq type='error' id='bind_2'>
  <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'>
    <resource>someresource</resource>
  </bind>
  <error type='cancel'>
    <resource-constraint xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
    <resource-limit-exceeded xmlns='urn:xmpp:errors'/>
  </error>
</iq>
]]></example>
  </section2>
  <section2 topic='Stanza Size' anchor='rec-stanzasize'>
    <p>A server implementation SHOULD enable a server administrator to limit the size of stanzas it will accept from a connected client or peer server.</p>
    <p>If a connected client or peer server sends a stanza that violates the upper limit, the receiving server SHOULD NOT process the stanza and instead SHOULD return a &notallowed; stanza error, where the XMPP &ERROR; element SHOULD also include an application-specific error condition of &lt;stanza-too-big/&gt;, as shown in the following example:</p>
    <example caption='Stanza size limit violation: stanza error'><![CDATA[
<message from='shakespeare.lit' to='iago@shakespare.lit/evilos'>
  <error type='modify'>
    <not-allowed xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
    <stanza-too-big xmlns='urn:xmpp:errors'/>
  </error>
</message>
]]></example>
    <p>Note: In the case of a stanza size limit, the server SHOULD NOT include the original payload in the error stanza.</p>
    <p>Alternatively (e.g., if the sender has sent a seriously large stanza), the server MAY instead return a &lt;policy-violation/&gt; stream error:</p>
    <example caption='Stanza size limit violation: stream error'><![CDATA[
<stream:error>
  <policy-violation xmlns='urn:ietf:params:xml:ns:xmpp-streams'/>
  <stanza-too-big xmlns='urn:xmpp:errors'/>
</stream:error>
</stream:stream>
]]></example>
  </section2>
  <section2 topic='Multiple Recipients' anchor='rec-recipients'>
    <p>A server implementation SHOULD enable a server administrator to limit the number of XML stanzas that a connected client may send to distinct recipients within a given time period.</p>
    <p>If a connected client sends too many stanzas to distinct recipients in a given time period, the receiving server SHOULD NOT process the stanza and instead SHOULD return an &unexpected; stanza error, where the XMPP &ERROR; element SHOULD also include an application-specific error condition of &lt;too-many-stanzas/&gt;, as shown in the following example:</p>
    <example caption='Stanza recipients violation: stanza error'><![CDATA[
<message from='iago@shakespeare.lit/evilos' to='juliet@capulet.lit'>
  <error type='wait'>
    <unexpected-request xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
    <too-many-stanzas xmlns='urn:xmpp:errors'/>
  </error>
</message>
]]></example>
  </section2>
  <section2 topic='Bandwidth Limits' anchor='rec-bandwidth'>
    <p>A server implementation SHOULD enable a server administrator to limit the amount of bandwidth it will allow a connected client or peer server to use in a given time period.</p>
    <p>Bandwidth limits in existing XMPP server implementations (often called "karma") can be somewhat complex, since they dynamically respond to usage patterns, take into account temporary traffic bursts, enable the server administrator to modify recovery times and penalty lengths, etc. An example of low average bandwidth limits would be 1k-2k per second, of medium limits 4k-6k per second, of high limits 8k-10k per second. For details, see documentation for existing implementations.</p>
  </section2>
  <section2 topic='Stanza Limits' anchor='rec-stanzas'>
    <p>A server implementation SHOULD enable a server administrator to limit the types of stanzas (based on payload etc.) it will allow a connected client send over an active connection. Possible restrictions include:</p>
    <ul>
      <li>Forbidding XMPP protocol extensions that typically involve the sending of large stanzas, such as &xep0008; and &xep0047;</li>
      <li>Prohibiting &xep0077; when directed to the server itself (i.e., disallowing open registration of new accounts).</li>
      <li>Limiting the number of roster requests that a user may request in a given time period.</li>
      <li>Not supporting offline message storage (or limiting the size of offline storage).</li>
      <li>Limiting the number of presence subscription requests that a user may send in a given time period.</li>
      <li>Limiting the number of stanzas that a user may generate in a given time period that are intended for unknown or non-existent JIDs, that are intended for JIDs at remote domains, or that are intended for distinct JIDs.</li>
    </ul>
  </section2>
  <section2 topic='Service Restrictions' anchor='rec-services'>
    <p>An implementation of a service that enables traffic amplification (e.g., multi-user chat or publish-subscribe) SHOULD enable an administrator of that service to limit (based on JabberID or other characteristics) what entities may send information through the service. (See &xep0045; regarding methods of banning users from multi-user chat rooms and <cite>XEP-0060</cite> regarding methods for prohibiting users from interacting with publish-subscribe nodes.)</p>
    <p>In fact, the "session manager" of an XMPP presence server also acts as just such an amplifier, since presence information is broadcast to all subscribers. Any such service SHOULD enable an administrator to limit the number of stanzas sent through the service in any given period of time (presence changes in a session manager, presence changes or messages in a chatroom, published items in a pubsub service).</p>
  </section2>
</section1>
<section1 topic='Implementation Considerations' anchor='impl'>
  <p>Implementations MAY enable administrators to configure appropriate exceptions to some of the recommendations specified in this document. Examples include:</p>
  <ul>
    <li>Less strict limits for server administrators compared to entities associated with registered accounts, and for entities associated with registered accounts compared to anonymous entities.</li>
    <li>Less strict limits for entities that authenticate via strong authentication methods (e.g., TLS + SASL EXTERNAL) compared to entities that authenticate via weaker authentication methods (e.g., TLS + SASL PLAIN or server dialback).</li>
    <li>Less strict limits for connections from known IP addresses.</li>
    <li>Less strict limits for connections made via the TCP binding compared to connections made via the HTTP binding.</li>
  </ul>
</section1>
<section1 topic='Security Considerations' anchor='security'>
  <p>This entire document is about security.</p>
</section1>
<section1 topic='IANA Considerations' anchor='iana'>
  <p>This document requires no interaction with &IANA;.</p>
</section1>
<section1 topic='XMPP Registrar Considerations' anchor='registrar'>
  <p>The &REGISTRAR; includes &lt;resource-limit-exceeded/&gt; and &lt;too-many-stanzas/&gt; in its registry of application-specific error conditions (see &APPERRORS;), where the element is qualified by the 'urn:xmpp:errors' namespace as described in &xep0182;.</p>
  <p>The registry submission is as follows:</p>
  <code><![CDATA[
<condition>
  <ns>urn:xmpp:errors</ns>
  <element>resource-limit-exceeded</element>
  <desc>
    The account is not allowed to bind more resources at this time.
  </desc>
  <doc>XEP-0205</doc>
</condition>
<condition>
  <ns>urn:xmpp:errors</ns>
  <element>too-many-stanzas</element>
  <desc>
    A connected client has attempted to send multiple stanzas to
    too many different intended recipients in a given time period.
  </desc>
  <doc>XEP-0205</doc>
</condition>
]]></code>
</section1>
<section1 topic='Acknowledgements' anchor='ack'>
  <p>Special thanks to Chris Mullins for calling attention to the need for a specification on this topic. Thanks also to Thiago Camargo, Bruce Campbell, Dave Cridland, Gustavo Felisberto, Justin Karneges, Alexey Melnikov, Pedro Melo, Kevin Smith, Michal Vaner, and Matthew Wild for their suggestions.</p>
</section1>
</xep>