SIPPING Working Group G. Camarillo Internet-Draft Ericsson Expires: September 25, 2004 A. Roach dynamicsoft March 27, 2004 Providing a Session Initiation Protocol (SIP) Application Server with a List of URIs draft-camarillo-uri-list-02.txt Status of this Memo By submitting this Internet-Draft, I certify that any applicable patent or other IPR claims of which I am aware have been disclosed, and any of which I become aware will be disclosed, in accordance with RFC 3667. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http:// www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on September 25, 2004. Copyright Notice Copyright (C) The Internet Society (2004). All Rights Reserved. Abstract This document describes how a user agent can provide an application server with a list of URIs. The way the application server uses the URIs in the list is method specific. Camarillo & Roach Expires September 25, 2004 [Page 1] Internet-Draft URI Lists in SIP March 2004 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 4. Procedures at the User Agent . . . . . . . . . . . . . . . . . 4 5. URI List Format . . . . . . . . . . . . . . . . . . . . . . . 4 6. The SIP and SIPS URI List Parameter . . . . . . . . . . . . . 5 7. The Content-ID SIP Header Field . . . . . . . . . . . . . . . 5 8. Pointing to External URI Lists . . . . . . . . . . . . . . . . 6 9. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 10. Security Considerations . . . . . . . . . . . . . . . . . . . 7 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 12. Acknowledges . . . . . . . . . . . . . . . . . . . . . . . . . 8 Normative References . . . . . . . . . . . . . . . . . . . . . 8 Informational References . . . . . . . . . . . . . . . . . . . 9 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 9 Intellectual Property and Copyright Statements . . . . . . . . 10 Camarillo & Roach Expires September 25, 2004 [Page 2] Internet-Draft URI Lists in SIP March 2004 1. Introduction Some services require a SIP UA to provide an application server with a set of URIs. For example, a UA creating a conference needs to provide the conference server with the participants. The same way, a UA requesting presence information from a set of users needs to provide the resource list server with the URIs of the users that belong to the list. These lists are typically configured using out-of-band methods. For instance, a UA can use XCAP [7] to create a list of URIs and to associate this list with a SIP URI (e.g., sip:myfriends@example.com). It can, then, send a SIP request (an INVITE or a SUBSCRIBE in our previous examples) to that SIP URI. Still, there is a need to create lists of URIs in an ad-hoc way and send them directly in a SIP message. Transporting the URI list in the SIP message that triggers the service usually helps reduce the service establishment time, and is useful for UAs that do not have access to a server to host their list (and they cannot act as a server themselves). In any case, the way the application server interprets the URI list received in the request is method specific. A UA creating a SIP request that needs to carry a URI list proceeds this way. It places the URI list (e.g., an XCAP resource list [4]) in a body part, and constructs a pointer to that body part (i.e., a Content-ID URL [2] that points to the body part that carries the URI list). Then, the UA places the pointer in a "list" URI parameter. The way the application server interprets the URI list received in the request is method specific. 2. Scope This document specifies how to associate a URI list with a SIP or SIPS URI using the "list" parameter. The base URI identifies, as usual, a resource (generally a service), which is further described by the associated URI list. SIP transport of URI lists that are not associated with a SIP or SIPS URI is outside the scope of this document. Note, in any case, that the syntax of a number of already defined SIP header fields (e.g., Alert-Info, Call-Info, Contact, etc) allows them to carry a set of URIs. Camarillo & Roach Expires September 25, 2004 [Page 3] Internet-Draft URI Lists in SIP March 2004 3. Terminology In this document, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as described in BCP 14, RFC 2119 [1] and indicate requirement levels for compliant implementations. 4. Procedures at the User Agent A UA creating a SIP request that needs to carry a SIP or SIPS URI with an associated URI list MUST place the URI list in a body part, and MUST construct a pointer to that body part (i.e., a Content-ID URL [2] that points to the body part that carries the URI list). Then, the UA MUST place the pointer in a "list" URI parameter (which is defined in Section 6) of the SIP or SIPS URI. The following is an example of a Content-ID URL: cid:cn35t8jf02@example.com The body the previous Content-ID URI points to would be described by, among other header fields, the following Content-ID header field: Content-ID: Further procedures are method specific and are defined in separate documents. For example, the use of lists and the INVITE method is described in (draft-camarillo-sipping-adhoc-conferencing-00.txt), and the use of lists and SUBSCRIBE is defined in (draft-camarillo-sipping-adhoc-simple-00.txt). As for any other SIP request, the size of requests carrying URI lists MUST NOT exceed 1300 bytes, unless the user agent client has positive knowledge that the message will not traverse a congestion-unsafe link at any hop, or that the message size is at least 200 bytes less than the lowest MTU value found en route to the server. 5. URI List Format The default URI list format for SIP entities is the XCAP resource list format defined in [4]. So, SIP entities handling URI lists MUST support this format. Nevertheless, the XCAP resource list format provides features such as hierarchical lists and list's attributes that are not needed by many Camarillo & Roach Expires September 25, 2004 [Page 4] Internet-Draft URI Lists in SIP March 2004 services, which only need to transfer a flat list of URIs from a client to a server. The amount of information that a URI list needs to carry between a client and a server is method specific. Additionally, the way a client and a server negotiate the amount of information needed for a particular service is method specific as well. A client invoking a particular service SHOULD NOT include more information in its URI list than the service requires. A server providing a particular service MAY discard any extra information which is received in a URI list from the client. The following is an example of a flat list without attributes. Figure 1: URI List 6. The SIP and SIPS URI List Parameter SIP and SIPS URIs that need to reference a URI list MUST carry a pointer to the URI list, as described in Section 4, in a "list" SIP and SIPS URI parameter. We define the "list" parameter for SIP and SIPS URIs so that it MUST contain a Content-ID URL [2] that points to a URI list. The ABNF of the "list" parameter is: list-param = "list=" absoluteURI The following is an example of a SIP URI with a list parameter pointing to a body part using a Content-ID URL [2]: sip:group@example.com;list=cid:cn35t8jf02@example.com 7. The Content-ID SIP Header Field The Content-ID MIME header field is defined in RFC 2045 [6]. We define here the same header field to be used in SIP messages. Without this definition, SIP messages with a single body could not reference it using Content-ID URLs (messages with multiple bodies use the Camarillo & Roach Expires September 25, 2004 [Page 5] Internet-Draft URI Lists in SIP March 2004 definition RFC 2045 [6]). The ABNF of the SIP Content-ID header field is: Content-ID = "Content-ID" HCOLON msg-id RFC 2822 [3] defines msg-id in Section 3.6.4. The Content-ID value is used to uniquely identify a body. The Content-ID header field MAY appear in any SIP request or response that contains a body. 8. Pointing to External URI Lists UAs that want to use an external URI list, instead of sending it as a body part, SHOULD use the content indirection mechanism defined in [5]. Indirected body parts are equivalent and have the same treatment as in-line body parts. The content indirection mechanism has certain security properties, such as allowing the UA to provide a hash of the contents of the external list, that could not be provided if "list" parameters could point directly to external lists (e.g., using an HTTP URI). 9. Examples The following is an example of an INVITE request that carries a URI list in its body. The Request-URI of this INVITE contains a pointer to the body part carrying the list. INVITE sip:ad-hoc@example.com;list=cid:cn35t8jf02@example.com SIP/2.0 Via: SIP/2.0/TCP client.chicago.example.com ;branch=z9hG4bKhjhs8ass83 Max-Forwards: 70 To: From: Carol ;tag=32331 Call-ID: d432fa84b4c76e66710 CSeq: 1 INVITE Contact: Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Allow-Events: dialog Accept: application/sdp, message/sipfrag, application/resource-lists+xml Conten-Type: multipart/mixed;boundary="boundary1" Content-Length: 679 --boundary1 Content-Type: application/sdp Camarillo & Roach Expires September 25, 2004 [Page 6] Internet-Draft URI Lists in SIP March 2004 Content-Length: 160 v=0 o=carol 2890844526 2890842807 IN IP4 chicago.example.com s=Example Subject c=IN IP4 192.0.0.1 t=0 0 m=audio 20000 RTP/AVP 0 m=video 20002 RTP/AVP 31 --boundary1 Content-Type: application/resource-lists+xml Content-Length: 315 Content-ID: --boundary1-- Figure 2: INVITE request Refer to (draft-camarillo-sipping-adhoc-conferencing-00.txt) for the normative details on how a list can be used with the INVITE method. 10. Security Considerations This document discusses how to carry URI lists in SIP messages. In some cases, the URIs in the lists may need to be kept private. It is RECOMMENDED that S/MIME is used to prevent a third party from viewing this information. Some application servers, on reception of a SIP message with a URI list, send SIP requests to the URIs in the list. Such an application server may have policies that limit the number of URIs in the list, as a very long list could be used in a denial of service attack to place a large burden on the application server to send a large number of SIP requests. In addition, it is RECOMMENDED that S/MIME is used to integrity protect the list contents to keep attackers from adding URIs to a list. An application server MUST authenticate and authorize any user that Camarillo & Roach Expires September 25, 2004 [Page 7] Internet-Draft URI Lists in SIP March 2004 requests the application server to send requests to a list of URIs. Otherwise, a malicious client could use the application server to perform a denial of service attack. In any event, this risk also exists when a client sets up a URI list using out-of-band methods (e.g., XCAP) and sends a request to that list. Application servers MUST use authentication and authorization mechanisms with equivalent security properties when sending requests to URI lists created using out-of-band and in-band methods. 11. IANA Considerations This document registers the "list" SIP and SIPS URI parameter, which is described in Section 6. This parameter is to be added to the SIP and SIPS URI parameter registry under http://www.iana.org/ TBD. This document registers the Content-ID SIP header field, which is described in Section 7. This header field is to be added to the header field registry under http://www.iana.org/assignments/ sip-parameters. Header Name: Content-ID Compact Form: (none) 12. Acknowledges Alan Johnston, Orit Levin, and Cullen Jennings provided useful comments on this document. Normative References [1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [2] Levinson, E., "Content-ID and Message-ID Uniform Resource Locators", RFC 2392, August 1998. [3] Resnick, P., "Internet Message Format", RFC 2822, April 2001. [4] Rosenberg, J., "An Extensible Markup Language (XML) Configuration Access Protocol (XCAP) Usage for Presence Lists", draft-ietf-simple-xcap-list-usage-02 (work in progress), February 2004. [5] Olson, S., "A Mechanism for Content Indirection in Session Initiation Protocol (SIP) Messages", draft-ietf-sip-content-indirect-mech-03 (work in progress), June 2003. Informational References Camarillo & Roach Expires September 25, 2004 [Page 8] Internet-Draft URI Lists in SIP March 2004 [6] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996. [7] Rosenberg, J., "The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)", draft-ietf-simple-xcap-02 (work in progress), February 2004. Authors' Addresses Gonzalo Camarillo Ericsson Hirsalantie 11 Jorvas 02420 Finland EMail: Gonzalo.Camarillo@ericsson.com Adam Roach dynamicsoft 5100 Tennyson Pkwy Suite 1200 Plano, TX 75024 US EMail: adam@dynamicsoft.com Camarillo & Roach Expires September 25, 2004 [Page 9] Internet-Draft URI Lists in SIP March 2004 Intellectual Property Statement The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the IETF's procedures with respect to rights in IETF Documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright Statement Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Acknowledgment Funding for the RFC Editor function is currently provided by the Internet Society. Camarillo & Roach Expires September 25, 2004 [Page 10]