SIPPING Working Group G. Camarillo Internet-Draft Ericsson Expires: November 30, 2004 A. Roach dynamicsoft June 2004 Message-Contained URI-Lists in the Session Initiation Protocol (SIP) draft-ietf-sipping-uri-list-00.txt Status of this Memo By submitting this Internet-Draft, I certify that any applicable patent or other IPR claims of which I am aware have been disclosed, and any of which I become aware will be disclosed, in accordance with RFC 3668. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http:// www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on November 30, 2004. Copyright Notice Copyright (C) The Internet Society (2004). All Rights Reserved. Abstract This document describes how a user agent can provide another user agent with a list of URIs in a SIP message. The way the receiving user agent uses the URIs in the list is method or status code specific. Camarillo & Roach Expires November 30, 2004 [Page 1] Internet-Draft Message-Contained URI-Lists in SIP June 2004 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. The uri-list Disposition Type . . . . . . . . . . . . . . . . 3 3.1 Default URI List Format . . . . . . . . . . . . . . . . . 4 4. Pointing to External URI Lists . . . . . . . . . . . . . . . . 4 5. Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 6. Security Considerations . . . . . . . . . . . . . . . . . . . 6 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 8. Acknowledges . . . . . . . . . . . . . . . . . . . . . . . . . 6 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 6 9.1 Normative References . . . . . . . . . . . . . . . . . . . . 6 9.2 Informational References . . . . . . . . . . . . . . . . . . 7 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 7 Intellectual Property and Copyright Statements . . . . . . . . 8 Camarillo & Roach Expires November 30, 2004 [Page 2] Internet-Draft Message-Contained URI-Lists in SIP June 2004 1. Introduction Some services require a SIP UA (User Agent) to provide another UA (e.g., a SIP URI-list service acting as a UA server) with a set of URIs. For example, a UA creating a conference needs to provide the conference server with the participants. The same way, a UA requesting presence information from a set of users needs to provide the resource list server with the URIs of the users that belong to the list. These lists are typically configured using out-of-band methods. For instance, a UA can use XCAP [8] to create a list of URIs and to associate this list with a SIP URI (e.g., sip:myfriends@example.com). It can, then, send a SIP request (an INVITE or a SUBSCRIBE in our previous examples) to that SIP URI. Still, there is a need to create lists of URIs and send them directly in a SIP message. Transporting the URI list in the SIP message that triggers the service usually helps reduce the service establishment time, and is useful for UAs that do not have access to a server to host their list (and they cannot act as a server themselves). In any case, the way the application server interprets the URI list received in the request is method specific. A UA creating a SIP request or response that needs to carry a URI list places the URI list (e.g., an XCAP resource list [4]) in a body part whose disposition type is "uri-list". The way the receiving UA interprets the URI list received is method specific, or, in the case of a response, status code specific. 2. Terminology In this document, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as described in BCP 14, RFC 2119 [1] and indicate requirement levels for compliant implementations. 3. The uri-list Disposition Type We define a new disposition type for the Content-Disposition header field: uri-list. Both requests and responses MAY carry uri-list bodies. Bodies whose disposition type is uri-list carry a list of URIs. The way a UA receiving a URI list interprets it is method specific, or, in the case of a response, status code specific. Camarillo & Roach Expires November 30, 2004 [Page 3] Internet-Draft Message-Contained URI-Lists in SIP June 2004 3.1 Default URI List Format The default format for uri-list bodies is the XCAP resource list format defined in [4]. So, SIP entities handling uri-list bodies MUST support this format. Nevertheless, the XCAP resource list format provides features such as hierarchical lists and list's attributes that are not needed by many services, which only need to transfer a flat list of URIs between two UAs. The amount of information that a URI list needs to carry between two UAs is method or status code specific. Additionally, the way a client and a server negotiate the amount of information needed for a particular service is method specific as well. A client invoking a particular service SHOULD NOT include more information in its URI list than the service requires. A server providing a particular service MAY discard any extra information which is received in a URI list from the client. The following is an example of a flat list without attributes. Figure 1: URI List 4. Pointing to External URI Lists UAs that want to use an external URI list, instead of sending it as a body part, SHOULD use the content indirection mechanism defined in [5]. Indirected body parts are equivalent and have the same treatment as in-line body parts. 5. Example The following is an example of an INVITE request that carries a URI list in its body. The Request-URI of this INVITE contains a pointer to the body part carrying the list. Camarillo & Roach Expires November 30, 2004 [Page 4] Internet-Draft Message-Contained URI-Lists in SIP June 2004 INVITE sip:conf-fact@example.com SIP/2.0 Via: SIP/2.0/TCP client.chicago.example.com ;branch=z9hG4bKhjhs8ass83 Max-Forwards: 70 To: Conf Factory From: Carol ;tag=32331 Call-ID: d432fa84b4c76e66710 CSeq: 1 INVITE Contact: Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Allow-Events: dialog Accept: application/sdp, message/sipfrag, Conten-Type: multipart/mixed;boundary="boundary1" Content-Length: 635 --boundary1 Content-Type: application/sdp v=0 o=carol 2890844526 2890842807 IN IP4 chicago.example.com s=Example Subject c=IN IP4 192.0.2.1 t=0 0 m=audio 20000 RTP/AVP 0 a=rtpmap:0 PCMU/8000 m=video 20002 RTP/AVP 31 a=rtpmap:31 H261/90000 --boundary1 Content-Type: application/resource-lists+xml Content-Disposition: uri-list --boundary1-- Figure 2: INVITE request Refer to (draft-ietf-sipping-uri-list-conferencing-00.txt) for the normative details on how a list can be used with the INVITE method. Camarillo & Roach Expires November 30, 2004 [Page 5] Internet-Draft Message-Contained URI-Lists in SIP June 2004 6. Security Considerations This document discusses how to carry URI lists in SIP messages. Attackers may attempt to modify URI lists sent between two user agents. This would cause a different service behavior than expected by the user agents. To prevent this attack, user agents SHOULD integrity protect URI lists using mechanisms such as S/MIME, which can also provide URI list confidentiality, if needed. Some application servers, on reception of a SIP message with a URI list, send SIP requests to the URIs in the list. These application servers are referred to as SIP URI-list services. The Security Considerations Section of the Requirements and Framework for SIP SIP URI-List Services [6] discusses issues related to SIP URI-list services. Implementations of SIP URI-list services MUST follow the security-related rules in [6]. These rules include mandatory authentication and authorization of clients, and opt-in lists. 7. IANA Considerations This document defines a new Content-Disposition header field disposition type (uri-list) in Section 3. This value should be registered in the IANA registry for Content-Dispositions on http://www.iana.org/assignments/mail-cont-disp with the following description: uri-list the body contains a list of URIs 8. Acknowledges Alan Johnston, Orit Levin, and Cullen Jennings provided useful comments on this document. 9. References 9.1 Normative References [1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [2] Levinson, E., "Content-ID and Message-ID Uniform Resource Locators", RFC 2392, August 1998. [3] Resnick, P., "Internet Message Format", RFC 2822, April 2001. Camarillo & Roach Expires November 30, 2004 [Page 6] Internet-Draft Message-Contained URI-Lists in SIP June 2004 [4] Rosenberg, J., "An Extensible Markup Language (XML) Configuration Access Protocol (XCAP) Usage for Presence Lists", draft-ietf-simple-xcap-list-usage-02 (work in progress), February 2004. [5] Olson, S., "A Mechanism for Content Indirection in Session Initiation Protocol (SIP) Messages", draft-ietf-sip-content-indirect-mech-03 (work in progress), June 2003. [6] Camarillo, G., "Requirements for Session Initiation Protocol (SIP) Exploder Invocation", draft-camarillo-sipping-exploders-02 (work in progress), February 2004. 9.2 Informational References [7] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996. [8] Rosenberg, J., "The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)", draft-ietf-simple-xcap-02 (work in progress), February 2004. Authors' Addresses Gonzalo Camarillo Ericsson Hirsalantie 11 Jorvas 02420 Finland EMail: Gonzalo.Camarillo@ericsson.com Adam Roach dynamicsoft 5100 Tennyson Pkwy Suite 1200 Plano, TX 75024 US EMail: adam@dynamicsoft.com Camarillo & Roach Expires November 30, 2004 [Page 7] Internet-Draft Message-Contained URI-Lists in SIP June 2004 Intellectual Property Statement The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the IETF's procedures with respect to rights in IETF Documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright Statement Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Acknowledgment Funding for the RFC Editor function is currently provided by the Internet Society. Camarillo & Roach Expires November 30, 2004 [Page 8]