RFC 4538
Request Authorization through Dialog Identification in the Session Initiation Protocol (SIP)
RFC 4538: Request Authorization through Dialog Identification in SIP 🎀
Okay bestie, let's get into it! 💖 This is RFC 4538, called Request Authorization through Dialog Identification in the Session Initiation Protocol (SIP). It's a Standards Track document, so it's an actual Internet standard and not just a suggestion. 💅 It was written by J. Rosenberg from Cisco Systems and dated June 2006. The header doesn't have an "Obsoletes" or "Updates" line, so it doesn't replace or change any other RFC. 🦋
Status of This Memo 📜
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. 🌸 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited. ✨
Copyright Notice ⭐
The copyright line reads Copyright (C) The Internet Society (2006). 🫶
Abstract 🔥
Here's the big picture: this spec defines the Target-Dialog header field for SIP, plus its option tag, tdialog. ✨ The header goes in requests that create SIP dialogs, and it tells the recipient that the sender already knows about an existing dialog with that recipient. That could be because the sender is on the other side of the dialog, or because it can access the dialog identifiers. 👑 The recipient can then use that awareness to authorize the request. Iconic. 💜
Table of Contents 🧚
1. Introduction ....................................................3
1.1. Terminology ................................................4
2. Overview of Operation ...........................................4
3. User Agent Client (UAC) Behavior ................................5
4. User Agent Server Behavior ......................................7
5. Proxy Behavior ..................................................8
6. Extensibility Considerations ....................................8
7. Header Field Definition .........................................9
8. Security Considerations .........................................9
9. Relationship with In-Reply-To ..................................10
10. Example Call Flow .............................................10
11. IANA Considerations ...........................................13
11.1. Header Field .............................................13
11.2. Header Field Parameters ..................................13
11.2.1. local-tag .........................................13
11.2.2. remote-tag ........................................13
11.3. SIP Option Tag ...........................................14
12. Acknowledgements ..............................................14
13. References ....................................................14
13.1. Normative References .....................................14
13.2. Informative References ...................................151. Introduction 🌈
Okay so, SIP [2] defines a dialog as a persistent relationship between a pair of user agents. 💖 Dialogs carry context like sequence numbers, proxy routes, and dialog identifiers. They get set up when SIP requests with certain methods are sent. Specifically, INVITE, REFER [8], and SUBSCRIBE [3] requests all create dialogs. 🎀
Now here's the tricky part. When a user agent gets a request that creates a dialog, it has to decide whether to authorize that request. 🤔 For some requests, that decision depends on who the sender is, what the request method is, and stuff like that. But lots of situations have come up where the decision depends on whether the sender is currently in a dialog with that user agent, or whether the sender knows about a dialog the user agent has with someone else. 💅
First example: call transfer, done with REFER. Say user agents A and B are in an INVITE dialog, and A wants to transfer B over to user agent C. 🦋 A has to send a REFER to B, asking B to send an INVITE to C. B needs to authorize that REFER. The right call is for B to accept it if it came from a user B currently has an INVITE dialog with. 🫶
Right now, implementations handle this by sending the REFER on the same dialog that's already running between A and B. 😭 But that approach has lots of problems [12]. The big ones: it's hard to figure out the lifecycle of the dialog and its usages, and it's hard to tell which messages belong to which application usage. 💀 So the better move is for A to send the REFER to B outside of the dialog. Then B needs some other way to authorize that REFER. ✨
Second example: the application interaction framework [14]. In that framework, proxy servers on the path of a SIP INVITE can put user interface components on the user agent that generated or received the request. 🌸 To pull that off, the proxy has to send a REFER to the user agent, aimed at its Globally Routable User Agent URI (GRUU) [13]. That REFER asks the user agent to fetch an HTTP resource that holds the UI component. Again, the user agent needs a way to authorize the REFER. 👑 The framework says the request should be authorized if it came from an entity on the path of the original dialog. 🧚 The trick is to include the dialog identifiers in the REFER. That proves the sender knows those identifiers. (And this needs protecting from eavesdroppers through the sips mechanism, obviously. 🙈)
Third example: say two user agents share an INVITE dialog, and some element on the INVITE's path wants to keep track of the INVITE's state. 🍓 That element sends a SUBSCRIBE to the user agent's GRUU, asking for a subscription to the dialog event package. If the SUBSCRIBE came from an element on the INVITE request path, it should be authorized. 💜
1.1. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [1]. 🌟 These are the official requirement words, so read them carefully, bestie. 💅
2. Overview of Operation 🦋
Here's the picture! 👀
+--------+ +--------+
| | INVITE | |
| Server |----------->| Server |
| A | | B |
| |...........>| |
+--------+ +--------+
^ REFER . \
/ . \
/ . \
/ . \
/ . \
/ V V
+--------+ +--------+
| | | |
| User | | User |
| Agent | | Agent |
| A | | B |
+--------+ +--------+
Figure 1Figure 1 shows the basic model. 🌷 User agent A sends an INVITE to user agent B, and it goes through two servers, server A and server B. Both servers act as proxies for that transaction. Then B sends back a 200 OK response to the INVITE. 💖 This 200 OK includes a Supported header field that says B supports this spec, shown by the tdialog option tag being there. And that 200 OK sets up a dialog between the two user agents. Dialog created, bestie! 🎉
Next up: an entity that was on the request path (server A, for example) wants to send a dialog-forming request, like REFER, to user agent A or B (say, B). ✨ So that entity acts as a user agent and sends the request to user agent B. The request is addressed to B's URI, which server A learned by looking at the Contact header field in the 200 OK for the INVITE. 🫶 If that URI has the GRUU [11] property (meaning any element on the Internet, like server A, can use it to reach the exact user agent instance that generated that 200 OK), then the mechanism works across NAT boundaries. 🌈
The request server A generates will contain a Target-Dialog header field. 🧚 That header holds the dialog identifiers for the INVITE dialog between user agents A and B, made up of the Call-ID, local tag, and remote tag. Server A knew to include the Target-Dialog header in the REFER because it knows user agent B supports it. 👑
When the request reaches user agent B, B has to make an authorization decision. 🔥 The INVITE dialog was set up using a sips URI, and the dialog identifiers are cryptographically random [2]. So no entity except user agent A or the proxies on the path of the initial INVITE can know the dialog identifiers. 💀 That means that since the request contains those identifiers, user agent B can be certain the request came from user agent A, one of the two proxies, or an entity that user agent or proxies gave the dialog identifiers to. 💜 So B authorizes the request and performs the requested actions. Periodt. 💅
That's Part 1 of 4 done! 🎀 Part 2 is coming next, so stay tuned, bestie. 💖
3. User Agent Client (UAC) Behavior 🎀
okay so a UAC SHOULD include a Target-Dialog header field in a request if ALL of these are true 💅
- the request is going out outside of any existing dialog
- the UAC thinks the request might not get authorized by the UAS unless the UAC can prove it knows the dialog identifiers for some other dialog. call that one the target dialog 👀
- the request doesn't already have anything showing the UAC knows those dialog identifiers
- the UAC knows the UAS supports the Target-Dialog header field. it can know this if it saw a request or response from the UAS inside the target dialog that had a Supported header field with the tdialog option tag in it ✨
if the fourth condition isn't met, the UAC SHOULD NOT use this specification. instead, if it's already in a dialog with the User Agent Server (UAS), it SHOULD try to send the request inside the existing target dialog 🫶
here are some use cases where these conditions ARE met 🦋
- a REFER request is sent according to the principles of [14]. these REFERs are sent outside of a dialog and don't contain anything else showing awareness of the target dialog. [14] also mandates that the REFER be sent only if the UA indicates support for the target dialog specification 💜
- User A is in separate calls with users B and C. User A decides to start a three way call, and so morphs into a focus [17]. User B would like to learn the other participants in the conference. So, it sends a SUBSCRIBE request to user A (who is now acting as the focus) for the conference event package [16]. It is sent outside of the existing dialog between user B and the focus, and it would be authorized by A if user B could prove that it knows the dialog identifiers for its existing dialog with the focus. Thus, the Target-Dialog header field would be included in the SUBSCRIBE 🌸
and here are some where the conditions are NOT met 🙈
- a server acting as a proxy is a participant in an INVITE dialog that establishes a session. the server would like to use the Keypad Markup Language (KPML) event package [18] to find out about keypresses from the originating user agent. to do this, it sends a SUBSCRIBE request. however, the Event header field of this SUBSCRIBE contains event parameters that indicate the target dialog of the subscription. so the request can be authorized without additional information 💀
- a server acting as a proxy is a participant in an INVITE dialog that establishes a session. the server would like to use the dialog event package [15] to find out about dialogs at the originating user agent. to do this, it sends a SUBSCRIBE request. however, the Event header field of this SUBSCRIBE contains event parameters that indicate the target dialog of the subscription.
so the request can be authorized without additional information. no notes 🙅♀️
specs that plan to use the Target-Dialog header field SHOULD discuss the specific conditions where it's supposed to be included 🎀
okay now the important bit 🚨 assuming it IS being included, the value of the callid production in the Target-Dialog header field MUST be equal to the Call-ID of the target dialog. the "remote-tag" header field parameter MUST be present and MUST contain the tag that would be viewed as the remote tag from the perspective of the recipient of the new request. the "local-tag" header field parameter MUST be present and MUST contain the tag that would be viewed as the local tag from the perspective of the recipient of the new request 🔥
the request the UAC sends SHOULD include a Require header field that has the tdialog option tag. in theory this request should never fail with a 420 (Bad Extension) response, because the UAC wouldn't have sent it unless it believed the UAS supported the extension 🥹 if there was no Require header field and the UAS didn't support the extension, it would normally reject the request because it was unauthorized, probably with a 403. BUT without the Require header field, the UAC couldn't tell the difference between these two 403s:
- a 403 that showed up because the UAS didn't actually understand the Target-Dialog header field (in which case the client should send the request within the target dialog if it can)
- a 403 that showed up because the UAS understood the Target-Dialog header field, but chose not to authorize the request even though the UAC proved it knew the target dialog (in which case the client should not resend the request within the target dialog, even if it could)
the vibes are very "read the room" honestly 😭
4. User Agent Server Behavior 💖
if a user agent server gets a dialog-creating request and wants to authorize it, AND that authorization depends on whether the sender knows about an existing dialog with the UAS, AND information outside of the Target-Dialog header field doesn't prove that knowledge, then the UAS SHOULD check the request for the Target-Dialog header field. if that header field isn't there, the UAS MAY still authorize the request by other means 🧚
if the header field IS there, and the callid production value, the "remote-tag", and the "local-tag" values all match the Call-ID, remote tag, and local tag of an existing dialog, AND that dialog was established using a sips URI, the UAS SHOULD authorize the request if it would authorize any entity on the path of the request that created that dialog, or any entity trusted by an entity on the path of that request 🔐
if the dialog identifiers match, but they match a dialog that wasn't created with a sips URI, the UAS MAY authorize the request if it would authorize any entity on the path of the request that created that dialog, or any entity trusted by an entity on the path of that request. however, in this case any eavesdropper on the original dialog path would have access to the dialog identifiers, so the authorization is optional 👀
and if the dialog identifiers DON'T match, or they don't contain both a "remote-tag" and "local-tag" parameter, the header field MUST be ignored, and authorization MAY be determined by other means 🫠
5. Proxy Behavior 🌈
proxy behavior is totally unaffected by this specification ✨
6. Extensibility Considerations 🦋
this spec depends on a user agent client knowing, BEFORE it sends a request to a user agent server, whether that UAS supports the Target-Dialog header field. like we talked about in Section 3, the UAC can know this because it saw a request or response from that UAS inside the target dialog that had the Supported header field with the tdialog option tag in its value 💅
because of this requirement, it's especially important that user agents following this spec include a Supported header field in ALL dialog forming requests and responses. including the Supported header field in requests is at SHOULD strength per RFC 3261, and this spec doesn't change that 🙌 BUT implementers should realize that unless the tdialog option tag is in the Supported header field of requests and responses, this extension probably won't get used. instead, the request will likely get re-sent within the existing target dialog (assuming the sender is the UA on the other side of the target dialog) 😤 so the only cases where the SHOULD wouldn't be followed are the rare ones where the UA doesn't want to turn this extension on at all 🎀
7. Header Field Definition 🍓
the grammar for the Target-Dialog header field goes like this 🧁
Target-Dialog = "Target-Dialog" HCOLON callid *(SEMI
td-param) ;callid from RFC 3261
td-param = remote-param / local-param /
generic-param
remote-param = "remote-tag" EQUAL token
local-param = "local-tag" EQUAL token
;token and generic-param from RFC 3261Figures 3 and 4 extend Tables 2 and 3 in RFC 3261 [2] for the Target-Dialog header field. the "INF" column is for the INFO method [4], "PRA" is for the PRACK method [5], "UPD" is for the UPDATE method [6], "SUB" is for the SUBSCRIBE method [3], "NOT" is for the NOTIFY method [3], "MSG" is for the MESSAGE method [7], "REF" is for the REFER method [8], and "PUB" is for the PUBLISH method [9] 📋
Header field where proxy ACK BYE CAN INV OPT REG PUB
Target-Dialog R - - - - o - - -
Figure 3: Allowed Methods for Target-DialogHeader field where proxy PRA UPD SUB NOT INF MSG REF
Target-Dialog R - - - o - - - o
Figure 4: Allowed Methods for Target-Dialog8. Security Considerations 🔐
okay this section is SERIOUS bestie, so pay attention 😭🚨
the Target-Dialog header field is used to authorize requests based on the fact that the sender has access to information that only certain entities can access. for that authorization decision to be secure, two conditions have to be met 🛡️
first, NO eavesdroppers can have access to this information. that means the original SIP dialog has to be established using a sips URI, which gives you TLS on each hop. with a sips URI, only the user agents and proxies on the request path will be able to know the dialog identifiers 🙅♀️
second, the dialog identifiers have to be random enough that they can't be guessed. RFC 3261 requires global uniqueness for the Call-ID and 32 bits of cryptographic randomness for each tag (and there are two tags for a dialog). a typical dialog is pretty short-lived (maybe as long as a day), so this amount of randomness seems adequate for stopping guessing attacks 🤏 BUT it's really important to note that this specification requires true cryptographic randomness as set forth in RFC 4086 [11]. weaker pseudorandom identifiers reduce the chance of collisions, but because they're guessable, they aren't enough to stop an attacker from watching a sequence of identifiers, guessing the next one, and then using this specification to launch an attack 💀🔥
9. Relationship with In-Reply-To 🧵
okay bestie, so RFC 3261 already defines the In-Reply-To header field 💅 It gives you a list of Call-IDs for calls that the current request references or returns. It was basically built to do what Reply-To does in email: help build "threads" of conversations in a user interface 🧵✨ Target-Dialog is kind of similar because it also points back at a previous session, so you have to understand how they're different. They are NOT substitutes for each other 🙅♀️
First, In-Reply-To is for a human or a UI widget to read 👀 It gives the user context so they can decide what the call is about and whether they should pick up. Target-Dialog is for the user agent itself to read 🤖 It helps with authorization of session requests in specific cases where the authorization comes from the underlying protocols and not from the user. A UA will authorize a call containing Target-Dialog based on a correct value of the Target-Dialog header field 🔐 that's the whole vibe
Second, Target-Dialog points at a specific dialog that has to be currently in progress 📞 In-Reply-To points at a previous call attempt, most likely one that never turned into a dialog 💀 That's why In-Reply-To uses a Call-ID, and Target-Dialog uses a set of dialog identifiers 🆔
Finally, In-Reply-To implies cause and effect ⚡ When it's there, it means the request is being sent because of the previous request that was delivered. Target-Dialog does NOT imply cause and effect 🙅♀️ it only means awareness, and that awareness is for authorization purposes 🫶
10. Example Call Flow 🎬
okay this example is so good 😭 User agent A and user agent B set up an INVITE-initiated dialog through Server-A and Server-B, and each server acts as a proxy for the INVITE 🛰️ Then Server B wants to use the application interaction framework [14] to ask user agent A to fetch an HTML user interface component 🖼️ So it sends a REFER request to A's URI. You can see the flow in Figure 5 👀 The conventions of [19] are used to show long message lines, so don't panic if things look wrapped 🌸
A Server-A Server-B B
|(1) INVITE | | |
|----------->| | |
| |(2) INVITE | |
| |----------->| |
| | |(3) INVITE |
| | |----------->|
| | |(4) 200 OK |
| | |<-----------|
| |(5) 200 OK | |
| |<-----------| |
|(6) 200 OK | | |
|<-----------| | |
|(7) ACK | | |
|------------------------------------->|
| |(8) REFER | |
| |<-----------| |
|(9) REFER | | |
|<-----------| | |
|(10) 200 OK | | |
|----------->| | |
| |(11) 200 OK | |
| |----------->| |Figure 5 🦋
Okay, step one: the caller sends an INVITE, that's message 1 📨
INVITE sips:B@example.com SIP/2.0
Via: SIP/2.0/TLS host.example.com;branch=z9hG4bK9zz8
From: Caller <sip:A@example.com>;tag=kkaz-
To: Callee <sip:B@example.org>
Call-ID: fa77as7dad8-sd98ajzz@host.example.com
CSeq: 1 INVITE
Max-Forwards: 70
Supported: tdialog
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, REFER
Accept: application/sdp, text/html
<allOneLine>
Contact: <sips:A@example.com;gruu;opaque=urn:uuid:f81d4f
ae-7dec-11d0-a765-00a0c91e6bf6;grid=99a>;schemes="http,sip,sips"
</allOneLine>
Content-Length: ...
Content-Type: application/sdp
--SDP not shown--This INVITE shows the caller supports GRUU (look at its spot in the Contact header field 👀) and the Target-Dialog header field 🎀 The INVITE gets forwarded to the callee (messages 2-3), who generates a 200 OK that gets forwarded back to the caller (messages 4-5) 💌 Message 5 might look like this:
SIP/2.0 200 OK
Via: SIP/2.0/TLS host.example.com;branch=z9hG4bK9zz8
From: Caller <sip:A@example.com>;tag=kkaz-
To: Callee <sip:B@example.org>;tag=6544
Call-ID: fa77as7dad8-sd98ajzz@host.example.com
CSeq: 1 INVITE
Contact: <sips:B@pc.example.org>
Content-Length: ...
Content-Type: application/sdp
--SDP not shown--In this case the called party does NOT support GRUU or the Target-Dialog header field 🥺 The caller sends an ACK (message 7) ✅ Then Server B decides to send a REFER to user A 🚀
REFER sips:A@example.com;gruu;opaque=urn:uuid:f81d4f
ae-7dec-11d0-a765-00a0c91e6bf6;grid=99a SIP/2.0
Via: SIP/2.0/TLS serverB.example.org;branch=z9hG4bK9zz10
From: Server B <sip:serverB.example.org>;tag=mreysh
To: Caller <sips:A@example.com;gruu;opaque=urn:uuid:f81d4f
ae-7dec-11d0-a765-00a0c91e6bf6;grid=99a>
Target-Dialog: fa77as7dad8-sd98ajzz@host.example.com
;local-tag=kkaz-
;remote-tag=6544
Refer-To: http://serverB.example.org/ui-component.html
Call-ID: 86d65asfklzll8f7asdr@host.example.com
CSeq: 1 REFER
Max-Forwards: 70
Require: tdialog
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, NOTIFY
Contact: <sips:serverB.example.org>
Content-Length: 0This REFER gets delivered to server A because it was sent to the GRUU 🛰️ From there it's forwarded to user agent A (message 9), and it gets authorized because the Target-Dialog header field is there 🔐 main character energy, honestly 👑
11. IANA Considerations 📋
this part is the registry paperwork, but it's still important 💅 This specification registers a new SIP header field, a new option tag according to the processes of RFC 3261 [2], and two new header field parameters according to the processes of RFC 3968 [10] 📝
11.1. Header Field 🎀
- RFC Number: RFC 4538
- Header Field Name: Target-Dialog
- Compact Form: none
11.2. Header Field Parameters 🧩
This section registers two header field parameters according to the processes of RFC 3968 [10] ✨
11.2.1. local-tag 🏷️
- Header Field: Target-Dialog
- Header Field Parameter: local-tag
- Predefined Values: None
- RFC: RFC 4538
11.2.2. remote-tag 🏷️
- Header Field: Target-Dialog
- Header Field Parameter: remote-tag
- Predefined Values: None
- RFC: RFC 4538
11.3. SIP Option Tag 🌷
This specification registers a new SIP option tag per the guidelines in Section 27.1 of RFC 3261 📖
- Name: tdialog
- Description: This option tag is used to identify the target dialog header field extension. When used in a Require header field, it implies that the recipient needs to support the Target-Dialog header field. When used in a Supported header field, it implies that the sender of the message supports it.
12. Acknowledgements 🫶
This specification is based on a header field first proposed by Robert Sparks in the dialog usage draft [12] 🌟 John Elwell also provided helpful comments, so big thanks to both of them 💖
13. References 📚
13.1. Normative References 💜
- [1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [2] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002.
- [3] Roach, A., "Session Initiation Protocol (SIP)-Specific Event Notification", RFC 3265, June 2002.
- [4] Donovan, S., "The SIP INFO Method", RFC 2976, October 2000.
- [5] Rosenberg, J. and H. Schulzrinne, "Reliability of Provisional Responses in Session Initiation Protocol (SIP)", RFC 3262, June 2002.
- [6] Rosenberg, J., "The Session Initiation Protocol (SIP) UPDATE Method", RFC 3311, October 2002.
- [7] Campbell, B., Rosenberg, J., Schulzrinne, H., Huitema, C., and D. Gurle, "Session Initiation Protocol (SIP) Extension for Instant Messaging", RFC 3428, December 2002.
- [8] Sparks, R., "The Session Initiation Protocol (SIP) Refer Method", RFC 3515, April 2003.
- [9] Niemi, A., "Session Initiation Protocol (SIP) Extension for Event State Publication", RFC 3903, October 2004.
- [10] Camarillo, G., "The Internet Assigned Number Authority (IANA) Header Field Parameter Registry for the Session Initiation Protocol (SIP)", BCP 98, RFC 3968, December 2004.
13.2. Informative References 🌈
- [11] Eastlake, D., Schiller, J., and S. Crocker, "Randomness Requirements for Security", BCP 106, RFC 4086, June 2005.
- [12] Sparks, R., "Multiple Dialog Usages in the Session Initiation Protocol", Work in Progress, March 2006.
- [13] Rosenberg, J., "Obtaining and Using Globally Routable User Agent (UA) URIs (GRUU) in the Session Initiation Protocol (SIP)", Work in Progress, May 2006.
- [14] Rosenberg, J., "A Framework for Application Interaction in the Session Initiation Protocol (SIP)", Work in Progress, July 2005.
- [15] Rosenberg, J., Schulzrinne, H., and R. Mahy, "An INVITE-Initiated Dialog Event Package for the Session Initiation Protocol (SIP)", RFC 4235, November 2005.
- [16] Rosenberg, J., "A Session Initiation Protocol (SIP) Event Package for Conference State", Work in Progress, July 2005.
- [17] Rosenberg, J., "A Framework for Conferencing with the Session Initiation Protocol (SIP)", RFC 4353, February 2006.
- [18] Burger, E., "A Session Initiation Protocol (SIP) Event Package for Key Press Stimulus (KPML)", Work in Progress, December 2004.
- [19] Sparks, R., Ed., Hawrylyshen, A., Johnston, A., Rosenberg, J., and H. Schulzrinne, "Session Initiation Protocol (SIP) Torture Test Messages", RFC 4475, May 2006.
Author's Address 🏡
- Jonathan Rosenberg
- Cisco Systems
- 600 Lanidex Plaza
- Parsippany, NJ 07054
- US
- Phone: +1 973 952-5000
- EMail: jdrosen@cisco.com
- URI: http://www.jdrosen.net
Full Copyright Statement ⚖️
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💅
Intellectual Property ✨
okay bestie, let's talk about who owns what 💅 The IETF takes no position on whether any Intellectual Property Rights or other rights that someone might claim over the technology in this document are valid or in scope, and it doesn't say whether any license under those rights might or might not be available. It also doesn't claim it has made any independent effort to find those rights 🙈 If you want the rules on rights in RFC documents, look in BCP 78 and BCP 79.
Copies of IPR disclosures sent to the IETF Secretariat are available, along with any assurances of licenses that are going to be made available. You can also get the result of an attempt to get a general license or permission for implementers or users to use proprietary rights, all from the IETF's online IPR repository at http://www.ietf.org/ipr 🔥
The IETF also invites anyone who's interested to tell it about any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 🫶
Acknowledgement 💖
Funding for the RFC Editor function comes from the IETF Administrative Support Activity (IASA) 🌸 The people keeping the RFC library running get backed by IASA, which is honestly so iconic 👑
📦 where this page comes from
- ietf: rfc4538 2006-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms