RFC 4570
Session Description Protocol (SDP) Source Filters
RFC 4570: Session Description Protocol (SDP) Source Filters 🎀
Okay bestie, here's the header info first 💅
- RFC number: 4570
- Title: Session Description Protocol (SDP) Source Filters
- Authors: B. Quinn (BoxnArrow.com) and R. Finlayson (Live Networks, Inc.)
- Working group: Network Working Group
- Category: Standards Track
- Date: July 2006
- Obsoletes / Updates: the header has no line for either one 🙈
Status of This Memo 📜
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. 🦋
Copyright Notice ©️
Copyright (C) The Internet Society (2006).
Abstract 🌸
This doc explains how to adapt the Session Description Protocol (SDP) so it can list one or more source addresses as a source filter for one or more destination "connection" addresses. It defines the syntax and semantics for an SDP "source-filter" attribute that can reference IPv4 or IPv6 addresses as either an inclusive or exclusive source list, for either multicast or unicast destinations. The main point: an inclusive source-filter can be used to specify a Source-Specific Multicast (SSM) session 👑
1. Introduction ✨
The Session Description Protocol [SDP] gives you a general purpose format for describing multimedia sessions in announcements or invitations. SDP uses an entirely textual data format (the US-ASCII subset of [UTF-8]) so it's easy to carry over basically any transport 🧚 SDP doesn't define a protocol, though. It only defines the syntax for describing a multimedia session with enough info to discover and join that session. Session descriptions can be sent using any number of existing application protocols for transport (e.g., Session Announcement Protocol (SAP), SIP, Real Time Streaming Protocol (RTSP), email, and HTTP) 💌
Usually, session descriptions reference an IP multicast address for the "connection-address" (destination), but unicast addresses or fully qualified domain names (FQDNs) MAY also be used. The "source-filter" attribute defined in this document narrows down the session traffic by identifying the address (or FQDN) of legitimate sources (senders). The goal is for receivers to use the source and destination address pair(s) to filter traffic, so applications only get legitimate session traffic. Serving looks 💅
Receiver applications are expected to use the SDP source-filter information to identify traffic from legitimate senders, and discard traffic from illegitimate senders. Applications and hosts can also share the source-filter information with network elements (e.g., with routers using [IGMPv3]) so they can potentially do the filtering further "upstream," closer to the source(s). Filtering at the source end is giving efficiency 🔥
The "source-filter" attribute can appear at the session level and/or the media level.
1.1. Motivation 💖
The whole point of a source-filter is to help protect receivers from traffic sent from illegitimate source addresses. Filtering traffic can help preserve content integrity and protect against Denial of Service (DoS) attacks 🛡️ Not me being dramatic about DoS, it's a real threat 💀
For multicast destination addresses, receiver applications MAY apply source-filters using the Multicast Source Filter APIs [MSF-API]. Hosts are likely to implement these APIs using protocol mechanisms to send the source filters to local multicast routers. Other "upstream" multicast routers MAY apply the filters too, which gives more explicit multicast group management and better use of network resources 🌈 The protocol mechanisms that make these operations work are outside the scope of this document, but they're the reason SDP source-filters exist in the first place 🧠
2. Terminology 📚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [REQMNT]. Bestie, these words are the real deal, so read them carefully 🫶
3. The "source-filter" Attribute 🦋
The SDP source-filter attribute doesn't change any existing SDP syntax or semantics. It just defines a format for extra session description information. Specifically, source-filter syntax can name one or more unicast addresses as either legitimate or illegitimate sources for any (or all) SDP session description "connection-address" field values 🍓
Here's the catch. The unicast source addresses in this attribute are the ones a receiver sees. So if source addresses get translated on the way from the original sender to the receiver (e.g., because of Network Address Translation (NAT) or some tunneling mechanism), the SDP "source-filter" attribute won't be accurate when it reaches the receiver, unless the source addresses inside it get translated to match ⚠️
Translation mismatch is a sneaky bug. If the addresses in the filter don't match what the receiver actually sees, the filter quietly stops working.
The source-filter attribute has the following syntax:
a=source-filter: <filter-mode> <filter-spec>The <filter-mode> is either incl or excl (for inclusion or exclusion, respectively). The <filter-spec> has four sub-components:
<nettype> <address-types> <dest-address> <src-list>A <filter-mode> of incl means an incoming packet is accepted only if its source address is in the set specified by <src-list>. A <filter-mode> of excl means an incoming packet is rejected if its source address is in the set specified by <src-list> 🎀
The first sub-field, <nettype>, tells you the network type, since SDP is protocol independent. This document is mostly about the value IN, which means the Internet Protocol 🌐
The second sub-field, <address-types>, identifies the address family. For this document it can be either the <addrtype> value IP4 or IP6. Alternatively, when <dest-address> is an FQDN, the value MAY be * to cover both address types, since either type can come back from a DNS lookup 🔍
The third sub-field, <dest-address>, is the destination address. It MUST correspond to one or more of the session's "connection-address" field values. It can be a unicast or multicast address, an FQDN, or the * wildcard to match any/all of the session's "connection-address" values 🎯
The fourth sub-field, <src-list>, is the list of source hosts/interfaces in the source-filter. It's made of one or more unicast addresses or FQDNs, separated by space characters ✨
The format and content of these semantic elements come from and stay compatible with what's defined in [SDP]. For more detail, see Appendix A of this document 📖
3.1. Processing Rules 🧩
There are a bunch of details to think about when you parse the SDP source-filter syntax. Let's go 💅
The <dest-address> value in a "source-filter" attribute MUST correspond to an existing <connection-field> value in the session description. The only exception is when a "*" wildcard is used to say the source-filter applies to all <connection-field> values.
When the <dest-address> value is a multicast address, the field value MUST NOT include the sub-fields <ttl> and <number of addresses> from the <connection-address> value. If the <connection-address> specifies more than one multicast address (in the <number of addresses> field), then a source filter, if any, for each such address must be stated explicitly, using a separate a=source-filter line for each address (unless a "*" wildcard is used for <dest-address>). See section 3.2.4 for an example 🍰
When the <addrtype> value is the "*" wildcard, the <dest-address> MUST be either an FQDN or "*" (i.e., it MUST NOT be an IPv4 or IPv6 address). See section 3.2.6 for an example 🙌
As has always been the case, the default behavior when no source-filter attribute is in a session description is that all traffic sent to the specified <connection-address> value should be accepted (i.e., from any source address). The source-filter grammar doesn't include any syntax to express either "exclude none" or "include all" 💫
Like the standard <connection-field> described in [SDP], where the "source-filter" attribute sits decides whether it applies to the whole session or just one medium (i.e., "session-level" or "media-level"). A media-level source-filter will always completely override a session-level source-filter 👑
A "source-filter" doesn't have to live at the same hierarchy level as its <connection-field>. So a media-level <source-filter> can reference a session-level <connection-field> value, and a session-level "source-filter" can apply to all matching media-level <connection-field> values. See section 3.2.3 for an example 🧚
An SDP description MUST NOT contain more than one session-level "source-filter" attribute that covers the same destination address, or more than one media-level "source-filter" attribute that covers the same destination address. No doubling up, bestie 🚫
There's no specified limit on how many entries can go in the <src-list>. There are practical limits you should still think about, though. For example, depending on the transport used for the session description, there may be a limit to the total size of the session description (e.g., set by the maximum payload in a single datagram). Also, when the source-filter is applied to control protocols, there may be a limit to how many source addresses can be sent. These limits are outside the scope of this document, but they should be considered when you define source-filter values for SDP 📏
3.2. Examples 🎀
Here are some examples showing how to use the source-filter attribute in common scenarios. We start from the following session description components, and for each example we show the source filter with extra relevant info plus a quick explanation 💖
<session-description> =
v=0
o=The King <Elvis@example.com>
s=Elvis Impersonation
i=All Elvis, all the time
u=http://www.example.com/ElvisLive/
t=0 0
a=recvonly
<media-description 1> =
m=audio 54320 RTP/AVP 0
<media-description 2> =
m=video 54322 RTP/AVP 34🌈 Elvis is the content, the vibe, and the main character of this whole RFC 👑
Part 1 of 3, bestie. Keep reading for the rest! 💜
3.2.1. Source-Specific Multicast Example 🦋
okay so Source-Specific Multicast [SSM] addresses need exactly one unicast sender address for each multicast destination, which is literally why source-filter is such a natural fit 💅 In this example, a session member should receive only traffic sent from 192.0.2.10 to the multicast session address 232.3.4.5.
<session-description>
c=IN IP4 232.3.4.5/127
a=source-filter: incl IN IP4 232.3.4.5 192.0.2.10
<media-description 1>this source-filter example is giving inclusion list 💖 it has one multicast connection-address as the destination and one unicast address as the source. the value of the connection-address matches the value in the connection-field, so they're besties 🫶
also, since the connection-field lives in the session-description section, the source-filter applies to all media 🎀
and here's the tea 🍵: if the SDP description specifies an RTP session (e.g., its "m=" line(s) specify "RTP/AVP" as the transport protocol), then the "incl" specification applies not only to RTP packets, but also to any RTCP packets sent to the specified multicast address. so as a side effect of "incl", the only possible multicast RTCP packets will be "Sender Report" (SR) packets sent from the specified source address 😭
because of this, an SDP description for a Source-Specific Multicast (SSM) RTP session SHOULD also include an
a=rtcp-unicast ...attribute, as described in [RTCP-SSM] (section 10.1). this specifies that RTCP "Reception Report" (RR) packets are to be sent back via unicast 🌸
3.2.2. Unicast Exclusion Example 🧚
typically an SDP session <connection-address> value is a multicast address, although it's also possible to use either a unicast address or FQDN. this example shows a session description that lists the unicast source address 192.0.2.10 in an exclusion filter. basically this sample source-filter is saying, "destination 192.0.2.11 should accept traffic from any sender except 192.0.2.10." not me being picky 💅
<session-description>
c=IN IP4 192.0.2.11
a=source-filter: excl IN IP4 192.0.2.11 192.0.2.10
<media-description 1>3.2.3. Multiple Session Address Example 🌈
this source-filter example uses the wildcard "*" value for <dest-addr> to match any/all <connection-address> values. so the only legit source for traffic sent to either 232.2.2.2 or 232.4.4.4 is 192.0.2.10 👑 traffic from any other unicast source address should be discarded by the receiver. bye bye 👋
<session-description>
a=source-filter: incl IN IP4 * 192.0.2.10
<media-description 1>
c=IN IP4 232.2.2.2/127
<media-description 2>
c=IN IP4 232.4.4.4/633.2.4. Multiple Multicast Address Example 🍓
in this one, the <connection-address> lists three multicast addresses: 224.2.1.1, 224.2.1.2, and 224.2.1.3. the first and third get source filters, but the second address (224.2.1.2) is not given a source filter. it's the main character who gets to do whatever she wants 💅✨
<session-description>
c=IN IP4 224.2.1.1/127/3
a=source-filter: incl IN IP4 224.2.1.1 192.0.2.10
a=source-filter: incl IN IP4 224.2.1.3 192.0.2.42
<media-description 1>3.2.5. IPv6 Multicast Source-Filter Example 💜
this simple example has a single session-level source-filter that points at one IPv6 multicast destination and source pair. IP multicast traffic sent to FFOE::11A is valid only from the unicast source address 2001:DB8:1:2:240:96FF:FE25:8EC9 🫶
<session-description>
c=IN IP6 FF0E::11A/127
a=source-filter incl IN IP6 FF0E::11A 2001:DB8:1:2:240:96FF:FE25:8EC9
<media-description 1>3.2.6. IPv4 and IPv6 FQDN Example 🌸
this one shows off the <addrtype> "*" wildcard, along with multicast and source FQDNs that might resolve to an IPv6 address, an IPv4 address, or both 🧚 usually the multicast and source addresses will match (both IPv4 or both IPv6), but using the wildcard for addrtype in the source filter lets them be asymmetric. so an IPv4 source address can be used with an IPv6 multicast address. it's giving flexibility 🦋
<session-description>
c=IN IP4 channel-1.example.com/127
c=IN IP6 channel-1.example.com/127
a=source-filter: incl IN * channel-1.example.com src-1.example.com
<media-description 1>3.3. Offer-Answer Model Considerations 🎀
the "source-filter" attribute is not meant to be used as an 'offer' in an SDP offer-answer exchange [OFFER]. why? because sets of source addresses aren't 'capabilities' or 'limitations' of the offerer, and the offerer usually has no idea in advance which IP source address(es) will end up in an answer 🙈 an answerer can still put the "source-filter" attribute in his/her answer (e.g., to designate an SSM session), but the answerer SHOULD ignore any "source-filter" attribute that was in the original offer. no copying homework 😤
4. Interoperability Issues ✨
defining a list of legit sources for a multicast destination address is a departure from the Any-Source Multicast (ASM) model, as originally described in [IGMPv1] 💅 the ASM model supports anonymous senders and all kinds of multicast apps (e.g., many-to-many). using a source-filter excludes some (unknown or undesirable) senders, which makes it better suited to one-to-many or few-to-few multicast apps 🌈
but these two models have different operational characteristics and requirements, and they can still coexist on the same network using the same protocols. source-filters don't corrupt ASM semantics, they just give receivers more control, at their discretion 🫶 iconic coexistence energy 💖
5. Security Considerations 💀
see [SDP] for security considerations specific to the Session Description Protocol in general. the big drama here is address authenticity 😭
using the source IP address for authentication is weak, because addresses are often dynamically assigned, and a sender can "spoof" its source address (i.e., use one other than its own) in the datagrams it sends. proper router configuration can reduce how often "spoofed" source addresses get sent to or from a network. specifically, border routers are encouraged to filter traffic so that datagrams with invalid source addresses are not forwarded (e.g., routers drop datagrams if the source address is non-local) [FILTERING]. this does not stop IP source addresses from being spoofed on a Local Area Network (LAN) though 🙃
also, as noted in section 3 above, tunneling or NAT mechanisms may require corresponding translation of the addresses in the SDP "source-filter" attribute. they may also cause a set of original source addresses to be translated into a smaller set of source addresses as seen by the receiver 🌀
using FQDNs for either <dest-address> or <src-list> values gives you a layer of indirection with great flexibility. but it also exposes the source-filter to any security inadequacies the DNS system may have. if DNS isn't secured, it's conceivable that the DNS server could return illegitimate addresses 💀
in addition, if source-filtering is implemented by sharing source-filter information with network elements, then the security of the protocol(s) used for that (e.g., [IGMPv3]) becomes super important, so that legitimate traffic (and only legitimate traffic) is received 🔥
so for these reasons, receivers SHOULD NOT treat the SDP "source-filter" attribute as their sole mechanism for protecting the integrity of received content. this is a vibe-check: the filter is not your bodyguard 🛡️💅
6. IANA Considerations 🌈
as recommended by [SDP] (Appendix B), the new attribute name "source-filter" has been registered with IANA, as follows:
the following contact information shall be used for all registrations included here:
Contact: Ross Finlayson
email: finlayson (at) live555.com
phone: +1-650-254-1184
SDP Attribute ("att-field"):
Attribute name: source-filter
Long form: Source Filter
Type of name: att-field
Type of attribute: Session level or media level
Subject to charset: No
Purpose: See this document
Reference: This document
Values: See this document, and registrations below7. Acknowledgements 🫶
the authors would like to thank Dave Thaler and Mark Handley, whose input provided much of the substance of this document 💖 Magnus Westerlund also provided valuable feedback during editing ✨
8. Normative References 📚
[ABNF] Crocker, D., Ed. and P. Overell, "Augmented BNF for
Syntax Specifications: ABNF", RFC 4234, October 2005.
[REQMNT] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[SDP] Handley, M., Jacobson, V., and C. Perkins, "SDP: Session
Description Protocol", RFC 4566, July 2006.
[UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO
10646", STD 63, RFC 3629, November 2003.9. Informative References 🧚
[FILTERING] Ferguson, P. and D. Senie, "Network Ingress Filtering:
Defeating Denial of Service Attacks which employ IP
Source Address Spoofing", BCP 38, RFC 2827, May 2000.
[IGMPv1] Deering, S., "Host extensions for IP multicasting", STD
5, RFC 1112, August 1989.
[IGMPv3] Cain, B., Deering, S., Kouvelas, I., Fenner, B., and A.
Thyagarajan, "Internet Group Management Protocol, Version
3", RFC 3376, October 2002.
[MSF-API] Thaler, D., Fenner, B., and B. Quinn, "Socket Interface
Extensions for Multicast Source Filters", RFC 3678,
January 2004.
[OFFER] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model
with Session Description Protocol (SDP)", RFC 3264, June
2002.
[RTCP-SSM] Chesterfield, J., E. Schooler, J. Ott, "RTCP Extensions
for Single-Source Multicast Sessions with Unicast
Feedback", Work in Progress, October 2004.
[SSM] Bhattacharyya, S., "An Overview of Source-Specific
Multicast (SSM)", RFC 3569, July 2003.Appendix A. Source-Filter Attribute Syntax ✨
okay so this appendix is the grammar bestie 📜 it's an Augmented BNF [ABNF] grammar for writing down an exclusion or inclusion list of one or more (IPv4 or IPv6) unicast source addresses 🦋 it's meant to extend the grammar for the Session Description Protocol from [SDP]. specifically it defines the syntax for the brand new "source-filter" attribute field, which MAY be either a session-level or media-level attribute 💖
The "dest-address" value in each source-filter field MUST match an existing connection-field value, unless the wildcard connection-address value "*" is specified 🫶
source-filter = "source-filter" ":" SP filter-mode SP filter-spec
; SP is the ASCII 'space' character
; (0x20, defined in [ABNF]).
filter-mode = "excl" / "incl"
; either exclusion or inclusion mode.
filter-spec = nettype SP address-types SP dest-address SP src-list
; nettype is as defined in [SDP].
address-types = "*" / addrtype
; "*" for all address types (both IP4 and IP6),
; but only when <dest-address> and <src-list>
; reference FQDNs.
; addrtype is as defined in [SDP].
dest-address = "*" / basic-multicast-address / unicast-address
; "*" applies to all connection-address values.
; unicast-address is as defined in [SDP].
src-list = *(unicast-address SP) unicast-address
; one or more unicast source addresses (in
; standard IPv4 or IPv6 ASCII-notation form)
; or FQDNs.
; unicast-address is as defined in [SDP].
basic-multicast-address = basic-IP4-multicast / basic-IP6-multicast
/ FQDN / extn-addr
; i.e., the same as multicast-address
; defined in [SDP], except that the
; /<ttl> and /<number of addresses>
; fields are not included.
; FQDN and extn-addr are as defined
; in [SDP].
basic-IP4-multicast = m1 3( "." decimal-uchar )
; m1 and decimal-uchar are as defined
; in [SDP].
basic-IP6-multicast = hexpart
; hexpart is as defined in [SDP].Authors' Addresses 🌸
Here are the lovely humans who wrote this, with their contact details exactly as they appear in the original 💌
Bob Quinn
BoxnArrow.com
31 Caldwell Road
Waltham, MA 02453
Phone: +1-781-577-1539
EMail: rcq@boxnarrow.com
Ross Finlayson
Live Networks, Inc.
650 Castro St., suite 120-196
Mountain View, CA 94041
EMail: finlayson@live555.comFull Copyright Statement 📝
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔥
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 🫶
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). 💜
📦 where this page comes from
- ietf: rfc4570 2006-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms