RFC 5318
The Session Initiation Protocol (SIP) P-Refused-URI-List Private-Header (P-Header)
RFC 5318: The Session Initiation Protocol (SIP) P-Refused-URI-List Private-Header (P-Header) 💖
Okay bestie, this is RFC 5318, and it's giving very focused main character energy 🎀 It was written by J. Hautakorpi and G. Camarillo from Ericsson, and it came out in December 2008. It's Informational, so it's sharing knowledge rather than setting an Internet standard ✨ It was put out by the Network Working Group. The title block doesn't list anything it obsoletes or updates, so it's standing on its own 💅
Status of This Memo 📝
This memo gives information to the Internet community. It doesn't specify an Internet standard of any kind. Distribution of this memo is unlimited 🌸
Copyright Notice ©️
Copyright (c) 2008 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.
Abstract 🦋
Okay so the big idea here is the SIP P-Refused-URI-List Private-Header, which we'll just call the P-Header 💜 It's used in the Open Mobile Alliance's (OMA) Push to talk over Cellular (PoC) system. The vibe is that it lets URI-list servers say "nope, not handling this" when an incoming URI list has embedded URI lists inside it 🙅♀️ It also lets the server tell the client which embedded URI list caused the rejection, plus the individual URIs that make up that list. Iconic behavior, honestly 😭
Table of Contents 🗂️
1. Introduction ....................................................2
2. Terminology .....................................................2
3. Usage Scenario ..................................................3
4. Overview of Operation ...........................................6
5. Syntax of P-Refused-URI-List Header Field .......................6
6. Response Generation .............................................7
7. Message Sequence Example ........................................7
8. Applicability ...................................................9
9. Security Considerations ........................................10
10. IANA Considerations ...........................................11
11. Acknowledgements ..............................................11
12. References ....................................................11
12.1. Normative References .....................................11
12.2. Informative References ...................................121. Introduction ✨
So the Open Mobile Alliance (OMA) created the Push to talk over Cellular (PoC) service 📱 It runs on the Session Initiation Protocol (SIP) [3] and the Uniform Resource Identifier (URI)-list services [5]. If you want more OMA PoC tea, check out [8] 🍵
Here's the problem OMA PoC is dealing with: servers need a way to refuse incoming URI lists when those lists have embedded URI lists inside them. This mechanism is meant for one specific type of PoC session called an ad-hoc PoC group session 🎀
Quick roadmap, bestie 🗺️ Section 3 covers the scenario where this gets used. Section 4 gives the overview, which includes the new P-Header called P-Refused-URI-List. Section 5 defines the syntax of that P-Header, and Section 6 explains how to use it. Section 7 has a usage example, and Section 8 describes where the P-Header is applicable. Security considerations are in Section 9, and the IANA considerations are in Section 10 🔐
2. Terminology 📚
Ngl this section is the rulebook for the capital words. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [1] 💅
3. Usage Scenario 🎀
An ad-hoc PoC group session is a type of multi-party PoC session 🫶 The originator, which is the person starting it, picks the set of participants in an ad-hoc way. Think of it like scrolling through an address book and tapping the people you want 📖 To set up the ad-hoc PoC group session, the originator sends an INVITE request with a URI list containing the URIs of those participants.
The PoC network follows the procedures defined in [6]. It receives that INVITE request and then generates an individual INVITE request for each URI in the URI list 📨
Here's some history, because it's lowkey interesting 🕰️ In earlier versions of the OMA PoC service, the originator could only put URIs for individual PoC users in the initial URI list. Later versions let the originator also include URI lists as entries. So the initial URI list can contain entries that are URI lists themselves. The expected behavior then is that the members of those embedded URI lists get invited to join the ad-hoc PoC group session 🧚
Figure 1 shows the behavior we want. The originator, who isn't shown, puts the URI list friends@example.org along with the URI alice@example.com into the initial URI list. The PoC network resolves friends@example.org into its members, bob@example.org and carol@example.net, and sends INVITE requests to all the recipients 💜
2. INVITE
+------------------>
| alice@example.com
|
|
+-------------+
| |
1. INVITE | | 3. INVITE
------------------>| PoC Network |---------------->
alice@example.com | | bob@example.org
friends@example.org | |
+-------------+
|
|
|
| 4. INVITE
+------------------>
carol@example.net
Figure 1: PoC Expected BehaviorThe PoC network in Figure 1 is made up of PoC servers. These are SIP entities that can act as proxies or B2BUAs (Back-to-Back User Agents) 🤖 There are two logical types of PoC server: controlling and participating 👑
In an ad-hoc PoC group session there is always exactly one controlling PoC server. The controlling PoC server resolves an incoming URI list and sends INVITEs to the members of that list. It also works as the focus of the session 🎯 Every participant in an ad-hoc PoC group has an associated participating PoC server, and that server lives in the participant's home domain 🏠
Figure 2 shows how the PoC servers behave in the scenario from Figure 1. The originating PoC user agent sends an INVITE request (1) with a URI list to its participating PoC server. That participating PoC server receives the INVITE request, takes on the role of controlling PoC server for the ad-hoc PoC group session, and sends an INVITE request to each URI in the URI list 🌈
+-------------+
2. INVITE | Particip. |
+------------------>| PoC server |->
| alice@example.com | example.com |
| +-------------+
|
+-------------+ 3. INVITE +-------------+
| |-------------------->| |
1. INVITE | Controlling | friends@example.org | Particip. |
-------------> | PoC server | | PoC server |->
alice@example.com| | 4. 403 Forbidden | example.org |
friends@example.org| |<--------------------| |
+-------------+ bob@example.org +-------------+
| | carol@example.net ^
| | |
| | 5. INVITE |
| +--------------------------------+
| bob@example.org
|
| +------------+
| 6. INVITE | Particip. |
+------------------>| PoC server |->
carol@example.net | example.net|
+------------+
Figure 2: PoC Network BehaviorThe first URI in the list, alice@example.com, identifies a single user 🙋♀️ The second URI, friends@example.org, identifies a URI list. In PoC terms, friends@example.com identifies a pre-arranged PoC group 🥰 The PoC server at example.org knows the membership of friends@example.com, but it can't send INVITE requests to those members, because that PoC server doesn't act as a controlling PoC server for the ad-hoc PoC group session being set up. Instead, it tells the controlling PoC server that friends@example.org is a list whose members are bob@example.org and carol@example.net. Once the controlling PoC server gets that info, it generates INVITE requests to bob@example.org and carol@example.net 📬
Even though it isn't shown in the example above, the participating PoC server (example.org) can return just a partial list of the URIs in the URI list. It can make that call based on policy, on the presence of the members, and so on 🫧 Also, a URI that the participating PoC server returns can itself be a URI list 🔁
Right now there's no mechanism for a participating PoC server to tell a controlling PoC server that a URI identifies a list and what that list's members are. There's also no way to indicate the URIs contained in the list. This document defines that mechanism, and it's called the P-Refused-URI-List P-Header 🎉
4. Overview of Operation 🦋
Here's the flow. When a URI-list server receives an INVITE request with a URI list that has entries which are URI lists themselves, and the server can't handle the request, it returns a 403 (Forbidden) response with a P-Refused-URI-List P-Header 🙅♀️ That P-Header holds the members of the URI list or lists that caused the rejection. That way, the client can send requests straight to those member URIs 💌 Check out Figure 3 for the full picture 👀
+---------+ INVITE request +----------+
| |------------------------------>| |
| | [URI list in a URI list] | URI-list |
| Client | | server |
| | 403 Forbidden | |
| |<------------------------------| |
| | [Content of refused URI list] | |
+---------+ +----------+
Figure 3: Operational Overview5. Syntax of P-Refused-URI-List Header Field ✨
okay so the grammar bit, bestie 🎀 this is the augmented Backus-Naur Form (BNF) [4] syntax for the P-Refused-URI-List P-Header, and it's giving very precise vibes 💅
P-Refused-URI-List = "P-Refused-URI-List" HCOLON
uri-list-entry
*(COMMA uri-list-entry)
uri-list-entry = ( name-addr / addr-spec )
*( SEMI refused-param )
refused-param = members-param / generic-param
members-param = "members" EQUAL
LDQUOT *( qdtext / quoted-pair ) RDQUOTthe members P-Header parameter MUST contain a cid-url, which is defined in RFC 2392 [2] 🔥 so no skipping that part, periodt 🙈
the HCOLON, SEMI, EQUAL, LDQUOT, RDQUOT, and generic-param are defined in [3] 🦋 so if you're wondering where those little symbols come from, go check there ✨
6. Response Generation 🌸
so a 403 (Forbidden) response can have more than one P-Refused-URI-List entries, lowkey iconic 👑 but the P-Refused-URI-List header field MUST NOT be used with any other response, no cap 💀 the P-Refused-URI-List P-Header holds one or more URIs that were in the URI list of the incoming request and that the server couldn't handle 😭 and on top of that, the P-Refused-URI-List can optionally carry some or all of the members of the URI lists those URIs point to 🧚
the 403 (Forbidden) response MAY include body parts that contain URI lists 🎀 those body parts can be referenced by the P-Refused-URI-List entries through their Content-IDs [2] 💜 if a Content-ID is defined in the P-Refused-URI-List, one of the body parts MUST have an equivalent Content-ID ✨ the format of a URI list is service specific, so it depends on the service, fr fr 🌈
this structure is main character energy 💖 because clients can figure out which URI goes with which URI list, but only if the URI-list server is willing to share that info 🫶 and the info inside those URI lists lets clients take further actions to fix the rejection, like sending individual requests to each member of the list 🦋
7. Message Sequence Example 🧚
okay so in this example, a controlling PoC server sends an INVITE request to a participating PoC server 💅 the participating PoC server rejects it with a 403 (Forbidden) response, and that response has a P-Refused-URI-List P-Header carrying the members of the rejected URI lists that the participating PoC server decides to disclose to the controlling PoC server, in the message body 🎀
Controlling PoC server Participating PoC server
example.com example.net
| |
| INVITE |
|-------------------------------->|
| |
| 403 Forbidden |
|<--------------------------------|
| |
Figure 4: Message Sequence Examplethe INVITE request in Figure 4 looks like this (Via header fields are not shown for simplicity 🙈):
INVITE sip:poc-service@example.net SIP/2.0
Max-Forwards: 70
From: PoC service <sip:poc-service@example.com>;tag=4fxaed73sl
To: PoC service <sip:poc-service@example.net>
Call-ID: 7xTn9vxNit65XU7p4@example.com
CSeq: 1 INVITE
Contact: <sip:poc-service@poc-as.example.com>
Require: recipient-list-invite
Content-Type: multipart/mixed;boundary="boundary1"
Content-Length: 538
--boundary1
Content-Type: application/sdp
(SDP not shown)
--boundary1
Content-Type: application/resource-lists+xml
Content-Disposition: recipient-list
<?xml version="1.0" encoding="UTF-8"?>
<resource-lists xmlns="urn:ietf:params:xml:ns:resource-lists">
<list>
<entry uri="sip:bob@example.net"/>
<entry uri="sip:friends-list@example.net"/>
<entry uri="sip:colleagues-list@example.net"/>
</list>
</resource-lists>
--boundary1--so sip:friends-list@example.net and sip:colleagues-list@example.net are actually references to URI lists, aka pre-arranged PoC groups 🍓 in the response below, those URI lists are in the XML resource list format [7] ✨
the content of the 403 (Forbidden) response in Figure 4 goes like this (Via header fields are not shown for simplicity 💜):
SIP/2.0 403 Forbidden
From: PoC service <sip:poc-service@example.com>;tag=4fxaed73sl
To: PoC service <sip:poc-service@example.net>;tag=814254
Call-ID: 7xTn9vxNit65XU7p4@example.com
CSeq: 1 INVITE
P-Refused-URI-List: sip:friends-list@example.net;
members=<cid:an3bt8jf03@example.net>
P-Refused-URI-List: sip:colleagues-list@example.net;
members=<cid:bn35n8jf04@example.net>
Content-Type: multipart/mixed;boundary="boundary1"
Content-Length: 745
--boundary1
Content-Type: application/resource-lists+xml
Content-Disposition: recipient-list
Content-ID: <an3bt8jf03@example.net>
<?xml version="1.0" encoding="UTF-8"?>
<resource-lists xmlns="urn:ietf:params:xml:ns:resource-lists">
<list>
<entry uri="sip:bill@example.org"/>
<entry uri="sip:randy@example.com"/>
<entry uri="sip:eddy@example.com"/>
</list>
</resource-lists>
--boundary1
Content-Type: application/resource-lists+xml
Content-Disposition: recipient-list
Content-ID: <bn35n8jf04@example.net>
<?xml version="1.0" encoding="UTF-8"?>
<resource-lists xmlns="urn:ietf:params:xml:ns:resource-lists">
<list>
<entry uri="sip:joe@example.org"/>
<entry uri="sip:carol@example.com"/>
</list>
</resource-lists>
--boundary1--so using the message body of that 403, the controlling PoC server can figure out the members of sip:friend-list@example.net and sip:colleagues-list@example.net that the participating PoC server decides to disclose to it 🫶 and the controlling PoC server can also deduce that the participating PoC server hasn't sent any outgoing requests, per regular URI-list server procedures 🔥
8. Applicability 💖
the P-Refused-URI-List header field is intended for OMA PoC networks 🎀 it's used between PoC servers and carries info about the URI lists that the server receiving the request rejected ✨
the OMA PoC services are designed so that, in a given session, only one PoC server can resolve incoming URI lists and send INVITEs to members of those lists 💅 this restriction isn't there on services built for the public Internet 🌈 so the P-Refused-URI-List P-Header doesn't really seem to have general applicability outside OMA PoC 😭
also, using the P-Refused-URI-List P-Header requires special trust relationships between servers, which typically don't exist on the public Internet 💀
it's important to note that the P-Refused-URI-List is optional and doesn't change the basic behavior of a SIP URI-list service 🦋 it just gives clients extra info about why the request got refused 🧚
9. Security Considerations 🔥
okay bestie, this section is serious, so read it closely 🙈
it's assumed that the network elements handling the P-Refused-URI-List P-Header are trusted 🫶 also, attackers are not supposed to have access to the protocol messages between those elements 💀 this is because the P-Refused-URI-List is meant for the OMA PoC environment, which is implemented in the operators' core network 👑 for more on OMA PoC security assumptions, see [9] ✨ traffic protection between network elements is achieved with IP Security (IPsec) and sometimes by physically protecting the network 🔒
however, implementors and administrators should be aware of two special security considerations related to the P-Refused-URI-List 😭
Eavesdropping: 403 (Forbidden) responses may contain information about the members of a given URI list 🎀 eavesdroppers can grab this info if the 403 (Forbidden) responses aren't encrypted 💀 so it is RECOMMENDED that either hop-by-hop or end-to-end encryption (e.g., using TLS or S/MIME, respectively) is used 🔥
Disclosing information: a rogue entity may be able to acquire information about the members of a given URI list if the URI-list server sends info about those URI lists to unauthorized users 🙈 so it is RECOMMENDED that a URI-list server discloses the content of that URI list only to authorized clients 🫶
10. IANA Considerations 🧚
the IANA made two additions to the Session Initiation Protocol (SIP) Parameters registry ✨ the following header field was added to the Header Fields sub-registry 🎀
Header Name compact Reference
----------------- ------- ---------
P-Refused-URI-List [RFC5318]the following header field parameter was added to the Header Field Parameters and Parameter Values sub-registry 💜
Predefined
Header Field Parameter Name Values Reference
---------------------------- --------------- --------- ---------
P-Refused-URI-List members No [RFC5318]11. Acknowledgements 🌸
the authors would like to thank Tom Hiller, who did a thorough, dedicated review of this document 🫶 he really came through 👑
12. References 🦋
12.1. Normative References ✨
[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[2] Levinson, E., "Content-ID and Message-ID Uniform Resource
Locators", RFC 2392, August 1998.
[3] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP:
Session Initiation Protocol", RFC 3261, June 2002.
[4] Crocker, D. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", STD 68, RFC 5234, January 2008.
[5] Camarillo, G. and A. Roach, "Framework and Security
Considerations for Session Initiation Protocol (SIP) URI-List
Services", RFC 5363, October 2008.
[6] Camarillo, G. and A. Johnston, "Conference Establishment Using
Request-Contained Lists in the Session Initiation Protocol
(SIP)", RFC 5366, October 2008.12.2. Informative References ⭐
[7] Rosenberg, J., "Extensible Markup Language (XML) Formats for
Representing Resource Lists", RFC 4826, May 2007.
[8] Open Mobile Alliance, "OMA PoC System Description: Draft Version
2.0", April 2007.
[9] Open Mobile Alliance, "Push to talk over Cellular (PoC) -
Architecture: Draft Version 2.0", April 2007.Authors' Addresses 💌
Jani Hautakorpi
Ericsson
Hirsalantie 11
Jorvas 02420
Finland
EMail: Jani.Hautakorpi@ericsson.com
Gonzalo Camarillo
Ericsson
Hirsalantie 11
Jorvas 02420
Finland
EMail: Gonzalo.Camarillo@ericsson.com📦 where this page comes from
- ietf: rfc5318 2008-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms