RFC 5363

Framework and Security Considerations for Session Initiation Protocol (SIP) URI-List Services

📅 published October 2008, from ietf

RFC 5363: Framework and Security Considerations for Session Initiation Protocol (SIP) URI-List Services 🎀✨

Okay bestie, this one is from the Network Working Group 💌 It's written by G. Camarillo (Ericsson) and A.B. Roach (Tekelec), it's a Standards Track doc, and it's dated October 2008. Its header doesn't list anything it obsoletes or updates, so there's nothing to flag there 💅

Status of This Memo 📜

This is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈

Abstract 🦋

This doc explains why SIP URI-list services are needed and sets out the requirements for invoking them. It also defines a framework for these services, and that framework comes with its own security considerations 🔐

Table of Contents 🗂️

1. Introduction ....................................................2
2. Terminology .....................................................2
3. Requirements ....................................................2
   3.1. Requirements for URI-List Services Using
        Request-Contained Lists ....................................3
   3.2. General Requirements for URI-List Services .................3
4. Framework .......................................................3
   4.1. Carrying URI Lists in SIP ..................................3
   4.2. Processing of URI Lists ....................................4
   4.3. Results ....................................................5
5. Security Considerations .........................................5
   5.1. List Integrity and Confidentiality .........................5
   5.2. Amplification Attacks ......................................5
   5.3. General Issues .............................................7
6. IANA Considerations .............................................7
7. Acknowledgements ................................................8
8. References ......................................................8
   8.1. Normative References .......................................8
   8.2. Informative References .....................................8

1. Introduction ✨

Some apps need a SIP [RFC3261] UA (User Agent) to run a similar transaction with a bunch of remote UAs at the same moment 😭 Like, an instant messaging app that wants to send "Hello folks" to n receivers has to send n MESSAGE requests, one to each receiver. Main character energy? Not really, it's a lot of work 💀

When the transaction being repeated is a big request, or there are lots of recipients, or both, the UA's access network has to carry a serious amount of traffic. Finishing all those transactions over a low-bandwidth access would take forever, and that's just unacceptable for a lot of apps 🙈

So the fix is to put URI-list services in the network 🧚 A SIP URI-list service gets a request that contains or references a URI list (one or more URIs), then sends a bunch of similar requests to the destinations on that list. Once those requests are out, the URI-list service usually tells the UA how things went. Basically, the URI-list service acts like a B2BUA (Back-to-Back-User-Agent) 👑

A URI-list service can take in a URI list that's inside the SIP request from the client, or an external URI list. For example, the Request-URI is a SIP URI linked to a URI list on the server. External URI lists usually get set up with out-of-band mechanisms, like the XML Configuration Access Protocol (XCAP) [RFC4825]. There's an example of a URI-list service for SUBSCRIBE requests that uses stored URI lists in [RFC4662] 🍓

The rest of this doc gives requirements and a framework for URI-list services, whether they use request-contained URI lists, external URI lists, or both 🌸

2. Terminology 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Yes, these are the official BCP 14 key words, so they mean exactly what the spec says 💅

3. Requirements 🎯

Section 3.1 covers the requirements that only apply to URI-list services using request-contained lists. Section 3.2 covers the requirements that also apply to services using external lists 🫶

3.1. Requirements for URI-List Services Using Request-Contained Lists 💜

  • REQ 1: The URI-list service invocation mechanism MUST allow the invoker to provide a list of destination URIs to the URI-list service.
  • REQ 2: The invocation mechanism SHOULD NOT require more than one transaction.

3.2. General Requirements for URI-List Services 🌈

  • GEN 1: A URI-list service MAY include services beyond sending requests to the URIs in the URI list. That is, URI-list services can be modeled as application servers. For example, a URI-list service handling INVITE requests may behave as a conference server and perform media mixing for all the participants ✨
  • GEN 2: The interpretation of the meaning of the URI list sent by the invoker MUST be at the discretion of the application to which the list is sent.
  • GEN 3: It MUST be possible for the invoker to find out about the result of the operations performed by the URI-list service with the URI list. An invoker may, for instance, be interested in the status of the transactions initiated by the URI-list service 👀
  • GEN 4: URI-list services MUST NOT send requests to any destination without authenticating the invoker. Non-negotiable, bestie 🔥

4. Framework 🦋

This framework isn't limited to application servers that only do request fan-out. Per GEN 1, it also covers application servers that offer a particular service which includes a request fan-out. For example, a conference server that INVITEs several participants chosen by a user agent 🎀

4.1. Carrying URI Lists in SIP 📬

The requirements for URI-list services that use request-contained lists point to the need for a mechanism that gives a SIP URI-list service a URI list in a single transaction. So we define a new disposition type [RFC2183] for the Content-Disposition header field: recipient-list. Both requests and responses MAY carry recipient-list bodies. Bodies with the disposition type recipient-list carry a list of URIs that contains the final recipients of the requests the URI-list service generates 💌

The default format for recipient-list bodies is service specific. So, URI-list services specifications MUST specify a default format for recipient-list bodies used within a particular service. Either way, clients SHOULD NOT include any particular URI more than once in a given URI list 🙅‍♀️

A UA server that receives a request with more than one recipient-list body part (for example, each body part using a different URI-list format) MUST behave as if it had received a single URI list containing all the URIs from the different body parts 🧩

A UA server that receives a recipient-list URI list with a URI that appears more than once MUST behave as if that URI appeared in the URI list only once. To figure out whether any URI shows up more than once, the UA server uses the comparison rules specific to the URI scheme of each URI in the list. Also, Section 4 of "Extensible Markup Language (XML) Format Extension for Representing Copy Control Attributes in Resource Lists" [RFC5364] covers cases where duplicated URI entries are tagged with different values of the copyControl attribute. Naturally, URI-list services that use the copyControl attribute defined in [RFC5364] need to follow the recommendations in [RFC5364] about avoiding duplicated requests 🫣

How a UA server interprets a URI list it has received is service specific, as described in Section 4.2 🧁

4.2. Processing of URI Lists 🧠

Per GEN 1 and GEN 2, URI-list services can act as application servers. In other words, they take a URI list as input and can provide arbitrary services. So the server's interpretation of the URI list depends on the service being provided. For a conference server, the URIs in the list might identify the initial set of participants. For a server dealing with MESSAGEs, the URIs in the list might identify the recipients of an instant message 💬

At the SIP level, this means the behavior of application servers that receive requests with URI lists SHOULD be specified on a per-service basis. Examples of these specifications are [RFC5366] for INVITE, [RFC5365] for MESSAGE, and [RFC5367] for SUBSCRIBE ✨

4.3. Results 📊

Per GEN 3, user agents should have a way to get information about the operations the application server performed. Since those operations are service specific, how user agents get kept informed is also service specific. For example, a user agent setting up an ad hoc conference with an INVITE that carries a URI list can find out which participants were successfully brought into the conference by using the conference package [RFC4575] 🎉

5. Security Considerations 🔐

Security plays a huge role in implementing any URI-list service. In fact, it's the most important common area across all types of URI-list services 😭🔥

By definition, a URI-list service takes one request in and sends a potentially large number of them out. Attackers may try to use URI-list services as traffic amplifiers to launch DoS (denial-of-service) attacks. This section gives guidelines to avoid these attacks 🚨

5.1. List Integrity and Confidentiality 🔒

Attackers may try to modify URI lists sent from clients to servers. That could make the server behave differently than the client expects, like sending requests to different recipients than the ones the client specified 🙀 To prevent this, clients SHOULD integrity protect URI lists using end-to-end mechanisms such as S/MIME or, if those aren't available, hop-by-hop mechanisms such as TLS. Both S/MIME and TLS can also provide URI-list confidentiality if needed 🫶

5.2. Amplification Attacks 💥

okay bestie, this one is seriously important 😭 URI-list services take ONE request in and can send out a potentially huge number of requests 📤. These services usually run on beefy servers with fat, high-bandwidth links 💪, so we have to make sure attackers can't use them as amplifiers to launch DoS attacks 🚨.

Here's the scary part 👀. An attacker can send a URI list whose host parts point at the victims of the DoS attack. Those victims don't have to be SIP nodes either. They can be non-SIP endpoints or even routers 🖥️. If it works, the attacker floods a set of nodes, or just one node, with traffic without ever having to generate a big volume of traffic themselves. Sneaky, and not it 💀.

ngl this isn't a SIP-only problem 🙈. It also shows up in multihoming situations, where a server has to contact a set of IP addresses that a client gave it.

So there are a few measures we need to take to stop this. The first one is keeping unauthorized users away from URI-list services 🚫. That means URI-list services MUST NOT perform any request explosion for an unauthorized user. URI-list services MUST authenticate users and check whether they're authorized to request the service before they do any request fan-out 🔐. Main character rule #1 ✨.

Heads up, the risk also exists when a client uses stored URI lists 📚. Application servers MUST use authentication and authorization mechanisms with equivalent security properties when dealing with stored and request-contained URI lists. No sneaking around the lock just because the list was saved 🔒.

Now, even with that rule keeping unauthorized users out, authorized users can still launch attacks through these services 😤. To deal with that, we introduce the concept of opt-in lists 🎀. URI-list services should not allow a client to place a user (identified by his or her URI) in a URI list unless that user has already agreed to be placed in that list. And URI-list services MUST NOT send a request to a destination that hasn't agreed to receive requests from the URI-list service beforehand 🙅‍♀️.

There are a bunch of ways users can agree to receive requests from a URI-list service 💌. They could fill out a web page, send an email, sign a contract, or use "A Framework for Consent-Based Communications in the Session Initiation Protocol (SIP)" [RFC5360], whose requirements are discussed in [RFC4453] 📝. On top of that, users MUST be able to further describe the requests they're willing to receive. For example, a user might only want to get requests from a particular URI-list service on behalf of a particular user 🫶. Basically, these rules turn the URI lists used by URI-list services into opt-in lists ✨.

When a URI-list service gets a request with a URI list from a client, it checks whether all the destinations have agreed beforehand to receive requests from the service on behalf of this client 🔍. If the URI list has permission to send requests to all of the targets in the request, it goes ahead and does so 🚀. If not, it doesn't send any request at all 🛑.

The Framework for Consent-Based Communications in SIP [RFC5360] also specifies a way for the URI-list service to tell the client that some permissions were missing and how to request them 📬.

Ok but here's the catch 🙈: the mechanism used to get permissions should not create chances to launch DoS amplification attacks. Those attacks would be possible if, say, the URI-list service automatically contacted the whole set of targets it didn't have permissions for in order to ask for them. The service would get ONE SIP request and then send out a bunch of authorization request messages 😱. The Framework for Consent-Based Communications in SIP [RFC5360] avoids this by having the client generate roughly the same amount of traffic toward the URI-list service as the service generates toward the destinations 👑.

Last thing for this section 🫶. To have an interoperable way to meet the opt-in list requirements described here, URI-list services MUST implement and SHOULD use "A Framework for Consent-Based Communications in SIP" [RFC5360]. Periodt 💅.

5.3. General Issues 🌸

URI-list services MAY have policies that limit the number of URIs in the lists they accept 📏. That's because a super long list could be used in a denial-of-service attack to pile a huge burden onto the URI-list service, which would have to send a massive number of SIP requests 😵.

A URI-list service makes a set of requests out of a URI list 📨. Section 19.1.5 of [RFC3261] gives recommendations that need to be taken into consideration when forming a request from a URI 🧠. Naturally, those recommendations apply to all SIP URI-list services 💖.

The general requirement GEN 4 says URI-list services need to authenticate their clients 🔐, and the previous rules apply to URI-list services in general 🌈. On top of all that, specifications dealing with individual methods MUST describe the security issues that relate to each particular method. Every method gets its own security glow-up 💜.

6. IANA Considerations 🧚

This document defines a new Content-Disposition header field disposition type (recipient-list) in Section 4.1 🎀. That value has been registered in the IANA registry for Mail Content Disposition Values and Parameters, with the following description:

recipient-list    The body includes a list of URIs to which URI-list
                  services are to be applied.

7. Acknowledgements 🙏

Duncan Mills and Miguel A. Garcia-Martin supported the idea of 1 to n MESSAGE requests 💌. Jon Peterson, Dean Willis, and Jonathan Rosenberg provided useful comments 🫶.

8. References 📚

8.1. Normative References 🦋

  • [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [RFC2183] Troost, R., Dorner, S., and K. Moore, "Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field", RFC 2183, August 1997.
  • [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002.
  • [RFC5360] Rosenberg, J., Camarillo, G., Ed., and D. Willis, "A Framework for Consent-Based Communications in the Session Initiation Protocol (SIP)", RFC 5360, October 2008.

8.2. Informative References 🌷

  • [RFC4453] Rosenberg, J., Camarillo, G., and D. Willis, "Requirements for Consent-Based Communications in the Session Initiation Protocol (SIP)", RFC 4453, April 2006.
  • [RFC4575] Rosenberg, J., Schulzrinne, H., and O. Levin, "A Session Initiation Protocol (SIP) Event Package for Conference State", RFC 4575, August 2006.
  • [RFC4662] Roach, A.B., Campbell, B., and J. Rosenberg, "A Session Initiation Protocol (SIP) Event Notification Extension for Resource Lists", RFC 4662, August 2006.
  • [RFC4825] Rosenberg, J., "The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)", RFC 4825, May 2007.
  • [RFC5364] Garcia-Martin, M. and G. Camarillo, "Extensible Markup Language (XML) Format Extension for Representing Copy Control Attributes in Resource Lists", RFC 5364, October 2008.
  • [RFC5365] Garcia-Martin, M. and G. Camarillo, "Multiple-Recipient MESSAGE Requests in the Session Initiation Protocol (SIP)", RFC 5365, October 2008.
  • [RFC5366] Camarillo, G. and A. Johnston, "Conference Establishment Using Request-Contained Lists in the Session Initiation Protocol (SIP)", RFC 5366, October 2008.
  • [RFC5367] Camarillo, G., Roach, A.B., and O. Levin, "Subscriptions to Request-Contained Resource Lists in the Session Initiation Protocol (SIP)", RFC 5367, October 2008.

Authors' Addresses 🏡

Gonzalo Camarillo
Ericsson
Hirsalantie 11
Jorvas  02420
Finland

EMail: Gonzalo.Camarillo@ericsson.com


Adam Roach
Tekelec
17210 Campbell Rd Ste 250
Dallas, TX  75252
USA

EMail: Adam.Roach@tekelec.com

Copyright (C) The IETF Trust (2008).

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🔥

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. 💜

📦 where this page comes from