RFC 5658
Addressing Record-Route Issues in the Session Initiation Protocol (SIP)
Addressing Record-Route Issues in the Session Initiation Protocol (SIP) 🎀
RFC: 5658 Network Working Group 🌸 Authors: T. Froment (Tech-invite), C. Lebel and B. Bonnaerens (Alcatel-Lucent) Category: Standards Track ⭐ Date: October 2009 Obsoletes / Updates: This header doesn't list anything it obsoletes or updates, so I'm not adding anything 🙈
Abstract ✨
okay so a SIP Proxy usually sticks a Record-Route header onto the first, dialog-creating requests so that all the later in-dialog requests come back through it 🦋 That header holds a SIP URI or a SIPS (secure SIP) URI that says where and how those later requests should go to reach the proxy. These URIs can carry IPv4 or IPv6 addresses, plus URI parameters that affect routing, like the transport parameter (for example, transport=tcp) or a compression indication like comp=sigcomp 💅
Here's the tricky bit: when a proxy has to change some of those parameters between its incoming and outgoing interfaces (multi-homed proxies, transport protocol switching, or IPv4 to IPv6 scenarios, etc.), you end up asking what should go in the Record-Route header(s) 🤔 One header just can't have the characteristics of both interfaces at once, no cap.
This document tries to clear up these scenarios and fix bugs that people already spotted on this topic 🧚 It formally recommends the double Record-Route technique as an alternative to the current RFC 3261 text, which only describes a Record-Route rewriting solution. Main character energy for double Record-Route, fr fr 👑
Status of This Memo 📜
This document specifies an Internet standards track protocol for the Internet community, and asks for discussion and suggestions for improvements 💜 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Copyright Notice ©️
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved 🫶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as in effect on the date of publication of this document. Please read these carefully, bestie, because they spell out your rights and restrictions for this document 📖 Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the BSD License.
Table of Contents 🗂️
1. Introduction ....................................................3
2. Terminology .....................................................3
3. Problem Statement ...............................................4
3.1. Background: Multi-Homed Proxies ............................4
3.2. Identified Problems ........................................5
4. Record-Route Rewriting ..........................................6
5. Double Record-Routing ...........................................6
6. Usage of Transport Protocol Parameter ..........................10
6.1. UA Implementation Problems and Recommendations ............10
6.2. Proxy Implementation Problems and Recommendations .........14
7. Conclusion .....................................................15
8. Security Considerations ........................................16
9. Acknowledgments ................................................16
10. References ....................................................17
10.1. Normative References .....................................17
10.2. Informative References ...................................171. Introduction 🦋
So over the years, people at interop events like SIPit kept noticing that a lot of implementations ran into interoperability problems. The cause was various Record-Routing issues, or misreadings of [RFC3261]. It mostly bites when something changes between the incoming and outgoing sides of a proxy: transport protocol switching, "multi-homed" proxies (including IPv4 to IPv6 interface changes), and so on 😭 Several documents have already tackled this, and each one gives a decent recommendation for its own use case. But none of them offers a general solution or a coherent set of clarifications 💅
Here's what's already out there:
- [RFC3486], Section 6, describes double Record-Routing as an alternative to Record-Route rewriting in responses. This document is limited in scope to the "comp=sigcomp" parameter when doing compression with Signalling Compression (SIGCOMP) 🍓
- [RFC3608], Section 6.2, recommends double Record-Routing instead of the rewriting solution described in [RFC3261] for "Dual-homed" proxies. Those are defined as "proxies connected to two (or more) different networks such that requests are received on one interface and proxied out through another network interface". 🌸
- Section 3.1.1 of [V6Tran] mandates double Record-Routing for multi-homed proxies doing IPv4/IPv6 transitions, when the proxy inserts IP addresses in the Record-Route header URI. ✨
So why are there still problems? Despite all those documents, the RFC 3261 description has never been changed, and lots of implementations don't support extensions like Service-Route ([RFC3608]) or SIGCOMP ([RFC3486]) 🙈
This document also wants to clarify a bug that's referenced in [BUG664]. In particular, it takes on the [BUG664] recommendation, which says that "the language that describes this, needs to clearly capture that this applies to all types of different interface on each side issues, including IPv4 on one side and IPv6 on the other". Literally the whole point 👑
2. Terminology 📚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🫶
3. Problem Statement 🔥
3.1. Background: Multi-Homed Proxies 🌈
A multi-homed proxy is a proxy connected, like a router, to two or more different networks, with an interface into each network. That way, traffic comes "in" one network and goes "out" a different one. Here's a simple example 🎀
+-----+
| UA1 |
+--+--+
| .66
192.0.2.64/26 |
----------------+---+-...
|
| .65
+-+-+
| P |
+-+-+
| .129
| 192.0.2.128/26
...---+------+------------------
|
| .130
+--+--+
| UA2 |
+--+--+
Figure 1: Multi-Homed Proxy IllustrationUA1 has one interface with IP address 192.0.2.66 🦋
The Proxy P has two interfaces and two addresses:
--192.0.2.65
--192.0.2.129UA2 has one interface with address 192.0.2.130. There's potentially no IP-level route between UA1 and UA2 (pinging or traceroute doesn't work between these two hosts). They live in entirely different subnetworks 😭 But they can still exchange SIP messages, because P is a SIP Proxy. This works in SIP because P can apply Record-Routing ✨
In most cases there is still some IP connectivity between UA1 and UA2. But the SIP proxy has to manage the SIP traffic between the two different "sides". For example, those sides might use two different IP addresses, or one side might use SIGCOMP and the other side not, etc. 🧚
3.2. Identified Problems 💖
Handling of the Record-Route header in SIP Proxies is specified by the following sections of [RFC3261]:
On the request processing side, [RFC3261], item 4 of Section 16.6 states that:
The URI placed in the Record-Route header field value MUST be a SIP or SIPS URI. [...] The URI SHOULD NOT contain the transport parameter unless the proxy has knowledge (such as in a private network) that the next downstream element that will be in the path of subsequent requests supports that transport.
Following this statement, it's not clear how a proxy should decide when to insert the transport protocol parameter in the Record-Route URI 🤔
On the response processing side, [RFC3261] recommends in step 8 of Section 16.7 that:
If the selected response contains a Record-Route header field value originally provided by this proxy, the proxy MAY choose to rewrite the value before forwarding the response. This allows the proxy to provide different URIs for itself to the next upstream and downstream elements. A proxy may choose to use this mechanism for any reason. For instance, it is useful for multi-homed hosts. If the proxy received the request over Transport Layer Security (TLS), and sent it out over a non-TLS connection, the proxy MUST rewrite the URI in the Record-Route header field to be a SIPS URI.
Note that [RFC5630] has weakened the SIP/SIPS URI rewriting requirement in the Record-Route header by removing this second paragraph 🙈
Indeed, [RFC3261] suggests rewriting the Record-Route header in responses 💅
This list highlights why rewriting and double Record-Routing techniques are useful for any multi-homed proxy use case: whenever the proxy changes its IP address, the transport protocol, or the URI scheme between incoming and outgoing interfaces. Rewriting and double Record-Routing are described, compared, and discussed in Sections 4 and 5. The specific question of whether or not to insert the transport parameter in the Record-Route URI is then discussed in Section 6 🎀
4. Record-Route Rewriting ✨
Okay bestie, so the IETF mailing lists have been saying this for ages: rewriting Record-Route in responses is NOT the move 💅 for multi-homed or transport-protocol-switching situations. 🙈 The bigger problem is that rewriting makes the route set the caller sees different from the one the callee sees, and that causes at least two issues. 😭
- The callee can't sign the route set, because the proxy edits it in the response. That means end-to-end protection of the route set can't be supported by the protocol. Honestly, this breaks the Internet's principles of openness and end-to-end connectivity. 💔
- A proxy has to run special "multi-homed" logic, which is so much extra work 🥱. While forwarding a request, it works out the output interface and writes info that resolves to that interface into the URI of the
Record-Routeheader. When a response comes back, the proxy has to look through theRecord-Routeheader(s), find an input interface, and selectively edit them so they point at the correct output interface. It has to do this lookup for every response it forwards, so this technique basically gives the CPU a drag. 🐌
So, this document recommends using the double Record-Route approach to avoid rewriting the Record-Route. This applies to ALL uses of Record-Route rewriting by proxies, including transport protocol switching and multi-homed proxies. It's the main character solution 👑
5. Double Record-Routing
The serious drawbacks of rewriting are exactly why double Record-Routing has been recommended in SIP extensions like [RFC3486] or [RFC3608]. Iconic behaviour 🦋
Here's how it works. The proxy inserts, before any existing Record-Route header, a Record-Route header whose URI reflects the input interface (including schemes and/or URI parameters). Then it adds a second Record-Route header whose URI reflects the output interface. When the response is processed, the recorded route doesn't need any modification at all ✨ This is completely backward compatible with [RFC3261]. Generally speaking, double Record-Routing is cheaper on time complexity, because when the response comes back the proxy doesn't have to do any rewrites (and so, no searching) 🍓 Plus, handling in-dialog requests and responses doesn't need any special handling anymore. Clean. 💖
Now, when double Record-Routing, the proxy has to handle the subsequent in-dialog request(s) as a spiral, so it has to devote resources to maintaining the transactions needed to handle that spiral. What counts as a spiraling request is explained in Section 6 of [RFC3261]. To avoid a spiral, the proxy can be smart and scan one extra Route header ahead to see whether the request will spiral through it. If it will, the proxy can optimize the second spiral through itself. This is an implementation decision, but it's SO much more efficient to avoid spiraling 🧚 So, in Section 16.4, "Route Information Preprocessing" [RFC3261], implementors can choose that a proxy MAY remove two Route headers instead of one when using double Record-Routing. Bestie, that's a whole glow-up 🌈
The following example extends the one given in [V6Tran]. It shows a basic call flow using double Record-Routing in a multi-homed IPv4 to IPv6 proxy, and it annotates the dialog state on each User Agent (UA). In this example, proxy P1, responsible for the domain biloxy.example.com, gets a request from an IPv4-only upstream client, and proxies it to an IPv6-only downstream server. Proxy P1 runs on a dual-stack host. On its IPv4 interface it has the address 192.0.2.254, and on its IPv6 interface it's configured with 2001:db8::1. Some mandatory SIP headers have been left out to keep things readable 🎀
UA1 Proxy "P1" UA2
(IPv4) (IPv4/IPv6) (IPv6)
| | |
| F1 INVITE | |
|------------------->| F2 INVITE |
| |------------------->|
| 100 Trying | |
|<-------------------| |
| | F3 200 OK |
| F4 200 OK |<-------------------|
|<-------------------| |
| | |
| F5 ACK | |
|------------------->| F6 ACK |
| |------------------->|
| | |
| | F7 BYE |
| F8 BYE |<-------------------|
|<-------------------| |Figure 2: IPv4 to IPv6 Multi-Homed Proxy Illustration
F1 INVITE UA1 -> P1 (192.0.2.254:5060)
INVITE sip:bob@biloxi.example.com SIP/2.0
Route: <sip:192.0.2.254:5060;lr>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>
Contact: <sip:alice@192.0.2.1>
F2 INVITE P1 (2001:db8::1) -> UA2
INVITE sip:bob@biloxi.example.com SIP/2.0
Record-Route: <sip:[2001:db8::1];lr>
Record-Route: <sip:192.0.2.254:5060;lr>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>
Contact: <sip:alice@192.0.2.1>
Dialog State at UA2:
Local URI = sip:bob@biloxi.example.com
Remote URI = sip:alice@atlanta.example.com
Remote target = sip:alice@192.0.2.1
Route Set = sip:[2001:db8::1];lr
sip:192.0.2.254:5060:lr
F3 200 OK UA2 -> P1 (2001:db8::1)
SIP/2.0 200 OK
Record-Route: <sip:[2001:db8::1];lr>
Record-Route: <sip:192.0.2.254:5060;lr>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>;tag=4567
Contact: <sip:bob@[2001:db8::33]>
F4 200 OK P1 -> UA1
SIP/2.0 200 OK
Record-Route: <sip:[2001:db8::1];lr>
Record-Route: <sip:192.0.2.254:5060;lr>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>;tag=4567
Contact: <sip:bob@[2001:db8::33]>
Dialog State at UA1:
Local URI = sip:alice@atlanta.example.com
Remote URI = sip:bob@biloxi.example.com
Remote target = sip:bob@[2001:db8::33]
Route Set = sip:192.0.2.254:5060:lr
sip:[2001:db8::1];lr
F5 ACK UA1 -> P1 (192.0.2.254:5060)
ACK sip:bob@[2001:db8::33] SIP/2.0
Route: <sip:192.0.2.254:5060:lr>
Route: <sip:[2001:db8::1];lr>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>;tag=4567
F6 ACK P1 (2001:db8::1) -> UA2
ACK sip:bob@[2001:db8::33] SIP/2.0
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>;tag=4567
(both Route headers have been removed by the proxy)
F7 BYE UA2 -> P1 (2001:db8::1)
BYE sip:alice@192.0.2.1 SIP/2.0
Route: <sip:[2001:db8::1];lr>
Route: <sip:192.0.2.254:5060:lr>
From: Bob <sip:bob@biloxi.example.com>;tag=4567
To: Alice <sip:alice@atlanta.example.com>;tag=1234
F8 BYE P1 (192.0.2.254:5060) -> UA1
BYE sip:alice@192.0.2.1 SIP/2.0
From: Bob <sip:bob@biloxi.example.com>;tag=4567
To: Alice <sip:alice@atlanta.example.com>;tag=1234Figure 3: Multi-Homed IPv4 to IPv6 Double Record-Routing Illustration
6. Usage of Transport Protocol Parameter
This section is all about a set of problems linked to using transport protocol URI parameters in the Record-Route header. Sometimes things go wrong because it isn't clear whether or not to include the transport parameter on the URI of the Record-Route header. Past SIPit events flagged this as a frequent problem, so it's not just you 🫶
[RFC3261], step 8 of Section 16.7 says:
The URI SHOULD NOT contain the transport parameter unless the proxy has knowledge (such as in a private network) that the next downstream element that will be in the path of subsequent requests supports that transport.
Honestly, this wording seems to confuse implementors 😵💫 The result is proxies that insert a single Record-Route without a transport URI parameter, and that leads to the problems described in this section. 💀
6.1. UA Implementation Problems and Recommendations 💅
okay so picture this: a SIP proxy doing TCP to UDP transport protocol switching 🦋 bestie, this is the drama we're here for 😭
Proxy P1 is responsible for the domain biloxy.example.com. It gets a request from Alice (UA1) over TCP and proxies it to Bob (UA2), who registered a Contact that says UDP is the transport. So P1 gets the first request from Alice over TCP and forwards it to Bob over UDP. For the requests after that, it's expected that TCP keeps going between Alice and P1, and UDP between P1 and Bob. But that can't happen if a numeric IP address is used and no transport parameter is set on the Record-Route URI. The reason is the procedures in [RFC3263] 💀 Some mandatory SIP headers got left out below so it's easier to read 🎀
Alice UA1 ===== TCP ===== Proxy P1 ===== UDP ===== Bob UA2
| | |
| F1 INVITE | |
|----------------------->| F2 INVITE |
| |------------------------>|
| 100 Trying | |
|<-----------------------| |
| | F3 200 OK |
| F4 200 OK |<------------------------|
|<-----------------------| |
| | |
| F5 ACK | |
|---(sent over UDP) X--->| ACK |
| |------------------------>|
| | |
| | F6 BYE |
| BYE |<------------------------|
|<-----------------------| |
Figure 4: TCP to UDP Transport Protocol
Switching Issue Illustration
F1 INVITE UA1 -> P1 (192.0.2.1/tcp)
INVITE sip:bob@biloxi.example.com SIP/2.0
Route: <sip:192.0.2.1;lr;transport=tcp>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>
Contact: <sip:alice@ua1.atlanta.example.com;transport=tcp>
F2 INVITE P1 -> UA2 (ua2.biloxi.example.com/udp)
INVITE sip:bob@ua2.biloxi.example.com;transport=udp SIP/2.0
Record-Route: <sip:192.0.2.1;lr> (NO transport param)
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>
Contact: <sip:alice@ua1.atlanta.example.com;transport=tcp>
Dialog State at UA2:
Local URI = sip:bob@biloxi.example.com
Remote URI = sip:alice@atlanta.example.com
Remote target = sip:alice@ua1.atlanta.example.com;transport=tcp
Route Set = sip:192.0.2.1;lr
F3 200 OK UA2 -> P1 (192.0.2.1/udp)
SIP/2.0 200 OK
Record-Route: <sip:192.0.2.1;lr>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>;tag=4567
Contact: <sip:bob@ua2.biloxi.example.com>
F4 200 OK P1 -> UA1 (ua1.atlanta.example.com/tcp)
SIP/2.0 200 OK
Record-Route: <sip:192.0.2.1;lr>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>;tag=4567
Contact: <sip:bob@ua2.biloxi.example.com>
Dialog State at UA1:
Local URI = sip:alice@atlanta.example.com
Remote URI = sip:bob@biloxi.example.com
Remote target = sip:bob@ua2.biloxi.example.com
Route Set = sip:192.0.2.1;lr
F5 ACK UA1 -> P1 (192.0.2.1/udp)
ACK sip:bob@ua2.biloxi.example.com SIP/2.0
Route: <sip:192.0.2.1;lr>
From: Alice <sip:alice@atlanta.example.com>;tag=1234
To: Bob <sip:bob@biloxi.example.com>;tag=4567
F6 BYE UA2 -> P1 (192.0.2.1/udp)
BYE sip:alice@ua1.atlanta.example.com;transport=tcp SIP/2.0
Route: <sip:192.0.2.1;lr>
From: Bob <sip:bob@biloxi.example.com>;tag=4567
To: Alice <sip:alice@atlanta.example.com>;tag=1234
Figure 5: TCP to UDP Transport Protocol
Switching Issue DescriptionHere's the tea ☕ P1 doesn't put any transport parameter in the Record-Route URI. So when UA1 sends in-dialog requests later, like the ACK in F5, it follows the behavior in Section 12.2 (requests within a Dialog) of [RFC3261]. That means the route set gets used, and then, with [RFC3263] applied, the Route sip:192.0.2.1 resolves to UDP by default, since there's no transport parameter. And no Naming Authority Pointer (NAPTR) lookup happens, because it's a numeric IP address. Iconic behavior from a numeric IP, ngl 🙈
The real issue is that UA1 is trying to send that ACK and it just isn't ready to change transport for a mid-dialog request. It fails, and the proxy implementer has to put the transport protocol into the Record-Route URI to fix it 🔧
Now, what if the proxy had Record-Routed its logical name (biloxi.example.com) instead? Since Bob is contacted over UDP, the switching gets avoided only if the transport that comes out of [RFC3263] procedures is UDP. For any other resulting transport, the switching problem above happens anyway. And if one of the UAs sends an initial request over a different transport than the one it got from DNS, this is also going to be a problem 😬
In real life, there are a bunch of situations where UA implementations don't use logical names and NAPTR records for an initial request to a proxy. For example, this happens when:
- UAs let you "choose" the transport for initial requests, even if they support [RFC3263]. This is a super common UA feature, and it's justified by these use cases:
- when it's not possible to change the DNS server configuration and the implementation doesn't support all the transport protocols that could be configured by default in DNS (e.g., TLS).
- when the end-user wants to pick their transport protocol for whatever reason, e.g., needing to force TCP, avoiding UDP/congestion, retransmitting, or fragmenting, etc.
Forcing the transport for initial requests in UAs like this SHOULD be avoided 🙅♀️ Picking the transport in the configuration of an outbound proxy means the [RFC3263] procedure gets bypassed for initial requests. So if the proxy Record-Routed with no transport parameter, as [RFC3261] recommends, the UA ends up being forced to use the [RFC3263]-preferred transport for subsequent requests anyway. That leads right into the problematic scenario from Figure 4 💔
- UAs decide to always keep the same transport for a given dialog. This choice is erratic 🌀 If the proxy isn't Record-Routing, the callee MAY receive the subsequent request over a transport that isn't the one in its Contact. If a UA really wants to avoid transport protocol switching between the initial and subsequent requests, it SHOULD rely on DNS records for that. So it SHOULD avoid statically configuring the outbound proxy with a numeric IP address. A logical name, with no transport parameter, SHOULD be used instead ✨
- UAs don't support [RFC3263] at all, or don't have any DNS server available. In that case, as shown earlier, forcing UA1 to switch from TCP to UDP between the initial request and the subsequent request(s) is clearly not the desired default behavior, and it typically leads to interoperability problems. UA implementations SHOULD then be ready to change the transport protocol between initial and subsequent requests. In theory, any UA or proxy using UDP must also be prepared to use TCP for requests that exceed the size limit of path MTU, as described in Section 18.1.1 of [RFC3261]. the transport protocol drama is so real, bestie 🦋👑
6.2. Proxy Implementation Problems and Recommendations ✨
okay so UA bugs are one side of the drama, but proxies can totally help fix it too 🫶 If the transport protocol changes between a proxy's incoming and outgoing sides, the proxy SHOULD use the double Record-Route technique and SHOULD add a transport parameter to each of the Record-Route URIs it inserts. 💅 When TLS is used on the transport on either side of the proxy, the URI in the Record-Route header field MUST encode a next-hop that will be reached using TLS. 🔒
There are two ways to make that work. Option one: the Record-Route URI is a SIPS URI 🦋 Option two: the Record-Route URI is built so that applying the [RFC3263] resolution procedures to it ends up selecting TLS 🌸
Now the tea ☕ Proxies compliant with this specification MUST NOT use a transport=tls parameter on the URI placed in the Record-Route, because transport=tls was deprecated by [RFC3261]. Not me using a deprecated parameter in 2026 😭
Record-Route rewriting MAY also be used 🎀 BUT the "put a transport parameter on the Record-Route URI" advice does not apply when the proxy changed the transport because the UDP request was too big, per Section 18.1.1 of [RFC3261]. 🙈 Here's how the earlier example plays out, and one of these two things will happen:
- Double Record-Routing: the proxy inserts two Record-Route headers into the SIP request. The first is
Record-Route: <sip:192.0.2.1;lr;transport=tcp>, and the second isRecord-Route: <sip:192.0.2.1;lr>with no transport, or withtransport=udp, which basically means the same thing. 💖 - Record-Route rewriting on responses: in the INVITE request sent in F2, the proxy puts the outgoing transport protocol in the transport parameter of the Record-Route URI. Doing so, UA2 will correctly send its BYE request in F6 using the same transport protocol as the previous messages in the same dialog ✨ The proxy rewrites the Record-Route when it processes the 200 OK response, changing the transport parameter "on the fly" to
transport=tcp, so the Route set looks like<sip:192.0.2.1;lr;transport=tcp>for UA1 and<sip:192.0.2.1;lr;transport=udp>for UA2. 🦋
It's super common for proxy implementations to support double Record-Route AND to insert the transport parameter in the Record-Route URI 💜 That's fine, as long as every SIP element that might be on the path of later requests supports that transport. Let me explain why, because it's a whole vibe 🧚 Imagine two proxies, P1 at "p1.biloxi.example.com" and P2, which is on the path of an initial request. P1 is Record-Routing and switches the transport from UDP to Stream Control Transmission Protocol (SCTP), because the P2 URI resolves to SCTP when [RFC3263] is applied. So P1 inserts two Record-Route headers:
Record-Route: <sip:p1.biloxi.example.com;transport=udp> and
Record-Route: <sip:p1.biloxi.example.com;transport=sctp>.Here's where it gets messy 😬 If P2 is NOT Record-Routing, then the SIP element downstream of P2 will be asked to reach P1 over SCTP for any later in-dialog request from the callee, and that downstream element might not support SCTP at all. Yikes 💀
So to dodge that, this document recommends that a proxy SHOULD apply the double Record-Routing technique as soon as it changes the transport protocol between its incoming and outgoing sides. If P2 in the example above follows this advice, it does double Record-Routing, and the downstream element never has to send requests over a transport it doesn't support 🎀
And by extension, a proxy SHOULD also insert a Record-Route header for any multi-homed situation (like the ones described in this document: scheme changes, sigcomp, IPv4/IPv6, transport changes, and so on) that could affect how proxies further along the path process subsequent requests 🌈
7. Conclusion
okay recap time, bestie 📝✨ Here's what to notice:
- Record-Route rewriting is presented as a technique that MAY be used, with the drawbacks outlined in Section 4. 🌸
- Double Record-Routing is presented as the technique that SHOULD be used, and it's documented in Section 5. 👑
- Record-Route header interoperability problems in transport protocol switching scenarios were outlined and described in Section 6. That last section gives some recommendations to UA and proxy implementations to make things better 🫶 Proxies SHOULD use double Record-Routing for any multi-homed situation that MAY impact further processing, and they SHOULD put transport protocol parameters on Record-Route URIs in some circumstances. UAs SHOULD NOT offer options to overwrite the transport for initial requests 🙅♀️ Also, UAs SHOULD rely on DNS to express their desired transport and SHOULD avoid IP addresses with transport parameters in this case. Finally, UAs SHOULD be ready to switch transports between the initial request and later in-dialog messages 💅
8. Security Considerations
ngl this section is serious, so let's go 🔐 The recommendations in this document describe a way to use the existing protocol specified in RFC 3261 rather than introducing any new protocol mechanism. So they don't bring in any new security concerns, BUT the existing ones deserve extra thought 🧠 Specifically, when a message is transiting two interfaces, the double Record-Route technique carries information about both interfaces to each of the involved endpoints (and any intermediaries between this proxy and those endpoints). Rewriting, on the other hand, only exposes information about the interface closest to each endpoint 👀 If topology hiding or privacy (as described in [RFC3323]) is a concern, the URI values placed in the Record-Route for each interface should be carefully constructed to avoid exposing more information than was intended. Don't overshare, babe 🙈🔒
9. Acknowledgments
huge thank yous to everyone who reviewed and commented 🥹💖 Dean Willis, Vijay K. Gurbani, Joel Repiquet, Robert Sparks, Jonathan Rosenberg, Cullen Jennings, Juha Heinanen, Paul Kyzivat, Nils Ohlmeier, Tim Polk, Francois Audet, Adrian Farrel, Ralph Droms, Tom Batsele, Yannick Bourget, Keith Drage, and John Elwell. You all are literally iconic 👑✨
10. References
10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
A., Peterson, J., Sparks, R., Handley, M., and E.
Schooler, "SIP: Session Initiation Protocol", RFC 3261,
June 2002.
[RFC3263] Rosenberg, J. and H. Schulzrinne, "Session Initiation
Protocol (SIP): Locating SIP Servers", RFC 3263, June
2002.
[RFC3323] Peterson, J., "A Privacy Mechanism for the Session
Initiation Protocol (SIP)", RFC 3323, November 2002.
[RFC5630] Audet, F., "The Use of the SIPS URI Scheme in the Session
Initiation Protocol (SIP)", RFC 5630, October 2009.10.2. Informative References
[BUG664] Sparks, RS., "Bug 664: Double record routing,
http://bugs.sipit.net/show_bug.cgi?id=664", October 2002.
[RFC3486] Camarillo, G., "Compressing the Session Initiation
Protocol (SIP)", RFC 3486, February 2003.
[RFC3608] Willis, D. and B. Hoeneisen, "Session Initiation Protocol
(SIP) Extension Header Field for Service Route Discovery
During Registration", RFC 3608, October 2003.
[V6Tran] Camarillo, G., El Malki, K., and V. Gurbani, "IPv6
Transition in the Session Initiation Protocol (SIP)", Work
in Progress, August 2009.Authors' Addresses
the people behind it 💜🧚
Thomas Froment
Tech-invite
EMail: thomas.froment@tech-invite.com
Christophe Lebel
Alcatel-Lucent
Lieu dit Le Mail
Orvault 44708
France
EMail: christophe.lebel@alcatel-lucent.com
Ben Bonnaerens
Alcatel-Lucent
Copernicuslaan 50
Antwerpen 2018
Belgium
EMail: ben.bonnaerens@alcatel-lucent.com📦 where this page comes from
- ietf: rfc5658 2009-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms