RFC 5898

Connectivity Preconditions for Session Description Protocol (SDP) Media Streams

πŸ“… published July 2010, from ietf

RFC 5898: Connectivity Preconditions for Session Description Protocol (SDP) Media Streams πŸ’–

okay bestie, this one is from the IETF, which is the crew that writes the rules for how the internet talks to itself 🌐✨. It's RFC 5898 and it's a Standards Track document, so it's an actual spec people build software against πŸ’…. It came out in July 2010 and its ISSN is 2070-1721 πŸŽ€.

The authors are F. Andreasen (Cisco Systems), G. Camarillo (Ericsson), D. Oran (Cisco Systems), and D. Wing (Cisco Systems) 🫢. The title block doesn't list anything it obsoletes or updates, so it's a fresh addition to the SDP precondition framework 🧚.

Abstract

okay so this doc adds a brand new connectivity precondition to the SDP precondition framework πŸ¦‹. The whole point is to hold off on setting up or changing a session until the media stream is actually connected and verified ✨. How you check depends on the transport. For UDP (unreliable datagrams), you poke the stream by sending data or control packets to probe it πŸ”₯. For TCP (reliable, connection-oriented), a successful connection setup can be enough, or you can probe with data or control packets, depending on what's going on πŸ’œ.

Status of This Memo

This is an Internet Standards Track document 🌸.

It's a product of the Internet Engineering Task Force (IETF) and reflects what the IETF community agreed on. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG) πŸ‘‘. If you want more on Internet Standards, check Section 2 of RFC 5741 πŸ“.

Info about the document's current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc5898 πŸ’….

Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved πŸŽ€.

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date πŸ“œ. Read those carefully, because they spell out your rights and restrictions. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes 🫢.

This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008 🌈. The people who control the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process πŸ™ˆ. Unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside that process. The exceptions are formatting it for publication as an RFC or translating it into languages other than English ✨.

Table of Contents

1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  4
3.  Connectivity Precondition Definition . . . . . . . . . . . . .  4
  3.1.  Syntax . . . . . . . . . . . . . . . . . . . . . . . . . .  4
  3.2.  Operational Semantics  . . . . . . . . . . . . . . . . . .  4
  3.3.  Status Type  . . . . . . . . . . . . . . . . . . . . . . .  5
  3.4.  Direction Tag  . . . . . . . . . . . . . . . . . . . . . .  5
  3.5.  Precondition Strength  . . . . . . . . . . . . . . . . . .  5
4.  Verifying Connectivity . . . . . . . . . . . . . . . . . . . .  6
  4.1.  Correlation of Dialog to Media Stream  . . . . . . . . . .  7
  4.2.  Explicit Connectivity Verification Mechanisms  . . . . . .  7
  4.3.  Verifying Connectivity for Connection-Oriented
        Transports . . . . . . . . . . . . . . . . . . . . . . . .  9
5.  Connectivity and Other Precondition Types  . . . . . . . . . .  9
6.  Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
7.  Security Considerations  . . . . . . . . . . . . . . . . . . . 14
8.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 15
9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 15
  9.1.  Normative References . . . . . . . . . . . . . . . . . . . 15
  9.2.  Informative References . . . . . . . . . . . . . . . . . . 16

1. Introduction ✨

okay so the Session Description Protocol (SDP) [RFC4566] precondition idea lives inside the Session Initiation Protocol (SIP) [RFC3261] and it's defined in RFC 3312 [RFC3312], which got updated by RFC 4032 [RFC4032] 🧚. A precondition is basically a condition that a media stream has to meet before session establishment or modification can move forward πŸ”₯. If it's not met, session progress just waits until the condition is satisfied or the session fails πŸ’€. Like, RFC 3312 [RFC3312] defines the Quality of Service precondition, which makes sure network resources are available before you set up a session (aka before the callee starts alerting) πŸŽ€.

SIP sessions usually exist to set up one or more media streams πŸ¦‹. Here's the tea: a media stream can get negotiated fine through an SDP offer-answer exchange and still fail in practice 😭. If there's one or more Network Address Translators (NATs) or firewalls on the media path, the far end might never receive the media πŸ™ˆ. If the media runs over a connection-oriented transport like TCP [RFC0793], the connection setup itself can fail πŸ’…. So the connectivity precondition in this doc makes sure session progress waits until media stream connectivity has been verified 🫢.

The connectivity precondition type defined here follows the guidelines in RFC 4032 [RFC4032] for extending the SIP preconditions framework 🌸.

2. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] πŸ“–πŸ’œ.

3. Connectivity Precondition Definition πŸ“

3.1. Syntax

The connectivity precondition type is named by the string conn, so we modify the grammar from RFC 3312 [RFC3312] and RFC 5027 [RFC5027] like this πŸŽ€:

   precondition-type = "conn" / "sec" / "qos" / token

This precondition tag gets registered with IANA in Section 8 🧾✨.

3.2. Operational Semantics

okay this part is giving spec energy πŸ€“. According to RFC 4032 [RFC4032], docs that define new precondition types have to describe what UAs (User Agents) do from the moment session establishment gets suspended because of a set of preconditions until it resumes once those preconditions are met πŸ‘‘. An entity that wants to hold off session establishment or modification until media stream connectivity is set up uses this precondition type in an offer πŸ’–. When a mandatory connectivity precondition shows up in an offer, session establishment or modification waits until the precondition is met, meaning media stream connectivity has been established in the desired direction or directions πŸ”₯. This delay also means the called party doesn't get alerted until the precondition is satisfied 😀.

Packets can be sent and received on the media streams in question πŸ¦‹. BUT those packets SHOULD be limited to what's needed to verify connectivity between the two endpoints on that media stream πŸ’…. In other words, the media stream SHOULD NOT be cut through πŸ™ˆ. For example, Interactive Connectivity Establishment (ICE) connectivity checks [RFC5245] and TCP SYN, SYN-ACK, and ACK packets can be exchanged on media streams that support them to verify connectivity 🧚.

Some media streams are described by a single m line but still involve multiple addresses 🌈. For example, RFC 5109 [RFC5109] explains how to send FEC (Forward Error Correction) info as a separate stream, where the address for the FEC stream is given in an a=fmtp line πŸ’œ. When a media stream has multiple destination addresses, connectivity to all of them MUST be verified before the precondition can be met πŸ”₯. For RTP media streams [RFC3550] that use RTCP, connectivity MUST be verified for both RTP and RTCP, and the RTCP transmission interval rules MUST still be adhered to 🫢.

3.3. Status Type

RFC 3312 [RFC3312] supports two kinds of status types, segmented and end-to-end πŸŽ€. The connectivity precondition type defined here MUST be used with the end-to-end status type. Using the segmented status type is undefined πŸ™ˆ.

3.4. Direction Tag

The direction attributes from RFC 3312 [RFC3312] get interpreted like this πŸ¦‹:

  • send: the party that generated the session description is sending packets on the media stream to the other party, and the other party has received at least one of those packets. So there's connectivity in the forward (sending) direction ✨.
  • recv: the other party is sending packets on the media stream to the party that generated the session description, and this party has received at least one of those packets. So there's connectivity in the backwards (receiving) direction πŸ’….
  • sendrecv: both the send and recv conditions hold πŸ”₯.

Quick heads up: a "send" connectivity precondition from the offerer's point of view is a "recv" connectivity precondition from the answerer's point of view, and vice versa πŸ™ƒ. If you need media connectivity in both directions before session establishment or modification can continue, set the desired status to "sendrecv" πŸ’–.

3.5. Precondition Strength ✨

okay so connectivity preconditions can come with a strength-tag, and it's either "mandatory" or "optional" πŸ’… the strength tag is basically how strict the precondition is, and it totally changes what happens next 🫢

if a mandatory connectivity precondition shows up in an offer and the answerer can't satisfy it (like, the offer doesn't include the parameters needed to verify connectivity without cutting through the media 😭), the offer MUST be rejected as described in RFC 3312 [RFC3312]. no mercy, bestie πŸ’€

when an optional connectivity precondition shows up in an offer, the answerer MUST generate its answer SDP as soon as possible πŸƒβ€β™€οΈ session progress isn't held up in this case, so nobody actually knows yet whether the media streams will have connectivity πŸ€·β€β™€οΈ if the answerer does want to hold off session progress until connectivity is verified, the answerer MUST bump the strength up by putting a strength-tag of "mandatory" in the answer. main character move πŸ‘‘

the catch: using a mandatory precondition needs the SIP "Require" header with the option tag "precondition" to be there πŸŽ€ any SIP UA that doesn't support a mandatory precondition will reject those requests 😬 to dodge that, you can use an optional connectivity precondition along with the SIP "Supported" header with the option tag "precondition" instead 🌸

now for re-INVITEs and UPDATEs that carry connectivity preconditions, they follow the rules in Section 6 of RFC 3312 [RFC3312] πŸ’– which basically means:

Both user agents SHOULD continue using the old session parameters until all the mandatory preconditions are met. At that moment, the user agents can begin using the new session parameters.

so both sides keep the old session settings until every mandatory precondition is met, and only then do they switch to the new ones πŸ¦‹


4. Verifying Connectivity πŸ”

okay this part is about how you actually figure out that media stream connectivity is working 🧚 it's done with a connectivity verification mechanism between the media endpoints. that mechanism can be explicit, like ICE [RFC5245] or ICE TCP [ICE-TCP], or implicit, like TCP 🫢 explicit ones spell out exactly when connectivity between two endpoints (using an offer/answer exchange) is ascertained, while implicit ones don't. the mechanism gets negotiated as part of the normal offer/answer exchange, but it's not called out explicitly πŸ™ˆ more than one mechanism can be negotiated, and the offerer and answerer don't have to use the same one πŸ’œ

these rules decide which verification mechanism to use:

  • If an explicit connectivity verification mechanism (e.g., ICE) is negotiated, the precondition is met when the mechanism verifies connectivity successfully.
  • Otherwise, if a connection-oriented transport (e.g., TCP) is negotiated, the precondition is met when the connection is established.
  • Otherwise, if an implicit verification mechanism is provided by the transport itself or the media stream data using the transport, the precondition is met when the mechanism verifies connectivity successfully.
  • Otherwise, connectivity cannot be verified reliably, and the connectivity precondition will never be satisfied if requested.

this document doesn't mandate any particular connectivity verification mechanism 🌈 but below, we share some extra thoughts on verification mechanisms πŸ’…

4.1. Correlation of Dialog to Media Stream 🎯

SIP and SDP don't have any built-in way to link an incoming media stream packet to a specific dialog 😭 so when an offerer is trying to ascertain connectivity and an incoming media stream packet shows up, the offerer might not know which dialog had its "recv" connectivity verified πŸ₯Ί explicit verification mechanisms usually give you a way to correlate the media stream being verified with a particular SIP dialog. some mechanisms might not, though πŸ™ˆ if there's no mechanism for correlating dialog to media stream (e.g., ICE), a UAS (User Agent Server) MUST NOT require the offerer to confirm a connectivity precondition. no gatekeeping here, periodt ✨

4.2. Explicit Connectivity Verification Mechanisms πŸ›°οΈ

explicit verification mechanisms usually send probe traffic and get some kind of feedback that tells the sender whether reception worked πŸ“‘ here are two examples of how they work with connectivity preconditions:

Interactive Connectivity Establishment (ICE) [RFC5245] gives you one or more candidate addresses in signaling between the offerer and answerer, then uses STUN (Simple Traversal of the UDP Protocol through NAT) Binding Requests to figure out which pairs of candidate addresses actually have connectivity 🧩 every STUN Binding Request carries a password that's also communicated in the SDP, and that's what lets you correlate STUN Binding Requests with candidate addresses for a particular media stream πŸ”‘ it also gives you correlation with a particular SIP dialog. iconic πŸ’–

ICE implementations can be full or lite (see [RFC5245]) πŸŽ€ full ones generate and respond to STUN Binding Requests, while lite ones only respond to them. with ICE, one side is the controlling agent and the other is the controlled agent πŸ‘‘ a full implementation can be either role, but a lite implementation can only be controlled. the controlling agent picks which valid candidate to use and tells the controlled agent about it by identifying the pair as the nominated pair ✨ that leads to these connectivity precondition rules:

  • A full implementation ascertains both "send" and "recv" connectivity when it operates as a STUN client and has sent a STUN Binding Request that resulted in a successful check for all the components of the media stream (as defined further in ICE).
  • A full or a lite implementation ascertains "recv" connectivity when it operates as a STUN server and has received a STUN Binding Request that resulted in a successful response for all the components of the media stream (as defined further in ICE).
  • A lite implementation ascertains "send" and "recv" connectivity when the controlling agent has informed it of the nominated pair for all the components of the media stream.

there's a simpler (and slightly more delay-prone) option too 🐒 all ICE implementations can ascertain "send" and "recv" connectivity for a media stream once the ICE state for that media stream has moved to Completed 🏁

also, there's never a need for the answerer to request confirmation of the connectivity precondition when using ICE πŸ’… the answerer can figure out the status locally. one more thing: when ICE is used to verify connectivity preconditions, the precondition isn't satisfied until connectivity has been verified for all the component transport addresses used by the media stream 🧐 for example, with an RTP-based media stream where RTCP isn't suppressed, connectivity MUST be ascertained for both RTP and RTCP. and finally, even though connectivity has been ascertained, a new offer/answer exchange may be needed before media can flow (per ICE) πŸ™ƒ

those are just examples of explicit connectivity verification mechanisms, and other techniques can be used too 🌸 it is, however, RECOMMENDED that ICE be supported by entities that support connectivity preconditions 🫢 ICE works for all media streams (not just RTP), and it helps with NAT and firewall traversal, which could otherwise get in the way of connectivity πŸ›‘οΈ plus, the ICE recommendation gives everyone a baseline, so every entity that needs probe traffic to support connectivity preconditions has a common way of ascertaining connectivity 🀝

4.3. Verifying Connectivity for Connection-Oriented Transports πŸ”—

connection-oriented transport protocols usually come with an implicit connectivity verification mechanism πŸ’œ connection establishment involves sending traffic in both directions, so connectivity gets verified at the transport-protocol level πŸ™Œ when a three-way (or longer) handshake for connection establishment succeeds, bi-directional communication is confirmed and both the "send" and "recv" preconditions are satisfied, whether they were requested or not πŸ’– with TCP, for example, once the TCP three-way handshake has completed (SYN, SYN-ACK, ACK), the TCP connection is established and either party can send and receive data (so both a send and a receive connectivity precondition are satisfied) πŸ¦‹ SCTP (Stream Control Transmission Protocol) [RFC4960] connections have similar semantics to TCP and SHOULD be treated the same 🫧

when a connection-oriented transport is part of an offer, it can be passive, active, or active/passive [RFC4145] 🎭 when it's passive, the offerer expects the answerer to start the connection establishment. when it's active, the offerer wants to start it. when it's active/passive, the answerer decides πŸ‘€ as we mentioned earlier, not having a media-stream-to-dialog correlation mechanism can make it hard to guarantee who connectivity was ascertained with πŸ˜΅β€πŸ’« when the offerer takes the passive role, it won't necessarily know which SIP dialog started an incoming connection request. if the offerer is active instead, that problem gets avoided ✨

5. Connectivity and Other Precondition Types 🌈

the whole job of a connectivity precondition is to ascertain media stream connectivity before a session gets established or modified πŸŽ€ the underlying goal is for the two parties to be able to exchange media packets successfully. but connectivity alone might not fully cover it πŸ™ˆ for example, Quality of Service might be required for the media stream, and that can be handled with the "qos" precondition defined in RFC 3312 [RFC3312] πŸ’… similarly, successful security parameter negotiation might be another prerequisite, which can be handled with the "sec" precondition defined in RFC 5027 [RFC5027] πŸ” stacking those up is giving main character energy πŸ‘‘

6. Examples ✨

okay bestie, the first example is SO good because it shows the connectivity precondition working with TCP over a wireless access network πŸ“‘ Both UAs are on a radio access network that won't let them send any data (not even a TCP SYN πŸ™ˆ) until a radio bearer has been set up for the connection. Figure 1 shows the message flow (the required PRACK transaction got left out to keep things clean, so check [RFC3312] if you want the full details πŸ’…):

           A                                    B
           |  INVITE                            |
           |  a=curr:conn e2e none              |
           |  a=des:conn mandatory e2e sendrecv |
           |  a=setup:holdconn                  |
           |----------------------------------->|
           |                                    |
           |  183 Session Progress              |
           |  a=curr:conn e2e none              |
           |  a=des:conn mandatory e2e sendrecv |
           |  a=setup:holdconn                  |
           |<-----------------------------------|
           |                                    |
           |  UPDATE                            |
           |  a=curr:conn e2e none              |
           |  a=des:conn mandatory e2e sendrecv |
 A's radio |  a=setup:actpass                   |
 bearer is +----------------------------------->|
 up        |                                    |
           |  200 OK                            |
           |  a=curr:conn e2e none              |
           |  a=des:conn mandatory e2e sendrecv |
           |  a=setup:active                    |
           |<-----------------------------------|
           |                                    |
           |                                    |
           |                                    |
           |                                    | B's radio
           |<---TCP Connection Establishment--->+ bearer is up
           |                                    | B sends TCP SYN
           |                                    |
           |                                    |
           |  180 Ringing                       | TCP connection
           |<-----------------------------------+ is up
           |                                    | B alerts the user
           |                                    |

Figure 1: Message Flow with Two Types of Preconditions

A sends an INVITE requesting connection-establishment preconditions πŸŽ€ The setup attribute in the offer is set to holdconn [RFC4145] because A cannot send or receive any data before setting up a radio bearer for the connection.

B agrees to use the connectivity precondition by sending a 183 (Session Progress) response 🌸 The setup attribute in the answer is also set to holdconn because B, like A, cannot send or receive any data before setting up a radio bearer for the connection.

When A's radio bearer is ready, A sends an UPDATE to B with a setup attribute with a value of actpass πŸ’œ This attribute indicates that A can perform an active or a passive TCP open. A is letting B choose which endpoint will initiate the connection, which is so generous of A, honestly 🫢

Since B's radio bearer is not ready yet, B chooses to be the one initiating the connection and indicates this with a setup attribute with a value of active πŸ¦‹ At a later point, when B's radio bearer is ready, B initiates the TCP connection towards A.

Once the TCP connection is established successfully, B knows the "sendrecv" precondition is satisfied, so B proceeds with the session (i.e., alerts the Callee) and sends a 180 (Ringing) response πŸ”₯

The second example shows a basic SIP session establishment using SDP connectivity preconditions and ICE (the required PRACK transaction and some SDP details have been omitted for clarity 🧚). The offerer (A) is a full ICE implementation, whereas the answerer (B) is a lite ICE implementation. The message flow for this scenario is shown in Figure 2 below πŸ‘‘

              A                                            B

              |                                            |
              |-------------(1) INVITE SDP1--------------->|
              |                                            |
              |<------(2) 183 Session Progress SDP2--------|
              |                                            |
              |~~~~~ Connectivity check to B ~~~~~~~~~~~~~>|
              |<~~~~ Connectivity to B OK ~~~~~~~~~~~~~~~~~|
              |                                            |
              |-------------(3) UPDATE SDP3--------------->|
              |                                            |
              |<--------(4) 200 OK (UPDATE) SDP4-----------|
              |                                            |
              |<-------------(5) 180 Ringing---------------|
              |                                            |
              |                                            |

Figure 2: Connectivity Precondition with ICE Connectivity Checks

SDP1: A includes a mandatory end-to-end connectivity precondition with a desired status of "sendrecv" 🌈 This will ensure media stream connectivity in both directions before continuing with the session setup. Since media stream connectivity in either direction is unknown at this point, the current status is set to "none". A's local status table (see [RFC3312]) for the connectivity precondition is as follows:

    Direction |  Current | Desired Strength |  Confirm
   -----------+----------+------------------+----------
     send    |    no    |   mandatory      |    no
     recv    |    no    |   mandatory      |    no

and the resulting offer SDP is:

  a=ice-pwd:asd88fgpdd777uzjYhagZg
  a=ice-ufrag:8hhY
  m=audio 20000 RTP/AVP 0
  c=IN IP4 192.0.2.1
  a=rtcp:20001
  a=curr:conn e2e none
  a=des:conn mandatory e2e sendrecv
  a=candidate:1 1 UDP 2130706431 192.0.2.1 20000 typ host

SDP2: When B receives the offer, B sees the mandatory sendrecv connectivity precondition πŸ‘€ B is a lite ICE implementation and hence B can only ascertain "recv" connectivity (from B's point of view) from A; thus, B wants A to inform it about connectivity in the other direction ("send" from B's point of view). B's local status table therefore looks as follows:

    Direction |  Current | Desired Strength |  Confirm
   -----------+----------+------------------+----------
     send    |    no    |   mandatory      |    no
     recv    |    no    |   mandatory      |    no

Since B is a lite ICE implementation and B wants to ask A for confirmation about the "send" (from B's point of view) connectivity precondition, the resulting answer SDP becomes:

  a=ice-lite
  a=ice-pwd:qrCA8800133321zF9AIj98
  a=ice-ufrag:H92p
  m=audio 30000 RTP/AVP 0
  c=IN IP4 192.0.2.4
  a=rtcp:30001
  a=curr:conn e2e none
  a=des:conn mandatory e2e sendrecv
  a=conf:conn e2e send
  a=candidate:1 1 UDP 2130706431 192.0.2.4 30000 typ host

Since the "send" and the "recv" connectivity precondition (from B's point of view) are still not satisfied, session establishment remains suspended 😭

SDP3: When A receives the answer SDP, A notes that B is a lite ICE implementation and that confirmation was requested for B's "send" connectivity precondition, which is the "recv" precondition from A's point of view 🧠 A performs a successful send and recv connectivity check to B by sending an ICE connectivity check to B and receiving the corresponding response. A's local status table becomes:

    Direction |  Current | Desired Strength |  Confirm
   -----------+----------+------------------+----------
     send    |    yes   |   mandatory      |    no
     recv    |    yes   |   mandatory      |    yes

whereas B's local status table becomes:

    Direction | Current  | Desired Strength | Confirm
   -----------+----------+------------------+----------
     send    |    no    |   mandatory      |   no
     recv    |    yes   |   mandatory      |   no

Since B asked for confirmation about the "recv" connectivity (from A's point of view), A now sends an UPDATE (5) to B to confirm the connectivity from A to B πŸ¦‹

  a=ice-pwd:asd88fgpdd777uzjYhagZg
  a=ice-ufrag:8hhY
  m=audio 20000 RTP/AVP 0
  c=IN IP4 192.0.2.1
  a=rtcp:20001
  a=curr:conn e2e sendrecv
  a=des:conn mandatory e2e sendrecv
  a=candidate:1 1 UDP 2130706431 192.0.2.1 20000 typ host

B knows it has recv connectivity (verified by ICE as well as A's UPDATE) and send connectivity (confirmed by A's UPDATE) at this point πŸŽ‰ B's local status table becomes:

    Direction | Current  | Desired Strength | Confirm
   -----------+----------+------------------+----------
     send    |    yes   |   mandatory      |   no
     recv    |    yes   |   mandatory      |   no

and the session can continue ✨

7. Security Considerations πŸ”

General security considerations for preconditions are discussed in RFC 3312 [RFC3312] and RFC 4032 [RFC4032]. As discussed in RFC 4032 [RFC4032], it is strongly RECOMMENDED that S/MIME [RFC3853] integrity protection be applied to the SDP session descriptions. When the user agent provides identity services (rather than the proxy server), the SIP identity mechanism specified in RFC 4474 [RFC4474] provides an alternative end-to-end integrity protection. Additionally, the following security issues relate specifically to connectivity preconditions πŸ›‘οΈ

Connectivity preconditions rely on mechanisms beyond SDP, such as TCP [RFC0793] connection establishment or ICE connectivity checks [RFC5245], to establish and verify connectivity between an offerer and an answerer. An attacker that prevents those mechanisms from succeeding (e.g., by keeping ICE connectivity checks from arriving at their destination) can prevent media sessions from being established. While this attack relates to connectivity preconditions, it is actually an attack against the connection-establishment mechanisms used by the endpoints. This attack can be performed in the presence or in the absence of connectivity preconditions. In their presence, the whole session setup will be disrupted. In their absence, only the establishment of the particular stream under attack will be disrupted. This specification does not provide any mechanism against attackers able to block traffic between the endpoints involved in the session because such an attacker will always be able to launch DoS (Denial-of-Service) attacks πŸ’€

Instead of blocking the connectivity checks, the attacker can generate forged connectivity checks that would cause the endpoints to assume that there was connectivity when there was actually no connectivity. This attack would result in the user experience being poor because the session would be established without all the media streams being ready. The same attack can be used, regardless of whether or not connectivity preconditions are used, to attempt to hijack a connection. The forged connectivity checks would trick the endpoints into sending media to the wrong direction. To prevent these attacks, it is RECOMMENDED that the mechanisms used to check connectivity are adequately secured by message authentication and integrity protection. For example, Section 2.5 of [RFC5245] discusses how message integrity and data origin authentication are implemented in ICE connectivity checks 🚨

8. IANA Considerations πŸ’…βœ¨

okay so IANA went and registered a brand new precondition type πŸŽ€ It lives in the Precondition Types used with SIP subregistry, which is tucked under the Session Initiation Protocol (SIP) Parameters registry. literally so cute πŸ¦‹

Precondition-Type  Description                          Reference
-----------------  -----------------------------------  ---------
conn               Connectivity precondition            [RFC5898]

9. References πŸ“šπŸŒΈ

9.1. Normative References πŸ’œ

  • [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002.
  • [RFC3312] Camarillo, G., Marshall, W., and J. Rosenberg, "Integration of Resource Management and Session Initiation Protocol (SIP)", RFC 3312, October 2002.
  • [RFC3853] Peterson, J., "S/MIME Advanced Encryption Standard (AES) Requirement for the Session Initiation Protocol (SIP)", RFC 3853, July 2004.
  • [RFC4032] Camarillo, G. and P. Kyzivat, "Update to the Session Initiation Protocol (SIP) Preconditions Framework", RFC 4032, March 2005.
  • [RFC4474] Peterson, J. and C. Jennings, "Enhancements for Authenticated Identity Management in the Session Initiation Protocol (SIP)", RFC 4474, August 2006.
  • [RFC4566] Handley, M., Jacobson, V., and C. Perkins, "SDP: Session Description Protocol", RFC 4566, July 2006.
  • [RFC5027] Andreasen, F. and D. Wing, "Security Preconditions for Session Description Protocol (SDP) Media Streams", RFC 5027, October 2007.
  • [RFC5245] Rosenberg, J., "Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal for Offer/Answer Protocols", RFC 5245, April 2010.

9.2. Informative References 🧚

  • [RFC0793] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, September 1981.
  • [RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V. Jacobson, "RTP: A Transport Protocol for Real-Time Applications", STD 64, RFC 3550, July 2003.
  • [RFC4145] Yon, D. and G. Camarillo, "TCP-Based Media Transport in the Session Description Protocol (SDP)", RFC 4145, September 2005.
  • [RFC4960] Stewart, R., "Stream Control Transmission Protocol", RFC 4960, September 2007.
  • [RFC5109] Li, A., "RTP Payload Format for Generic Forward Error Correction", RFC 5109, December 2007.
  • [ICE-TCP] Perreault, S., Ed. and J. Rosenberg, "TCP Candidates with Interactive Connectivity Establishment (ICE)", Work in Progress, October 2009.

Authors' Addresses πŸ«ΆπŸŽ€

Here's where to find the authors, bestie πŸ’–

Flemming Andreasen
Cisco Systems, Inc.
499 Thornall Street, 8th Floor
Edison, NJ  08837
USA

EMail: fandreas@cisco.com
Gonzalo Camarillo
Ericsson
Hirsalantie 11
Jorvas  02420
Finland

EMail: Gonzalo.Camarillo@ericsson.com
David Oran
Cisco Systems, Inc.
7 Ladyslipper Lane
Acton, MA  01720
USA

EMail: oran@cisco.com
Dan Wing
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA  95134
USA

EMail: dwing@cisco.com
πŸ“¦ where this page comes from