RFC 7200
A Session Initiation Protocol (SIP) Load-Control Event Package
(part 1 of 9 🎀 more coming, bestie)
📜 RFC 7200: A Session Initiation Protocol (SIP) Load-Control Event Package
Okay so the title block is giving everything, so here's the tea ☕
- RFC number: 7200
- Published by: the Internet Engineering Task Force (IETF) 🌸
- Authors: C. Shen; H. Schulzrinne (Columbia U.); A. Koike (NTT) 👑
- Category: Standards Track ✨
- ISSN: 2070-1721
- Date: April 2014 🍓
- Obsoletes / updates: the title block doesn't list anything it obsoletes or updates 🙈
Abstract 💜
This spec is all about a load-control event package for SIP (the Session Initiation Protocol 📞). SIP entities can hand out load-filtering policies to other SIP entities across the network, so everyone knows who to slow down. These policies have rules to throttle calls from one specific user, or based on the source or destination domain, or on a telephone number prefix 💅. The whole point is to stop signaling overload before it starts, and it works alongside the feedback-based SIP overload control efforts. Main character energy, literally 🦋
Status of This Memo 🌈
This is an Internet Standards Track document ✨
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 5741 🧚
Info about the current status of this doc, any errata, and how to give feedback can be found at http://www.rfc-editor.org/info/rfc7200 🔥
Copyright Notice 💖
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved 🫶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License ⚠️
Table of Contents 📚
1. Introduction ....................................................3
2. Conventions .....................................................3
3. SIP Load-Filtering Overview .....................................4
3.1. Load-Filtering Policy Format ...............................4
3.2. Load-Filtering Policy Computation ..........................4
3.3. Load-Filtering Policy Distribution .........................4
3.4. Applicable Network Domains .................................8
4. Load-Control Event Package ......................................9
4.1. Event Package Name .........................................9
4.2. Event Package Parameters ...................................9
4.3. SUBSCRIBE Bodies ...........................................9
4.4. SUBSCRIBE Duration .........................................9
4.5. NOTIFY Bodies .............................................10
4.6. Notifier Processing of SUBSCRIBE Requests .................10
4.7. Notifier Generation of NOTIFY Requests ....................10
4.8. Subscriber Processing of NOTIFY Requests ..................10
4.9. Handling of Forked Requests ...............................12
4.10. Rate of Notifications ....................................12
4.11. State Delta ..............................................12
5. Load-Control Document ..........................................13
5.1. Format ....................................................13
5.2. Namespace .................................................13
5.3. Conditions ................................................14
5.3.1. Call Identity ......................................14
5.3.2. Method .............................................16
5.3.3. Target SIP Entity ..................................17
5.3.4. Validity ...........................................18
5.4. Actions ...................................................18
6. XML Schema Definition for Load Control .........................20
7. Security Considerations ........................................23
8. IANA Considerations ............................................24
8.1. Load-Control Event Package Registration ...................24
8.2. application/load-control+xml Media Type Registration ......24
8.3. URN Sub-Namespace Registration ............................25
8.4. Load-Control Schema Registration ..........................26
9. Acknowledgements ...............................................27
10. References ....................................................27
10.1. Normative References .....................................27
10.2. Informative References ...................................28
Appendix A. Definitions ...........................................30
Appendix B. Design Requirements ...................................30
Appendix C. Discussion of How This Specification Meets the
Requirements of RFC 5390 ..............................31
Appendix D. Complete Examples .....................................36
D.1. Load-Control Document Examples ............................36
D.2. Message Flow Examples .....................................40
Appendix E. Related Work .........................................41
E.1. Relationship to Load Filtering in PSTN ....................41
E.2. Relationship with Other IETF SIP Overload Control Efforts .421. Introduction ✨
Okay so SIP load-control mechanisms exist to stop congestion collapse [RFC6357] when a SIP server gets overloaded [RFC5390] 😭 There are two flavors. The first one is feedback control, where SIP servers send load limits upstream so the incoming rate of all SIP requests goes down [SIP-OVERLOAD]. The upstream servers then drop or delay incoming requests. The catch is that feedback control is reactive, so it hits signaling messages that user agent clients already sent. This works well when core proxy servers or destination-specific edge proxy servers are overloaded. But by nature those servers have to push rate, drop, or window info to every upstream proxy, and it usually hits all calls equally, no matter where they're headed 🙄
Here's where this spec comes in with its own move, called "load filtering" 🦋 It shines when a traffic surge and its source and destination mix can be predicted ahead of time. In that case, network operators make load-filtering policies saying calls to certain destinations, or calls from certain sources, should be rate-limited or randomly dropped. Those policies then get shared with SIP servers, and maybe SIP user agents too, that are likely to make calls to the affected destinations or come from the affected sources 💅 Load filtering works best when it stops calls as close to the originating user agent client as possible. And honestly, SIP load filtering isn't only for overload. It can also be stretched to do things like service level agreement commitments 🌸
2. Conventions 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🧚
3. SIP Load-Filtering Overview 🦋
3.1. Load-Filtering Policy Format 🍓
Load-filtering policies are built out of sets of rules. Each rule has both load-filtering conditions and actions 💜 The conditions define the identities of the targets to be filtered (Section 5.3.1). For example, there are two typical resource limits in an overload situation: human destination limits (the number of call takers) and node capacity limits. The filtering targets in those two cases can be specific callee numbers or the destination domain tied to the overload. The conditions also say which message type gets matched (Section 5.3.2), which target SIP entity the policy is tied to (Section 5.3.3), and when the policy should be activated and deactivated (Section 5.3.4). The actions describe the control you want, like keeping the request rate under a set level (Section 5.4) 🔥
3.2. Load-Filtering Policy Computation 👑
When you're computing load-filtering policies, you have to think about stuff like overload time, scope and network topology, and service policies 🧠 It's also really important to make sure there's no resource allocation loop, and that server capacity gets allocated so it both prevents overload and maximizes effective throughput (commonly called goodput) 💖 Sometimes, to use system resources better, it may be preferable to use an algorithm that dynamically computes the load-filtering policies from the server load status observed right now, instead of a purely static policy assignment ✨ The computation algorithm for load-filtering policies is beyond the scope of this specification 🙈
3.3. Load-Filtering Policy Distribution ✨
okay so for passing load-filtering policies around, this spec defines the SIP event package for load control 📮. It's an instantiation of the generic SIP event notification framework [RFC6665], which is giving "reuse the good stuff" energy 💅. This spec also defines the XML schema of a load-control document (Section 5), and that's the format we use to encode the policies 🎀.
So for the policies to actually get distributed, every capable SIP entity in the network subscribes to the SIP load-control event package of each SIP entity it sends signaling requests to 🫶. A SIP entity that accepts subscription requests is called a "notifier" (Section 4.6) 👑. Subscriptions get set up and kept alive during normal server operation ✨. The subscriptions between neighboring SIP entities need to be persistent, as described in Sections 4.1 and 4.2 of [RFC6665] 🦋. The refresh procedure is in Section 4.7 below 💖. Subscribers can end the subscription if they haven't gotten notifications for a long time, and they can resubscribe once they figure out that signaling with the notifier is active again 🌸. Bestie, that's the whole safety net 🧚.
Here's an example architecture in Figure 1 to show how the distribution works 🌈. The scenario has two networks, one belonging to Service Provider A and one to Service Provider B 💜. Each provider's network has two SIP core proxy servers and four SIP edge proxy servers 🍓. The core and edge proxy servers of Service Provider A are called CPa1 to CPa2 and EPa1 to EPa4, and the core and edge proxy servers of Service Provider B are called CPb1 to CPb2 and EPb1 to EPb4 💅.
+-----------+ +-----------+ +-----------+ +-----------+
| | | | | | | |
| EPa1 | | EPa2 | | EPa3 | | EPa4 |
| | | | | | | |
+-----------+ +-----------+ +-----------+ +-----------+
\ / \ /
\ / \ /
\ / \ /
+-----------+ +-----------+
| | | |
| CPa1 |------------------| CPa2 |
| | | |
+-----------+ +-----------+
| |
Service | |
Provider A | |
| |
=================================================================
| |
Service | |
Provider B | |
| |
+-----------+ +-----------+
| | | |
| CPb1 |------------------| CPb2 |
| | | |
+-----------+ +-----------+
/ \ / \
/ \ / \
/ \ / \
+-----------+ +-----------+ +-----------+ +-----------+
| | | | | | | |
| EPb1 | | EPb2 | | EPb3 | | EPb4 |
| | | | | | | |
+-----------+ +-----------+ +-----------+ +-----------+
Figure 1: Example Network Scenario Using SIP Load-Control Event
Package MechanismDuring the initialization stage, the proxy servers first figure out all their outgoing signaling neighbors and subscribe to them 🔍. Service providers can provision neighbors, or the proxy servers can gradually learn who their neighbors are by checking the signaling messages they send and receive 🕵️♀️. If we assume all signaling relationships in Figure 1 are bidirectional, then after this initialization stage, every proxy server is subscribed to all of its neighbors 🫶✨.
Case I: EPa1 runs a TV program hotline and wants to limit the total number of incoming calls to it so nothing overloads 📞. To do that, EPa1 sends a notification to CPa1 with the specific hotline number, the time of activation, and the total acceptable call rate 💌. Depending on the load-filtering policy computation algorithm, CPa1 might split the received total acceptable call rate among its neighbors, which are EPa2, CPa2, and CPb1 🍰. Then it tells them about the allocation, along with the hotline number and the activation time 🎀. CPa2 and CPb1 can do further allocation among their own neighbors and notify the matching proxy servers 🔁. This keeps going until every edge proxy server in the network knows about the event and has the right load-filtering policies set up 🌟.
In the case above, the network entity where the load-filtering policy is first introduced is the SIP server that gives access to the resource causing the overload 🎯. In other situations, the network entry point where the policy is introduced could also be an entity that hosts that resource 🏠. For example, an operator might host an application server that does toll-free-number ("800 number") translation services 📱. That application server could be a SIP proxy server or a SIP Back-to-Back User Agent (B2BUA) 🤖. If one of the toll-free numbers hosted at the application server causes the overload condition, the load-filtering policies can be introduced from the application server and then passed along to other SIP proxy servers in the network 🚀.
Case II: A hurricane hits the region covered by CPb2, EPb3, and EPb4 🌪️. All three of these SIP proxy servers are overloaded 😭. The rescue team decides that outbound calls are more valuable than inbound calls in this situation 🚑. So EPb3 and EPb4 get configured with load-filtering policies that accept more outbound calls than inbound calls 📤. CPb2 can be configured the same way, or it can receive dynamically computed load-filtering policies from EPb3 and EPb4 💫. Depending on the load-filtering policy computation algorithm, CPb2 can also send notifications to its outside neighbors, CPb1 and CPa2, specifying a limit on the acceptable rate of inbound calls to CPb2's responsible domain 🛑. Then CPb1 and CPa2 can tell their own neighbors about limiting calls to CPb2's area 📣. The same process can keep going until all edge proxy servers have been notified and have load-filtering policies configured 🌸.
Note that this specification does not define the provisioning interface between the party who decides the load-filtering policy and the network entry point where the policy is introduced 👀. One of the options for the provisioning interface is the Extensible Markup Language (XML) Configuration Access Protocol (XCAP) [RFC4825] 💜.
3.4. Applicable Network Domains 🌐
This specification MUST be applied inside a "Trust Domain" 🔐. The idea of a Trust Domain is similar to what's defined in [RFC3324] and [RFC3325] 💖. For SIP load filtering, a Trust Domain is a set of SIP entities, like SIP proxy servers, that are trusted to exchange the load-filtering policies defined in this specification 🫶. In the simplest case, a Trust Domain is a network of SIP entities that all belong to one service provider, who deploys them and accurately knows how those SIP entities behave 🏰. Simple Trust Domains can be joined together to form bigger Trust Domains through bilateral agreements between the service providers of the SIP entities 🤝.
The key requirement of a Trust Domain for SIP load filtering is that the behavior of all SIP entities inside a given Trust Domain is known to comply with the following set of specifications 📜.
- SIP entities in the Trust Domain agree on the mechanisms used to secure the communication among SIP entities within the Trust Domain 🔒.
- SIP entities in the Trust Domain agree on the manner used to determine which SIP entities are part of the Trust Domain 🗺️.
- SIP entities in the Trust Domain are compliant to SIP [RFC3261] ✅.
- SIP entities in the Trust Domain are compliant to SIP-Specific Event Notification[RFC6665] ✅.
- SIP entities in the Trust Domain are compliant to this specification 💅.
- SIP entities in the Trust Domain agree on what types of calls can be affected by this SIP load-filtering mechanism. For example,
<call-identity>condition elements (Section 5.3.1)<one>and<many>might be limited to describe within certain prefixes 📞. - SIP entities in the Trust Domain agree on the destinations to which calls may be redirected when the
"redirect"action (Section 5.4) is used. For example, the URI might have to match a given set of domains 🦋.
SIP load filtering is only effective if all neighbors that are possible signaling sources take part and enforce the designated load-filtering policies 🙈. Otherwise, a single non-conforming neighbor could make all the filtering efforts useless by pumping in excessive traffic to overload the server 💀. That's why the SIP server that distributes load-filtering policies needs to take countermeasures toward any non-conforming neighbors 🛡️. A simple method is to reject excessive requests with 503 "Service Unavailable" response messages, as if they were obeying the rate 🙅♀️. Considering the rejection costs, a more complicated but fairer method would be to allocate, at the overloaded server, the same amount of processing to the combination of both normal processing and rejection as the overloaded server would spend processing requests for a conforming upstream SIP server ⚖️. These approaches work as long as the total rejection cost does not overwhelm the entire server resources 🧮. On top of that, SIP servers need to handle message prioritization properly while performing load filtering, which is described in Section 4.8 🎀.
4. Load-Control Event Package 🎀
The SIP load-filtering mechanism defines a load-control event package for SIP based on [RFC6665] 💌.
4.1. Event Package Name 🏷️
The name of this event package is "load-control" 🌷. This name is carried in the Event and Allow-Events header, as specified in [RFC6665] 📨.
4.2. Event Package Parameters 🧁
No package-specific event header field parameters are defined for this event package 🙅♀️.
4.3. SUBSCRIBE Bodies 📝
This specification does not define the content of SUBSCRIBE bodies 🤷♀️. Future specifications could define bodies for SUBSCRIBE messages, for example, to request specific types of load-control event notifications 🔮.
A SUBSCRIBE request sent without a body implies the default subscription behavior as specified in Section 4.7 ✨.
4.4. SUBSCRIBE Duration ⏰
The default expiration time for a subscription to load-filtering policy is one hour 🕐. Since the desired expiration time may vary a lot for subscriptions among SIP entities with different signaling relationships, the subscribers and notifiers are RECOMMENDED to explicitly negotiate an appropriate subscription duration when they know about their mutual signaling relationship 🤝💜.
4.5. NOTIFY Bodies ✨
okay so the body of a NOTIFY request in this event package carries load-filtering policies 💅. The body MUST be in one of the formats listed in the Accept header field of the SUBSCRIBE request, or in the default format from [RFC6665] 🎀. The default for this package is application/load-control+xml (defined in Section 5) 🌸. So if a NOTIFY body shows up but the SUBSCRIBE had no Accept header, the body MUST contain content in the application/load-control+xml format 🫶.
4.6. Notifier Processing of SUBSCRIBE Requests
the notifier is the one who decides what to do with a SUBSCRIBE 👑. When it gets a valid SUBSCRIBE request, it either accepts a brand new subscription or updates an existing one 🦋.
if the subscriber's identity isn't allowed to receive load-filtering policies, the notifier MUST return a 403 "Forbidden" response 🚫💀. no vibes for you, bestie.
if none of the media types in the SUBSCRIBE request's Accept header are supported, the notifier SHOULD return a 406 "Not Acceptable" response 🙈.
4.7. Notifier Generation of NOTIFY Requests
a notifier MUST send a NOTIFY request carrying its current load-filtering policy to the subscriber whenever it successfully accepts or refreshes a subscription 💜. the timing is literally everything 🔥.
if there's no load-filtering policy to distribute when the subscription comes in, the notifier SHOULD sent a NOTIFY request without a body to the subscriber 🌈. even so, the Content-Type header field of that NOTIFY MUST show the correct body format as if a body were there, like application/load-control+xml ✨.
notifiers will probably send bodiless NOTIFYs when a subscription starts for the very first time, like when a SIP entity has just been introduced 🧚. why? because there might not be any planned events that need load filtering yet 🍓.
and a notifier SHOULD generate NOTIFY requests every time the load-filtering policy changes, keeping the maximum notification rate within the values defined in Section 4.10 ⭐.
4.8. Subscriber Processing of NOTIFY Requests
the subscriber is the load-filtering server that actually enforces the policies it gets from the notifier 🛡️💖. how it handles a NOTIFY depends on what policies are inside it 🌸. usually those policies are rules that say "do this action to requests matching these conditions" 💅. so a subscriber first installs the rules, then enforces the matching actions, like limiting how fast call requests headed to one specific callee can be sent 🦋.
now, if a policy has a future validity, the subscription to the notifier that sent it might have expired by the time that validity kicks in 😭. in that case, it is RECOMMENDED that the subscriber re-activate its subscription with that notifier 🫶. but here's the thing: whether or not the re-activation works, the subscriber SHOULD enforce the rules once the validity time hits 👑.
if a NOTIFY request arrives with a Subscription-State header field whose value is "terminated", the subscription with that notifier is over 💀. and subscribers MUST also throw out the load-filtering policies they got from that notifier 🙅♀️.
the subscriber MUST discard unknown bodies 🗑️. if a NOTIFY has several bodies and none of them are supported, the subscriber SHOULD unsubscribe, unless it knows it might get NOTIFY requests with supported bodies from that notifier later 🌈. a NOTIFY without a body just means no load-filtering policies need updating 🍓.
when the subscriber enforces these policies, it has to prioritize requests and pick which ones to reject or redirect ✨. that choice is mostly up to local policy 💅. the subscriber is expected to follow local policy as long as the traffic reduction still matches the overload algorithm running on that node 🔥. so the normative behavior in the next three bullets should be read with one thing in mind: the subscriber will try to keep local policy intact as much as possible 🎀.
- The subscriber SHOULD honor the local policy for prioritizing SIP requests, such as policies based on message type, e.g., INVITEs versus requests associated with existing sessions 🦋.
- The subscriber SHOULD honor the local policy for prioritizing SIP requests based on the content of the Resource-Priority header (RPH, [RFC4412]). Specific (namespace.value) RPH contents may indicate high-priority requests that should be preserved as much as possible during overload. The RPH contents can also indicate a low-priority request that is eligible to be dropped during times of overload 🌸.
- The subscriber SHOULD honor the local policy for prioritizing SIP requests relating to emergency calls, as identified by the sos URN [RFC5031] indicating an emergency request 🚨💖.
a local policy can be expected to combine both the SIP request type and the prioritization markings, and it SHOULD be honored when overload conditions prevail 👑✨.
4.9. Handling of Forked Requests
okay forking? not a thing here 🙅♀️. when this load-control event package is used between neighboring SIP entities that are one hop apart, forking just doesn't apply 🦋. and if the scope spans multiple hops, forking isn't expected either, because the subscription request is addressed to one clearly defined SIP entity 💜.
BUT, in the super unlikely case that forking does happen, this event package only lets the first potential dialog-establishing message create a dialog 😤, as specified in Section 5.4.9 of [RFC6665] 💅.
4.10. Rate of Notifications
the rate of notifications is honestly not going to be much of a concern here 😌, especially when this local control event package is used in non-real-time mode for relatively static load-filtering policies 🌿. but if things get wild and a load-filtering policy needs to be updated pretty often, it is RECOMMENDED that the notifier not generate notifications faster than once per second in all cases 🕐. the reason is to stop the NOTIFY requests themselves from overloading the system 🙈💀.
4.11. State Delta
updates to specific load-filtering policies usually change only some of the policy parameters 🎀, like the acceptable request rate or percentage, but not the matching identities 💅. this happens because how loaded a resource gets depends on dynamic unknowns, like holding time and how offered load is spread across subscribing SIP entities 🌸. the updates could come from a human, or from an algorithm that dynamically computes the policies (Section 3.2) 🤖. another thing that's usually not known precisely (or has to be computed automatically) is how long the event needing load filtering will last ⏳. so it's super common for the validity to change often too 🦋.
this event package allows state delta, as in [RFC6665], to handle those frequent partial updates 🫶. for each NOTIFY transaction in a subscription, a version number that goes up by exactly one MUST be included in the NOTIFY request body whenever the body is present 🔢✨. when the subscriber gets a state delta, it ties the partial updates to the right policy by matching the rule id (Appendix D) 🧩. but if a NOTIFY comes in with a version number that jumped by more than one, the subscriber knows it missed a state delta and needs a full state snapshot 😱. so it ignores that NOTIFY carrying the state delta, and resends a SUBSCRIBE request to force a NOTIFY with a complete state snapshot 🔄💖.
5. Load-Control Document ✨
5.1. Format
a load-control document is an XML document that describes the load-filtering policies 📄💅. it inherits from and enhances the common policy document defined in [RFC4745] 🌈. a common policy document holds a set of rules, and each rule has three parts: conditions, actions, and transformations 🧩.
the conditions part is a set of expressions with attributes like identity, domain, and validity time information 🪪. each expression evaluates to TRUE or FALSE 🔍. conditions are matched using "equality" or "greater than" style comparisons 🟰. there is no regular expression matching, so no fancy pattern stuff here 🙅♀️. conditions get evaluated when an initial SIP request for a dialog or standalone transaction shows up 📨. if a request matches all the conditions in a rule set, then the action part and the transformation part get consulted to figure out the "permission" for handling that request 🔐.
each action or transformation gives the policy server a positive grant to carry out the resulting actions 🎁. and there are well-defined mechanisms for combining actions and transformations that come from more than one source 🫶.
5.2. Namespace
the namespace URI for the elements defined by this specification is a Uniform Resource Namespace (URN) ([RFC2141]) 🌸. it uses the namespace identifier "ietf", which is defined by [RFC2648] and extended by [RFC3688] 💜. the URN looks like this:
urn:ietf:params:xml:ns:load-control5.3. Conditions
[RFC4745] defines three condition elements: <identity>, <sphere>, and <validity> 🪪. this specification defines new condition elements, but it reuses the <validity> element 🔁. the <sphere> element is not used here 🙅♀️✨.
5.3.1. Call Identity
Okay so, the [RFC4745] <identity> element is not enough for load filtering 😭 because this spec has a totally different problem to solve. First, load filtering can hit different identities inside one request, like the identity of the receiving entity and the sending entity. Second, how much authentication matters depends on which identity we're looking at. So this spec defines new identity conditions that can get as specific as each SIP identity header field. The authentication requirement depends on which field is being matched 🔐
The identity condition for load filtering is the <call-identity> element, and its sub-element is <sip>. The <sip> element holds sub-elements for SIP sending and receiving identity header fields: <from>, <to>, <request-uri>, and <p-asserted-identity>. All of those are an extended form of the [RFC4745] <identity> element. On top of the <one>, <except>, and <many> sub-elements from [RFC4745], the extended form adds two new ones, <many-tel> and <except-tel>, which we'll get to in a sec 🎀
The [RFC4745] <one> and <except> elements can have an "id" attribute, which is the URI of one single entity to include or exclude. When they show up in <from>, <to>, <request-uri>, and <p-asserted-identity>, that "id" value is the URI found in the matching header field: From, To, Request-URI, or P-Asserted-Identity 💅
Now the combining rules, and these are a whole vibe 🦋 When <call-identity> has multiple <sip> sub-elements, the results are combined using logical OR. When <from>, <to>, <request-uri>, and <p-asserted-identity> have multiple <one>, <many>, or <many-tel> sub-elements, those results are also combined using logical OR. If <many> has one or more <except> sub-elements, or <many-tel> has one or more <except-tel> sub-elements, each <except> or <except-tel> result is combined using logical OR too, same as the [RFC4745] <identity> element. BUT, when the <sip> element has multiple <from>, <to>, <request-uri>, and <p-asserted-identity> sub-elements, the results are combined using logical AND. This is what lets a call identity be pinned down by several fields of one SIP request at once, like both the From and the To header fields. Iconic, honestly ✨
Here's an example of <call-identity> matching call requests whose To header field contains the SIP URI "sip:alice@hotline.example.com" or the 'tel' URI "tel:+1-212-555-1234":
<call-identity>
<sip>
<to>
<one id="sip:alice@hotline.example.com"/>
<one id="tel:+1-212-555-1234"/>
</to>
</sip>
</call-identity>Before evaluating <call-identity> conditions, the subscriber shall convert URIs received in SIP header fields to canonical form as per [RFC3261], except that the "phone-context" parameter shall not be removed, if present. The "phone-context" parameter has to stay, no cap 🫶
The [RFC4745] <many> and <except> elements may take a "domain" attribute. That attribute names a domain to match against the domain part of the candidate identity, so it can cover a big, possibly unknown number of entities within one domain. The "domain" attribute works well for SIP URIs 🌸
BUT a SIP user's URI can also be a 'tel' URI, so we need a similar way to group a bunch of 'tel' URIs too. There are two forms of 'tel' URI: global numbers and local numbers. According to [RFC3966], "All phone numbers MUST use the global form unless they cannot be represented as such...Local numbers MUST be tagged with a 'phone-context'". Global number 'tel' URIs start with a "+". The "phone-context" parameter of a local number can be labeled as a global number, any number of its leading digits, or a domain name. Both forms make the resulting URI globally unique, which is so satisfying 🌈
Global-number 'tel' URIs can be grouped by prefixes made of any number of common leading digits. For example, a prefix made of the country code, or of both the country and area code, identifies phone numbers within a country or an area. Country and area code lengths differ between regions, so the prefix length varies too. That gives you flexibility, like grouping numbers into sub-areas within the same area code. Local-number 'tel' URIs can be grouped by the value of their "phone-context" parameter 🍓
The <many> and <except> sub-elements in the [RFC4745] <identity> element don't allow extra attributes to be added directly. Redefining what their existing "domain" attribute does would cause backward-compatibility issues, so this spec defines <many-tel> and <except-tel> as sub-elements that extend the [RFC4745] <identity> element. Both have a "prefix" attribute for grouping 'tel' URIs, similar to how "domain" groups SIP URIs in the existing <many> and <except> sub-elements. For global numbers, the "prefix" value holds any number of common leading digits, like "+1-212" for US phone numbers in area code "212", or "+1-212-854" for an organization with US area code "212" and local prefix "854". For local numbers, the "prefix" value is the "phone-context" parameter value. It's worth noting that visual separators (such as the "-" sign) in 'tel' URIs are not used for URI comparison as per [RFC3966] 🧚
This example uses the "prefix" attribute together with the "domain" attribute. It matches requests calling the number "+1-202-999-1234" but NOT calling from a "+1-212" prefix or from a SIP From URI domain of "manhattan.example.com" (not me being picky about the wording, that's literally the match logic 💀):
<call-identity>
<sip>
<from>
<many>
<except domain="manhattan.example.com"/>
</many>
<many-tel>
<except-tel prefix="+1-212"/>
</many-tel>
</from>
<to>
<one id="tel:+1-202-999-1234"/>
</to>
</sip>
</call-identity>5.3.2. Method
The load on a SIP server depends on the type of initial SIP requests, whether they start dialogs or are standalone transactions. The <method> element names the SIP method that the load-filtering action applies to. If this element isn't included, the load-filtering actions apply to all applicable initial requests. Those are INVITE, MESSAGE, REGISTER, SUBSCRIBE, OPTIONS, and PUBLISH. Non-initial requests, such as ACK, BYE, and CANCEL, MUST NOT be subjected to load filtering 🚫 Also, SUBSCRIBE requests aren't filtered if the event-type header field indicates the event package defined in this specification 💜
Here's <method> being used to apply the filtering actions to INVITE requests:
<method>INVITE</method>5.3.3. Target SIP Entity
A SIP server doing load filtering might have several paths to route call requests that match the same set of call identity elements. In that case, the SIP load-filtering server might want to use the alternative paths, and only apply load-filtering actions to matching requests headed for the next-hop SIP entity that originated the matching load-filtering policy. To make that work, the SIP load-filtering server has to link every load-filtering policy to its originating SIP entity. That's what the <target-sip-entity> element is for. It contains the URI of the entity that started the load-filtering policy, which is usually the notifier. A notifier MAY include this element as part of the condition of its filtering policy sent to the subscriber, like so:
<target-sip-entity>sip:biloxi.example.com</target-sip-entity>When a SIP load-filtering server gets a policy with a <target-sip-entity> element, it SHOULD record it and take it into account when making load-filtering decisions. If the load-filtering server gets a load-filtering policy that does NOT contain a <target-sip-entity> element, it MAY still record the URI of the policy's originator as the <target-sip-entity> information and consider it when making load-filtering decisions 🎯
Two examples of <target-sip-entity> in action, bestie:
Use case I: The network has user A connected to SIP Proxy 1 (SP1), user B connected to SIP Proxy 3 (SP3), SP1 and SP3 connected through SIP Proxy 2 (SP2), and SP2 connected to an Application Server (AS). Under normal load, a call from A to B is routed along A-SP1-SP2-AS-SP3-B. The AS provides a nonessential service and can be bypassed when it's overloaded. Now say the AS gets overloaded and sends SP2 a load-filtering policy asking that 50% of all INVITE requests be dropped. SP2 can keep AS as the <target-sip-entity> for that policy, so it knows the 50% drop only applies to call requests that have to go through AS, without touching calls routed directly through SP3 to B. Smart, right? 🧠
Use case II: A translation service for toll-free numbers is installed on two Application Servers, AS1 and AS2. User A is connected to SP1 and calls 800-1234-4529, which AS1 and AS2 translate into a regular E.164 number depending on, e.g., the caller's location. SP1 forwards INVITE requests with Request-URI = "800 number" to AS1 or AS2 based on a load-balancing strategy. Because calls to 800-1234-4529 create a pre-overload condition in AS1, AS1 sends SP1 a load-filtering policy asking that 50% of calls toward 800-1234-4529 be rejected. In this case, SP1 can keep AS1 as the <target-sip-entity> for the rule and only apply the policy to incoming requests intended for AS1. Requests going to AS2, even though they match the <call-identity> of the filter, won't be affected 🙌
5.3.4. Validity
A filtering policy is usually paired with a validity period condition. This spec reuses the <validity> element from [RFC4745], which specifies a validity period with pairs of <from> and <until> sub-elements. When there are multiple time periods, the validity condition evaluates to TRUE if the current time falls into any of them. So it's a logical OR across all the validity time periods ⏰
Here's a <validity> element for a valid period from 12:00 to 15:00 US Eastern Standard Time on 2008-05-31:
<validity>
<from>2008-05-31T12:00:00-05:00</from>
<until>2008-05-31T15:00:00-05:00</until>
</validity>5.4. Actions ✨
okay so the actions are the stuff a load-filtering server actually does 💅 to loads that match its conditions, and they're defined by the <accept> element in the load-filtering policy 🎀. Inside it you can find any one of three sub-elements: <rate>, <percent>, and <win>. 🦋
- <rate> is an absolute number: the maximum acceptable request rate, in requests per second 🔥
- <percent> is a relative thing: the percentage of incoming requests that should be accepted 🌸
- <win> describes the acceptable window size supplied by the receiver, and it's only relevant for window-based load-filtering 🧚
bestie, in static load-filtering policy setups, using <rate> is RECOMMENDED 💖 and honestly it's giving common sense, because enforcing a percentage or a window is hard to pull off when the incoming load from upstream or the reactions from downstream are super unpredictable 😭 (If you want the deep dive on rate-based, loss-based, and window-based load control, check out [SIP-OVERLOAD] and [RFC6357] 📚)
Also, the <accept> element can take an optional "alt-action" attribute 🌈 that explicitly says what to do when a request can't be processed. "alt-action" can be one of three values: "reject", "redirect", or "drop". 💜
- "reject" is the default for "alt-action" 🙈. The load-filtering server rejects the request with a 503 "Service Unavailable" response message. Classic.
- "redirect" means redirecting the request to another target 🦋. When you use it, an "alt-target" attribute MUST be defined 🚨. The "alt-target" holds one URI or a list of URIs where the request should be redirected, and the server sends those redirect URIs out in a 300-class response message ✨.
- "drop" means simply ignoring the request without doing anything 🫶. This can, in certain cases, help save processing capability during overload. For example, when SIP runs over a reliable transport such as TCP, the "drop" action does not send out a rejection response, and it doesn't close the transport connection either 🍓. BUT when SIP runs over an unreliable transport such as UDP, using "drop" creates message retransmissions that make the overload situation even worse 💀. So any "drop" action applied to an unreliable transport MUST be treated as if it were "reject" 🔥.
Here's the "alt-action" processing as pseudocode, so you can see the logic at a glance 👑:
SWITCH "alt-action"
"redirect": "redirect"
"drop":
IF unreliable-transport
THEN treat as "reject"
ELSE
"drop"
"reject": "reject"
default: "reject"
ENDAnd here's an example <actions> element. The server accepts a maximum of 100 call requests per second 📞, and the remaining calls get redirected to an answering machine 📼💅:
<actions>
<accept alt-action="redirect" alt-target=
"sip:answer-machine@example.com">
<rate>100</rate>
</accept>
</actions>6. XML Schema Definition for Load Control 🎀
Okay this section is the XML schema for the load-control document 🧁. It extends the Common Policy schema in [RFC4745] in two ways ✨.
First, it defines two mandatory attributes for the <ruleset> element: "version" and "state" 🔥. The "version" attribute lets the recipient of the notification properly order them 📊. Versions start at zero and increase by one for each new document sent to a subscriber within the same subscription 🌱. Versions MUST be representable using a non-negative 32-bit integer 💜. The "state" attribute indicates whether the document contains a full load-filtering policy update or only a state delta as a partial update 🦋.
Second, it defines new members of the <conditions> and <actions> elements 💖.
<?xml version="1.0" encoding="UTF-8"?>
<xs:schema targetNamespace="urn:ietf:params:xml:ns:load-control"
xmlns:lc="urn:ietf:params:xml:ns:load-control"
xmlns:cp="urn:ietf:params:xml:ns:common-policy"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified"
attributedFormDefault="unqualified">
<xs:import namespace="urn:ietf:params:xml:ns:common-policy"/>
<!-- RULESET -->
<xs:element name="ruleset">
<xs:complexType>
<xs:complexContent>
<xs:restriction base="xs:anyType">
<xs:sequence>
<xs:element name="rule" type="cp:ruleType"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:restriction>
</xs:complexContent>
<xs:attribute name="version" type="xs:integer" use="required"/>
<xs:attribute name="state" use="required">
<xs:simpleType>
<xs:restriction base="xs:string">
<xs:enumeration value="full"/>
<xs:enumeration value="partial"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:complexType>
</xs:element>
<!-- CONDITIONS -->
<!-- CALL IDENTITY -->
<xs:element name="call-identity" type="lc:call-identity-type"/>
<!-- CALL IDENTITY TYPE -->
<xs:complexType name="call-identity-type">
<xs:choice>
<xs:element name="sip" type="lc:sip-id-type"/>
<any namespace="##other" processContents="lax" minOccurs="0"
maxOccurs="unbounded"/>
</xs:choice>
<anyAtrribute namespace="##other" processContents="lax"/>
</xs:complexType>
<!-- SIP ID TYPE -->
<xs:complexType name="sip-id-type">
<xs:sequence>
<element name="from" type="lc:identityType" minOccurs="0"/>
<element name="to" type="lc:identityType" minOccurs="0"/>
<element name="request-uri" type="lc:identityType"
minOccurs="0"/>
<element name="p-asserted-identity" type="lc:identityType"
minOccurs="0"/>
<any namespace="##other" processContents="lax" minOccurs="0"
maxOccurs="unbounded"/>
</xs:sequence>
<anyAtrribute namespace="##other" processContents="lax"/>
</xs:complexType>
<!-- IDENTITY TYPE -->
<xs:complexType name="identityType">
<xs:complexContent>
<xs:restriction base="xs:anyType">
<xs:choice minOccurs="1" maxOccurs="unbounded">
<xs:element name="one" type="cp:oneType"/>
<xs:element name="many" type="lc:manyType"/>
<xs:element name="many-tel" type="lc:manyTelType"/>
<xs:any namespace="##other" processContents="lax"/>
</xs:choice>
</xs:restriction>
</xs:complexContent>
</xs:complexType>
<!-- MANY-TEL TYPE -->
<xs:complexType name="manyTelType">
<xs:complexContent>
<xs:restriction base="xs:anyType">
<xs:choice minOccurs="0" maxOccurs="unbounded">
<xs:element name="except-tel" type="lc:exceptTelType"/>
<xs:any namespace="##other"
minOccurs="0" processContents="lax"/>
</xs:choice>
<xs:attribute name="prefix"
use="optional" type="xs:string"/>
</xs:restriction>
</xs:complexContent>
</xs:complexType>
<!-- EXCEPT-TEL TYPE -->
<xs:complexType name="exceptTelType">
<xs:attribute name="prefix" type="xs:string" use="optional"/>
<xs:attribute name="id" type="xs:anyURI" use="optional"/>
</xs:complexType>
<!-- METHOD -->
<xs:element name="method" type="lc:method-type"/>
<!-- METHOD TYPE -->
<xs:simpleType name="method-type">
<xs:restriction base="xs:string">
<xs:enumeration value="INVITE"/>
<xs:enumeration value="MESSAGE"/>
<xs:enumeration value="REGISTER"/>
<xs:enumeration value="SUBSCRIBE"/>
<xs:enumeration value="OPTIONS"/>
<xs:enumeration value="PUBLISH"/>
</xs:restriction>
</xs:simpleType>
<!-- TARGET SIP ENTITY -->
<xs:element name="target-sip-entity" type="xs:anyURI" minOccurs="0"/>
<!-- ACTIONS -->
<xs:element name="accept">
<xs:choice>
<element name="rate" type="xs:decimal" minOccurs="0"/>
<element name="win" type="xs:integer" minOccurs="0"/>
<element name="percent" type="xs:decimal" minOccurs="0"/>
<any namespace="##other" processContents="lax" minOccurs="0"
maxOccurs="unbounded"/>
</xs:choice>
<xs:attribute name="alt-action" type="xs:string" default="reject"/>
<xs:attribute name="alt-target" type="lc:alt-target-type"
use="optional"/>
<anyAtrribute namespace="##other" processContents="lax"/>
</xs:element>
<!-- ALT TARGET TYPE -->
<xs:simpleType name="alt-target-type">
<xs:list itemType="xs:anyURI"/>
</xs:simpleType>
</xs:schema>7. Security Considerations 🔒
Okay, security time, and bestie this part is SERIOUS 😭🚨. Two primary security considerations come out of this specification 💅. One is the distribution mechanism for the load-filtering policy, which is based on the SIP event notification framework 📬. The other is the enforcement mechanism for the load-filtering policy 🛡️.
Security considerations for SIP event package mechanisms are covered in Section 6 of [RFC6665] 📖. A particularly relevant concern for this event package is that if the notifiers can be spoofed, attackers can send fake notifications asking subscribers to throttle all traffic, which leads to denial-of-service (DoS) attacks 💀. Therefore, this SIP load-filtering mechanism MUST be used in a Trust Domain (Section 3.4) 🚨. But if a legitimate notifier in the Trust Domain is itself compromised, additional mechanisms will be needed to detect the attack 👀.
Security considerations for load-filtering policy enforcement depend very much on the contents of the policy 🫣. This specification defines a possible match of the following SIP header fields in a load-filtering policy: <from>, <to>, <request-uri>, and <p-asserted-identity> 🎀. The exact requirement to authenticate and authorize these fields is up to the service provider 💼. In general, if the identity field represents the source of the request, it SHOULD be authenticated and authorized 🔐. If the identity field represents the destination of the request, authentication and authorization is optional 🌸.
In addition, the "redirect" action (Section 5.4) could facilitate a reflection denial-of-service attack 😱. Picture this: a number of SIP proxy servers in a Trust Domain are using UDP and are configured to get their policies from a central server. An attacker spoofs the central server's address and sends a bunch of NOTIFY bodies telling the proxy servers to redirect all calls to victim@outside-of-trust-domain.com 🙀. The proxy servers then redirect all calls to the victim, who becomes a victim of a Denial of Service attack and becomes inaccessible from the Internet 💔. To address this threat, this specification requires that a Trust Domain agrees on what types of calls can be affected, as well as on the destinations to which calls may be redirected, as in Section 3.4 🔒✨.
8. IANA Considerations 📋
This specification registers a SIP event package, a new media type, a new XML namespace, and a new XML schema 🌈.
8.1. Load-Control Event Package Registration 💜
This section registers an event package based on the registration procedures defined in [RFC6665] 🧚.
Package name: load-control
Type: package
Published specification: This specification
Person to contact: Charles Shen, charles@cs.columbia.edu
8.2. application/load-control+xml Media Type Registration 💌
Okay so this section registers a brand new media type 🎀. It's built on the procedures in [RFC6838] and the guidelines in [RFC3023], and honestly it's giving very official paperwork energy ✨
Type name: application
Subtype name: load-control+xml
Required parameters: none
Optional parameters: Same as charset parameter of application/xml as
specified in [RFC3023].
Encoding considerations: Same as encoding considerations of
application/xml as specified in [RFC3023].
Security considerations: See Section 10 of [RFC3023] and Section 7 of
this specification.
Interoperability considerations: none
Published specification: This specification
Applications that use this media type: Applications that perform load
control of SIP entities.
Fragment identifier considerations: Same as fragment identifier
considerations of application/xml as specified in [RFC3023].
Additional Information:
Deprecated alias names for this type: none
Magic Number(s): none
File Extension(s): .xml
Macintosh file type code(s): "TEXT"
Person and email address for further information: Charles Shen,
charles@cs.columbia.edu
Intended usage: COMMON
Restrictions on usage: none
Author: Charles Shen, Henning Schulzrinne, Arata Koike
Change controller: IESG
Provisional registration? (standards tree only): noQuick vibe check 🧐: the security stuff points you back to Section 10 of [RFC3023] and to Section 7 of this spec, so don't skip that 🔒
8.3. URN Sub-Namespace Registration 🌸
This section registers a new XML namespace, following the guidelines in [RFC3688] 💅
The URI for this namespace is:
urn:ietf:params:xml:ns:load-controlRegistrant Contact is the IETF SOC Working Group <sip-overload@ietf.org>, as designated by the IESG <iesg@ietf.org> 🫶
Here's the XML, verbatim 👀:
BEGIN
<?xml version="1.0"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML Basic 1.0//EN"
"http://www.w3.org/TR/xhtml-basic/xhtml-basic10.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="content-type"
content="text/html;charset=iso-8859-1"/>
<title>SIP Load-Control Namespace</title>
</head>
<body>
<h1>Namespace for SIP Load Control</h1>
<h2>urn:ietf:params:xml:ns:load-control</h2>
<p>See <a href="http://www.rfc-editor.org/rfc/rfc7200.txt">
RFC 7200</a>.</p>
</body>
</html>
END8.4. Load-Control Schema Registration 🧚
The schema URI is:
urn:ietf:params:xml:schema:load-controlRegistrant Contact is the IETF SOC working group, plus Charles Shen (charles@cs.columbia.edu) 💜
The XML schema from Section 6 has been registered ✨ Its first line is:
<?xml version="1.0" encoding="UTF-8"?>and its last line is:
</xs:schema>9. Acknowledgements 🫶
The authors gave a huge shout-out to a whole crew of folks 🙌 Jari Arkko, Richard Barnes, Stewart Bryant, Gonzalo Camarillo, Bruno Chatras, Benoit Claise, Spencer Dawkins, Martin Dolly, Keith Drage, Ashutosh Dutta, Donald Eastlake, Adrian Farrel, Stephen Farrell, Janet Gunn, Vijay Gurbani, Brian Haberman, Volker Hilt, Geoff Hunt, Carolyn Johnson, Hadriel Kaplan, Paul Kyzivat, Barry Leiba, Pearl Liang, Salvatore Loreto, Timothy Moran, Eric Noel, Parthasarathi R, Pete Resnick, Adam Roach, Dan Romascanu, Shida Schubert, Robert Sparks, Martin Stiemerling, Sean Turner, Phil Williams, and the other members of the SOC and SIPPING working groups who left helpful comments 💖
Some special mentions 🎀 Bruno Chatras proposed the <method> and <target-sip-entity> condition elements, plus a bunch of other text upgrades. Janet Gunn dropped detailed text suggestions, including Appendix C. Eric Noel suggested clarifying the load-filtering policy distribution initialization process. Shida Schubert made lots of suggestions about terminology. Phil Williams suggested adding support for delta updates. Ashutosh Dutta pointed the way to Public Switched Telephone Network (PSTN) references. Adam Roach suggested improvements related to RFC 6665 and offered other helpful clarifications. Richard Barnes made many suggestions, like referencing the Trust Domain concept of RFCs 3324 and 3325, using a separate element for 'tel' URI grouping, and addressing the "redirect" action security threat 🔥
10. References 📚
10.1. Normative References 🔒
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2141] Moats, R., "URN Syntax", RFC 2141, May 1997.
[RFC3023] Murata, M., St. Laurent, S., and D. Kohn, "XML Media
Types", RFC 3023, January 2001.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
A., Peterson, J., Sparks, R., Handley, M., and E.
Schooler, "SIP: Session Initiation Protocol", RFC 3261,
June 2002.
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
January 2004.
[RFC3966] Schulzrinne, H., "The tel URI for Telephone Numbers", RFC
3966, December 2004.
[RFC4745] Schulzrinne, H., Tschofenig, H., Morris, J., Cuellar, J.,
Polk, J., and J. Rosenberg, "Common Policy: A Document
Format for Expressing Privacy Preferences", RFC 4745,
February 2007.
[RFC6665] Roach, A., "SIP-Specific Event Notification", RFC 6665,
July 2012.
[RFC6838] Freed, N., Klensin, J., and T. Hansen, "Media Type
Specifications and Registration Procedures", BCP 13, RFC
6838, January 2013.10.2. Informative References 🧠
[E.300SerSup3]
ITU-T, "North American Precise Audible Tone Plan",
Recommendation E.300 Series Supplement 3, November 1988.
[E.412] ITU-T, "Network Management Controls", Recommendation
E.412-2003, January 2003.
[Q.1248.2] ITU-T, "Interface Recommendation for Intelligent Network
Capability Set4:SCF-SSF interface", Recommendation
Q.1248.2, July 2001.
[RFC2648] Moats, R., "A URN Namespace for IETF Documents", RFC 2648,
August 1999.
[RFC3324] Watson, M., "Short Term Requirements for Network Asserted
Identity", RFC 3324, November 2002.
[RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private
Extensions to the Session Initiation Protocol (SIP) for
Asserted Identity within Trusted Networks", RFC 3325,
November 2002.
[RFC4412] Schulzrinne, H. and J. Polk, "Communications Resource
Priority for the Session Initiation Protocol (SIP)", RFC
4412, February 2006.
[RFC4825] Rosenberg, J., "The Extensible Markup Language (XML)
Configuration Access Protocol (XCAP)", RFC 4825, May 2007.
[RFC5031] Schulzrinne, H., "A Uniform Resource Name (URN) for
Emergency and Other Well-Known Services", RFC 5031,
January 2008.
[RFC5390] Rosenberg, J., "Requirements for Management of Overload in
the Session Initiation Protocol", RFC 5390, December 2008.
[RFC6357] Hilt, V., Noel, E., Shen, C., and A. Abdelal, "Design
Considerations for Session Initiation Protocol (SIP)
Overload Control", RFC 6357, August 2011.
[SIP-OVERLOAD]
Gurbani, V., Ed., Hilt, V., and H. Schulzrinne, "Session
Initiation Protocol (SIP) Overload Control", Work in
Progress, March 2014.Appendix A. Definitions 🍓
This spec reuses the definitions for "Event Package", "Notification", "Notifier", "Subscriber", and "Subscription" from [RFC6665]. It also uses these extra definitions ✨
- Load Filtering: A load-control mechanism that applies specific actions to selected loads (e.g., SIP requests) matching specific conditions.
- Load-Filtering Policy: A set of zero or more load-filtering rules, also known as load-filtering rule set.
- Load-Filtering Rule: Conditions and actions to be applied for load filtering.
- Load-Filtering Condition: Elements that describe how to select loads to apply load-filtering actions. This specification defines the
<call-identity>,<method>,<target-sip-identity>, and<validity>condition elements (Section 5.3). - Load-Filtering Action: An operation to be taken by a load-filtering server on loads that match the load-filtering conditions. This specification allows actions such as accept, reject, and redirect of loads (Section 5.4).
- Load-Filtering Server: A server that performs load filtering. In the context of this specification, the load-filtering server is the subscriber, which receives load-filtering policies from the notifier and enforces those policies during load filtering.
- Load-Control Document: An XML document that describes the load-filtering policies (Section 5). It inherits and enhances the common policy document defined in [RFC4745].
Appendix B. Design Requirements 🧩
The SIP load-filtering mechanism needs to hit these requirements 💅
- For simplicity, the solution should focus on a method for controlling SIP load, rather than a generic application-layer mechanism.
- The load-filtering policy needs to be distributed efficiently to possibly a large subset of all SIP elements.
- The solution should reuse existing SIP protocol mechanisms to reduce implementation and deployment complexity.
- For predictable overload situations, such as holidays and mass calling events, the load-filtering policy should specify during what time it is to be applied, so that the information can be distributed ahead of time.
- For destination-specific overload situations, the load-filtering policy should be able to describe the destination domain or the callee.
- To address accidental and intentional high-volume call generators, the load-filtering policy should be able to specify the caller.
- Caller and callee need to be specified as both SIP URIs and 'tel' URIs [RFC3966] in load-filtering policies.
- It should be possible to specify particular information in the SIP headers (e.g., prefixes in telephone numbers) that allow load filtering over limited regionally focused overloads.
- The solution should draw upon experiences from related PSTN mechanisms [Q.1248.2] [E.412] [E.300SerSup3] where applicable.
- The solution should be extensible to meet future needs.
Appendix C. Discussion of How This Specification Meets the Requirements of RFC 5390 🎀
This section checks whether the load-control event package mechanism in this spec meets the SIP overload control requirements from [RFC5390]. As mentioned in Section 1, this spec complements other efforts in the overall SIP load-control solution space, so not every RFC 5390 requirement applies here. This spec sorts the results into Yes (the requirement is met), P/A (Partially Applicable), No (must be used in conjunction with another mechanism to meet the requirement), and N/A (Not Applicable) 📊
Here's the first one, REQ 1 👑
REQ 1: The overload mechanism shall strive to maintain the overall
useful throughput (taking into consideration the quality-of-
service needs of the using applications) of a SIP server at
reasonable levels, even when the incoming load on the network is
far in excess of its capacity. The overall throughput under load
is the ultimate measure of the value of an overload control
mechanism.P/A. Okay so the whole point of load filtering is to prevent overload or keep goodput up during overload 💅, but it totally depends on predicting the load, doing the computations, and distributing the filtering policies. If the load predictions or policy computations are wrong, or the filtering policy isn't distributed properly, the mechanism is gonna be less effective 😭. But if the load can be predicted accurately and the policies are computed and distributed appropriately, then this requirement can be met ✨.
REQ 2: When a single network element fails, goes into overload, or loses processing capacity, the mechanism SHOULD strive to limit the impact on other elements in the network 🫶. That helps stop a small-scale failure from turning into a widespread outage 💀.
N/A if load-filtering policies are installed in advance and don't change during the potential overload period, P/A if load-filtering policies are dynamically adjusted 🦋. The algorithm to dynamically compute load-filtering policies is outside the scope of this specification 🙈, but distributing the updated filtering policies uses the event package mechanism of this specification.
REQ 3: The mechanism SHOULD seek to minimize the amount of configuration required to work 🎀. For example, it's better to avoid needing to configure a server with its SIP message throughput, because those kinds of numbers are hard to determine 🙈.
No. This mechanism is entirely dependent on advance configuration, based on advance knowledge. To satisfy REQ 3, it SHOULD be used in conjunction with other mechanisms that are not based on advance configuration 💅.
REQ 4: The mechanism MUST be capable of dealing with elements that don't support it, so a network can be a mix of elements that do and don't support it 🌈. In other words, the mechanism SHOULD NOT only work in environments where all elements support it. It's reasonable to assume it works better in such environments, of course. Ideally, there SHOULD be incremental improvements in overall network throughput as increasing numbers of elements in the network support the mechanism ✨.
No. This mechanism is entirely dependent on the participation of all possible neighbors. To satisfy REQ 4, it SHOULD be used in conjunction with other mechanisms, some of which are described in Section 3.4 🫶.
REQ 5: The mechanism SHOULD NOT assume it will only be deployed in environments with completely trusted elements 🔥. It SHOULD seek to operate as effectively as possible where other elements are malicious, and that includes stopping malicious elements from getting more than a fair share of service 👑.
No. This mechanism is entirely dependent on the non-malicious participation of all possible neighbors. To satisfy REQ 5, it SHOULD be used in conjunction with other mechanisms, some of which are described in Section 3.4 💖.
REQ 6: When overload is signaled by a specific message, the message MUST clearly indicate that it's being sent because of overload, as opposed to other non-overload-based failure conditions 🚨. This is meant to dodge the problems that came from reusing the 503 response code for multiple purposes 😭. Of course, overload is also signaled by lack of response to requests. This requirement only applies to explicit overload signals ✨.
N/A. This mechanism signals anticipated overload, not actual overload 🦋. However, the signals in this mechanism aren't used for any other purpose 🫶.
REQ 7: The mechanism SHALL provide a way for an element to throttle the amount of traffic it receives from an upstream element 🎀. That throttling SHALL be graded, so it's not all-or-nothing like the current 503 mechanism 💖. This recognizes that "overload" isn't a binary state and there are degrees of overload 🌸.
Yes. This event package allows rate-/loss-/window-based overload control options, as discussed in Section 5.4 ✨.
REQ 8: The mechanism SHALL ensure that when a request wasn't processed successfully due to overload (or failure) of a downstream element, the request will not be retried on another element that is also overloaded or whose status is unknown 🙅. This requirement derives from REQ 1 🧚.
N/A to the load-control event package mechanism itself 🙈.
REQ 9: A request that has been rejected from an overloaded element SHALL NOT unduly restrict the ability of that request to be submitted to and processed by an element that is not overloaded 🍓. This requirement derives from REQ 1.
Yes. For example, load-filtering policy (Section 3.1) can include alternative forwarding destinations for rejected requests 💜.
REQ 10: The mechanism SHOULD support servers that receive requests from a large number of different upstream elements, where the set of upstream elements is not enumerable 🌈.
No. Because this mechanism requires advance configuration of specifically identified neighbors, it doesn't support environments where the number and identity of the upstream neighbors aren't known in advance. To satisfy REQ 10, it SHOULD be used in conjunction with other mechanisms 😭.
REQ 11: The mechanism SHOULD support servers that receive requests from a finite set of upstream elements, where the set of upstream elements is enumerable ✨.
Yes. See also the answer to REQ 10 💖.
REQ 12: The mechanism SHOULD work between servers in different domains 🦋.
Yes. The load-control event package mechanism is not limited by domain boundaries. However, it is likely more applicable in intra-domain scenarios than in inter-domain scenarios due to security and other concerns (see also Section 3.4) 🔥.
REQ 13: The mechanism MUST NOT dictate a specific algorithm for prioritizing the processing of work within a proxy during times of overload 👑. It MUST permit a proxy to prioritize requests based on any local policy, so that certain ones (such as a call for emergency services or a call with a specific value of the Resource-Priority header field [RFC4412]) are given preferential treatment, such as not being dropped, being given additional retransmission, or being processed ahead of others 💅.
P/A. This mechanism does not specifically address the prioritizing of work during times of overload. But it does not preclude any particular local policy 🌸.
REQ 14: The mechanism SHOULD provide unambiguous directions to clients on when they SHOULD retry a request and when they SHOULD NOT 😭. This especially applies to TCP connection establishment and SIP registrations, in order to mitigate against avalanche restart 🫶.
N/A to the load-control event package mechanism itself 🧚.
REQ 15: In cases where a network element fails, is so overloaded that it cannot process messages, or cannot communicate due to a network failure or network partition, it will not be able to provide explicit indications of the nature of the failure or its levels of congestion 💀. The mechanism MUST properly function in these cases 🫶.
P/A. Because the load-filtering policies are provisioned in advance, they are not affected by the overload or failure of other network elements. On the other hand, they may not, in those cases, be able to protect the overloaded network elements (see REQ 1) 🙈.
REQ 16: The mechanism SHOULD attempt to minimize the overhead of the overload control messaging 🎀.
Yes. The standardized SIP event package mechanism [RFC6665] is used 💖.
REQ 17: The overload mechanism MUST NOT provide an avenue for malicious attack, including DoS and DDoS attacks 🚨.
P/A. This mechanism does provide a potential avenue for malicious attacks. Therefore, the security mechanisms for SIP event packages, in general, [RFC6665] and Section 7 of this specification SHOULD be used 🔐.
REQ 18: The overload mechanism SHOULD be unambiguous about whether a load indication applies to a specific IP address, host, or URI, so that an upstream element can determine the load of the entity to which a request is to be sent 🦋.
Yes. The identity of load indication is covered in the load-filtering policy format definition in Section 3.1 ✨.
REQ 19: The specification for the overload mechanism SHOULD give guidance on which message types might be desirable to process over others during times of overload, based on SIP-specific considerations. For example, it may be more beneficial to process a SUBSCRIBE refresh with Expires of zero than a SUBSCRIBE refresh with a non-zero expiration (since the former reduces the overall amount of load on the element), or to process re-INVITEs over new INVITEs 📞.
N/A to the load-control event package mechanism itself 💅.
REQ 20: In a mixed environment of elements that do and do not implement the overload mechanism, no disproportionate benefit SHALL accrue to the users or operators of the elements that do not implement the mechanism 🌸.
No. This mechanism is entirely dependent on the participation of all possible neighbors. To satisfy REQ 20, it SHOULD be used in conjunction with other mechanisms, some of which are described in Section 3.4 🫶.
REQ 21: The overload mechanism SHOULD ensure that the system remains stable. When the offered load drops from above the overall capacity of the network to below the overall capacity, the throughput SHOULD stabilize and become equal to the offered load 🌊.
N/A to the load-control event package mechanism itself 🧚.
REQ 22: It MUST be possible to disable the reporting of load information towards upstream targets based on the identity of those targets. This allows a domain administrator who considers the load of their elements to be sensitive information to restrict access to that information 🔒. Of course, in such cases, there is no expectation that the overload mechanism itself will help prevent overload from that upstream target 🙈.
N/A to the load-control event package mechanism itself 💖.
REQ 23: It MUST be possible for the overload mechanism to work in cases where there is a load balancer in front of a farm of proxies 🍓.
Yes. The load-control event package mechanism does not preclude its use in a scenario with server farms 👑.
Appendix D. Complete Examples ✨
D.1. Load-Control Document Examples 🎀
okay bestie, this part is all about the full examples 💅 Both are complete load-control documents, and both are valid against the XML schema from Section 6 ✨
Example one is all about hotlines 📞 They live at sip:alice@hotline.example.com and tel:+1-212-555-1234, and they're active from 12:00 to 15:00 US Eastern Standard Time on 2008-05-31. The goal is to cap incoming calls to the hotlines at 100 requests per second, and any call that goes over the limit gets explicitly rejected 🚫
<?xml version="1.0" encoding="UTF-8"?>
<ruleset xmlns="urn:ietf:params:xml:ns:common-policy"
xmlns:lc="urn:ietf:params:xml:ns:load-control"
version="0" state="full">
<rule id="f3g44k1">
<conditions>
<lc:call-identity>
<lc:sip>
<lc:to>
<one id="sip:alice@hotline.example.com"/>
<one id="tel:+1-212-555-1234"/>
</lc:to>
</lc:sip>
</lc:call-identity>
<method>INVITE</method>
<validity>
<from>2008-05-31T12:00:00-05:00</from>
<until>2008-05-31T15:00:00-05:00</until>
</validity>
</conditions>
<actions>
<lc:accept alt-action="reject">
<lc:rate>100</lc:rate>
</lc:accept>
</actions>
</rule>
</ruleset>Example two is the hurricane one 🌪️ It optimizes server resources during the three-day period after a hurricane. Incoming calls to the domain sandy.example.com, or to call destinations with the prefix +1-212, get limited to 100 requests per second. The one exception is calls coming from the rescue team domain rescue.example.com 🚑 Outgoing calls from the hurricane domain, and calls within the local domain, are never limited. Any call that gets throttled is forwarded to an answering machine with updated hurricane rescue info 📣
<?xml version="1.0" encoding="UTF-8"?>
<ruleset xmlns="urn:ietf:params:xml:ns:common-policy"
xmlns:lc="urn:ietf:params:xml:ns:load-control"
version="1" state="full">
<rule id="f3g44k2">
<conditions>
<lc:call-identity>
<lc:sip>
<lc:to>
<many domain="sandy.example.com"/>
<many-tel prefix="+1-212"/>
</lc:to>
<lc:from>
<many>
<except domain="sandy.example.com"/>
<except domain="rescue.example.com"/>
</many>
</lc:from>
</lc:sip>
</lc:call-identity>
<method>INVITE</method>
<validity>
<from>2012-10-25T09:00:00+01:00</from>
<until>2012-10-28T09:00:00+01:00</until>
</validity>
</conditions>
<actions>
<lc:accept alt-action="redirect" alt-target=
"sip:sandy@update.example.com">
<lc:rate>100</lc:rate>
</lc:accept>
</actions>
</rule>
</ruleset>Now, sometimes a ruleset has multiple rules that match the same methods, call identity, and validity. When that happens, the first-match-wins principle kicks in 👑 In the example below, the first rule says every call from the example.com domain gets rejected. The next rule says calls from sip:alice@example.com should be redirected to sip:eve@example.com, but those calls still get rejected, because the earlier rule already matched them 🙈
<?xml version="1.0" encoding="UTF-8"?>
<ruleset xmlns="urn:ietf:params:xml:ns:common-policy"
xmlns:lc="urn:ietf:params:xml:ns:load-control"
version="1" state="full">
<rule id="f3g44k3">
<conditions>
<lc:call-identity>
<lc:sip>
<lc:from>
<many domain="example.com"/>
</lc:from>
</lc:sip>
</lc:call-identity>
<method>INVITE</method>
<validity>
<from>2013-7-2T09:00:00+01:00</from>
<until>2013-7-3T09:00:00+01:00</until>
</validity>
</conditions>
<actions>
<lc:accept alt-action="reject">
<lc:rate>0</lc:rate>
</lc:accept>
</actions>
</rule>
<rule id="f3g44k4">
<conditions>
<lc:call-identity>
<lc:sip>
<lc:from>
<one id="sip:alice@example.com"/>
</lc:from>
</lc:sip>
</lc:call-identity>
<method>INVITE</method>
<validity>
<from>2013-7-2T09:00:00+01:00</from>
<until>2013-7-3T09:00:00+01:00</until>
</validity>
</conditions>
<actions>
<lc:accept alt-action="redirect" alt-target=
"sip:eve@example.com">
<lc:rate>0</lc:rate>
</lc:accept>
</actions>
</rule>
</ruleset>D.2. Message Flow Examples ✨
This section shows an example message flow for the load-control event package mechanism defined in this spec. Here's the big picture first 🦋
atlanta biloxi
| F1 SUBSCRIBE |
|------------------>|
| F2 200 OK |
|<------------------|
| F3 NOTIFY |
|<------------------|
| F4 200 OK |
|------------------>|Step one is F1, the SUBSCRIBE from atlanta to biloxi 💌 The label is F1 SUBSCRIBE atlanta.example.com -> biloxi.example.com, and the message looks like this:
SUBSCRIBE sip:biloxi.example.com SIP/2.0
Via: SIP/2.0/TCP atlanta.example.com;branch=z9hG4bKy7cjbu3
From: sip:atlanta.example.com;tag=162ab5
To: sip:biloxi.example.com
Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com
CSeq: 2012 SUBSCRIBE
Contact: sip:atlanta.example.com
Event: load-control
Max-Forwards: 70
Accept: application/load-control+xml
Expires: 3600
Content-Length: 0Then F2 comes back as a 200 OK from biloxi to atlanta, labelled F2 200 OK biloxi.example.com -> atlanta.example.com 🌸
SIP/2.0 200 OK
Via: SIP/2.0/TCP biloxi.example.com;branch=z9hG4bKy7cjbu3
;received=192.0.2.1
To: <sip:biloxi.example.com>;tag=331dc8
From: <sip:atlanta.example.com>;tag=162ab5
Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com
CSeq: 2012 SUBSCRIBE
Expires: 3600
Contact: sip:biloxi.example.com
Content-Length: 0F3 is the NOTIFY from biloxi to atlanta, labelled F3 NOTIFY biloxi.example.com -> atlanta.example.com 🔔
NOTIFY sip:atlanta.example.com SIP/2.0
Via: SIP/2.0/TCP biloxi.example.com;branch=z9hG4bKy71g2ks
From: <sip:biloxi.example.com>;tag=331dc8
To: <sip:atlanta.example.com>;tag=162ab5
Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com
Event: load-control
Subscription-State: active;expires=3599
Max-Forwards: 70
CSeq: 1775 NOTIFY
Contact: sip:biloxi.example.com
Content-Type: application/load-control+xml
Content-Length: ...
[Load-Control Document]Last up is F4, the 200 OK from atlanta back to biloxi, labelled F4 200 OK atlanta.example.com -> biloxi.example.com 🎉
SIP/2.0 200 OK
Via: SIP/2.0/TCP atlanta.example.com;branch=z9hG4bKy71g2ks
;received=192.0.2.2
From: <sip:biloxi.example.com>;tag=331dc8
To: <sip:atlanta.example.com>;tag=162ab5
Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com
CSeq: 1775 NOTIFY
Content-Length: 0Appendix E. Related Work 🌈
E.1. Relationship to Load Filtering in PSTN 📞
Okay, so the PSTN network already has its own load-filtering mechanism to stop overload 💅 Its filtering policy is set up manually, except in certain cases where the Intelligent Network architecture is used [Q.1248.2][E.412]. This spec defines a load-filtering mechanism built on the SIP event notification framework, so filtering policies can be distributed automatically in environments that support it 🤖
PSTN overload control uses messages that specify an outgoing control list, a call gap duration, and a control duration [Q.1248.2][E.412]. Those roughly match the identity, action, and time fields of the SIP load-filtering policy in this spec. The SIP version is way more generic and flexible though, no cap 🔥
First off, PSTN load filtering only applies to telephone numbers. The identity element of a SIP load-filtering policy lets you specify both SIP URIs and telephone numbers (through the tel URI). Those identities can be grouped by SIP domains or by any number of leading prefixes of the telephone numbers 🧚
Second, PSTN load filtering is usually limited to call gapping. The action field in a SIP load-filtering policy allows more flexible options, like rate throttling and others 💖
Third, the duration field in PSTN load filtering gives a value in seconds for the filtering duration only, and the allowed values are mapped into a set of values. The time field in a SIP load-filtering policy can specify not just a duration, but also a future activation time. That's super useful for automating load filtering for overloads you can predict 🦋
PSTN load filtering can run in both edge switches and transit switches. SIP load filtering can also be applied in both edge proxy servers and core proxy servers, and even in capable user agents 🌸
PSTN load filtering also has special treatment for High Probability of Completion (HPC) calls, which are similar to calls marked with the SIP Resource Priority Headers [RFC4412] 👑 The SIP load-filtering mechanism lets you prioritize these calls too, by specifying favorable actions for them ⭐
PSTN load filtering also has an administrative option for routing failed call attempts to either a reorder tone [E.300SerSup3], which signals overload conditions, or a special recorded announcement. The SIP load-filtering mechanism can offer something similar by specifying an appropriate alt-action attribute in its action field 🎀
E.2. Relationship with Other IETF SIP Overload Control Efforts ✨
Okay bestie, so the load-filtering policies in this spec are built from three things: identity, action, and time 💅. The identity can be super specific, like one single user, or a whole aggregate of users, or domains, or areas 🌸. You can identify the user by either the source or the destination 🦋. When the user is identified by the source and the action is favorable, it's kinda similar to picking out a priority user based on authorized Resource Priority Headers [RFC4412] in the requests 👑. And if you give a source user identity an unfavorable action, it's somewhat like an inverse SIP resource priority mechanism 🙈. Not me the reverse VIP lol 💀
The load-filtering policy here is generic, and it's expected to work not just for the load-filtering mechanism but also for the feedback overload control mechanism in [SIP-OVERLOAD] 🎀. Both mechanisms could use specific or wildcard identities for load control, and they could share well-known load-control actions 🫶. The time duration field in the load-filtering policy could also be used in both mechanisms ⭐. As mentioned in Section 1, the load-filtering policy distribution mechanism and the feedback overload control mechanism cover complementary areas of the overload control problem space 🌈. Load filtering is more proactive: it pushes filtering policies toward the source of the traffic. The hop-by-hop feedback approach is reactive, and it cuts down traffic that the network has already accepted 😭. Because of that, they could also use the generic load-filtering policy components in different ways 💜.
For example, the load-filtering mechanism might use the time field to specify not only a control duration but also a future activation time, which helps with a predictable overload like the one caused by Mother's Day greetings or a viewer-voting program 🍓🧚. The feedback-based control might not need the time field at all, or it might use the time field to specify an immediate load-control duration ✨
Authors' Addresses 💌
Charles Shen
Columbia University
Department of Computer Science
1214 Amsterdam Avenue, MC 0401
New York, NY 10027
USA
Phone: +1 212 854 3109
EMail: charles@cs.columbia.eduHenning Schulzrinne
Columbia University
Department of Computer Science
1214 Amsterdam Avenue, MC 0401
New York, NY 10027
USA
Phone: +1 212 939 7004
EMail: schulzrinne@cs.columbia.eduArata Koike
NTT Network Technology Labs
3-9-11 Midori-cho Musashino-shi
Tokyo 180-8585
Japan
Phone: +81 422 59 6099
EMail: koike.arata@lab.ntt.co.jpThat's the whole RFC, bestie! 🦋💖 Protocol perfection, served with a side of main character energy 👑🫶
📦 where this page comes from
- ietf: rfc7200 2014-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms