RFC 8787

Location Source Parameter for the SIP Geolocation Header Field

📅 published May 2020, from ietf

RFC 8787: Location Source Parameter for the SIP Geolocation Header Field 🎀

Okay bestie, let's get into it. 🦋 This one is by J. Winterbottom (Winterb Consulting Services), R. Jesske (Deutsche Telekom), B. Chatras (Orange Labs), and A. Hutton (Atos). It came out in May 2020 from the IETF, it's a Standards Track document, and the ISSN is 2070-1721. 💅 It updates RFC 6442. The header doesn't have an Obsoletes line, so it doesn't replace anything. 🌸

Abstract ✨

Okay so there are some situations where a Geolocation header field can carry more than one locationValue, and that's where this gets spicy 🌶️. If the recipient knows which node added each locationValue, they get way more freedom to pick which one to look at first, instead of only going by the order they showed up in. 🧚 This document defines the "loc-src" parameter, which lets whoever adds a locationValue identify themselves with their hostname. It also updates RFC 6442. 💜

Status of This Memo

This is an Internet Standards Track document. 🎀

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. ✨

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8787. 🌈

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. 📜

Table of Contents 🗺️

1.  Introduction
2.  Terminology
3.  Rationale
4.  Mechanism
5.  Example
6.  Privacy Considerations
7.  Security Considerations
8.  IANA Considerations
  8.1.  Registration of "loc-src" Parameter for Geolocation Header
        Field
9.  References
  9.1.  Normative References
  9.2.  Informative References
Acknowledgements
Authors' Addresses

1. Introduction 🦋

So the "Geolocation" SIP header field is described in the SIP Geolocation spec [RFC6442]. It's how a SIP message says it's carrying location information. [RFC6442] says SIP intermediaries should not add locationValues to a request that already has one. It also says that if an intermediary does add location, it's fully on the hook for handling any 424 (Bad Location Information) SIP response it gets back. 😭

BUT. Some architectures, like 3GPP [TS23-167] and ETSI [M493], would rather use info from edge proxies or from core-network nodes before they trust info coming only from the user equipment (UE). 💅 These solutions don't rule out UE-provided location. They just need a way to tell apart the node that added the locationValue from the one the UE provided. 🫶

Here's the thing: [RFC6442] says the locationValues in the Geolocation header field go in the same order they were added. That order does hint at which values were added earlier in the chain, but it doesn't tell you which node added each one. ✨ Knowing who added the location lets the recipient pick which one to consider first, instead of just trusting the order. 👑

This document extends the Geolocation header field of [RFC6442] by letting an entity that adds a locationValue identify itself with a hostname. It does that by defining a new geoloc-param header field parameter called "loc-src". How the entity gets the location information is out of scope here. 🧚 Also, the "loc-src" parameter doesn't change what the locationValue is about. 💖

2. Terminology 🎀

So the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 💅 Lowercase versions don't count, okay? 🙈

3. Rationale 🌸

The main reason for the "loc-src" parameter is emergency calling. 🚨 There are a bunch of architectures for emergency calls over SIP messaging. Each one has its own pros and cons. ✨ All of them let the UE provide location, but a lot of them also attach other location sources, either to do veracity checks, as backup info, or as the main location. 🌈

This document doesn't weigh in on those architectures or on why someone would include multiple locationValues. It does admit those architectures exist, and that there's a real need to figure out which entity added the location info. 🫶

The "loc-src" parameter adds the location source that generated the locationValue, so recipients can make smart choices about which of the multiple values to use. 🧠

The "loc-src" parameter is applicable within a single private administrative domain, or between different administrative domains that have a trust relationship. So it's meant to be used only in trust domains where Spec(T), as described in [RFC3325], exists. 💜

The "loc-src" parameter isn't included in a SIP message sent to another network when there's no trust relationship. It also isn't applicable if the administrative domain handles emergency calls in a way that doesn't need any location to be generated. 🙅‍♀️

The functional architecture for supporting emergency caller location described in ETSI [M493] is an example of an architecture where this parameter makes sense. 🦋

4. Mechanism 🔥

The mechanism adds a geoloc-param parameter to the locationValue defined in [RFC6442]. It identifies the hostname of the entity that added the locationValue to the Geolocation header field. ✨ The Augmented BNF (ABNF) [RFC5234] for this parameter is shown in Figure 1. 👑

          location-source = "loc-src" EQUAL hostname
          hostname = <defined in RFC 3261>

                         Figure 1: Location Source

Only a fully qualified host name is valid. The syntax doesn't support IP addresses. So if an entity that follows this specification receives a Geolocation header field with a "loc-src" parameter containing an IP address, it MUST remove the parameter. 🚫

A SIP intermediary that conforms to this specification and adds a locationValue to a Geolocation header field SHOULD also add a "loc-src" header field parameter, so it's clearly identified as the node that added the location. 🫶 A User Agent (UA) MUST NOT insert a "loc-src" header field parameter. 🙅‍♀️ And if a SIP intermediary gets a message from an untrusted source with the "loc-src" parameter set, it MUST remove the "loc-src" parameter before passing the message into a trusted network. 🛡️

5. Example 🎀

The following example shows a SIP INVITE message with a Geolocation header field that has two locationValues. 💅 The first locationValue points to a Presence Information Data Format Location Object (PIDF-LO) in the SIP body, using a content-indirection (cid:) URI per [RFC4483]. The UE provides this one. The second locationValue is an https URI provided by a SIP intermediary, which identifies itself using the "loc-src" parameter. 🧚

   INVITE sip:bob@biloxi.example.com SIP/2.0
   Via: SIP/2.0/TLS pc33.atlanta.example.com;branch=z9hG4bK74bf9
   Max-Forwards: 70
   To: Bob <sip:bob@biloxi.example.com>
   From: Alice <sip:alice@atlanta.example.com>;tag=9fxced76sl
   Call-ID: 3848276298220188511@atlanta.example.com
   Geolocation: <cid:target123@atlanta.example.com>,
        <https://lis.example.com:8222/y77syc7cuecbh>;
                 loc-src=edgeproxy.example.com
   Geolocation-Routing: yes
   Accept: application/sdp, application/pidf+xml
   CSeq: 31862 INVITE
   Contact: <sip:alice@atlanta.example.com>
   Content-Type: multipart/mixed; boundary=boundary1
   Content-Length: ...

         Figure 2: Example Location Request (in Trust Domain)

6. Privacy Considerations 🙈

This document doesn't change any of the privacy considerations described in [RFC6442]. Adding the "loc-src" parameter does identify the entity that added the location in the signaling path. But that gives away very little more than adding a proxy identity to the Record-Route header field does (privacy defined in [RFC3323]). 🌸

7. Security Considerations 😭🔐

Okay, this section is important, so pay attention, bestie. ⚠️ This document gives a SIP intermediary the ability to insert a host name saying it added a specific locationValue to the Geolocation header field. The idea is that the location recipient uses this when the SIP message contains multiple locationValues. Because of that, this parameter should only be used by the location recipient in a trusted network. Adding this parameter in an untrusted network only gives location information to untrusted parties, and it is NOT RECOMMENDED. 🚨

As already stated in [RFC6442], securing the location hop by hop, using TLS, protects the message from eavesdropping and modification in transit. But it exposes the information to all SIP intermediaries on the path, as well as the endpoint. 👀

The "loc-src" parameter is applicable within a single private administrative domain, or between different administrative domains that have a relationship. If there's no trust relationship like that, it is strongly recommended to delete the location information. 🗑️

The use of this parameter isn't restricted to a specific architecture. But using multiple locations and loc-src might end in compatibility issues. [RFC6442] already deals with the issue of multiple locations. 💅 And to avoid possible corruption of the location information, including the "loc-src" parameter, when there's an untrusted relationship, it is strongly recommended to delete location information when it's passed to another domain outside the trust domain. 🛡️💖

8. IANA Considerations 🌈

(to be continued in part 2 🧚✨)

8.1. Registration of "loc-src" Parameter for Geolocation Header Field

okay so IANA added a brand new SIP header field parameter 🎀 for the Geolocation header field. It lives in the "Header Field Parameters and Parameter Values" subregistry (created by [RFC3968]), which sits inside the "Session Initiation Protocol (SIP) Parameters" registry at https://www.iana.org/assignments/sip-parameters/ 🦋 Here's the entry:

Header Field:  Geolocation

Parameter Name:  loc-src

Predefined Values:  No

Reference:  RFC 8787

9. References ✨

9.1. Normative References

these are the docs we lean on the hardest 💪

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.

[RFC3323] Peterson, J., "A Privacy Mechanism for the Session Initiation Protocol (SIP)", RFC 3323, DOI 10.17487/RFC3323, November 2002, https://www.rfc-editor.org/info/rfc3323.

[RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private Extensions to the Session Initiation Protocol (SIP) for Asserted Identity within Trusted Networks", RFC 3325, DOI 10.17487/RFC3325, November 2002, https://www.rfc-editor.org/info/rfc3325.

[RFC3968] Camarillo, G., "The Internet Assigned Number Authority (IANA) Header Field Parameter Registry for the Session Initiation Protocol (SIP)", BCP 98, RFC 3968, DOI 10.17487/RFC3968, December 2004, https://www.rfc-editor.org/info/rfc3968.

[RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", STD 68, RFC 5234, DOI 10.17487/RFC5234, January 2008, https://www.rfc-editor.org/info/rfc5234.

[RFC6442] Polk, J., Rosen, B., and J. Peterson, "Location Conveyance for the Session Initiation Protocol", RFC 6442, DOI 10.17487/RFC6442, December 2011, https://www.rfc-editor.org/info/rfc6442.

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.

9.2. Informative References

these ones are good background reading 📚🌸

[M493] European Telecommunications Standards Institute, "Functional architecture to support European requirements on emergency caller location determination and transport", ES 203 178, V 1.1.1, February 2015.

[RFC4483] Burger, E., Ed., "A Mechanism for Content Indirection in Session Initiation Protocol (SIP) Messages", RFC 4483, DOI 10.17487/RFC4483, May 2006, https://www.rfc-editor.org/info/rfc4483.

[TS23-167] 3rd Generation Partnership Project, "Technical Specification Group Services and System Aspects; IP Multimedia Subsystem (IMS) emergency sessions", TS 23.167, V12.1.0, March 2015.

Acknowledgements ✨

huge shoutout to everyone who helped 🫶 The authors thank Dale Worley, Christer Holmberg, and Jean Mahoney for their extensive review of this document 💖 They also appreciate the constructive feedback from Paul Kyzivat and Robert Sparks 👑

Authors' Addresses ✨

meet the crew 💅

James Winterbottom
Winterb Consulting Services
Gwynneville NSW 2500
Australia

Phone: +61 448 266004
Email: a.james.winterbottom@gmail.com

Roland Jesske
Deutsche Telekom
Heinrich-Hertz Str, 3-7
64295 Darmstadt
Germany

Email: r.jesske@telekom.de
URI:   www.telekom.de

Bruno Chatras
Orange Labs
44, avenue de la Republique
F-92320 Chatillon
France

Email: bruno.chatras@orange.com

Andrew Hutton
Atos
Mid City Place
London
WC1V 6EA
United Kingdom

Email: andrew.hutton@atos.net

📦 where this page comes from

ietf: rfc8787 2020-05
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms