SIP WGNetwork Working Group C. Jennings, Ed. Internet-Draft Cisco Systems Expires: April 26, 2006Updates: 3261,3327 (if approved) R. Mahy, Ed. SIP Edge LLC October 23, 2005Expires: September 6, 2006 Plantronics March 5, 2006 Managing Client Initiated Connections in the Session Initiation Protocol (SIP) draft-ietf-sip-outbound-01draft-ietf-sip-outbound-02 Status of this Memo By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on April 26,September 6, 2006. Copyright Notice Copyright (C) The Internet Society (2005).(2006). Abstract Session Initiation Protocol (SIP) allows proxy servers to initiate TCP connections and send asynchronous UDP datagrams to User Agents in order to deliver requests. However, many practical considerations, such as the existence of firewalls and NATs,Network Address Translators (NATs), prevent servers from connecting to User Agents in this way. Even when a proxy server can open a TCP connection to a User Agent, most User Agents lack a certificate suitable to act as a TLS (Transport Layer Security) server. This specification defines behaviors for User Agents, registrars and proxy servers that allow requests to be delivered on existing connections established by the User Agent. It also defines keep alive behaviors needed to keep NAT bindings open and specifies the usage of multiple connections for high availability systems.connections. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 34 2. Conventions and Terminology . . . . . . . . . . . . . . . . . 34 2.1. Definitions . . . . . . . . . . . . . . . . . . . . . . . 35 3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 3.1. Summary of Mechanism . . . . . . . . . . . . . . . . . . . 45 3.2. Single Registrar and UA . . . . . . . . . . . . . . . . . 56 3.3. Multiple Connections from a User Agent . . . . . . . . . . 67 3.4. Edge Proxies . . . . . . . . . . . . . . . . . . . . . . . 89 3.5. Keep Alive Technique . . . . . . . . . . . . . . . . . . . 910 4. User Agent Mechanisms . . . . . . . . . . . . . . . . . . . . 10 4.1. Forming Flows . . .Instance ID Creation . . . . . . . . . . . . . . . . . . . 10 4.1.1. Request without GRUU .4.2. Initial Registrations . . . . . . . . . . . . . . . . 11 4.2. Detecting Flow Failure. . 12 4.2.1. Registration by Other Instances . . . . . . . . . . . 13 4.3. Sending Requests . . . . . 11 4.3. Flow Failure Recovery. . . . . . . . . . . . . . . . 13 4.3.1. Selecting the First Hop . . 12 4.4. Registration by Other Instances. . . . . . . . . . . . . 13 5. Registrar Mechanisms .4.3.2. Forming Flows . . . . . . . . . . . . . . . . . . . . 13 5.1. Processing Register Requests4.4. Detecting Flow Failure . . . . . . . . . . . . . . . . 13 5.2. Forwarding Requests. . 14 4.4.1. Keep Alive with STUN . . . . . . . . . . . . . . . . . 14 6. Edge Proxy Mechanisms4.4.2. Keep Alive with Double CRLF . . . . . . . . . . . . . 15 4.5. Flow Recovery . . . . . . . 15 6.1. Processing Register Requests. . . . . . . . . . . . . . . 15 6.2. Forwarding Requests5. Edge Proxy Mechanisms . . . . . . . . . . . . . . . . . . . . 16 7. Mechanisms for All Servers5.1. Processing Register Requests . . . . . . . . . . . . . . . 16 5.2. Generating Flow Tokens . . . . . . . 17 7.1. STUN Processing. . . . . . . . . . . 16 5.3. Forwarding Requests . . . . . . . . . . 17 7.2. Pin-Route Processing. . . . . . . . . 17 6. Registrar and Location Server Mechanisms . . . . . . . . . . . 17 8. Example Message Flow6.1. Processing Register Requests . . . . . . . . . . . . . . . 18 6.2. Forwarding Requests . . . . . . 18 9. Grammar. . . . . . . . . . . . . 19 7. Mechanisms for All Servers (Proxys, Registars, UAS) . . . . . 19 7.1. STUN Processing . . . . . . . . . 21 10. IANA Considerations. . . . . . . . . . . . 19 7.2. Double CRLF Processing . . . . . . . . . 22 11. Security Considerations. . . . . . . . . 20 8. Example Message Flow . . . . . . . . . . 22 12. Open Issues. . . . . . . . . . . 20 9. Grammar . . . . . . . . . . . . . . 23 13. Requirements. . . . . . . . . . . . . 23 10. IANA Considerations . . . . . . . . . . . . 24 14. Changes from 00 Version. . . . . . . . . 24 10.1. Contact Header Field . . . . . . . . . . 24 15. Acknowledgments. . . . . . . . . 24 10.2. SIP/SIPS URI Paramters . . . . . . . . . . . . . . . 25 16. References. . . 24 10.3. SIP Option Tag . . . . . . . . . . . . . . . . . . . . . . 24 10.4. Media Feature Tag . 25 16.1. Normative References. . . . . . . . . . . . . . . . . . . 25 16.2. Informative References11. Security Considerations . . . . . . . . . . . . . . . . . . . 26 Authors' Addresses12. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . 27 Intellectual Property and Copyright Statements. 26 13. Requirements . . . . . . . . . 28 1. Introduction There are many environments for SIP deployments in. . . . . . . . . . . . . . . . 27 14. Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 14.1. Changes from 01 Version . . . . . . . . . . . . . . . . . 27 14.2. Changes from 00 Version . . . . . . . . . . . . . . . . . 27 15. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 27 16. References . . . . . . . . . . . . . . . . . . . . . . . . . . 28 16.1. Normative References . . . . . . . . . . . . . . . . . . . 28 16.2. Informative References . . . . . . . . . . . . . . . . . . 29 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 30 Intellectual Property and Copyright Statements . . . . . . . . . . 31 1. Introduction There are many environments for SIP  deployments in which the User Agent (UA) can form a connection to a Registrar or Proxy but in which the connections in the reverse direction to the UA are not possible. This can happen for several reasons. Connection to the UA can be blocked by a firewall device between the UA and the proxy or registrar, which will only allow new connections in the direction of the UA to the Proxy. Similarly there may be a NAT, which are only capable of allowing new connections from the private address side to the public side. This specification allows SIP registration when the UA is behind such a firewall or NAT. Most IP phones and personal computers get their network configurations dynamically via a protocol such as DHCP.DHCP (Dynamic Host Configuration Protocol). These systems typically do not have a useful name in DNS,the Domain Name System (DNS), and they definitely do not have a long-term, stable DNS name that is appropriate for binding to a certificate. It is impractical for them to have a certificate that can be used as a client-side TLS certificate for SIP. However, these systems can still form TLS connections to a proxy or registrar such that the UAwhich authenticates thewith a server certificate, and thecertificate. The server authenticatescan authenticate the UA using a shared secret in a digest challenge over that TLS connection. The key idea of this specification is that when a UA sends a REGISTER request, the proxy can later use this same network "flow"--whether this is a bidirectional stream of UDP datagrams, a TCP connection, be it UDP, TCP,or an analogous concept of another transport protocol, toprotocol--to forward any requests that need to go to this UA. For a UA to receive incoming requests, the UA has to connect to thea server. Since the server can't connect to the UA, the UA has to make sure that a connectionflow is always active. This requires the UA to detect when a connectionflow fails. Since, such detection takes time and leaves a window of opportunity for missed incoming requests, this mechanism allows the UA to use multiple connections, referred to as "flows",flows to the proxy or registrar and usingregistrar. This mechanism also uses a keep alive mechanism onover each flow so that the UA can detect when a flow has failed. 2. Conventions and Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 .. 2.1. Definitions Edge Proxy: An Edge Proxy is any proxy that is located topologically between the registering User Agent and the registrar. flow: A Flow is a network protocol layer connection(layer 4) association between two hosts that is represented by the network address and port number of both ends and by the protocol. For TCP, a flow is equivalent to a TCP andconnection. For UDP this would include thea flow is a bidirectional stream of datagrams between a single pair of IP addresses and ports of both ends and the protocol (TCP or UDP).peers. With TCP, a flow wouldoften havehas a one to one correspondence with a single file descriptor in the operating system. flow-id:reg-id: This refers to the value of a new header field parameter value for the contact header.Contact header field. When a UA registerregisters multiple times, each simultaneous registration gets a unique flow-idreg-id value. This does not refer to flow.instance-id: This specification uses the word instance-id to refer to the value of the "sip.instance" media feature tag in the Contact header field as defined in .field. This is a URNUniform Resource Name (URN) that uniquely identifies this specific UA instance. outbound-proxy-set A configured set of SIP URIs (Uniform Resource Identifiers) that represents each of the UA.outbound proxies (often Edge Proxies) with which the UA will attempt to maintain a direct flow. 3. Overview Several scenarios in which this technique is useful are discussed below, including the simple collocatedco-located registrar and proxy, a User Agent desiring multiple connections to a resource (for redundancy for example), and a system that uses Edge Proxies. 3.1. Summary of Mechanism The overall approach is fairly simple. Each UA has a unique instance-id (found in the GRUU)that stays the same for this UA even if the UA reboots or is power cycled. Each UA can register multiple times over different connections for the same AORSIP Address of Record (AOR) to achieve high reliability. Each registration includes the instance-id for the UA and a flow-idreg-id label that is different for each connection. UAsflow. The registrar can use STUN asthe keep alive mechanism to keep their flowinstance-id to the proxy or registrar alive. A UA can create more than one flow using multiplerecognize that two different registrations forboth reach the same AOR. The instance-id parameter is used by the proxy to identify which UA a flow is associated with.UA. The flow-id is used by the proxy andregistrar to tellcan use the difference betweenreg-id label to recognize that a UA re-registering and one thatis registering over an additional flow. The proxies keep track of the flows used for successful registrations.after a reboot. When a proxy goes to route a message to a UA for which it has a binding, it can use any one of the flows on which a successful registration has been completed. A failure on a particular flow can be tried again on an alternate flow. Proxies can determine which flows go to the same UA by looking atcomparing the instance-id. Proxies can tell that a flow replaces a previously abandoned flow by looking at the flow-id.reg-id. UAs use the STUN (Simple Traversal of UDP through NATs) protocol as the keep alive mechanism to keep their flow to the proxy or registrar alive. 3.2. Single Registrar and UA In this example thereexample, a single server is acting as both a registrar and proxy. +-----------+ | Registrar | | Proxy | +-----+-----+ | | +----+--+ | User | | Agent | +-------+ User Agents formingwhich form only a single connectionflow continue to register normally but include the instance-id as described in the GRUU  specification andSection 4.1. The UA can also addinclude a flow-id parameter to the Contact header field value. The flow-idreg-id parameter is used to allow the registrar to detect and avoid using invalid contacts when a UA reboots or reconnects after its old connection has failed for some reason. For clarity, here is an example. Bob's UA creates a new TCP flow to the registrar and sends the following REGISTER request. REGISTER sip:example.com SIP/2.0 Via: SIP/2.0/UDPSIP/2.0/TCP 192.0.2.1;branch=z9hG4bK-bad0ce-11-1036 Max-Forwards: 70 From: Bob <sip:email@example.com>;tag=d879h76 To: Bob <sip:firstname.lastname@example.org> Call-ID: 8921348ju72je840.204 CSeq: 1 REGISTER Supported: path Contact: <sip:email@example.com>; flow-id=1;reg-id=1; ;+sip.instance="<urn:uuid:00000000-0000-0000-0000-000A95A0E128>" Content-Length: 0 Note: Implementors often ask why the value of the sip.instance is inside angle brackets. This is a requirement of RFC 3840  which defines media feature tags in SIP. Feature tags which are strings are compared by case sensitive string comparison. To differentiate these tags from tokens (which are not case sensitive), case sensitive parameters such as the sip.instance media feature tag are placed inside angle brackets.The registrar challenges this registration to authenticate Bob. When the registrar adds an entry for this contact under the AOR for Bob, the registrar also keeps track of the connection over which it received this registration. The registrar saves the instance-id (as defined in )and flow-id (as defined in Section 9)reg-id along with the rest of the Contact header field. If the instance-id and flow-idreg-id are the same as a previous registration for the same AOR, the proxy uses the most recently created registration first. This allows a UA that has rebooted to replace its previous registration for each flow with minimal impact on overall system load. Later whenWhen Alice sends a request to Bob, his proxy selects the target set. The proxy forwards the request to elements in the target set based on the proxy's policy. The proxy looks at the thetarget set and uses the instance-id to understand that two targets both end up routing to the same UA. When the proxy goes to forward a request to a given target, it looks and finds the flows that received the registration. The proxy then forwards the request on that flow instead of trying to form a new flow to that contact. This allows the proxy to forward a request to a particular contact downover the same flow that didthe registration forUA used to register this AOR. If the proxy hadhas multiple flows that all wentgo to this UA, it wouldcan choose any one of registration bindings that it hadfor this AOR andthat hadhas the same instance-id as the selected UA. In general, if two registrations have the same flow-idreg-id and instance-id, the proxy wouldwill favor the most recently registered flow. This is so that if a UA reboots, the proxy will prefer to use the most recent flow that goes to this UA instead of trying one of the old flows which willwould presumably fail. 3.3. Multiple Connections from a User Agent There are various ways to deploy SIP to build a reliable and scaleablescalable system. This section discusses one such design that is possible with the mechanisms in this draft.specification. Other designs are also possible. In this example system, the logical proxy/registrar for the domain is running on two hosts that share the appropriate state and can both provide registrar and proxy functionality for the domain. The UA will form connections to two of the physical hosts that can perform the proxy/registrar function for the domain. Reliability is achieved by having the UA form two TCP connections to the domain. ScaleabilityScalability is achieved by using DNS SRV to load balance the primary connection across a set of machines that can service the primary connection and also using DNS SRV to load balance across a separate set of machines that can service the backup connection. The deployment here requires that DNS beis configured with anone entry that resolves to all the primary hosts and another entry that resolves to all the backup hosts. Designs having only one set were also consideredconsidered, but in this case,case there would have to be some way to ensure that the two connection did not accidentally resolve to the same host. Various approaches for this are possible but all probably require extensions to the SIP protocol so they were not included in this specification. This approach can work with the disadvantage that slightly more configuration of DNS is required. +-------------------+ | Domain | | Logical Proxy/Reg | | | |+-----+ +-----+| ||Host1| |Host2|| |+-----+ +-----+| +---\------------/--+ \ / \ / \ / \ / +------+ | User | | Agent| +------+ The UA is configured with a primary and backup registration URI. These URIs are configured into the UA through whatever the normal mechanism is to configure the proxy or registrar foraddress in the UA. TheyIf the AOR is Alice@example.com, the outbound-proxy-set might look something like "sip:primary.example.com;sip-stun" and "sip:backup.example.com;sip-stun" if the domain was example.com."sip: backup.example.com;sip-stun". The "sip-stun" tag indicates that they supporta SIP server supports STUN and SIP muxed over the same flow, as described later in this specification. Note that each of themURI in the outbound-proxy-set could resolve to several different physical hosts. The administrative domain that created these URIs MUSTshould ensure that the two URIs resolve to separate hosts. These URIs haveare handled according to normal SIP processing rules, so things like SRV can be used to do load balancing across a proxy farm. The User Agent would get a GRUU from the domain to use at its contact. The GRUU would refer to the domain, not host1 or host2. Regardless of which host received a request to GRUU, thedomain would needalso needs to ensure that thea request gotfor the UA sent to host1 or host2 andis then sent across the appropriate flow to the UA. The domain might choose to use the Path header (as described in the next section) approach to formstore this internal routing toinformation on host1 or host2. When a single server fails, all the UAs that have a registration withflow through it will detect thisa flow failure and try to reconnect. This can cause large loads on the server andserver. When large numbers of hosts reconnect nearly simultaneously, this is referred to as the avalanche restart problemproblem, and is further discussed in Section 18.104.22.168. The multiple flows to many servers help reduce the load caused by the avalanche restart. If a UA has multiple flows, and one of the servers fails, it can delay some significant time before trying to form a new connection to replace the flow to the server that failed. By spreading out the time used for all the UAs to reconnect to a server, the load on the server farm is reduced. 3.4. Edge Proxies Some SIP deployments use edge proxies such that the UA sends the REGISTER to an Edge Proxy that then forwards the REGISTER to the Registrar. The Edge Proxy includes a Path header  so that when the registrar later forwards a request to this UA, the request is routed through the Edge Proxy. There could be a NAT for FWor firewall between the UA and the Edge Proxy and there could also be one between the Edge Proxy and the Registrar. This second case typically happens when the Edge Proxy is in an enterprise the Registrar is located at a service provider.Proxy. +---------+ |Registrar| |Proxy | +---------+ / \ ----------------------------NAT/FW/ \ / \ +-----+ +-----+ |Edge1| |Edge2| +-----+ +-----+ \ / \ / ----------------------------NAT/FW \ / \ / +------+ |User | |Agent | +------+ These systems can use effectively the same mechanism as described in the previous sections but need to use the Path header. When the Edge Proxy receives a registration, it needs to create an identifier value that is unique to this flow (and not a subsequent flow with the same addresses) and put this identifier in the path header.Path header URI. This iscan be done by putting the value in the user portion of a loose route in the path header. If the registration succeeds, the Edge Proxy needs to map future requests that are routed to the identifier value that was put infrom the Path headerheader, to the associated flow. The term Edge Proxy is often used to refer to deployments where the theEdge Proxy is in the same administrative domain as the Registrar. However, in this specification we use the term to refer to any proxy between the UA and the Registrar. For example the Edge Proxy may be inside an enterprise that requires its use and the registrar could be a service provider with no relationship to the enterprise. Regardless if they are in the same administrative domain, this specification requires that Registrars and Edge proxies support the Path header mechanism in RFC 3327 .. 3.5. Keep Alive Technique A keep alive mechanism needs to detect bothfailure of a connection and changes to the NAT public mappingmapping, as well as keeping any NAT bindings refreshed. This specification uses STUN  over the same flow as the SIP traffic to perform the keep alive. A flow definition could change because a NAT device in the network path reboots and the resulting public IP address or port mapping for the UA changes. To detect this, requests are sent over the connectionsame flow that is being used for the SIP traffic. The proxy or registrar acts as a STUN server on the SIP signaling port. Note: The STUN mechanism is very robust and allows the detection of a changed IP address. Many other options were considered. It may also be possible to do thisdetect a changes flow with OPTIONS messages and rport; although thisthe rport parameter. Although the OPTIONS approach has the advantage of being backwards compatible, it also significantly increases the load on the proxy or registrar server. The TCP KEEP_ALIVE mechanism iswas not used because most operating systems do not allow the time to be set on a per connection basis. Linux, Solaris, OS X, and Windows all allow KEEP_ALIVEs to be turned on or off on a single socket using the SO_KEEPALIVE socket options but can not change the duration of the timer for an individual socket. The length of the timer typically defaults to 7200 seconds. The length of the timer can be changed to a smaller value by setting a kernel parameter but that affects all TCP connections on the host and thus is not appropriate to use. IfWhen the UA detects that the connectiona flow has failed or that the flow definition has changed, it MUSTthe UA needs to re-register and MUSTwill use the back-off mechanism described in Section 4 in orderto provide congestion relief when a large number of agents simultaneously reboot. 4. User Agent Mechanisms The4.1. Instance ID Creation Each UA behavior is divided up into sections. The first describes what a client must do when forming a new connection,MUST have an Instance Identifer URN that uniquely identifies the second when detecting failuredevice. Usage of a connection,URN provides a persistent and unique name for the third on failure recovery. 4.1. Forming Flows When a User Agent initiates a dialog, it MUST provide a Contact URI which has GRUU properties if it is in possession ofUA instance. It also provides an appropriate GRUU. If it can not provide a GRUU, it needseasy way to followguarantee uniqueness within the procedure specified in Section 4.1.1. UAs are configured with one or more SIP URIs representingAOR. This URN MUST be persitant across power cylces of the default outbound proxies with which to register.device. A UA MUST support sets with at least two outbound proxy URIs (primary and backup) andSHOULD support sets with up to four URIs. For each outbound proxy URI in the set, the UA MUST senduse a REGISTER in the normal way using this URI as the default outbound proxy. Forming the route setUUID URN . The UUID URN allows for the request is discussed in  but typically results in sending the REGISTER with the Route header field containingnon- centralized computation of a loose route to the outbound proxy URI. The UA MUST include the instance-idURN based on time, unique names (such as described in . The UA MUST also adda distinct flow-id parameter to the Contact header field. The UA SHOULD useMAC address), or a flow-id value of 1 for therandom number generator. A device like a soft-phone, when first URIinstalled, can generate a UUID  and then save this in persistent storage for all future use. For a device such as a hard phone, which will only ever have a single SIP UA present, the set,UUID can include the MAC address and a flow-idbe generated at any time because it is guaranteed that no other UUID is being generated at the same time on that physical device. This means the value of 2 forthe second, and so on. Each onetime component of these registrations will form a new flow from the UA tothe proxy. The flow-id sequence does not have toUUID can be exactly 1,2,3 but it does havearbitrarily selected to be exactlyany time less than the same flow-id sequence eachtime when the device power cycles or reboots so thatwas manufactured. A time of 0 (as shown in the flow-id values will collide withexample in Section 3.2) is perfectly legal as long as the previously used flow-id values anddevice knows no other UUIDs were generated at this time. If a URN scheme other than UUID is used, the proxyURN MUST be selected such that the instance can realizebe certain that no other instance registering against the older registrations are probably not useful. Ifsame AOR would choose the 200 response to a REGISTER containssame URN value. An example of a Service Route header field value as defined in RFC 3608 , then whichever proxy sendsURN that would not meet the 200 response last will affect where all future requests fromrequirements of this UA are directed. Note thatspecification is the national bibliographic number . Since there is no clear relationship between a SIP UA needs to honor 503 responses to registrations as described in RFC 3261instance and RFC 3263 . In particular, implementors should note that when receivinga 503 withURN in this namespace, there is no way a Retry-After, theselection of a value can be performed that guarantees that another UA should waitinstance doesn't choose the indicated amount of timesame value. The UA SHOULD include a "sip.instance" media feature tag as a UA characteristic  in requests and retryresponses. As described in , this media feature tag will be encoded in the registration. A Retry-AfterContact header field as the "+sip.instance" Contact header field parameter. The value of 0 is valid and indicates thethis parameter MUST be a URN . One case where a UA should retry the REGISTER immediately. Implementations needmay not want to ensure that when retrying the REGISTER they redoinclude the DNS resolution process such that if multiple hosts are reachable fromURN in the URI, theresip.instance media feature tag is a chancewhen it is making an anoymous request or some other privacy concern requires that the UA not reveal its identity. RFC 3840  defines equality rules for callee capabilities parameters, and according to that specification, the "sip.instance" media feature tag will select an alternate host frombe compared by case- sensitive string comparison. This means that the oneURN will be encapsulated by angle brackets ("<" and ">") when it choseis placed within the previous timequoted string value of the URI was resolved. Note on Instance-ID Selection:+sip.instance Contact header field parameter. The instance-id needscase-sensitive matching rules apply only to be a URN but there are many ways one can be generated. A particularly simple way for both "hard" phones and "soft" phones is to use a UUID asthe generic usages defined in . A device like a soft-phone, when first installed, should generate a UUID RFC 3840  and then save thisin persistent storage for all future use. For a device such as a hard phone, which will only ever have a single SIP UA present,the UUID can be generated at any time because itcaller preferences specification . When the instance ID is guaranteed that no other UUIDused in this specification, it is being generated at the same time on that physical device. This meanseffectively "extracted" from the value ofin the time component of"sip.instance" media feature tag. Thus, equality comparisons are performed using the UUID can be arbitrarily selectedrules for URN equality that are specific to be any time less than the time when the device was manufactured. A time of 0 (as shown inthe examplescheme in Section 3.2) is perfectly legal as long asthe device knows no other UUIDs were generated at this time. 4.1.1. Request without GRUUURN. If the UAelement performing the comparisons does not have a GRUU, it MUST sendunderstand the request with a Contact header field containing a +sip.instance media feature parameter, andURN scheme, it MUST includeperforms the "pin-route" option-tagcomparisons using the lexical equality rules defined in both a Proxy-Require and a Require header field value. A User Agent compliant with this specification MUST NOT initiate a dialog with an INVITE without a GRUURFC 2141 . Lexical equality may result in the Contact header field. (At the time of this writingtwo URNs being considered unequal when they are actually equal. In this is allowedspecific usage of URNs, the only for dialogs initiated withelement which provides the SUBSCRIBE method.) This mechanism without a GRUUURN is not reliable ifthe SIP UA instance identified by that URN. As a result, the UA instance SHOULD provide lexically equivalent URNs in each registration it generates. This is likely to be normal behavior in any ofcase; clients are not likely to modify the proxies onvalue of the path failinstance ID so that it SHOULD not be used for long lived subscriptions. Onceremains functionally equivalent yet lexigraphically different to previous registrations. 4.2. Initial Registrations UAs are configured with one or more SIP URIs representing the default outbound-proxy-set. The specification assumes the set is determined via configuration but future specifications may define other mechanisms such as using DNS to discover this set. How the UA is configured is outside the scope of this specification. However, a UA acquires an appropriate GRUU, it should terminate these subscriptionsMUST support sets with at least two outbound proxy URIs (primary and re-subscribe usingbackup) and SHOULD support sets with up to four URIs. For each outbound proxy URI in the set, the normal GRUU based approach. 4.2. Detecting Flow Failure TheUA needs to detect ifMUST send a given flow has failed, and if it has failed, followREGISTER in the proceduresnormal way using this URI as the default outbound proxy. Forming the route set for the request is outside the scope of this document, but typically results in Section 4.1 to form a new flow to replacesending the failed one. User AgentsREGISTER such that form flows MUST check ifthe configured URI they are connectingtopmost Route header field contains a loose route to hasthe "sip-stun" tag (definedoutbound proxy URI. Other issues related to outbound route construction are discussed in . Registration requests, other than those described in Section 10) and, if4.2.1, MUST include the instance-id media feature tag is present, then the UA needs to periodically perform STUN as specified in Section 4.1. These ordinary registration requests over the flow. The time between STUN requests when using UDP SHOULD beMUST also add a random number between 24 and 29 seconds while for other transport protocols it SHOULD bedistinct reg-id parameter to the Contact header field. Each one of these registrations will form a random number between 95 and 120 seconds.new flow from the UA to the proxy. The times MAYreg-id sequence does not have to be configurable. Note on selection ofsequential but MUST be exactly the same reg-id sequence each time values: For UDP,the upper bound of 29 seconds was selected so that multiple STUN packets would be sent before 30 seconds based on information that some NATs had UDP timeouts as low as 30 seconds. The 24 second lower bound was selecteddevice power cycles or reboots so that after 10 minutes the jitter this introduce would have unsyncronized the STUN requests from different devices to evenly spread the load onthe servers. For TCP,reg-id values will collide with the 120 seconds was chosen based onpreviously used reg-id values. This is so the idea that for a good user experience, failures would be detected in this time and a new connection set up. Operatorsproxy can realize that wish to change the relationship between load on servers andthe expected time that a user may not receive inbound communications willolder registrations are probably adjust this time widely.not useful. The 95 seconds lower bound was chosen soUAC MUST indicate that it supports the jitter introduced would resultPath header  mechanism, by including the 'path' option-tag in a relatively even load on the servers after 30 minutes. IfSupported header field value in its REGISTER requests. Other than optionally examining the mapped addressPath vector in the STUN response changes, the UA must treatresponse, this as a failure on the flow. Any time a SIP messageis sent and the proxy does not respond, thisall that is also considered a failure,required of the flow is discarded andUAC to support Path. The UAC MAY examine successful registrations for the procedurespresence of an 'outbound' option-tag in Section 4.3 are followed to forma new flow. 4.3. Flow Failure Recovery When a flow to a particular URI inSupported header field value. Presence of this option-tag indicates that the proxy set fails,registrar is compliant with this specification. Note that the UA needs to form a new flowhonor 503 responses to replace it. The new flow MUST have the same flow-id as the flow it is replacing. This is done in much the same wayregistrations as the flows aredescribed as being formedin Section 4.1; however, if there isRFC 3261 and RFC 3263 . In particular, implementors should note that when receiving a failure in forming this flow,503 response with a Retry-After header field, the UA needs toshould wait a certainthe indicated amount of time before retrying to form a flow to this particular URI inand retry the proxy set. The time to waitregistration. A Retry-After header field value of 0 is computed invalid and indicates the following way. If all ofUA should retry the flowsREGISTER immediately. Implementations need to every URI inensure that when retrying the proxy set have failed,REGISTER they revisit the base time is set to 30 seconds; otherwise, inDNS resolution results such that the case where at least one ofUA can select an alternate host from the flows has not failed,one chosen the base time is set to 90 seconds. The waitprevious time is computed by takingthe base time multipliedURI was resolved. 4.2.1. Registration by two to power ofOther Instances A User Agent MUST NOT include an instance-id or reg-id in the numberContact header field of consecutivea registration failuresif the registering UA is not the same instance as the UA referred to that URI upby the target Contact header field. (This practice is occasionally used to install forwarding policy into registrars.) Note that a maximum of 1800 seconds. wait-time = min( 1800, (base-time * (2 ^ consecutive-failures))) These three times SHOULD be configurableUAC also MUST NOT include an instance-id or reg-id parameter in the UA. The three times are the max-time witha defaultrequest to deregister all Contacts (a single Contact header field value with the value of 1800 seconds,"*"). 4.3. Sending Requests As described in Section 4.1, all requests need to include the base-time-all- fail withinstance-id media feature tag unless privacy concerns require otherwise. 4.3.1. Selecting the First Hop When an UA is about to send a default of 30 seconds, andrequest, it first performs normal processing to select the base-time-not-failed withnext hop URI. The UA can use a defaultvariety of 60 seconds. For example iftechniques to compute the base time was 30 seconds,route set and there had been three failures, thenaccordingly the wait time would be min(1800,30*(2^3)) or 240 seconds. The delay time is computed by selecting a uniform random time between 50 and 100 percentnext hop URI. Discussion of these techniques is outside the the wait time.scope of this document but could include mechanisms specified in RFC 3608  (Service Route) and . 4.3.2. Forming Flows The UA MUST wait for the value ofperforms normal DNS resolution on the delay time before trying another registrationnext hop URI (as described in RFC 3263 ) to formfind a new flow for that URI. To be explicitly clear on the boundary conditions: whenprotocol, IP address, and port. For non TLS protocols, if the UA boots it immediately trieshas an existing flow to register. Ifthis fails and no registration on other flows had succeeded, the first retry would happen somewhere between 30IP address, and 60 seconds afterport with the failure ofcorrect protocol, then the first registration request. IfUA MUST use the number of consecutive-failures is large enough thatexisting connection. For TLS protocols, the maximum of 1800 secondsexisting flow is being reached, thenonly used if, in addition to matching the UA keep trying forever with a random time between 900IP address, port, and 1800 seconds betweenprotocol, the attempts. SIP dialogs can be used forhost production in the next hop URI MUST match one or more "usages". For example, a session created with INVITE (a session "usage") and a subscription (a subscription "usage") can share a dialog. On failureof a flow, a User Agent might wish to resynchronizingthe state of any active usages on any dialogs usingURIs contained in the flow. For example,subjectAltName in the User Agent could sendpeer certificate. If the UA cannot use one of the existing flows, then it SHOULD form a new subscription for each subscription usage and an INVITE with replacesflow by sending a datagram or opening a new connection to the next hop, as appropriate for each session usage. Note thatthe transport protocol. 4.4. Detecting Flow Failure The UA needs to detect when a specific flow was obtained viafails. If a REGISTER request, the flow might be used by many dialogs and dialog usages. Aflow obtained via another request (e.g. a SUBSCRIBE request) onlyhas usages from a single dialog. The only reasonfailed, the UA follows the procedures in Section 4.2 to do this is thatform a message may have been lost while thenew flow was being reestablished. The GRUU will ensure that any future messages are still deliveredto replace the failed one. The UA even if it does not re- subscribe, re-INVITE, or otherwise refresh the usage. Deployments needproactively tries to carefully consider the implications of these sortsdetect failure by periodically sending keep alive messages using one of operations. This approach only helpsthe techniques described in this section. The time between keep alive requests when using UDP based transports SHOULD be a very narrow corner caserandom number between 24 and 29 seconds while for TCP based transports it will causeSHOULD be a huge loadrandom number between 95 and 120 seconds. These times MAY be configurable. o Note on the system if a single proxy crashes. In some deployments, this will cause more harm than good. 4.4. Registration by Other Instances A User Agent MUST NOT include an instance-id or flow-id in the Contact header fieldselection of a registration if the registering UA is nottime values: For UDP, the same instanceupper bound of 29 seconds was selected so that multiple STUN packets could be sent before 30 seconds based on information that many NATs have UDP timeouts as low as 30 seconds. The 24 second lower bound was selected so that after 10 minutes the UA referred tojitter introduced by different timers will the target Contact header field. (This practice is occasionally usedkeep alive requests unsynchronized to install forwarding policy into registrars.) 5. Registrar Mechanisms 5.1. Processing Register Requests Registrars which implement this specification, MUST supportevenly spread the Path header mechanism and processes REGISTER requests as described in Section 10 of RFC 3261 withload on the following change. Any timeservers. For TCP, the registrar checks if a new contact matches an existing contact120 seconds was chosen based on the idea that for a good user experience, failures should be detected in this amount of time and a new connection set up. Operators that wish to change the location database, itrelationship between load on servers and the expected time that a user may not receive inbound communications will probably adjust this time. The 95 seconds lower bound was chosen so that the jitter introduced will result in a relatively even load on the servers after 30 minutes. 4.4.1. Keep Alive with STUN User Agents that form flows MUST alsocheck and seeif boththe instance-id and flow-id match. If they do not both match, thenconfigured URI they are not the same contact. Additionally, ifconnecting to has the both"sip-stun" URI parameter (defined in Section 10). If the instance-id and flow-id are present and do match, then itparameter is considered a match regardless of if the value ofpresent, the contact header field value matches. The registrar MUST be preparedUA needs to receive some registrations that use instance-id and flow-id and some that do not, simultaneously forperiodically perform keep alive checks by sending a STUN  Binding Requests over the same AOR. In addition toflow. If the normal information storedXOR-MAPPED-ADDRESS in the binding record, some additional informationSTUN Binding Response changes, the UA MUST be stored for any registration that containstreat this event as a flow-id header parameter infailure on the Contact header field value. The registrarflow. 4.4.2. Keep Alive with Double CRLF User Agents that form flows MUST store enough informationcheck if the configured URI they are connecting to uniquely identifyhas the network flow over which"crlf-ping" URI parameter (defined in Section 10). If the request arrived. For common operating systems with TCP, this would typically just beparameter is present, the file descriptor. For common operating systems with UDP this would typically beUA needs to send keep alive requests by sending a CRLF over the file descriptor forflow. If the local socket that receivedUA does not receive any data back over the request,flow within 7 seconds of sending the local interface, andCRLF, then it MUST consider the IP address and port numberlack of response to be a flow failure. 4.5. Flow Recovery When a flow to a particular URI in the remote sideoutbound-proxy-set fails, the UA needs to form a new flow to replace the old flow and replace any registrations that were previously sent the request. The registrarover this flow. Each new registration MUST also store all the Contact header field information includinghave the flow-id and instance-id and SHOULD also storesame reg-id as the time at whichregistration it replaces. This is done in much the binding was last updated. Ifsame way as forming a Path header fieldbrand new flow as described in Section 4.3.2; however, if there is present RFC 3327  requiresa failure in forming this to be stored and the registrar MUST store the Path header field value withflow, the binding record. AnyUA needs to wait a certain amount of time before retrying to form a messages is forwarded over theflow that created this binding,to this stored Path header field value will be usedparticular next hop. The time to routewait is computed in the message.following way. If all of the registrar receives a re-registration, it MUST updateflows to every URI in the information that uniquely identifiesproxy set have failed, the network flow over whichbase time is set to 30 seconds; otherwise, in the request arrived and SHOULD updatecase where at least one of the timeflows has not failed, the binding was last updated.base time is set to 90 seconds. The REGISTRAR MAY be configured with local policywait time is computed by taking two raised to reject any registrations that do not includepower of the instance-idnumber of consecutive registration failures for that URI, and flow-id to eliminate the amplification attack described in . 5.2. Forwarding Requests When a proxy usesmultiplying this by the location service to lookbase time, up a registration binding and then proxies a requestto a particular contact, it selects a contact to use normally, with a few additional rules: o The proxy MUST NOT populatemaximum of 1800 seconds. wait-time = min( 1800, (base-time * (2 ^ consecutive-failures))) These three times MAY be configurable in the target set with more than one contact withUA. The three times are the same AOR and instance-id at a time. If a request for a particular AOR and instance-id failsmax-time with a 410 response, the proxy SHOULD replacedefault of 1800 seconds, the failed branch with another targetbase-time-all-fail with the same AOR and instance-id, buta different flow-id. o If two bindings have the same instance-iddefault of 30 seconds, and flow-id, it SHOULD prefer the contact that was most recently updated. Note that if the request URI is a GRUU,the proxy will only select contactsbase-time-not-failed with a default of 60 seconds. For example if the AORbase time was 30 seconds, and instance-id associated withthere had been three failures, then the GRUU.wait time would be min(1800,30*(2^3)) or 240 seconds. The rules above still apply to a GRUU. This allows a request routed todelay time is computed by selecting a GRUU to first try oneuniform random time between 50 and 100 percent of the flowswait time. The UA MUST wait for the value of the delay time before trying another registration to form a UA, then if that fails, try anothernew flow tofor that URI. To be explicitly clear on the boundary conditions: when the sameUA instance. The proxy uses normal forwarding rules looking atboots it immediately tries to register. If this fails and no registration on other flows succeed, the Routefirst retry happens somewhere between 30 and 60 seconds after the failure of the message and any valuesfirst registration request. If the number of consecutive-failures is large enough that the maximum of 1800 seconds is reached, the stored Path header field value inUA will keep trying forever with a random time between 900 and 1800 seconds between the attempts. 5. Edge Proxy Mechanisms 5.1. Processing Register Requests When an Edge Proxy receives a registration binding to decide how to forward therequest and populate the Route headerwith a sip.instance media feature tag in the request. Additionally, when the proxy forwardsContact header field, it MUST form a requestflow identifier token that is unique to this network flow. The Edge Proxy MUST insert this token into a binding that containsURI referring to this proxy and place this URI into a flow-id,Path header field as described in RFC 3327 . The token MAY be placed in the proxy MUST senduserpart of the request overURI. 5.2. Generating Flow Tokens A trivial but impractical way to satisfy the same networkflow that was saved with the binding. This means that for TCP, the request MUST be sent on the same TCP socket that received the REGISTER request. For UDP, the request MUST be sent from the same local IP address and port over which the registration was received to the same IP address and port from which the REGISTER was received. If a proxy or registrar receives an indication from the network that indicates that no future messages on this flow will work, then it MUST remove all the bindings that use that flow (regardless of AOR). Examples of this are a TCP socket closing or receiving a destination unreachable ICMP error on a UDP flow. Similarly, if a proxy closes a file descriptor, it MUST remove all the bindings that use that flow. 6. Edge Proxy Mechanisms 6.1. Processing Register Requests When an Edge Proxy receives a registration request it MUST form a flow identifier token that is unique to this network flow and use thistoken as the user part of the URI that this proxy inserts into the Path header. Edge proxies MUST use a Path header. A trivial way to satisfy thisrequirement Section 5.1 involves storing a mapping between an incrementing counter and the connection information; however this would require the Edge Proxy to keep an impractical amount of state. It is unclear when this state could be removed and the approach would have problems if the proxy crashed and lost the value of the counter. Two stateless examples are provided below. A proxy can use any algorithm it wants as long as the flow token is unique to a flow, the flow can be recovered from the token, and the token can not be modified by attackers. Algorithm 1: The proxy generates a flow token for connection-oriented transports by concatenating the file descriptor (or equivalent) with the NTP time the connection was created, and base64 encoding the result. This results in an approximately 16 octet identifier. The proxy generates a flow token for UDP by concatenating the file descriptor and the remote IP address and port, then base64 encoding the result. This algorithm MUST NOT be used unless all messages between the Edge proxy and Registrar use a SIPS protected transport. If the SIPS level of integrity protection is not available, an attacker can hijack another user's calls. Algorithm 2: When the proxy boots it selects a 20 byte crypto random key called K that only the Edge Proxy knows. A byte array, called S, is formed that contains the following information about the flow the request was received on: an enumeration indicating the protocol, the local IP address and port, the remote IP address and port. The HMAC of S is computed using the key K and the HMAC- SHA1-80 algorithm, as defined in .. The concatenation of the HMAC and S are base64 encoded, as defined in ,, and used as the flow identifier. WithWhen using IPv4 address,addresses, this will result in a 32 octet identifier. Algorithm 1 MUST NOT be used unless5.3. Forwarding Requests When the REGISTER request is overEdge Proxy receives a SIPS protected transport. If the SIPS level of integrity protection is not available, an attacker can hijack another user's calls. 6.2. Forwarding Requests When the Edge Proxy receives a requestrequest, it applies normal routing procedures with the addition that it is routedfollowing addition. If the top-most Route header refers to the Edge Proxy and contains a URI with avalid flow identifier token thatcreated by this proxy created, thenproxy, the proxy MUST forward the request over the flow that received the REGISTER request that caused the flow identifier token to be created. For connection- orientedconnection-oriented transports, if the flow no longer exists the proxy SHOULD send a 410 response to the request. The advantage to a stateless approach to managing the flow information is that there is no state on the edge proxy that requires clean up or that has to be synchronized with the registrar. Proxies which used one of the two algorithms described in this document to form a flow token follow the procedures below to determine the correct flow. Algorithm 1: The proxy base64 decodes the user part of the Route header. For TCP, if a connection specified by the file descriptor is present and the creation time of the file descriptor matches the creation time encoded in the Route header, the proxy forwards the request over that connection. For UDP, the proxy forwards the request from the encoded file descriptor to the source IP address and port. Algorithm 2: To decode the flow token take the flow identifier in the user portion of the URI, and base64 decode it, then verityverify the HMAC is correct by recomputing the HMAC and checking it matches. If the HMAC is not correct, the proxy SHOULD send a 403 response. If the HMAC was correct then the proxy should forward the request on the flow that was specified by the information in the flow identifier. If this flow no longer exists, the proxy SHOULD send a 410 response to the request. Note that techniques to ensure that mid-dialog requests are routed over an existing flow are out of scope and therefore not part of this specification. However, an approach such as having the Edge Proxies MUSTProxy Record-Route sowith a flow token is one way to ensure that mid-dialog requests stillare routed over the correct flow. 7.6. Registrar and Location Server Mechanisms for All Servers 7.1. STUN6.1. Processing TODO:Register Requests This section needs to be brought into sync withspecification updates the STUN draft and check there are not issues for SIPdefinition of a binding in RFC 3261  Section 10 and STUN on TCP or UDP connections. A SIP device that receives SIP messages directly fromRFC 3327  Section 5.3. When no instance-id is present in a UA needs to behave as specifiedContact header field value in this section. Such devices would generally includea Registrar andREGISTER request, the corresponding binding is still between an Edge Proxy, as they both receive register requests directly from a UA. IfAOR and the server receives SIP requests onURI from that Contact header field value. When an instance-id is present in a given interface and port, it MUST also provideContact header field value in a limited version of a STUN server onREGISTER request, the same interfacecorresponding binding is between an AOR and port. Specifically it MUST be capablethe combination of receivinginstance-id and responding to STUN requests with the exception that it does not need to support STUN requestsreg-id. For a binding with an instance-id, the changed port or changed address flag set. This allowsregistrar still stores the STUN server to runContact header field value URI with only one port and IP address. It is easy to distinguish STUN and SIP packets becausethe first octet of a STUN packet has a value of 0 or 1 whilebinding, but does not consider the first octet of a SIP message is never a 0 or 1. When aContact URI for comparison purposes (the Contact URI is created that refers to a SIP device that supports STUN as described in this section,not part of the URI parameter "sip-stun", as defined in Section 10"key" for the binding). The registrar MUST be addedprepared to receive, simultaneously for the URI. This allows a UA to inspectsame AOR, some registrations that use instance-id and reg-id and some that do not. Registrars which implement this specification, MUST support the URI to decide if it should attempt to send STUN requestsPath header mechanism . In addition to this location. The sip-stun tag would typically show up inthe URInormal information stored in the Route header field value of a REGISTER request and would notbinding record, some additional information MUST be in the request URI. 7.2. Pin-Route Processing A sip device receivesstored for any registration that contains a request with the "pin-route" options tag set in the Proxy-Requirereg-id header field orparameter in the RequireContact header field needs to follow the procedures in this section. A UAS that receives a request with the "pin-route" option tag in the Require headervalue. The registrar MUST either rejectstore enough information to uniquely identify the network flow over which the request if pin-route is not supported, or if pin-route is supported byarrived. For common operating systems with TCP, this UAS, the UAS MUST ensure that any message send inwould typically just be the dialog formed byfile descriptor. For common operating systems with UDP this request is sent onwould typically be the same flow asfile descriptor for the initial request. This specification does not mandatelocal socket that all UAs support this option but certain UAs, such asreceived the NOTIFIER inrequest, the configuration framework, will want to support this so they can form subscriptions with devices that do not have a GRUU. A proxylocal interface, and the IP address and port number of the remote side that receives a request withsent the "pin-route" option tag inrequest. The registrar MUST also store all the Proxy-RequireContact header MUST addfield information including the reg-id and instance-id parameters and SHOULD also store the time at which the binding was last updated. If a record-routePath header field value that resolvesis present, RFC 3327  requires the registrar to store this proxy andinformation as well. If the registrar receives a re- registration, it MUST ensureupdate the information that any future requests or responses in this dialog are forwarded onuniquely identifies the samenetwork flow asover which the original request.request arrived and SHOULD update the time the binding was last updated. The suggested way to do this is to formRegistrar MUST include the 'outbound' option-tag in a flow identifier tokenSupported header field value in the same wayits responses to REGISTER requests. The Registrar MAY be configured with local policy to reject any registrations that an Edge Proxy would form this fordo not include the Path headerinstance-id and insert this flow identifier token inreg-id to eliminate the user portion ofamplification attack described in . Note that the URI usedrequirements in this section applies to both REGISTER requests received from an Edge Proxy as well as requests received directly from the record route header field value. 8. Example Message Flow The following call flow showsUAC. 6.2. Forwarding Requests When a proxy uses the location service to look up a basicregistration binding and an incoming call. Part way throughthen proxies a request to a particular contact, it selects a contact to use normally, with a few additional rules: o The proxy MUST NOT populate the call,target set with more than one contact with the flow tosame AOR and instance-id at a time. If a request for a particular AOR and instance-id fails with a 410 response, the Primaryproxy is lost. The BYE message forSHOULD replace the callfailed branch with another target (if one is rerouted toavailable) with the callee viasame AOR and instance-id, but a different reg-id. o If two bindings have the Backup proxy. When connectivity tosame instance-id and reg-id, the primaryproxy is established,SHOULD prefer the Callee registers againcontact that was most recently updated. The proxy uses normal forwarding rules looking at the Route of the message and the value of any stored Path header field vector in the registration binding to replacedecide how to forward the lost flow as shownrequest and populate the Route header in the request. Additionally, when the proxy forwards a request to a binding that contains a reg-id, the proxy MUST send the request over the same network flow that was saved with the binding. This means that for TCP, the request MUST be sent on the same TCP socket that received the REGISTER request. For UDP, the request MUST be sent from the same local IP address and port over which the registration was received, to the same IP address and port from which the REGISTER was received. If a proxy or registrar receives information from the network that indicates that no future messages will be delivered on a specific flow, then the proxy MUST invalidate all the bindings that use that flow (regardless of AOR). Examples of this are a TCP socket closing or receiving a destination unreachable ICMP error on a UDP flow. Similarly, if a proxy closes a file descriptor, it MUST invalidate all the bindings with flows that use that file descriptor. 7. Mechanisms for All Servers (Proxys, Registars, UAS) A SIP device that receives SIP messages directly from a UA needs to behave as specified in this section. Such devices would generally include a Registrar and an Edge Proxy, as they both receive register requests directly from a UA. 7.1. STUN Processing This document defines a new STUN usage for inband connectivity checks. The only STUN messages required by this usage are Binding Requests, Binding Responses, and Error Responses. The UAC sends Binding Requests over the same UDP flow, TCP connection, or TLS channel used for sending SIP messages, once a SIP registration has been successfully processed on that flow. These Binding Requests do not require any STUN attributes. The UAS responds to a valid Binding Request with a Binding Response which MUST include the XOR-MAPPED- ADDRESS attribute. After a successful STUN response is received over TCP or TLS over TCP, the underlying TCP connection is left in the active state. If the server receives SIP requests on a given interface and port, it MUST also provide a limited version of a STUN server on the same interface and port. Specifically it MUST be capable of receiving and responding to STUN Binding Requests. It is easy to distinguish STUN and SIP packets because the first octet of a STUN packet has a value of 0 or 1 while the first octet of a SIP message is never a 0 or 1. When a URI is created that refers to a SIP device that supports STUN as described in this section, the URI parameter "sip-stun", as defined in Section 10 MUST be added to the URI. This allows a UA to inspect the URI to decide if it should attempt to send STUN requests to this location. The sip-stun tag typically would be present in the URI in the Route header field value of a REGISTER request and not be in the Request URI. 7.2. Double CRLF Processing If the SIP server is acting as the TCP client and initiated the TCP connection (meaning that this host did the active open), then the SIP server MUST NOT perform any of the processing in this section. The following only applies when the SIP server is acting as the TCP server (meaning that this host did the passive open). When the server receives a CRLF before the start line of a message on a flow, it MUST send some data back on that same flow within 3 seconds. If no message is actively being sent, it SHOULD send back a CRLF after waiting at least 1 second. The reason for waiting at least 1 second is that if the other end has an incorrect implementation and incorrectly echoes the CRLF, this will stop the flow from going into a live-lock state. 8. Example Message Flow The following call flow shows a basic registration and an incoming call. Part way through the call, the flow to the Primary proxy is lost. The BYE message for the call is rerouted to the callee via the Backup proxy. When connectivity to the primary proxy is established, the Callee registers again to replace the lost flow as shown in message 15. [-----example.com domain -------------------] Caller Backup Primary Callee | | | (1) REGISTER | | | |<-----------------| | | |(2) 200 OK | | | |----------------->| | | | (3) REGISTER | | |<------------------------------------| | |(4) 200 OK | | | |------------------------------------>| |(5) INVITE | | | |----------------------------------->| | | | |(6) INVITE | | | |----------------->| | | | (7) 200 OK | | | |<-----------------| | | (8) 200 OK | | |<-----------------------------------| | |(9) ACK | | | |----------------------------------->| | | | |(10) ACK | | | |----------------->| | | CRASH X | |(11) BYE | | |---------------->| | | | (12) BYE | | |------------------------------------>| | | (13) 200 OK | | |<------------------------------------| | (14) 200 OK | | |<----------------| REBOOT | | | | | (15) REGISTER | | | |<-----------------| | | |(16) 200 OK | | | |----------------->| This call flow assumes that the Callee has been configured with a proxy set that consists of "sip:primary.example.com;lr;sip-stun" and "sip:backup.example.com;lr;sip-stun". The Callee REGISTER in message (1) looks like: REGISTER sip:example.com SIP/2.0 Via: SIP/2.0/UDP 10.0.1.1;branch=z9hG4bKnashds7 Max-Forwards: 70 From: Callee <sip:firstname.lastname@example.org>;tag=a73kszlfl To: Callee <sip:email@example.com> Call-ID: 1j9FpLxk3uxtm8tn@10.0.1.1 CSeq: 1 REGISTER Supported: path Route: <sip:primary.example.com;lr;sip-stun> Contact: <sip:firstname.lastname@example.org> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;flow-id=1;reg-id=1 Content-Length: 0 In the message, note that the Route is set and the Contact header field value contains the instance-id and flow-id.reg-id. The response to the REGISTER in message (2) would look like: SIP/2.0 200 OK Via: SIP/2.0/UDP 10.0.1.1;branch=z9hG4bKnashds7 From: Callee <sip:email@example.com>;tag=a73kszlfl To: Callee <sip:firstname.lastname@example.org> ;tag=b88sn Call-ID: 1j9FpLxk3uxtm8tn@10.0.1.1 CSeq: 1 REGISTER Contact: <sip:email@example.com> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;flow-id=1 ;expires=3600 Content-Length: 0 The second registration in message 3 and 4 are similar other than the Call-ID has changed, the flow-id is 2, and the route is set to the backup instead of the primary. They look like: REGISTER sip:example.com SIP/2.0 Via: SIP/2.0/UDP 10.0.1.1;branch=z9hG4bKnashds7 Max-Forwards: 70 From: Callee <sip:firstname.lastname@example.org>;tag=a73kszlfl To: Callee <sip:email@example.com> Call-ID: 1j9FpLxk3uxtm8tnfirstname.lastname@example.org CSeq: 1 REGISTER Route: <sip:backup.example.com;lr;sip-stun> Contact: <sip:email@example.com> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;flow-id=2 Content-Length: 0 SIP/2.0 200 OK Via: SIP/2.0/UDP 10.0.1.1;branch=z9hG4bKnashds7 From: Callee <sip:firstname.lastname@example.org>;tag=a73kszlfl To: Callee <sip:email@example.com> ;tag=b88sn Call-ID: 1j9FpLxk3uxtm8tnfirstname.lastname@example.org CSeq: 1 REGISTER Contact: <sip:email@example.com> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;flow-id=1 ;expires=3600 Contact: <sip:firstname.lastname@example.org> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;flow-id=2 ;expires=3600 Content-Length: 0 The messages in the call flow are very normal. The only interesting thing to note is that the INVITE in message 6 will have a: Record-Route: <sip:example.com;lr> Message 11 seems seams strange in that it goes to the backup instead of the primary. The Caller actually sends the message to the domain of the callee based on the GRUU that the callee provided in their Contact header field value when the dialog was formed and the domain selected a host (primary or backup) that was currently available. How the domain does this is an implementation detail up to the domain.<sip:email@example.com>;tag=a73kszlfl To: Callee <sip:firstname.lastname@example.org> ;tag=b88sn Call-ID: 1j9FpLxk3uxtm8tn@10.0.1.1 CSeq: 1 REGISTER Supported: outbound Contact: <sip:email@example.com> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;reg-id=1 ;expires=3600 Content-Length: 0 The registrationssecond registration in message 153 and 164 are the same as message 1 and 2similar other than the Call-ID has changed. 9. Grammar This specification defines a new Contact header field parameter, flow-id. The grammar for DIGIT and EQUAL is obtained from RFC 3261 . contact-params = c-p-q / c-p-expires / c-p-flow / contact-extension c-p-flow = "flow-id" EQUAL 1*DIGIT The value of the flow-id MUST NOT be 0 and MUST be less than 2**31. 10. IANA Considerations This specification defines a new Contact header field parameter called flow-id inchanged, the "Header Field Parametersreg-id is 2, and Parameter Values" sub-registry as per the registry created by  at http://www.iana.org/assignments/sip-parameters. The required information is: Header Field Parameter Name Predefined Reference Values ____________________________________________________________________ Contact flow-id Yes [RFC AAAA] [NOTE TO RFC Editor: Please replace AAAA with the RFC number of this specification.] This specification defines a new value in the "SIP/SIPS URI Parameters" sub-registry as perthe registry created by  at http://www.iana.org/assignments/sip-parameters. The required information is: Parameter Name Predefined Values Reference ____________________________________________ sip-stun No [RFC AAAA] [NOTE TO RFC Editor: Please replace AAAA withroute is set to the RFC number of this specification.] TODO: Add IANA section for "pin-route" option tag. 11. Security Considerations Onebackup instead of the key security concernsprimary. They look like: REGISTER sip:example.com SIP/2.0 Via: SIP/2.0/UDP 10.0.1.1;branch=z9hG4bKnashds7 Max-Forwards: 70 From: Callee <sip:firstname.lastname@example.org>;tag=a73kszlfl To: Callee <sip:email@example.com> Call-ID: 1j9FpLxk3uxtm8tnfirstname.lastname@example.org CSeq: 1 REGISTER Supported: path Route: <sip:backup.example.com;lr;sip-stun> Contact: <sip:email@example.com> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;reg-id=2 Content-Length: 0 SIP/2.0 200 OK Via: SIP/2.0/UDP 10.0.1.1;branch=z9hG4bKnashds7 From: Callee <sip:firstname.lastname@example.org>;tag=a73kszlfl To: Callee <sip:email@example.com> ;tag=b88sn Call-ID: 1j9FpLxk3uxtm8tnfirstname.lastname@example.org Supported: outbound CSeq: 1 REGISTER Contact: <sip:email@example.com> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;reg-id=1 ;expires=3600 Contact: <sip:firstname.lastname@example.org> ;+sip.instance="<urn:uuid:0C67446E-F1A1-11D9-94D3-000A95A0E128>" ;reg-id=2 ;expires=3600 Content-Length: 0 The messages in this workthe call flow are very normal. The only interesting thing to note is making surethat an attacker cannot hijackthe sessions of a valid user and cause all calls destined toINVITE in message 6 contains the following Record-Route header field: Record-Route: <sip:example.com;lr> Message 11 seems seams strange in that user to be sentit goes to the attacker.backup instead of the primary. The simple case is when there are no edge proxies. In this case,Caller actually sends the only time an entry can be addedmessage to the routing fordomain of the callee to a given AORhost (primary or backup) that is whencurrently available. How the registration succeeds. SIP protects against attackers being able to successfully register, anddomain does this scheme relies on that security. Some implementers have consideredis an implementation detail up to the ideadomain and not part of just savingthis specification. The registrations in message 15 and 16 are the instance-id without relating it tosame as message 1 and 2 other than the AOR with which it registered.Call-ID has changed. 9. Grammar This idea will not work because an attacker's UA can impersonate a valid user's instance-idspecification defines new Contact header field parameters, reg-id and hijack that user's calls.+sip.instance. The more complex case involves one or more edge proxies. When a UA sends a REGISTER request through an Edge Proxy ongrammar includes the definitions from RFC 3261  and includes the definition of uric from RFC 2396 . The ABNF is: contact-params = c-p-q / c-p-expires / c-p-flow / c-p-instance / contact-extension c-p-flow = "reg-id" EQUAL 1*DIGIT ; 1 to 2**31 c-p-instance = "+sip.instance" EQUAL LDQUOT "<" instance-val ">" RDQUOT instance-val = *uric ; defined in RFC 2396 The value of the registrar, the Edge Proxy insertsreg-id MUST NOT be 0 and MUST be less than 2**31. 10. IANA Considerations 10.1. Contact Header Field This specification defines a Pathnew Contact header field value. Ifparameter called reg-id in the registration is successfully authenticated,"Header Field Parameters and Parameter Values" sub-registry as per the proxy storesregistry created by  . The required information is: Header Field Parameter Name Predefined Reference Values ____________________________________________________________________ Contact reg-id Yes [RFC AAAA] [NOTE TO RFC Editor: Please replace AAAA with the valueRFC number of this specification.] 10.2. SIP/SIPS URI Paramters This specification arguments the Path header field. Later when"SIP/SIPS URI Parameters" sub- registry as per the registrar forwardsregistry created by  . The required information is: Parameter Name Predefined Values Reference ____________________________________________ sip-stun No [RFC AAAA] crlf-ping No [RFC AAAA] [NOTE TO RFC Editor: Please replace AAAA with the RFC number of this specification.] 10.3. SIP Option Tag This specification registers a request destinednew SIP option tag, as per the guidelines in Section 27.1 of RFC 3261. Name: outbound Description: This option-tag is used to identify Registrars which support extensions for Client Initiated Connections. A Registrar places this option-tag in a Supported header to communicate to the UA, it copiesregistering User Agent the stored value ofRegistrars support for this extension. 10.4. Media Feature Tag This section registers a new media feature tag, per the Path header fieldprocedures defined in RFC 2506 . The tag is placed into the route header fieldsip tree, which is defined in RFC 3840 . Media feature tag name: sip.instance ASN.1 Identifier: New assignment by IANA. Summary of the request and forwards the request to the Edge Proxy. The only time an Edge Proxy will route overmedia feature indicated by this tag: This feature tag contains a particular flow is when it has receivedstring containing a route headerURN that has the flowindicates a unique identifier information that it has created. An incoming request would have gotten this information fromassociated with the registrar. The registrar will only saveUA instance registering the Contact. Values appropriate for use with this informationfeature tag: String. The feature tag is intended primarily for a given AOR ifuse in the registrationfollowing applications, protocols, services, or negotiation mechanisms: This feature tag is most useful in a communications application, for describing the AOR has been successful; and the registration will only be successful ifcapabilities of a device, such as a phone or PDA. Examples of typical use: Routing a call to a specific device. Related standards or documents: RFC XXXX [[Note to IANA: Please replace XXXX with the UARFC number of this specification.]] Security Considerations: This media feature tag can correctly authenticate. Even if an attacker has spoofed some bad informationbe used in ways which affect application behaviors. For example, the path header sentSIP caller preferences extension  allows for call routing decisions to be based on the registrar, thevalues of these parameters. Therefore, if an attacker will notcan modify the values of this tag, they may be able to getaffect the registrar to acceptbehavior of applications. As a result, applications which utilize this informationmedia feature tag SHOULD provide a means for an AOR that does not belong toensuring its integrity. Similarly, this feature tag should only be trusted as valid when it comes from the attacker. The registrar will not hand outuser or user agent described by the tag. As a result, protocols for conveying this bad information to others,feature tag SHOULD provide a mechanism for guaranteeing authenticity. 11. Security Considerations One of the key security concerns in this work is making sure that an attacker cannot hijack the sessions of a valid user and others will notcause all calls destined to that user to be misled into contactingsent to the attacker. 12. Open Issues Service Route:The current interaction ofsimple case is when there are no edge proxies. In this draft and draft-rosenberg-sip-route-construct  does not work. Currently the Service Route specification, RCFC 3608, suggests thatcase, the service route is appendedonly time an entry can be added to the outbound proxy set. That will work with this specification. However the  draftrouting for a given AOR is suggesting to changewhen the behavior soregistration succeeds. SIP already protects against attackers being able to successfully register, and this scheme relies on that security. Some implementers have considered the Service Route replacesidea of just saving the outbound proxy. This is basically so that SIP can be used to make configuration changesinstance-id without relating it to the UA. The problem isAOR with which it registered. This idea will not work because an attacker's UA can impersonate a valid user's instance-id and hijack that this specification requires twouser's calls. The more complex case involves one or more URIs foredge proxies. When a UA sends a REGISTER request through an Edge Proxy on to the outbound configuration (so that reliability is possible) andregistrar, the Service Route would only be able to provideEdge Proxy inserts a single URI.Path header field value. If itthe registration is desirable to use Service Route this way, it probably needs to be modified in many ways including allowingsuccessfully authenticated, the proxy stores the value of the Path header field. Later when the registrar forwards a request destined for the UA, it copies the stored value of the Path header field into the route header field of the request and forwards the request to return different Service Routes to different devices registering forthe same AOR. Record RoutingEdge Proxies: IfProxy. The only time an Edge Proxy record routes withwill route over a name that resolves explicitly toparticular flow is when it and then crashes, all future requests in that dialog will fail. If an Edge Proxy record routes withhas received a name that resolves to many edge proxies or does not recordroute at all, then requestsheader that do nothas the flow identifier information that it has created. An incoming request would have GRUU as a contactgotten this information from the registrar. The registrar will not work. A suggested resolution toonly save this is to require GRUUinformation for long lived dialogs and have the Edge proxies use path headers and not record route. SUBSCRIBEs without a GRUU. Earlier version of draft assumed thata REGISTER was alwaysgiven AOR if the first message. Howeverregistration for the configuration framework needs to perform a SUBSCRIBE to getAOR has been successful; and the configuration thatregistration will allowonly be successful if the UA can correctly authenticate. Even if an attacker has spoofed some bad information in the path header sent to register. This specification needsthe registrar, the attacker will not be able to deal with situations where there is a SUBSCRIBE but no REGISTER. The current resolution isget the registrar to record routeaccept this information for these special cases and mitigatean AOR that does not belong to the reliability implications of this byattacker. The registrar will not allowing these dialogshand out this bad information to others, and others will not be long lived. The terminology of flow, flow-id, connection is confusing.misled into contacting the attacker. 12. Open Issues Do we want to changewant to include the Double CRLF keep alive option? Are thre any deployments that could use Algorithm 1 and if not can we remove it? We should change syntax from "sip-stun" to "keep-alive=sip-stun". 13. Requirements This specification was developed to meet the following requirements: 1. Must be able to detect that a UA supports these mechanisms. 2. Support UAs behind NATs. 3. Support TLS to a UA without a stable DNS name or IP.IP address. 4. Detect failure of connection and be able to correct for this. 5. Support many UAs simultaneously rebooting. 6. Support a NAT rebooting or resetting. 7. Support proxy farms with multiple hosts for scaling and reliability purposes. 8.Minimize initial startup load on a proxy. 9. Support proxies that provide geographic redundancy. 10.8. Support architectures with edge proxies. 11. Must be able14. Changes Note to receive notifications overRFC Editor: Please remove this whole section. 14.1. Changes from 01 Version Moved definition of instance-id from GRUU draft to this draft. Added tentative text about Double CRLF Keep Alive Removed pin-route stuff Changed the same flow usedname of "flow-id" to send a subscription, even before any registrations have been established. This ensures compatibility with"reg-id" Reorganized document flow Described the SIP configuration framework . 14.use of STUN as a proper STUN usage Added 'outbound' option-tag to detect if registrar supports outbound 14.2. Changes from 00 Version Moved TCP keep alive to be STUN. Allowed SUBSCRIBE to create flow mappings. Added pin-route option tags to support this. Added text about updating dialog state on each usage after a connection failure. 15. Acknowledgments Jonathan Rosenberg provided many comments and useful text. Dave Oran came up with the idea of using the most recent registration first in the proxy. Alan Hawrylyshen co-authored the draft that formed the initial text of this specification. Additionally, many of the concepts here originated at a connection reuse meeting at IETF 60 that included the authors, Jon Peterson, Jonathan Rosenberg, Alan Hawrylyshen, and Paul Kyzivat. The TCP design team consisting of Chris Boulton, Scott Lawrence, Rajnish Jain, Vijay K. Gurbani, and Ganesh Jayadevan provided input and text. Nils Ohlmeier provided many fixes and initial implementation experience. In addition, thanks to the following folks for useful comments: Francois Audet, Flemming Andreasen, Mike Hammer, Dan Wing, Srivatsa Srinivasan, and Lyndsay Campbell. 16. References 16.1. Normative References  Holtman, K., Mutz, A., and T. Hardie, "Media Feature Tag Registration Procedure", BCP 31, RFC 2506, March 1999.  Rosenberg, J., "ObtainingSchulzrinne, H., and Using Globally Routable User Agent (UA) URIs (GRUU) inP. Kyzivat, "Caller Preferences for the Session Initiation Protocol (SIP)", draft-ietf-sip-gruu-04 (work in progress), July 2005. RFC 3841, August 2004.  Moats, R., "URN Syntax", RFC 2141, May 1997.  Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.  Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002.  Rosenberg, J. and H. Schulzrinne, "Session Initiation Protocol (SIP): Locating SIP Servers", RFC 3263, June 2002.  Rosenberg, J., "Simple Traversal of UDP Through Network Address Translators (NAT) (STUN)", draft-ietf-behave-rfc3489bis-02 (work in progress), July 2005.  Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", RFC 2234, November 1997.  Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, July 2005.  Rosenberg, J., Schulzrinne, H., and P. Kyzivat, "Indicating User Agent Capabilities in the Session Initiation Protocol (SIP)", RFC 3840, August 2004. 16.2. Informative References  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.  Josefsson, S., "The Base16, Base32, Berners-Lee, T., Fielding, R., and Base64 Data Encodings",L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax", RFC 3548, July 2003. 2396, August 1998.  Willis, D. and B. Hoeneisen, "Session Initiation Protocol (SIP) Extension Header Field for Registering Non-Adjacent Contacts", RFC 3327, December 2002.  Camarillo, G., "The Internet Assigned Number Authority (IANA) Header Field Parameter Registry for the Session Initiation Protocol (SIP)", BCP 98, RFC 3968, December 2004.  Camarillo, G., "The Internet Assigned Number Authority (IANA) Uniform Resource Identifier (URI) Parameter Registry for the Session Initiation Protocol (SIP)", BCP 99, RFC 3969, December 2004.  Petrie, D., "A Framework16.2. Informative References  Hakala, J., "Using National Bibliography Numbers as Uniform Resource Names", RFC 3188, October 2001.  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.  Rosenberg, J., "Obtaining and Using Globally Routable User Agent (UA) URIs (GRUU) in the Session Initiation Protocol User Agent Profile Delivery", draft-ietf-sipping-config-framework-07(SIP)", draft-ietf-sip-gruu-04 (work in progress), July 2005.  Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 3548, July 2003.  Lawrence, S., Hawrylyshen, A., and R. Sparks, "Problems with Max-Forwards Processing (and Potential Solutions)", October 2005.  Rosenberg, J., "Clarifying Construction of the Route Header Field in the Session Initiation Protocol (SIP)", draft-rosenberg-sip-route-construct-00 (work in progress), July 2005.  Willis, D. and B. Hoeneisen, "Session Initiation Protocol (SIP) Extension Header Field for Service Route Discovery During Registration", RFC 3608, October 2003. Authors' Addresses Cullen Jennings (editor) Cisco Systems 170 West Tasman Drive Mailstop SJC-21/2 San Jose, CA 95134 USA Phone: +1 408 902-3341 Email: email@example.com Rohan Mahy (editor) SIP Edge LLC 5617 Scotts Valley Drive, Suite 200 Scotts Valley,Plantronics 345 Encincal St Santa Cruz, CA 9506695060 USA Email: firstname.lastname@example.org Intellectual Property Statement The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at email@example.com. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright Statement Copyright (C) The Internet Society (2005).(2006). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Acknowledgment Funding for the RFC Editor function is currently provided by the Internet Society.