idnits 2.17.1 draft-ietf-sipping-consent-format-04.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 15. -- Found old boilerplate from RFC 3978, Section 5.5, updated by RFC 4748 on line 589. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 600. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 607. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 613. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (October 2, 2007) is 6044 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 2617 (Obsoleted by RFC 7235, RFC 7615, RFC 7616, RFC 7617) ** Downref: Normative reference to an Informational RFC: RFC 3325 ** Obsolete normative reference: RFC 4474 (Obsoleted by RFC 8224) == Outdated reference: A later version (-04) exists of draft-ietf-sip-consent-framework-01 Summary: 4 errors (**), 0 flaws (~~), 2 warnings (==), 7 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 SIPPING G. Camarillo 3 Internet-Draft Ericsson 4 Intended status: Standards Track October 2, 2007 5 Expires: April 4, 2008 7 A Document Format for Requesting Consent 8 draft-ietf-sipping-consent-format-04.txt 10 Status of this Memo 12 By submitting this Internet-Draft, each author represents that any 13 applicable patent or other IPR claims of which he or she is aware 14 have been or will be disclosed, and any of which he or she becomes 15 aware will be disclosed, in accordance with Section 6 of BCP 79. 17 Internet-Drafts are working documents of the Internet Engineering 18 Task Force (IETF), its areas, and its working groups. Note that 19 other groups may also distribute working documents as Internet- 20 Drafts. 22 Internet-Drafts are draft documents valid for a maximum of six months 23 and may be updated, replaced, or obsoleted by other documents at any 24 time. It is inappropriate to use Internet-Drafts as reference 25 material or to cite them other than as "work in progress." 27 The list of current Internet-Drafts can be accessed at 28 http://www.ietf.org/ietf/1id-abstracts.txt. 30 The list of Internet-Draft Shadow Directories can be accessed at 31 http://www.ietf.org/shadow.html. 33 This Internet-Draft will expire on April 4, 2008. 35 Copyright Notice 37 Copyright (C) The IETF Trust (2007). 39 Abstract 41 This document defines an Extensible Markup Language (XML) format for 42 a permission document used to request consent. A permission document 43 written in this format is used by a relay to request a specific 44 recipient permission to perform a particular routing translation. 46 Table of Contents 48 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 49 2. Definitions and Terminology . . . . . . . . . . . . . . . . . 3 50 3. Permission Document Structure . . . . . . . . . . . . . . . . 4 51 3.1. Conditions . . . . . . . . . . . . . . . . . . . . . . . . 4 52 3.1.1. Recipient Condition . . . . . . . . . . . . . . . . . 4 53 3.1.2. Identity Condition . . . . . . . . . . . . . . . . . . 5 54 3.1.3. Target Condition . . . . . . . . . . . . . . . . . . . 7 55 3.1.4. Validity Condition . . . . . . . . . . . . . . . . . . 8 56 3.1.5. Sphere Condition . . . . . . . . . . . . . . . . . . . 8 57 3.2. Actions . . . . . . . . . . . . . . . . . . . . . . . . . 8 58 3.2.1. Translation Handling . . . . . . . . . . . . . . . . . 8 59 4. Example Document . . . . . . . . . . . . . . . . . . . . . . . 8 60 5. XML Schema . . . . . . . . . . . . . . . . . . . . . . . . . . 10 61 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 62 6.1. XML Namespace Registration . . . . . . . . . . . . . . . . 11 63 6.2. XML Schema Registration . . . . . . . . . . . . . . . . . 12 64 7. Security Considerations . . . . . . . . . . . . . . . . . . . 12 65 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 13 66 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13 67 9.1. Normative References . . . . . . . . . . . . . . . . . . . 13 68 9.2. Informative References . . . . . . . . . . . . . . . . . . 14 69 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 14 70 Intellectual Property and Copyright Statements . . . . . . . . . . 15 72 1. Introduction 74 The framework for consent-based communications in the Session 75 Initiation Protocol (SIP) [I-D.ietf-sip-consent-framework] identifies 76 the need for a format to create permission documents. Such 77 permission documents are used by SIP [RFC3261] relays to request 78 permission to perform translations. A relay is defined as any SIP 79 server, be it a proxy, B2BUA (Back-to-Back User Agent), or some 80 hybrid, which receives a request and translates the request URI into 81 one or more next hop URIs to which it then delivers a request. 83 The format for permission documents specified in this document is 84 based on Common Policy [RFC4745], an XML document format for 85 expressing privacy preferences. 87 2. Definitions and Terminology 89 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 90 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 91 document are to be interpreted as described in RFC 2119 [RFC2119]. 93 This document uses the terms defined in 94 [I-D.ietf-sip-consent-framework]. For completeness, these terms are 95 repeated here. Figure 1 of [I-D.ietf-sip-consent-framework] shows 96 the relationship between target and recipient URIs in a translation 97 operation. 99 Recipient URI: 101 The Request-URI of an outgoing request sent by an entity (e.g., a 102 user agent or a proxy). The sending of such request can have been 103 the result of a translation operation. 105 Relay: 107 Any SIP server, be it a proxy, B2BUA (Back-to-Back User Agent), or 108 some hybrid, that receives a request, translates its Request-URI 109 into one or more next-hop URIs (i.e., recipient URIs), and 110 delivers the request to those URIs. 112 Target URI: 114 The Request-URI of an incoming request that arrives to a relay 115 that will perform a translation operation. 117 Translation logic: 119 The logic that defines a translation operation at a relay. This 120 logic includes the translation's target and recipient URIs. 122 Translation operation: 124 Operation by which a relay translates the Request-URI of an 125 incoming request (i.e., the target URI) into one or more URIs 126 (i.e., recipient URIs) which are used as the Request- URIs of one 127 or more outgoing requests. 129 3. Permission Document Structure 131 A permission document is an XML document, formatted according to the 132 schema defined in [RFC4745]. Permission documents inherit the MIME 133 type of common policy documents, 'application/auth-policy+xml'. As 134 described in [RFC4745], this type of document is composed of three 135 parts: conditions, actions, and transformations. 137 This section defines the new conditions and actions defined by this 138 specification. This specification does not define any new 139 transformation. 141 3.1. Conditions 143 Note that, as discussed in [RFC4745], a permission document applies 144 to a translation if all the expressions in its conditions part 145 evaluate to TRUE. 147 3.1.1. Recipient Condition 149 The recipient condition is matched against the recipient URI of a 150 translation. Recipient conditions can contain the same elements and 151 attributes as identity conditions. 153 When performing a translation, a relay matches the recipient 154 condition of the permission document that was used to request 155 permission for that translation against the destination URI of the 156 outgoing request. When receiving a request granting or denying 157 permissions (e.g., a SIP PUBLISH request as described in 158 [I-D.ietf-sip-consent-framework]), the relay matches the recipient 159 condition of the permission document that was used to request 160 permission against the identity of the entity granting or denying 161 permissions (i.e., the sender of the PUBLISH request). 163 This section defines acceptable means of authentication, which are in 164 line with those described in Section 5.6.1 of 165 [I-D.ietf-sip-consent-framework]. 167 The 'id' attribute in the elements and MUST contain a 168 scheme when these elements appear in a permission document. 170 When used with SIP, a recipient granting or denying a relay 171 permissions is considered authenticated if one of the following 172 techniques is used: 174 SIP Identity [RFC4474], as described in Section 5.6.1.1 of 175 [I-D.ietf-sip-consent-framework]. For PUBLISH requests that are 176 authenticated using the SIP Identity mechanism, the identity of 177 the sender of the PUBLISH request is equal to the SIP URI in the 178 From header field of the request, assuming that the signature in 179 the Identity header field has been validated. 181 P-Asserted-Identity [RFC3325], as described in Section 5.6.1.2 of 182 [I-D.ietf-sip-consent-framework]. For PUBLISH requests that are 183 authenticated using the P-Asserted-Identity mechanism, the 184 identity of the sender of the PUBLISH request is equal to the 185 P-Asserted-Identity header field of the request. 187 Return Routability Test, as described in Section 5.6.1.3 of 188 [I-D.ietf-sip-consent-framework]. It can be used for SIP PUBLISH 189 and HTTP GET requests. No authentication is expected to be used 190 with return routability tests and, therefore, no identity matching 191 procedures are defined. 193 SIP digest, as described in Section 5.6.1.4 of 194 [I-D.ietf-sip-consent-framework]. The identity of the sender is 195 set equal to the SIP Address of Record (AOR) for the user that has 196 authenticated themselves. 198 3.1.2. Identity Condition 200 The identity condition, which is defined in [RFC4745], is matched 201 against the URI of the sender of the request that is used as input 202 for a translation. 204 When performing a translation, a relay matches the identity condition 205 against the identity of the sender of the incoming request. 207 The following subsections define acceptable means of authentication, 208 the procedure for representing the identity of the sender as a URI, 209 and the procedure for converting an identifier of the form 210 user@domain, present in the 'id' attribute of the and 211 elements, into a URI. 213 3.1.2.1. Acceptable Means of Authentication 215 When used with SIP, a request sent by a sender is considered 216 authenticated if one of the following techniques is used: 218 SIP Digest: the relay authenticates the sender using SIP digest 219 authentication [RFC2617]. However, if the anonymous 220 authentication described on page 194 of RFC 3261 [RFC3261] is 221 used, the sender is not considered authenticated. 223 Asserted Identity: if a request contains a P-Asserted-ID header 224 field [RFC3325] and the request is coming from a trusted element, 225 the sender is considered authenticated. 227 Cryptographically Verified Identity: if a request contains an 228 Identity header field as defined in [RFC4474], and it validates 229 the From header field of the request, the request is considered to 230 be authenticated. Note that this is true even if the request 231 contained a From header field of the form 232 sip:anonymous@example.com. As long as the signature verifies that 233 the request legitimately came from this identity, it is considered 234 authenticated. 236 3.1.2.2. Computing a URI for the Sender 238 For requests that are authenticated using SIP Digest, the identity of 239 the sender is set equal to the SIP Address of Record (AOR) for the 240 user that has authenticated themselves. For example, consider the 241 following "user record" in a database: 243 SIP AOR: sip:alice@example.com 244 digest username: ali 245 digest password: f779ajvvh8a6s6 246 digest realm: example.com 248 If the relay receives a request, challenges it with the realm set to 249 "example.com", and the subsequent request contains an Authorization 250 header field with a username of "ali" and a digest response generated 251 with the password "f779ajvvh8a6s6", the identity used in matching 252 operations is "sip:alice@example.com". 254 For requests that are authenticated using RFC 3325 [RFC3325], the 255 identity of the sender is equal to the SIP URI in the P-Asserted-ID 256 header field. If there are multiple values for the P-Asserted-ID 257 header field (there can be one sip URI and one tel URI [RFC3966]), 258 then each of them is used for the comparisons outlined in [RFC4745], 259 and if either of them match a or element, it is 260 considered a match. 262 For requests that are authenticated using the SIP Identity mechanism 263 [RFC4474], identity of the sender is equal to the SIP URI in the From 264 header field of the request, assuming that the signature in the 265 Identity header field has been validated. 267 SIP also allows for anonymous requests. If a request is anonymous 268 because the digest challenge/response used the "anonymous" username, 269 the request is considered unauthenticated and will not match the 270 condition. If a request is anonymous because it contains 271 a Privacy header field [RFC3323], but still contains a P-Asserted-ID 272 header field, the identity in the P-Asserted-ID header field is still 273 used in the authorization computations; the fact that the request was 274 anonymous has no impact on the identity processing. However, if the 275 request had traversed a trust boundary and the P-Asserted-ID header 276 field and the Privacy header field had been removed, the request will 277 be considered unauthenticated when it arrives at the relay, and thus 278 not match the condition. Finally, if a request contained an 279 Identity header field that was validated, and the From header field 280 contained a URI of the form sip:anonymous@example.com, then the 281 watcher is considered authenticated, and it will have an identity 282 equal to sip:anonymous@example.com. Had such an identity been placed 283 into a or element, there will be a match. 285 3.1.2.3. Computing a SIP URI from the id Attribute 287 If the or condition does not contain a scheme, 288 conversion of the value in the 'id' attribute to a SIP URI is done 289 trivially. If the characters in the 'id' attribute are valid 290 characters for the user and hostpart components of the SIP URI, a 291 'sip:' is appended to the contents of the 'id' attribute, and the 292 result is the SIP URI. If the characters in the 'id' attribute are 293 not valid for the user and hostpart components of the SIP URI, 294 conversion is not possible. This happens, for example, when the user 295 portion of the 'id' attribute contain UTF-8 characters. 297 3.1.3. Target Condition 299 The target condition is matched against the target URI of a 300 translation. The target condition can contain the same elements and 301 attributes as identity conditions. 303 When performing a translation, a relay matches the target condition 304 against the destination of the incoming request, which is typically 305 contained in the Request-URI. 307 3.1.4. Validity Condition 309 The element is not applicable to this document. Each 310 permission element has an infinite lifetime and can be revoked using 311 an independent mechanism, as described in Section 5.8 of 312 [I-D.ietf-sip-consent-framework]. 314 3.1.5. Sphere Condition 316 The element is not applicable to this document and therefore 317 is not used. 319 3.2. Actions 321 The actions in a permission document provide URIs to grant or deny 322 permission to perform the translation described in the document. 324 Note that the element is not an action, as 325 defined in Common Policy [RFC4745], but rather an informational 326 element. Therefore, the conflict resolution mechanism does not 327 apply to it. 329 Each policy rule contains at least two elements; one 330 element with a URI to grant and another with a URI to deny 331 permission. 333 3.2.1. Translation Handling 335 The provides URIs for a recipient to grant or deny 336 the relay permission to perform a translation. The defined values 337 are: 339 deny: this action tells the relay not to perform the translation. 341 grant: this action tells the server to perform the translation. 343 The 'perm-uri' attribute in the element provides a 344 URI to grant or deny permission to perform a translation. 346 4. Example Document 348 In the following example, a client adds 'sip:bob@example.org' to the 349 translation whose Target URI is 'sip:alices-friends@example.com'. 350 The relay handling the translation generates the following permission 351 document in order to ask for permission to relay requests sent to 352 'sip:alices-friends@example.com' to 'sip:bob@example.org'. The 353 Target URI is 'sip:alices-friends@example.com', and the Recipient URI 354 is 'sip:bob@example.org'. The sender's identity does not play a role 355 in this example. Therefore, the permission document does not put any 356 restriction on potential senders. 358 +--------+ +--------------------------------+ Permission 359 | | | | Request 360 | Client | | Relay | with 361 | | | sip:alices-friends@example.com | Permission 362 +--------+ | | Document 363 | |+-------+ |-------------+ 364 | ||Transl.| | | 365 |Manipulation ||Logic | | | 366 +------------>|+-------+ | | 367 Add +--------------------------------+ | 368 sip:bob@example.org V 369 +---------------------+ 370 | | 371 | Recipient | 372 | sip:bob@example.org | 373 | | 374 +---------------------+ 376 377 383 384 385 386 387 388 389 390 391 392 393 394 395 397 grant 398 400 grant 401 403 deny 404 406 deny 407 408 409 410 412 5. XML Schema 413 414 422 423 424 426 427 428 429 430 431 432 434 435 436 437 438 440 441 442 443 445 447 6. IANA Considerations 449 This section registers a new XML namespace and a new XML schema per 450 the procedures in [RFC3688]. 452 6.1. XML Namespace Registration 454 URI: urn:ietf:params:xml:ns:consent-rules 456 Registrant Contact: IETF SIPPING working group, 457 , Gonzalo Camarillo 458 459 XML: 461 BEGIN 462 463 465 466 467 469 Consent Rules Namespace 470 471 472

Namespace for Permission Documents

473

urn:ietf:params:xml:ns:consent-rules

474

See RFCXXXX 475 [NOTE TO IANA/RFC-EDITOR: 476 Please replace XXXX with the RFC number of this 477 specification.].

478 479 480 END 482 6.2. XML Schema Registration 484 URI: urn:ietf:params:xml:schema:consent-rules 486 Registrant Contact: IETF SIPPING working group, 487 , Gonzalo Camarillo 488 490 XML: The XML schema to be registered is contained in Section 5. 492 7. Security Considerations 494 Permission documents can reveal sensitive information. Additionally, 495 attackers may attempt to modify them in order to have clients grant 496 or deny permissions different to the ones they think are granting or 497 denying. For this reason, it is RECOMMENDED that relays use strong 498 means for information integrity protection and confidentiality when 499 sending permission documents to clients. 501 The mechanism used for conveying information to clients SHOULD ensure 502 the integrity and confidentially of the information. In order to 503 achieve these, an end-to-end SIP encryption mechanism, such as 504 S/MIME, as described in RFC 3261 [RFC3261], SHOULD be used. 506 If strong end-to-end security means (such as above) is not available, 507 it is RECOMMENDED that hop-by-hop security based on TLS and SIPS 508 URIs, as described in [RFC3261], is used. 510 8. Acknowledgements 512 Jonathan Rosenberg provided useful ideas on this document. Hannes 513 Tschofenig helped align this document with common policy. Ben 514 Campbell and Mary Barnes performed a thorough review of this 515 document. 517 9. References 519 9.1. Normative References 521 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 522 Requirement Levels", BCP 14, RFC 2119, March 1997. 524 [RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., 525 Leach, P., Luotonen, A., and L. Stewart, "HTTP 526 Authentication: Basic and Digest Access Authentication", 527 RFC 2617, June 1999. 529 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 530 A., Peterson, J., Sparks, R., Handley, M., and E. 531 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 532 June 2002. 534 [RFC3323] Peterson, J., "A Privacy Mechanism for the Session 535 Initiation Protocol (SIP)", RFC 3323, November 2002. 537 [RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private 538 Extensions to the Session Initiation Protocol (SIP) for 539 Asserted Identity within Trusted Networks", RFC 3325, 540 November 2002. 542 [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, 543 January 2004. 545 [RFC4474] Peterson, J. and C. Jennings, "Enhancements for 546 Authenticated Identity Management in the Session 547 Initiation Protocol (SIP)", RFC 4474, August 2006. 549 [RFC4745] Schulzrinne, H., Tschofenig, H., Morris, J., Cuellar, J., 550 Polk, J., and J. Rosenberg, "Common Policy: A Document 551 Format for Expressing Privacy Preferences", RFC 4745, 552 February 2007. 554 [I-D.ietf-sip-consent-framework] 555 Rosenberg, J., "A Framework for Consent-Based 556 Communications in the Session Initiation Protocol (SIP)", 557 draft-ietf-sip-consent-framework-01 (work in progress), 558 November 2006. 560 9.2. Informative References 562 [RFC3966] Schulzrinne, H., "The tel URI for Telephone Numbers", 563 RFC 3966, December 2004. 565 Author's Address 567 Gonzalo Camarillo 568 Ericsson 569 Hirsalantie 11 570 Jorvas 02420 571 Finland 573 Email: Gonzalo.Camarillo@ericsson.com 575 Full Copyright Statement 577 Copyright (C) The IETF Trust (2007). 579 This document is subject to the rights, licenses and restrictions 580 contained in BCP 78, and except as set forth therein, the authors 581 retain all their rights. 583 This document and the information contained herein are provided on an 584 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 585 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND 586 THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS 587 OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF 588 THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 589 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 591 Intellectual Property 593 The IETF takes no position regarding the validity or scope of any 594 Intellectual Property Rights or other rights that might be claimed to 595 pertain to the implementation or use of the technology described in 596 this document or the extent to which any license under such rights 597 might or might not be available; nor does it represent that it has 598 made any independent effort to identify any such rights. Information 599 on the procedures with respect to rights in RFC documents can be 600 found in BCP 78 and BCP 79. 602 Copies of IPR disclosures made to the IETF Secretariat and any 603 assurances of licenses to be made available, or the result of an 604 attempt made to obtain a general license or permission for the use of 605 such proprietary rights by implementers or users of this 606 specification can be obtained from the IETF on-line IPR repository at 607 http://www.ietf.org/ipr. 609 The IETF invites any interested party to bring to its attention any 610 copyrights, patents or patent applications, or other proprietary 611 rights that may cover technology that may be required to implement 612 this standard. Please address the information to the IETF at 613 ietf-ipr@ietf.org. 615 Acknowledgment 617 Funding for the RFC Editor function is provided by the IETF 618 Administrative Support Activity (IASA).