Connectivity Preconditions for
Session Description Protocol Media StreamsCisco Systems, Inc.499 Thornall Street, 8th FloorEdisonNJ08837USAfandreas@cisco.comEricssonHirsalantie 1102420JorvasFinlandGonzalo.Camarillo@ericsson.comCisco Systems, Inc.7 Ladyslipper LaneActonMA01720USAoran@cisco.comCisco Systems, Inc.170 West Tasman DriveSan JoseCA95134USAdwing@cisco.com
RAI
MMUSIC Working GroupSIPpreconditionsconnectionconnectivity
This document defines a new connectivity precondition for the Session
Description Protocol (SDP) precondition framework. A connectivity
precondition can be used to delay session establishment or
modification until media stream connectivity has been successfully
verified. The method of verification may vary depending on the type of
transport used for the media. For unreliable datagram transports such
as UDP, verification involves probing the stream with data or control
packets. For reliable connection-oriented transports such as TCP,
verification can be achieved simply by successful connection
establishment or by probing the connection with data or control
packets, depending on the situation.
The concept of a Session Description Protocol (SDP) precondition in the Session Initiation
Protocol (SIP) is defined in (updated by ). A
precondition is a condition that has to be satisfied for a given media
stream in order for session establishment or modification to
proceed. When the precondition is not met, session progress is delayed
until the precondition is satisfied or the session establishment
fails. For example, defines the Quality of
Service precondition, which is used to ensure availability of network
resources prior to establishing a session (i.e., prior to starting
alerting the callee).
SIP sessions are typically established in order to setup one or more
media streams. Even though a media stream may be negotiated
successfully through an SDP offer-answer exchange, the actual media
stream itself may fail. For example, when there is one or more Network
Address Translators (NATs) or firewalls in the media path, the media
stream may not be received by the far end. In cases where the media is
carried over a connection-oriented transport such as TCP, the connection-establishment procedures
may fail. The connectivity precondition defined in this document
ensures that session progress is delayed until media stream
connectivity has been verified.
The connectivity precondition type defined in this document follows
the guidelines provided in to extend the SIP
preconditions framework.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in .
The connectivity precondition type is defined by the string "conn" and
hence we modify the grammar found in as
follows:
precondition-type = "conn" / "qos" / token
This precondition tag is registered with the IANA in .
According to , documents defining new
precondition types need to describe the behavior of UAs (User Agents)
from the moment session establishment is suspended due to a set of
preconditions, until it is resumed when these preconditions are
met. An entity that wishes to delay session establishment or
modification until media stream connectivity has been established uses
this precondition-type in an offer. When a mandatory connectivity
precondition is received in an offer, session establishment or
modification is delayed until the connectivity precondition has been
met (i.e., until media stream connectivity has been established in the
desired direction or directions). The delay of session establishment
defined here implies that alerting of the called party does not occur
until the precondition has been satisfied.
Packets may be both sent and received on the media streams in
question. However, such packets SHOULD be limited to packets that are
necessary to verify connectivity between the two endpoints involved on
the media stream. That is, the underlying media stream SHOULD NOT be
cut through. For example, ICE connectivity checks and TCP SYN and ACK packets can be
exchanged on media streams that support them as a way of verifying
connectivity.
Some media streams are described by a single 'm' line but,
nevertheless, involve multiple addresses. For example, specifies how to send FEC (Forward Error
Correction) information as a separate stream (the address for the FEC
stream is provided in an 'a=fmtp' line). When a media stream consists
of multiple destination addresses, connectivity to all of them MUST be
verified in order for the precondition to be met. In the case of
RTP-based media streams, RTCP connectivity MAY be verified, but it is
not a requirement.
defines support for two kinds of status
types, namely segmented and end-to-end. The connectivity
precondition-type defined here MUST be used with the end-to-end status
type; use of the segmented status type is undefined.
The direction attributes defined in are
interpreted as follows:
send: the party that generated the session description is sending
packets on the media stream to the other party, and the other party
has received at least one of those packets. That is, there is
connectivity in the forward (sending) direction.
recv: the other party is sending packets on the media stream to the
party that generated the session description, and this party has
received at least one of those packets. That is, there is connectivity
in the backwards (receiving) direction.
sendrecv: both the send and recv conditions hold.
Note that a "send" connectivity precondition from the offerer's point
of view corresponds to a "recv" connectivity precondition from the
answerer's point of view, and vice versa. If media stream connectivity
in both directions is required before session establishment or
modification continues, the desired status needs to be set to
"sendrecv".
Connectivity preconditions may have a strength-tag of either
"mandatory" or "optional".
When a mandatory connectivity precondition is offered and the
answerer cannot satisfy the connectivity precondition (e.g., because
the offer does not include parameters that enable connectivity to be
verified without media cut through) the offer MUST be rejected as
described in .
When an optional connectivity precondition is offered, the answerer
MUST generate its answer SDP as soon as possible. Since session
progress is not delayed in this case, it is not known whether the
associated media streams will have connectivity. If the answerer wants
to delay session progress until connectivity has been verified, the
answerer MUST increase the strength of the connectivity precondition
by using a strength-tag of "mandatory" in the answer.
Note that use of a "mandatory" precondition requires the presence of a
SIP "Require" header with the option tag "precondition". Any SIP UA
that does not support a mandatory precondition will reject such
requests. To get around this issue, an optional connectivity
precondition and the SIP "Supported" header with the option tag
"precondition" can be used instead.
Offers with connectivity preconditions in re-INVITEs or UPDATEs follow
the rules given in Section 6 of . That is:
"Both user agents SHOULD continue using the old session parameters
until all the mandatory preconditions are met. At that moment, the
user agents can begin using the new session parameters."
Media stream connectivity is ascertained by use of a connectivity
verification mechanism between the media endpoints. A connectivity
verification mechanism may be an explicit mechanism, such as ICE or ICE TCP , or it may be an implicit
mechanism, such as TCP. Explicit mechanisms provide specifications for
when connectivity between two endpoints using an offer/answer exchange
is ascertained, whereas implicit mechanisms do not. The verification
mechanism is negotiated as part of the normal offer/answer exchange,
however it is not identified explicitly. More than one mechanism may
be negotiated, but the offerer and answerer need not use the same. The
following rules guide which connectivity verification mechanism to
use:
if an explicit connectivity verification mechanism (e.g., ICE) is
negotiated, the precondition is met when the mechanism verifies
connectivity successfully, otherwise
if a connection-oriented transport (e.g., TCP) is negotiated, the
precondition is met when the connection is established.
in other cases, an implicit verification mechanism MAY be provided by
the transport itself or the media stream data using the transport
if none of the above apply, connectivity cannot be verified reliably
and the connectivity precondition will never be satisfied if
requested.
This document does not mandate any particular connectivity
verification mechanism; however, in the following, we provide
additional considerations for verification mechanisms.
SIP and SDP do not provide any inherent capabilities for associating
an incoming media stream packet with a particular dialog. Thus, when
an offerer is trying to ascertain connectivity, and an incoming media
stream packet is received, the offerer may not know which dialog had
its "recv" connectivity verified. Explicit connectivity verification
mechanisms therefore typically provide a means to correlate the media
stream, whose connectivity is being verified, with a particular SIP
dialog. However, some connectivity verification mechanisms may not
provide such a correlation. In the absence of a dialog-to-media-stream
correlation mechanism (e.g., ICE), a UAS (User Agent Server) MUST NOT
require the offerer to confirm a connectivity precondition.
Explicit connectivity verification mechanisms typically use probe traffic with some sort of feedback to inform the sender whether reception was successful. Below we provide two examples of such mechanisms, and how they are used with connectivity preconditions:
Interactive Connectivity Establishment (ICE) provides one or more candidate
addresses in signaling between the offerer and the answerer and then
uses STUN Binding Requests to determine which pairs of candidate
addresses have connectivity. Each STUN Binding Request contains a
password which is communicated in the SDP as well; this enables
correlation between STUN Binding Requests and candidate addresses for
a particular media stream. It also provides correlation with a
particular SIP dialog.
ICE implementations may be either Full or Lite (see ). Full implementations generate and
respond to STUN Binding Requests, whereas Lite implementations only
respond to them. With ICE, one side is a controlling agent, and the
other side is a controlled agent. A Full implementation can take on
either role, whereas a Lite implementation can only be a controlled
agent. The controlling agent decides which valid candidate to use and
informs the controlled agent of it by identifying the pair as the
nominated pair. This leads to the following connectivity precondition
rules:
A Full implementation ascertains both "send" and "recv" connectivity when it operates as a STUN client and has sent a STUN Binding Request that resulted in a successful check for all the components of the media stream (as defined further in ICE).
A Full or a Lite implementation ascertains "recv" connectivity when it operates as a STUN server and has received a STUN Binding Request that resulted in a successful response for all the components of the media stream (as defined further in ICE).
A Lite implementation ascertains "send" and "recv" connectivity when the controlling agent has informed it of the nominated pair for all the components of the media stream.
A simpler and slightly more delay-prone alternative to the above rules is for all ICE implementations to ascertain "send" and "recv" connectivity for a media stream when the ICE state for that media stream has moved to Completed.
Note that there is never a need for the answerer to request
confirmation of the connectivity precondition when using ICE: the
answerer can determine the status locally. Also note, that when ICE
is used to verify connectivity preconditions, the precondition is not
satisfied until connectivity has been verified for all the component
transport addresses used by the media stream. For example, with an
RTP-based media stream where RTCP is not suppressed, connectivity MUST
be ascertained for both RTP and RTCP; this is a tightening of the
general operational semantics provided in , which is imposed by ICE.
Finally, it should be noted, that although connectivity has been
ascertained, a new offer/answer exchange may be required before media
can flow (per ICE).
The above are merely examples of explicit connectivity verification mechanisms. Other techniques can be used as well. It is however RECOMMENDED that ICE be supported by entities that support connectivity preconditions. Use of ICE has the benefit of working for all media streams (not just RTP) as well as facilitate NAT and firewall traversal, which may otherwise interfere with connectivity. Furthermore, the ICE recommendation provides a baseline to ensure that all entities that require probe traffic to support the connectivity preconditions have a common way of ascertaining connectivity.
Connection-oriented transport protocols generally provide an implicit
connectivity verification mechanism. Connection establishment involves
sending traffic in both directions thereby verifying connectivity at
the transport protocol level. When a three-way (or more) handshake for
connection establishment succeeds, bi-directional communication is
confirmed and both the "send" and "recv" preconditions are satisfied
whether requested or not. In the case of TCP for example, once the TCP
three-way handshake has completed (SYN, SYN-ACK, ACK), the TCP
connection is established and data can be sent and received by either
party (i.e., both a send and a receive connectivity precondition has
been satisfied). SCTP connections have
similar semantics as TCP and SHOULD be treated the same.
When a connection-oriented transport is part of an offer, it may be passive, active, or active/passive . When it is passive, the offerer expects the answerer to initiate the connection establishment, and when it is active, the offerer wants to initiate the connection establishment. When it is active/passive, the answerer decides. As noted earlier, lack of a media-stream-to-dialog correlation mechanism can make it difficult to guarantee with whom connectivity has been ascertained. When the offerer takes on the passive role, the offerer will not necessarily know which SIP dialog originated an incoming connection request. If the offerer instead is active, this problem is avoided.
The role of a connectivity precondition is to ascertain media stream
connectivity before establishing or modifying a session. The
underlying intent is for the two parties to be able to exchange media
packets successfully. Connectivity by itself however may not fully
satisfy this. Quality of Service for example may be required for the
media stream; this can be addressed by use of the "qos" precondition
defined in . Similarly, succesful security
parameter negotiation may be another prequisite; this can be addressed
by use of the "sec" precondition defined in .
The first example uses the connectivity precondition with TCP in the
context of a session involving a wireless access medium. Both UAs use
a radio access network that does not allow them to send any data (not
even a TCP SYN) until a radio bearer has been setup for the
connection. shows the message
flow of this example (the required PRACK transaction has been omitted
for clarity):
A sends an INVITE requesting connection-establishment preconditions.
The setup attribute in the offer is set to holdconn because A cannot send or receive any data before
setting up a radio bearer for the connection.
B agrees to use the connectivity precondition by sending a 183
(Session Progress) response. The setup attribute in the answer is also
set to holdconn because B, like A, cannot send or receive any data
before setting up a radio bearer for the connection.
When A's radio bearer is ready, A sends an UPDATE to B with a setup
attribute with a value of actpass. This attribute indicates that A can
perform an active or a passive TCP open. A is letting B choose which
endpoint will initiate the connection.
Since B's radio bearer is not ready yet, B chooses to be the one
initiating the connection and indicates so with a setup attribute with
a value of active. At a later point, when B's radio bearer is ready, B
initiates the TCP connection towards A.
Once the TCP connection is established successfully, B knows the
"sendrecv" precondition is satisfied, and B proceeds with the session
(i.e., alerts the Callee), and sends a 180 (Ringing) response.
The second example shows a basic SIP session establishment using SDP
connectivity preconditions and ICE (the required PRACK
transaction and some SDP details have been omitted for clarity). The
message flow for this scenario is shown in below.
SDP1: A includes a mandatory end-to-end connectivity precondition with
a desired status of "sendrecv"; this will ensure media stream
connectivity in both directions before continuing with the session
setup. Since media stream connectivity in either direction is unknown
at this point, the current status is set to "none". A's local status
table (see ) for the connectivity precondition
is as follows:
and the resulting offer SDP is:
SDP2: When B receives the offer, B sees the mandatory sendrecv
connectivity precondition. B can ascertain connectivity to A ("send"
from B's point of view) by use of the ICE connectivity check, however B wants A to
inform it about connectivity in the other direction ("recv" from B's
point of view). B's local status table therefore looks as follows:
Since B wants to ask A for confirmation about the "recv" (from B's
point of view) connectivity precondition, the resulting answer SDP
becomes:
Meanwhile, B performs a successful send connectivity check to A by
sending an ICE connectivity check packet to A and receiving the
corresponding response. B's local status table is updated as follows:
Since the "recv" connectivity precondition (from B's point of view) is
still not satisfied, session establishment remains suspended.
SDP3: When A receives the answer SDP, A notes that confirmation was
requested for B's "recv" connectivity precondition, which is the
"send" precondition from A's point of view. A performs a successful
send connectivity check to B by sending an ICE connectivity check
to B and receiving the corresponding response. A's local status table
becomes:
Since B asked for confirmation about the "send" connectivity (from A's
point of view), A now sends an UPDATE (5) to B to confirm the
connectivity from A to B:
B has both send and recv connectivity confirmed at this point and the
session can continue.
In addition to the general security considerations for preconditions
provided in , the following security issues,
which are specific to connectivity preconditions, should be
considered.
Connectivity preconditions rely on mechanisms beyond SDP such as
TCP connection establishment, or
ICE connectivity checks to establish and verify
connectivity between an offerer and an answerer. An attacker that
prevents those mechanism from succeeding can prevent media sessions
from being established and hence it is RECOMMENDED that such
mechanisms are adequately secured by message authentication and
integrity protection. Also, the mechanisms SHOULD consider how to
prevent denial of service attacks. Similarly, an attacker that can
forge packets for these mechanisms can enable sessions to be
established when there in fact is no media connectivity, which may
lead to a poor user experience. Authentication and integrity
protection of such mechanisms can prevent this type of attacks and
hence use of it is RECOMMENDED.
It is also strongly RECOMMENDED that integrity protection be applied
to the SDP session descriptions. S/MIME
provides such end-to-end integrity protection, as described in .
IANA is hereby requested to register a new precondition type under the
Precondition Types used with SIP subregistry, which is located under
the Session Initiation Protocol (SIP) Parameters registry.
[Note to the RFC Editor: replace RFCxxxx with the number assigned to
this RFC.]
Removed RTP No-Op. Fixed ABNF.
Minor fixes here and there.
Connectivity preconditions are now mechanism agnostic. Clarified when
and how to use ICE, RTP No-Op, and connection establishment procedures
to check connectivity. Clarified relation with other precondition
types.
There are no changes since the previous version of the document.