RFC 7200
A Session Initiation Protocol (SIP) Load-Control Event Package
Pages: 44
Proposed Standard
Proposed Standard
Part 2 of 2 – Pages 20 to 44
6. XML Schema Definition for Load Control
This section defines the XML schema for the load-control document. It extends the Common Policy schema in [RFC4745] in two ways. Firstly, it defines two mandatory attributes for the <ruleset> element: "version" and "state". The "version" attribute allows the recipient of the notification to properly order them. Versions start at zero and increase by one for each new document sent to a subscriber within the same subscription. Versions MUST be representable using a non-negative 32-bit integer. The "state" attribute indicates whether the document contains a full load- filtering policy update or only state delta as partial update. Secondly, it defines new members of the <conditions> and <actions> elements. <?xml version="1.0" encoding="UTF-8"?> <xs:schema targetNamespace="urn:ietf:params:xml:ns:load-control" xmlns:lc="urn:ietf:params:xml:ns:load-control" xmlns:cp="urn:ietf:params:xml:ns:common-policy" xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" attributedFormDefault="unqualified"> <xs:import namespace="urn:ietf:params:xml:ns:common-policy"/> <!-- RULESET --> <xs:element name="ruleset"> <xs:complexType> <xs:complexContent> <xs:restriction base="xs:anyType"> <xs:sequence> <xs:element name="rule" type="cp:ruleType" minOccurs="0" maxOccurs="unbounded"/> </xs:sequence> </xs:restriction> </xs:complexContent>
<xs:attribute name="version" type="xs:integer" use="required"/>
<xs:attribute name="state" use="required">
<xs:simpleType>
<xs:restriction base="xs:string">
<xs:enumeration value="full"/>
<xs:enumeration value="partial"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:complexType>
</xs:element>
<!-- CONDITIONS -->
<!-- CALL IDENTITY -->
<xs:element name="call-identity" type="lc:call-identity-type"/>
<!-- CALL IDENTITY TYPE -->
<xs:complexType name="call-identity-type">
<xs:choice>
<xs:element name="sip" type="lc:sip-id-type"/>
<any namespace="##other" processContents="lax" minOccurs="0"
maxOccurs="unbounded"/>
</xs:choice>
<anyAtrribute namespace="##other" processContents="lax"/>
</xs:complexType>
<!-- SIP ID TYPE -->
<xs:complexType name="sip-id-type">
<xs:sequence>
<element name="from" type="lc:identityType" minOccurs="0"/>
<element name="to" type="lc:identityType" minOccurs="0"/>
<element name="request-uri" type="lc:identityType"
minOccurs="0"/>
<element name="p-asserted-identity" type="lc:identityType"
minOccurs="0"/>
<any namespace="##other" processContents="lax" minOccurs="0"
maxOccurs="unbounded"/>
</xs:sequence>
<anyAtrribute namespace="##other" processContents="lax"/>
</xs:complexType>
<!-- IDENTITY TYPE -->
<xs:complexType name="identityType">
<xs:complexContent>
<xs:restriction base="xs:anyType">
<xs:choice minOccurs="1" maxOccurs="unbounded">
<xs:element name="one" type="cp:oneType"/>
<xs:element name="many" type="lc:manyType"/>
<xs:element name="many-tel" type="lc:manyTelType"/>
<xs:any namespace="##other" processContents="lax"/>
</xs:choice>
</xs:restriction>
</xs:complexContent>
</xs:complexType>
<!-- MANY-TEL TYPE -->
<xs:complexType name="manyTelType">
<xs:complexContent>
<xs:restriction base="xs:anyType">
<xs:choice minOccurs="0" maxOccurs="unbounded">
<xs:element name="except-tel" type="lc:exceptTelType"/>
<xs:any namespace="##other"
minOccurs="0" processContents="lax"/>
</xs:choice>
<xs:attribute name="prefix"
use="optional" type="xs:string"/>
</xs:restriction>
</xs:complexContent>
</xs:complexType>
<!-- EXCEPT-TEL TYPE -->
<xs:complexType name="exceptTelType">
<xs:attribute name="prefix" type="xs:string" use="optional"/>
<xs:attribute name="id" type="xs:anyURI" use="optional"/>
</xs:complexType>
<!-- METHOD -->
<xs:element name="method" type="lc:method-type"/>
<!-- METHOD TYPE -->
<xs:simpleType name="method-type">
<xs:restriction base="xs:string">
<xs:enumeration value="INVITE"/>
<xs:enumeration value="MESSAGE"/>
<xs:enumeration value="REGISTER"/>
<xs:enumeration value="SUBSCRIBE"/>
<xs:enumeration value="OPTIONS"/>
<xs:enumeration value="PUBLISH"/>
</xs:restriction>
</xs:simpleType>
<!-- TARGET SIP ENTITY -->
<xs:element name="target-sip-entity" type="xs:anyURI" minOccurs="0"/>
<!-- ACTIONS -->
<xs:element name="accept">
<xs:choice>
<element name="rate" type="xs:decimal" minOccurs="0"/>
<element name="win" type="xs:integer" minOccurs="0"/>
<element name="percent" type="xs:decimal" minOccurs="0"/>
<any namespace="##other" processContents="lax" minOccurs="0"
maxOccurs="unbounded"/>
</xs:choice>
<xs:attribute name="alt-action" type="xs:string" default="reject"/>
<xs:attribute name="alt-target" type="lc:alt-target-type"
use="optional"/>
<anyAtrribute namespace="##other" processContents="lax"/>
</xs:element>
<!-- ALT TARGET TYPE -->
<xs:simpleType name="alt-target-type">
<xs:list itemType="xs:anyURI"/>
</xs:simpleType>
</xs:schema>
7. Security Considerations
Two primary security considerations arise from this specification.
One is the distribution mechanism for the load filtering policy that
is based on the SIP event notification framework, and the other is
the enforcement mechanism for the load-filtering policy.
Security considerations for SIP event package mechanisms are covered
in Section 6 of [RFC6665]. A particularly relevant security concern
for this event package is that if the notifiers can be spoofed,
attackers can send fake notifications asking subscribers to throttle
all traffic, leading to denial-of-service (DoS) attacks. Therefore,
this SIP load-filtering mechanism MUST be used in a Trust Domain
(Section 3.4). But if a legitimate notifier in the Trust Domain is
itself compromised, additional mechanisms will be needed to detect
the attack.
Security considerations for load-filtering policy enforcement depends
very much on the contents of the policy. This specification defines
a possible match of the following SIP header fields in a load-
filtering policy: <from>, <to>, <request-uri>, and
<p-asserted-identity>. The exact requirement to authenticate and
authorize these fields is up to the service provider. In general, if
the identity field represents the source of the request, it SHOULD be
authenticated and authorized; if the identity field represents the
destination of the request, the authentication and authorization is
optional.
In addition, the "redirect" action (Section 5.4) could facilitate a reflection denial-of-service attack. If a number of SIP proxy servers in a Trust Domain are using UDP and configured to get their policies from a central server. An attacker spoofs the central server's address to send a number of NOTIFY bodies telling the proxy servers to redirect all calls to victim@outside-of-trust-domain.com. The proxy servers then redirect all calls to the victim, who then becomes a victim of Denial of Service attack and becomes inaccessiable from the Internet. To address this type of threat, this specification requires that a Trust Domain agrees on what types of calls can be affected as well as on the destinations to which calls may be redirected, as in Section 3.4.8. IANA Considerations
This specification registers a SIP event package, a new media type, a new XML namespace, and a new XML schema.8.1. Load-Control Event Package Registration
This section registers an event package based on the registration procedures defined in [RFC6665]. Package name: load-control Type: package Published specification: This specification Person to contact: Charles Shen, charles@cs.columbia.edu8.2. application/load-control+xml Media Type Registration
This section registers a new media type based on the procedures defined in [RFC6838] and guidelines in [RFC3023]. Type name: application Subtype name: load-control+xml Required parameters: none Optional parameters: Same as charset parameter of application/xml as specified in [RFC3023]. Encoding considerations: Same as encoding considerations of application/xml as specified in [RFC3023].
Security considerations: See Section 10 of [RFC3023] and Section 7 of this specification. Interoperability considerations: none Published specification: This specification Applications that use this media type: Applications that perform load control of SIP entities. Fragment identifier considerations: Same as fragment identifier considerations of application/xml as specified in [RFC3023]. Additional Information: Deprecated alias names for this type: none Magic Number(s): none File Extension(s): .xml Macintosh file type code(s): "TEXT" Person and email address for further information: Charles Shen, charles@cs.columbia.edu Intended usage: COMMON Restrictions on usage: none Author: Charles Shen, Henning Schulzrinne, Arata Koike Change controller: IESG Provisional registration? (standards tree only): no8.3. URN Sub-Namespace Registration
This section registers a new XML namespace, as per the guidelines in [RFC3688] URI: The URI for this namespace is urn:ietf:params:xml:ns:load-control Registrant Contact: IETF SOC Working Group <sip-overload@ietf.org>, as designated by the IESG <iesg@ietf.org>
XML:
BEGIN
<?xml version="1.0"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML Basic 1.0//EN"
"http://www.w3.org/TR/xhtml-basic/xhtml-basic10.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="content-type"
content="text/html;charset=iso-8859-1"/>
<title>SIP Load-Control Namespace</title>
</head>
<body>
<h1>Namespace for SIP Load Control</h1>
<h2>urn:ietf:params:xml:ns:load-control</h2>
<p>See <a href="http://www.rfc-editor.org/rfc/rfc7200.txt">
RFC 7200</a>.</p>
</body>
</html>
END
8.4. Load-Control Schema Registration
URI: urn:ietf:params:xml:schema:load-control
Registrant Contact: IETF SOC working group, Charles Shen
(charles@cs.columbia.edu).
XML: the XML schema contained in Section 6 has been registered.
Its first line is
<?xml version="1.0" encoding="UTF-8"?>
and its last line is
</xs:schema>
9. Acknowledgements
The authors would like to thank Jari Arkko, Richard Barnes, Stewart Bryant, Gonzalo Camarillo, Bruno Chatras, Benoit Claise, Spencer Dawkins, Martin Dolly, Keith Drage, Ashutosh Dutta, Donald Eastlake, Adrian Farrel, Stephen Farrell, Janet Gunn, Vijay Gurbani, Brian Haberman, Volker Hilt, Geoff Hunt, Carolyn Johnson, Hadriel Kaplan, Paul Kyzivat, Barry Leiba, Pearl Liang, Salvatore Loreto, Timothy Moran, Eric Noel, Parthasarathi R, Pete Resnick, Adam Roach, Dan Romascanu, Shida Schubert, Robert Sparks, Martin Stiemerling, Sean Turner, Phil Williams, and other members of the SOC and SIPPING working groups for many helpful comments. In particular, Bruno Chatras proposed the <method> and <target-sip-entity> condition elements along with many other text improvements. Janet Gunn provided detailed text suggestions including Appendix C. Eric Noel suggested clarification on load-filtering policy distribution initialization process. Shida Schubert made many suggestions such as terminology usage. Phil Williams suggested adding support for delta updates. Ashutosh Dutta gave pointers to Public Switched Telephone Network (PSTN) references. Adam Roach suggested improvements related to RFC 6665 and offered other helpful clarifications. Richard Barnes made many suggestions such as referencing the Trust Domain concept of RFCs 3324 and 3325, the use of a separate element for 'tel' URI grouping, and addressing the "redirect" action security threat.10. References
10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC2141] Moats, R., "URN Syntax", RFC 2141, May 1997. [RFC3023] Murata, M., St. Laurent, S., and D. Kohn, "XML Media Types", RFC 3023, January 2001. [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002. [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, January 2004. [RFC3966] Schulzrinne, H., "The tel URI for Telephone Numbers", RFC 3966, December 2004.
[RFC4745] Schulzrinne, H., Tschofenig, H., Morris, J., Cuellar, J., Polk, J., and J. Rosenberg, "Common Policy: A Document Format for Expressing Privacy Preferences", RFC 4745, February 2007. [RFC6665] Roach, A., "SIP-Specific Event Notification", RFC 6665, July 2012. [RFC6838] Freed, N., Klensin, J., and T. Hansen, "Media Type Specifications and Registration Procedures", BCP 13, RFC 6838, January 2013.10.2. Informative References
[E.300SerSup3] ITU-T, "North American Precise Audible Tone Plan", Recommendation E.300 Series Supplement 3, November 1988. [E.412] ITU-T, "Network Management Controls", Recommendation E.412-2003, January 2003. [Q.1248.2] ITU-T, "Interface Recommendation for Intelligent Network Capability Set4:SCF-SSF interface", Recommendation Q.1248.2, July 2001. [RFC2648] Moats, R., "A URN Namespace for IETF Documents", RFC 2648, August 1999. [RFC3324] Watson, M., "Short Term Requirements for Network Asserted Identity", RFC 3324, November 2002. [RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private Extensions to the Session Initiation Protocol (SIP) for Asserted Identity within Trusted Networks", RFC 3325, November 2002. [RFC4412] Schulzrinne, H. and J. Polk, "Communications Resource Priority for the Session Initiation Protocol (SIP)", RFC 4412, February 2006. [RFC4825] Rosenberg, J., "The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)", RFC 4825, May 2007. [RFC5031] Schulzrinne, H., "A Uniform Resource Name (URN) for Emergency and Other Well-Known Services", RFC 5031, January 2008.
[RFC5390] Rosenberg, J., "Requirements for Management of Overload in the Session Initiation Protocol", RFC 5390, December 2008. [RFC6357] Hilt, V., Noel, E., Shen, C., and A. Abdelal, "Design Considerations for Session Initiation Protocol (SIP) Overload Control", RFC 6357, August 2011. [SIP-OVERLOAD] Gurbani, V., Ed., Hilt, V., and H. Schulzrinne, "Session Initiation Protocol (SIP) Overload Control", Work in Progress, March 2014.
Appendix A. Definitions
This specification reuses the definitions for "Event Package", "Notification", "Notifier", "Subscriber", and "Subscription" as in [RFC6665]. The following additional definitions are also used. Load Filtering: A load-control mechanism that applies specific actions to selected loads (e.g., SIP requests) matching specific conditions. Load-Filtering Policy: A set of zero or more load-filtering rules, also known as load-filtering rule set. Load-Filtering Rule: Conditions and actions to be applied for load filtering. Load-Filtering Condition: Elements that describe how to select loads to apply load-filtering actions. This specification defines the <call-identity>, <method>, <target-sip-identity>, and <validity> condition elements (Section 5.3). Load-Filtering Action: An operation to be taken by a load-filtering server on loads that match the load-filtering conditions. This specification allows actions such as accept, reject, and redirect of loads (Section 5.4). Load-Filtering Server: A server that performs load filtering. In the context of this specification, the load-filtering server is the subscriber, which receives load-filtering policies from the notifier and enforces those policies during load filtering. Load-Control Document: An XML document that describes the load- filtering policies (Section 5). It inherits and enhances the common policy document defined in [RFC4745].Appendix B. Design Requirements
The SIP load-filtering mechanism needs to satisfy the following requirements: o For simplicity, the solution should focus on a method for controlling SIP load, rather than a generic application-layer mechanism. o The load-filtering policy needs to be distributed efficiently to possibly a large subset of all SIP elements.
o The solution should reuse existing SIP protocol mechanisms to
reduce implementation and deployment complexity.
o For predictable overload situations, such as holidays and mass
calling events, the load-filtering policy should specify during
what time it is to be applied, so that the information can be
distributed ahead of time.
o For destination-specific overload situations, the load-filtering
policy should be able to describe the destination domain or the
callee.
o To address accidental and intentional high-volume call generators,
the load-filtering policy should be able to specify the caller.
o Caller and callee need to be specified as both SIP URIs and 'tel'
URIs [RFC3966] in load-filtering policies.
o It should be possible to specify particular information in the SIP
headers (e.g., prefixes in telephone numbers) that allow load
filtering over limited regionally focused overloads.
o The solution should draw upon experiences from related PSTN
mechanisms [Q.1248.2] [E.412] [E.300SerSup3] where applicable.
o The solution should be extensible to meet future needs.
Appendix C. Discussion of How This Specification Meets the Requirements
of RFC 5390
This section evaluates whether the load-control event package
mechanism defined in this specification satisfies various SIP
overload control requirements set forth by [RFC5390]. As mentioned
in Section 1, this specification complements other efforts in the
overall SIP load-control solution space. Therefore, not all RFC 5390
requirements are found applicable to this specification. This
specification categorizes the assessment results into Yes (the
requirement is met), P/A (Partially Applicable), No (must be used in
conjunction with another mechanism to meet the requirement), and N/A
(Not Applicable).
REQ 1: The overload mechanism shall strive to maintain the overall
useful throughput (taking into consideration the quality-of-
service needs of the using applications) of a SIP server at
reasonable levels, even when the incoming load on the network is
far in excess of its capacity. The overall throughput under load
is the ultimate measure of the value of an overload control
mechanism.
P/A. The goal of load filtering is to prevent overload or maintain
overall goodput during the time of overload, but it is dependent on
the predictions of the load and the computations as well as
distribution of the filtering policies. If the load predictions or
filtering policy computations are incorrect, or the filtering policy
is not properly distributed, the mechanism will be less effective.
On the other hand, if the load can be accurately predicted and
filtering policies be computed and distributed appropriately, this
requirement can be met.
REQ 2: When a single network element fails, goes into overload, or
suffers from reduced processing capacity, the mechanism should
strive to limit the impact of this on other elements in the
network. This helps to prevent a small-scale failure from
becoming a widespread outage.
N/A if load-filtering policies are installed in advance and do not
change during the potential overload period, P/A if load-filtering
policies are dynamically adjusted. The algorithm to dynamically
compute load-filtering policies is outside the scope of this
specification, while the distribution of the updated filtering
policies uses the event package mechanism of this specification.
REQ 3: The mechanism should seek to minimize the amount of
configuration required in order to work. For example, it is
better to avoid needing to configure a server with its SIP message
throughput, as these kinds of quantities are hard to determine.
No. This mechanism is entirely dependent on advance configuration,
based on advance knowledge. In order to satisfy REQ 3, it should be
used in conjunction with other mechanisms that are not based on
advance configuration.
REQ 4: The mechanism must be capable of dealing with elements that
do not support it, so that a network can consist of a mix of
elements that do and don't support it. In other words, the
mechanism should not work only in environments where all elements
support it. It is reasonable to assume that it works better in
such environments, of course. Ideally, there should be
incremental improvements in overall network throughput as
increasing numbers of elements in the network support the
mechanism.
No. This mechanism is entirely dependent on the participation of all
possible neighbors. In order to satisfy REQ 4, it should be used in
conjunction with other mechanisms, some of which are described in
Section 3.4.
REQ 5: The mechanism should not assume that it will only be
deployed in environments with completely trusted elements. It
should seek to operate as effectively as possible in environments
where other elements are malicious; this includes preventing
malicious elements from obtaining more than a fair share of
service.
No. This mechanism is entirely dependent on the non-malicious
participation of all possible neighbors. In order to satisfy REQ 5,
it should be used in conjunction with other mechanisms, some of which
are described in Section 3.4.
REQ 6: When overload is signaled by means of a specific message,
the message must clearly indicate that it is being sent because of
overload, as opposed to other, non overload-based failure
conditions. This requirement is meant to avoid some of the
problems that have arisen from the reuse of the 503 response code
for multiple purposes. Of course, overload is also signaled by
lack of response to requests. This requirement applies only to
explicit overload signals.
N/A. This mechanism signals anticipated overload, not actual
overload. However, the signals in this mechanism are not used for
any other purpose.
REQ 7: The mechanism shall provide a way for an element to
throttle the amount of traffic it receives from an upstream
element. This throttling shall be graded so that it is not all-
or-nothing as with the current 503 mechanism. This recognizes the
fact that "overload" is not a binary state and that there are
degrees of overload.
Yes. This event package allows rate-/loss-/window-based overload
control options as discussed in Section 5.4.
REQ 8: The mechanism shall ensure that, when a request was not
processed successfully due to overload (or failure) of a
downstream element, the request will not be retried on another
element that is also overloaded or whose status is unknown. This
requirement derives from REQ 1.
N/A to the load-control event package mechanism itself.
REQ 9: That a request has been rejected from an overloaded element
shall not unduly restrict the ability of that request to be
submitted to and processed by an element that is not overloaded.
This requirement derives from REQ 1.
Yes. For example, load-filtering policy (Section 3.1) can include alternative forwarding destinations for rejected requests. REQ 10: The mechanism should support servers that receive requests from a large number of different upstream elements, where the set of upstream elements is not enumerable. No. Because this mechanism requires advance configuration of specifically identified neighbors, it does not support environments where the number and identity of the upstream neighbors are not known in advance. In order to satisfy REQ 10, it should be used in conjunction with other mechanisms. REQ 11: The mechanism should support servers that receive requests from a finite set of upstream elements, where the set of upstream elements is enumerable. Yes. See also answer to REQ 10. REQ 12: The mechanism should work between servers in different domains. Yes. The load-control event package mechanism is not limited by domain boundaries. However, it is likely more applicable in intra- domain scenarios than in inter-domain scenarios due to security and other concerns (see also Section 3.4). REQ 13: The mechanism must not dictate a specific algorithm for prioritizing the processing of work within a proxy during times of overload. It must permit a proxy to prioritize requests based on any local policy, so that certain ones (such as a call for emergency services or a call with a specific value of the Resource-Priority header field [RFC4412]) are given preferential treatment, such as not being dropped, being given additional retransmission, or being processed ahead of others. P/A. This mechanism does not specifically address the prioritizing of work during times of overload. But it does not preclude any particular local policy. REQ 14: The mechanism should provide unambiguous directions to clients on when they should retry a request and when they should not. This especially applies to TCP connection establishment and SIP registrations, in order to mitigate against avalanche restart. N/A to the load-control event package mechanism itself.
REQ 15: In cases where a network element fails, is so overloaded
that it cannot process messages, or cannot communicate due to a
network failure or network partition, it will not be able to
provide explicit indications of the nature of the failure or its
levels of congestion. The mechanism must properly function in
these cases.
P/A. Because the load-filtering policies are provisioned in advance,
they are not affected by the overload or failure of other network
elements. On the other hand, they may not, in those cases, be able
to protect the overloaded network elements (see REQ 1).
REQ 16: The mechanism should attempt to minimize the overhead of
the overload control messaging.
Yes. The standardized SIP event package mechanism [RFC6665] is used.
REQ 17: The overload mechanism must not provide an avenue for
malicious attack, including DoS and DDoS attacks.
P/A. This mechanism does provide a potential avenue for malicious
attacks. Therefore, the security mechanisms for SIP event packages,
in general, [RFC6665] and Section 7 of this specification should be
used.
REQ 18: The overload mechanism should be unambiguous about whether
a load indication applies to a specific IP address, host, or URI,
so that an upstream element can determine the load of the entity
to which a request is to be sent.
Yes. The identity of load indication is covered in the load-
filtering policy format definition in Section 3.1.
REQ 19: The specification for the overload mechanism should give
guidance on which message types might be desirable to process over
others during times of overload, based on SIP-specific
considerations. For example, it may be more beneficial to process
a SUBSCRIBE refresh with Expires of zero than a SUBSCRIBE refresh
with a non-zero expiration (since the former reduces the overall
amount of load on the element), or to process re-INVITEs over new
INVITEs.
N/A to the load-control event package mechanism itself.
REQ 20: In a mixed environment of elements that do and do not
implement the overload mechanism, no disproportionate benefit
shall accrue to the users or operators of the elements that do not
implement the mechanism.
No. This mechanism is entirely dependent on the participation of all possible neighbors. In order to satisfy REQ 20, it should be used in conjunction with other mechanisms, some of which are described in Section 3.4. REQ 21: The overload mechanism should ensure that the system remains stable. When the offered load drops from above the overall capacity of the network to below the overall capacity, the throughput should stabilize and become equal to the offered load. N/A to the load-control event package mechanism itself. REQ 22: It must be possible to disable the reporting of load information towards upstream targets based on the identity of those targets. This allows a domain administrator who considers the load of their elements to be sensitive information, to restrict access to that information. Of course, in such cases, there is no expectation that the overload mechanism itself will help prevent overload from that upstream target. N/A to the load-control event package mechanism itself. REQ 23: It must be possible for the overload mechanism to work in cases where there is a load balancer in front of a farm of proxies. Yes. The load-control event package mechanism does not preclude its use in a scenario with server farms.Appendix D. Complete Examples
D.1. Load-Control Document Examples
This section presents two complete examples of load-control documents valid with respect to the XML schema defined in Section 6. The first example assumes that a set of hotlines are set up at "sip:alice@hotline.example.com" and "tel:+1-212-555-1234". The hotlines are activated from 12:00 to 15:00 US Eastern Standard Time on 2008-05-31. The goal is to limit the incoming calls to the hotlines to 100 requests per second. Calls that exceed the rate limit are explicitly rejected.
<?xml version="1.0" encoding="UTF-8"?>
<ruleset xmlns="urn:ietf:params:xml:ns:common-policy"
xmlns:lc="urn:ietf:params:xml:ns:load-control"
version="0" state="full">
<rule id="f3g44k1">
<conditions>
<lc:call-identity>
<lc:sip>
<lc:to>
<one id="sip:alice@hotline.example.com"/>
<one id="tel:+1-212-555-1234"/>
</lc:to>
</lc:sip>
</lc:call-identity>
<method>INVITE</method>
<validity>
<from>2008-05-31T12:00:00-05:00</from>
<until>2008-05-31T15:00:00-05:00</until>
</validity>
</conditions>
<actions>
<lc:accept alt-action="reject">
<lc:rate>100</lc:rate>
</lc:accept>
</actions>
</rule>
</ruleset>
The second example optimizes the usage of server resources during the
three-day period following a hurricane. Incoming calls to the domain
"sandy.example.com" or to call destinations with prefix "+1-212" will
be limited to a rate of 100 requests per second, except for those
calls originating from a particular rescue team domain
"rescue.example.com". Outgoing calls from the hurricane domain or
calls within the local domain are never limited. All calls that are
throttled due to the rate limit will be forwarded to an answering
machine with updated hurricane rescue information.
<?xml version="1.0" encoding="UTF-8"?>
<ruleset xmlns="urn:ietf:params:xml:ns:common-policy"
xmlns:lc="urn:ietf:params:xml:ns:load-control"
version="1" state="full">
<rule id="f3g44k2">
<conditions>
<lc:call-identity>
<lc:sip>
<lc:to>
<many domain="sandy.example.com"/>
<many-tel prefix="+1-212"/>
</lc:to>
<lc:from>
<many>
<except domain="sandy.example.com"/>
<except domain="rescue.example.com"/>
</many>
</lc:from>
</lc:sip>
</lc:call-identity>
<method>INVITE</method>
<validity>
<from>2012-10-25T09:00:00+01:00</from>
<until>2012-10-28T09:00:00+01:00</until>
</validity>
</conditions>
<actions>
<lc:accept alt-action="redirect" alt-target=
"sip:sandy@update.example.com">
<lc:rate>100</lc:rate>
</lc:accept>
</actions>
</rule>
</ruleset>
Sometimes it may occur that multiple rules in a ruleset define
actions that match the same methods, call identity and validity. In
those cases, the "first-match-wins" principle is used. For example,
in the following ruleset, the first rule requires all calls from the
"example.com" domain to be rejected. Even though the rule following
that one specifies that calls from "sip:alice@example.com" be
redirected to a specific target "sip:eve@example.com", the calls from
"sip:alice@example.com" will still be rejected because they have
already been matched by the earlier rule.
<?xml version="1.0" encoding="UTF-8"?>
<ruleset xmlns="urn:ietf:params:xml:ns:common-policy"
xmlns:lc="urn:ietf:params:xml:ns:load-control"
version="1" state="full">
<rule id="f3g44k3">
<conditions>
<lc:call-identity>
<lc:sip>
<lc:from>
<many domain="example.com"/>
</lc:from>
</lc:sip>
</lc:call-identity>
<method>INVITE</method>
<validity>
<from>2013-7-2T09:00:00+01:00</from>
<until>2013-7-3T09:00:00+01:00</until>
</validity>
</conditions>
<actions>
<lc:accept alt-action="reject">
<lc:rate>0</lc:rate>
</lc:accept>
</actions>
</rule>
<rule id="f3g44k4">
<conditions>
<lc:call-identity>
<lc:sip>
<lc:from>
<one id="sip:alice@example.com"/>
</lc:from>
</lc:sip>
</lc:call-identity>
<method>INVITE</method>
<validity>
<from>2013-7-2T09:00:00+01:00</from>
<until>2013-7-3T09:00:00+01:00</until>
</validity>
</conditions>
<actions>
<lc:accept alt-action="redirect" alt-target=
"sip:eve@example.com">
<lc:rate>0</lc:rate>
</lc:accept>
</actions>
</rule>
</ruleset>
D.2. Message Flow Examples
This section presents an example message flow of using the load-
control event package mechanism defined in this specification.
atlanta biloxi
| F1 SUBSCRIBE |
|------------------>|
| F2 200 OK |
|<------------------|
| F3 NOTIFY |
|<------------------|
| F4 200 OK |
|------------------>|
F1 SUBSCRIBE atlanta.example.com -> biloxi.example.com
SUBSCRIBE sip:biloxi.example.com SIP/2.0
Via: SIP/2.0/TCP atlanta.example.com;branch=z9hG4bKy7cjbu3
From: sip:atlanta.example.com;tag=162ab5
To: sip:biloxi.example.com
Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com
CSeq: 2012 SUBSCRIBE
Contact: sip:atlanta.example.com
Event: load-control
Max-Forwards: 70
Accept: application/load-control+xml
Expires: 3600
Content-Length: 0
F2 200 OK biloxi.example.com -> atlanta.example.com
SIP/2.0 200 OK
Via: SIP/2.0/TCP biloxi.example.com;branch=z9hG4bKy7cjbu3
;received=192.0.2.1
To: <sip:biloxi.example.com>;tag=331dc8
From: <sip:atlanta.example.com>;tag=162ab5
Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com
CSeq: 2012 SUBSCRIBE
Expires: 3600
Contact: sip:biloxi.example.com
Content-Length: 0
F3 NOTIFY biloxi.example.com -> atlanta.example.com
NOTIFY sip:atlanta.example.com SIP/2.0
Via: SIP/2.0/TCP biloxi.example.com;branch=z9hG4bKy71g2ks
From: <sip:biloxi.example.com>;tag=331dc8
To: <sip:atlanta.example.com>;tag=162ab5
Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com
Event: load-control
Subscription-State: active;expires=3599
Max-Forwards: 70
CSeq: 1775 NOTIFY
Contact: sip:biloxi.example.com
Content-Type: application/load-control+xml
Content-Length: ...
[Load-Control Document]
F4 200 OK atlanta.example.com -> biloxi.example.com
SIP/2.0 200 OK
Via: SIP/2.0/TCP atlanta.example.com;branch=z9hG4bKy71g2ks
;received=192.0.2.2
From: <sip:biloxi.example.com>;tag=331dc8
To: <sip:atlanta.example.com>;tag=162ab5
Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com
CSeq: 1775 NOTIFY
Content-Length: 0
Appendix E. Related Work
E.1. Relationship to Load Filtering in PSTN
It is known that an existing PSTN network also uses a load-filtering
mechanism to prevent overload and the filtering policy configuration
is done manually except in specific cases when the Intelligent
Network architecture is used [Q.1248.2][E.412]. This specification
defines a load-filtering mechanism based on the SIP event
notification framework that allows automated filtering policy
distribution in suitable environments.
PSTN overload control uses messages that specify an outgoing control
list, call gap duration, and control duration [Q.1248.2][E.412].
These items correspond roughly to the identity, action, and time
fields of the SIP load-filtering policy defined in this
specification. However, the load-filtering policy defined in this
specification is much more generic and flexible as opposed to its
PSTN counterpart.
Firstly, PSTN load filtering only applies to telephone numbers. The identity element of SIP load-filtering policy allows both SIP URI and telephone numbers (through 'tel' URI) to be specified. These identities can be arbitrarily grouped by SIP domains or any number of leading prefixes of the telephone numbers. Secondly, the PSTN load-filtering action is usually limited to call gapping. The action field in SIP load-filtering policy allows more flexible possibilities such as rate throttle and others. Thirdly, the duration field in PSTN load filtering specifies a value in seconds for the load-filtering duration only, and the allowed values are mapped into a value set. The time field in SIP load- filtering policy may specify not only a duration, but also a future activation time that could be especially useful for automating load filtering for predictable overloads. PSTN load filtering can be performed in both edge switches and transit switches; the SIP load filtering can also be applied in both edge proxy servers and core proxy servers, and even in capable user agents. PSTN load filtering also has special accommodation for High Probability of Completion (HPC) calls, which would be similar to calls designated by the SIP Resource Priority Headers [RFC4412]. The SIP load-filtering mechanism also allows prioritizing the treatment of these calls by specifying favorable actions for them. PSTN load filtering also provides an administrative option for routing failed call attempts to either a reorder tone [E.300SerSup3] indicating overload conditions or a special recorded announcement. A similar capability can be provided in the SIP load-filtering mechanism by specifying appropriate "alt-action" attribute in the SIP load-filtering action field.E.2. Relationship with Other IETF SIP Overload Control Efforts
The load-filtering policies in this specification consist of identity, action, and time. The identity can range from a single specific user to an arbitrary user aggregate, domains, or areas. The user can be identified by either the source or the destination. When the user is identified by the source and a favorable action is specified, the result is, to some extent, similar to identifying a priority user based on authorized Resource Priority Headers [RFC4412] in the requests. Specifying a source user identity with an unfavorable action would cause an effect to some extent similar to an inverse SIP resource priority mechanism.
The load-filtering policy defined in this specification is generic and expected to be applicable not only to the load-filtering mechanism but also to the feedback overload control mechanism in [SIP-OVERLOAD]. In particular, both mechanisms could use specific or wildcard identities for load control and could share well-known load- control actions. The time duration field in the load-filtering policy could also be used in both mechanisms. As mentioned in Section 1, the load-filtering policy distribution mechanism and the feedback overload control mechanism address complementary areas in the overload control problem space. Load filtering is more proactive and focuses on distributing filtering policies towards the source of the traffic; the hop-by-hop feedback-based approach is reactive and reduces traffic already accepted by the network. Therefore, they could also make different use of the generic load-filtering policy components. For example, the load-filtering mechanism may use the time field in the filtering policy to specify not only a control duration but also a future activation time to accommodate a predicable overload such as the one caused by Mother's Day greetings or a viewer-voting program; the feedback-based control might not need to use the time field or might use the time field to specify an immediate load-control duration.
Authors' Addresses
Charles Shen Columbia University Department of Computer Science 1214 Amsterdam Avenue, MC 0401 New York, NY 10027 USA Phone: +1 212 854 3109 EMail: charles@cs.columbia.edu Henning Schulzrinne Columbia University Department of Computer Science 1214 Amsterdam Avenue, MC 0401 New York, NY 10027 USA Phone: +1 212 939 7004 EMail: schulzrinne@cs.columbia.edu Arata Koike NTT Network Technology Labs 3-9-11 Midori-cho Musashino-shi Tokyo 180-8585 Japan Phone: +81 422 59 6099 EMail: koike.arata@lab.ntt.co.jp