6. Notifications of Presence Information
6.1. Overview
Both XMPP and presence-aware SIP systems enable entities (often, but not necessarily, human users) to send presence notifications to other entities. At its most basic, the term "presence" refers to information about an entity's "on/off" availability for communication on a network. Often, this basic concept is supplemented by information that further specifies the entity's context or status while available for communication; these availability states commonly
include "away" and "do not disturb". Some systems and protocols extend the concepts of presence and availability even further and refer to any relatively ephemeral information about an entity as a kind of presence; categories of such "extended presence" include geographical location (e.g., GPS coordinates), user mood (e.g., grumpy), user activity (e.g., walking), and ambient environment (e.g., noisy). This document focuses on the "least common denominator" of network availability only. Future documents might address broader notions of presence, including availability states and extended presence or so-called "rich presence" as defined in specifications such as [RFC4480], [XEP-0107], and [XEP-0108]. The XMPP instant messaging and presence specification [RFC6121] defines how XMPP <presence/> stanzas can indicate availability (via the absence of a 'type' attribute) or lack of availability (via a 'type' attribute with a value of "unavailable"). SIP presence using a SIP event package for presence is specified in [RFC3856]. As described in [RFC6121], XMPP presence information about an entity is communicated by means of an XML <presence/> stanza sent over an XML stream. This document assumes that such a <presence/> stanza is sent from an XMPP client to an XMPP server over an XML stream negotiated between the client and the server, and that the client is controlled by a human user. In general, XMPP presence is sent by the user's client to the user's server and then broadcast to all entities who are subscribed to the user's presence information. As described in [RFC3856], presence information about an entity is communicated by means of a SIP NOTIFY event sent from a SIP User Agent to an intended recipient who is most generally referenced by a Presence URI of the form <pres:user@domain> but who might be referenced by a SIP or SIPS URI of the form <sip:user@domain> or <sips:user@domain>.6.2. XMPP to SIP
When Juliet interacts with her XMPP client to modify her presence information (or when her client automatically updates her presence information, e.g., via an "auto-away" feature), her client generates an XMPP <presence/> stanza. The syntax of the <presence/> stanza, including required and optional elements and attributes, is defined in [RFC6121]. The following is an example of such a stanza: Example 18: XMPP User Sends Presence Notification | <presence from='juliet@example.com/yn0cl4bnw0yr3vym'/>
Upon receiving such a stanza, the XMPP server to which Juliet has connected broadcasts it to all subscribers who are authorized to receive presence notifications from Juliet and who have indicated a current interest in receiving notifications (this is similar to the SIP NOTIFY method). For each subscriber, broadcasting the presence notification involves adding the 'to' address of the subscriber and then either delivering the notification to a local recipient (if the hostname in the subscriber's address matches one of the hostnames serviced by the XMPP server) or attempting to route it to the foreign domain that services the hostname in the subscriber's address. If the notification is bound for an address at a foreign domain, the XMPP server needs to determine the identity of the domainpart in the 'to' address, which it does by following the procedures discussed in [RFC7247]. If the domain is a SIP domain, the XMPP server will hand off the <presence/> stanza to an associated XMPP-to-SIP gateway or connection manager that natively communicates with presence-aware SIP proxy. The XMPP-to-SIP gateway is then responsible for translating the XMPP <presence/> stanza into a SIP NOTIFY request (including the PIDF document) from the XMPP user to the SIP contact. Example 19: SIP Transformation of XMPP Presence Notification | NOTIFY sip:juliet@example.com SIP/2.0 | Via: SIP/2.0/TCP x2s.example.com;branch=z9hG4bKna998sk | From: <sip:juliet@example.com>;tag=gh19 | To: <sip:romeo@example.net> | Contact: <sip:juliet@example.com>;gr=yn0cl4bnw0yr3vym | Call-ID: 2B44E147-3B53-45E4-9D48-C051F3216D14 | Event: presence | Subscription-State: active;expires=599 | Max-Forwards: 70 | CSeq: 2 NOTIFY | Content-Type: application/pidf+xml | Content-Length: 192 | | <?xml version='1.0' encoding='UTF-8'?> | <presence xmlns='urn:ietf:params:xml:ns:pidf' | entity='pres:juliet@example.com'> | <tuple id='ID-yn0cl4bnw0yr3vym'> | <status> | <basic>open</basic> | <show xmlns='jabber:client'>away</show> | </status> | </tuple> | </presence>
The mapping of XMPP syntax elements to SIP syntax elements MUST be as shown in the following table. (Mappings for elements not mentioned are undefined and therefore are a matter of implementation.) +-----------------------------+---------------------------+ | XMPP Element or Attribute | SIP Header or PIDF Data | +-----------------------------+---------------------------+ | <presence/> stanza | "Event: presence" (1) | +-----------------------------+---------------------------+ | XMPP resource identifier | tuple 'id' attribute (2) | +-----------------------------+---------------------------+ | from | From | +-----------------------------+---------------------------+ | id | no mapping (3) | +-----------------------------+---------------------------+ | to | To | +-----------------------------+---------------------------+ | type | basic status (4) (5) | +-----------------------------+---------------------------+ | xml:lang | Content-Language | +-----------------------------+---------------------------+ | <priority/> | priority for tuple (6) | +-----------------------------+---------------------------+ | <show/> | no mapping (7) | +-----------------------------+---------------------------+ | <status/> | <note/> | +-----------------------------+---------------------------+ Table 1: Presence Syntax Mapping from XMPP to SIP Note the following regarding these mappings: 1. Only an XMPP <presence/> stanza that lacks a 'type' attribute or whose 'type' attribute has a value of "unavailable" is mapped by an XMPP-to-SIP gateway to a SIP NOTIFY request, because those are the only <presence/> stanzas that represent notifications. 2. The PIDF schema defines the tuple 'id' attribute as having a datatype of "xs:ID"; because this datatype is more restrictive than the "xs:string" datatype for XMPP resourceparts (in particular, a number is not allowed as the first character of an ID), it is RECOMMENDED to prepend the resourcepart with "ID-" or some other alphabetic string when mapping from XMPP to SIP. 3. In practice, XMPP <presence/> stanzas often do not include the 'id' attribute.
4. Because the lack of a 'type' attribute indicates that an XMPP entity is available for communication, the XMPP-to-SIP gateway MUST map that information to a PIDF basic status of "open". Because a 'type' attribute with a value of "unavailable" indicates that an XMPP entity is not available for communication, the XMPP-to-SIP gateway MUST map that information to a PIDF <basic/> status of "closed". 5. When the XMPP-to-SIP gateway receives an XMPP presence of type "unavailable" from the XMPP contact, it sends a SIP NOTIFY request from the XMPP contact to the SIP User Agent containing a PIDF document specifying that the XMPP contact now has a basic status of "closed". 6. The value of the XMPP <priority/> element is an integer between -128 and +127, whereas the value of the PIDF <contact/> element's 'priority' attribute is a decimal number from zero to one inclusive, with a maximum of three decimal places. If the value of the XMPP <priority/> element is negative, an XMPP-to-SIP gateway MUST NOT map the value. If an XMPP-to-SIP gateway maps positive values, it SHOULD treat XMPP priority 0 as PIDF priority 0 and XMPP priority 127 as PIDF priority 1, mapping intermediate values appropriately so that they are unique (e.g., XMPP priority 1 to PIDF priority 0.007, XMPP priority 2 to PIDF priority 0.015, and so on up through mapping XMPP priority 126 to PIDF priority 0.992; note that this is an example only and that the exact mapping is up to the implementation). 7. Some implementations support custom extensions to encapsulate detailed information about availability; however, there is no need to standardize a PIDF extension for this purpose, because PIDF is already extensible, and thus the XMPP <show/> element (qualified by the 'jabber:client' namespace) can be included directly in the PIDF XML. The examples in this document illustrate this usage, which is RECOMMENDED. The most useful values are likely "away" and "dnd" (both defined in [RFC6121]), although note that in XMPP a value of "dnd" (short for "do not disturb") merely means "busy" and does not imply that a server or client ought to block incoming traffic while the user is in that state. Naturally, an XMPP-to-SIP gateway can choose to translate a custom extension into an established value of the XMPP <show/> element (as defined in [RFC6121]) or translate a <show/> element into a custom extension that the XMPP-to-SIP gateway knows is supported by the SIP User Agent of the intended recipient. Unfortunately, this behavior does not guarantee that information will not be lost; to help prevent information loss, an XMPP-to- SIP gateway ought to include both the <show/> element and the custom extension if it cannot suitably translate the custom value
into a <show/> value. However, there is no guarantee that the SIP receiver will render a standard XMPP <show/> value or custom extension. In XMPP, a user can connect with multiple clients at the same time [RFC6120]; for presence notification purposes [RFC6121], each client is associated with a distinct resourcepart [RFC7622] and a contact's SIP User Agent will receive a separate presence notification from each of the XMPP user's clients. Although the interpretation of multiple presence notifications from a single user is a matter of implementation by the contact's SIP User Agent, typically the SIP User Agent will show the "most available" status for the contact (e.g., if the user is online with three devices, one of which is "away", one of which is in "do not disturb" mode, and one of which is "available" with no qualifications, then the status shown will simply be "available"). In SIP, it is reasonable for a SIP User Agent to model multiple presence notifications from an XMPP user in the same way that it would handle multiple tuples from a SIP user.
6.3. SIP to XMPP
When Romeo changes his presence, his SIP User Agent generates a SIP NOTIFY request for any contacts that have presence authorizations and notification sessions. The syntax of the NOTIFY request is defined in [RFC3856]. The following is an example of such a request: Example 20: SIP User Sends Presence Notification | NOTIFY sip:romeo@example.net SIP/2.0 | Via: SIP/2.0/TCP simple.example.net;branch=z9hG4bKna998sk | From: <sip:romeo@example.net>;tag=yt66 | To: <sip:juliet@example.com>;tag=bi54 | Contact: <sip:romeo@example.net>;gr=dr4hcr0st3lup4c | Call-ID: C33C6C9D-0F4A-42F9-B95C-7CE86B526B5B | Event: presence | Subscription-State: active;expires=499 | Max-Forwards: 70 | CSeq: 8 NOTIFY | Content-Type: application/pidf+xml | Content-Length: 193 | | <?xml version='1.0' encoding='UTF-8'?> | <presence xmlns='urn:ietf:params:xml:ns:pidf' | entity='pres:romeo@example.net'> | <tuple id='ID-dr4hcr0st3lup4c'> | <status> | <basic>closed</basic> | </status> | </tuple> | </presence> Upon receiving the NOTIFY, the SIP proxy needs to determine the identity of the domain portion of the Request-URI, which it does by following the procedures discussed in [RFC7247]. If the domain is an XMPP domain, the SIP proxy will hand off the NOTIFY to an associated SIP-to-XMPP gateway or connection manager that natively communicates with XMPP servers. The SIP-to-XMPP gateway is then responsible for translating the NOTIFY into an XMPP <presence/> stanza addressed from the SIP user to the XMPP contact: Example 21: XMPP Transformation of SIP Presence Notification | <presence from='romeo@example.net' | to='juliet@example.com/yn0cl4bnw0yr3vym' | type='unavailable'/>
The mapping of SIP syntax elements to XMPP syntax elements MUST be as shown in the following table. (Mappings for elements not mentioned are undefined and therefore are a matter of implementation.) +---------------------------+-----------------------------+ | SIP Header or PIDF Data | XMPP Element or Attribute | +---------------------------+-----------------------------+ | basic status | type (1) | +---------------------------+-----------------------------+ | Content-Language | xml:lang | +---------------------------+-----------------------------+ | From | from | +---------------------------+-----------------------------+ | priority for tuple | <priority/> (2) | +---------------------------+-----------------------------+ | To | to | +---------------------------+-----------------------------+ | <note/> | <status/> | +---------------------------+-----------------------------+ | <show/> | <show/> (3) | +---------------------------+-----------------------------+ Table 2: Presence Syntax Mapping from SIP to XMPP Note the following regarding these mappings: 1. A PIDF basic status of "open" MUST be mapped to a <presence/> stanza with no 'type' attribute, and a PIDF basic status of "closed" MUST be mapped to a <presence/> stanza whose 'type' attribute has a value of "unavailable". 2. See the notes following Table 1 of this document regarding mapping of presence priority. 3. If a SIP implementation supports the XMPP <show/> element (qualified by the 'jabber:client' namespace) as a PIDF extension for availability status as described in the notes following Table 1 of this document, the SIP-to-XMPP gateway is responsible for including that element in the XMPP presence notification.
7. Polling for Presence Information
Both SIP and XMPP provide methods for explicitly requesting one-time information about the current presence status of another entity. These are "polling" methods as opposed to the publish-subscribe methods described in the rest of this document.7.1. XMPP to SIP
In XMPP, an explicit request for information about current presence status is completed by sending a <presence/> stanza of type "probe": Example 22: XMPP Server Sends Presence Probe on Behalf of XMPP User | <presence from='juliet@example.com/chamber' | to='romeo@example.net' | type='probe'/> Note: As described in [RFC6121], presence probes are used by XMPP servers to request presence on behalf of XMPP users; XMPP clients are discouraged from sending presence probes, because retrieving presence is a service that XMPP servers provide automatically. A SIP-to-XMPP gateway would transform the presence probe into its SIP equivalent, which is a SUBSCRIBE request with an Expires header value of zero ("0") in a new dialog: Example 23: SIP Transformation of XMPP Presence Probe | SUBSCRIBE sip:romeo@example.net SIP/2.0 | Via: SIP/2.0/TCP x2s.example.com;branch=z9hG4bKna998sk | From: <sip:juliet@example.com>;tag=j89d | Call-ID: 2398B737-566F-4CBB-A21A-1F8EEF7AF423 | Event: presence | Max-Forwards: 70 | CSeq: 1 SUBSCRIBE | Contact: <sip:juliet@example.com>;gr=yn0cl4bnw0yr3vym | Accept: application/pidf+xml | Expires: 0 | Content-Length: 0 As described in [RFC3856], this causes a NOTIFY to be sent to the subscriber, just as a presence probe does (the transformation rules for presence notifications have been previously described in Section 6.2 of this document).
7.2. SIP to XMPP
In SIP, an explicit request for information about current presence status is effectively completed by sending a SUBSCRIBE with an Expires header value of zero ("0"): Example 24: SIP User Sends Presence Request | SUBSCRIBE sip:juliet@example.com SIP/2.0 | Via: SIP/2.0/TCP simple.example.net;branch=z9hG4bKna998sk | From: <sip:romeo@example.net>;tag=yt66 | Call-ID: 717B1B84-F080-4F12-9F44-0EC1ADE767B9 | Event: presence | Max-Forwards: 70 | CSeq: 1 SUBSCRIBE | Contact: <sip:romeo@example.net>;gr=dr4hcr0st3lup4c | Expires: 0 | Content-Length: 0 A presence-aware SIP-to-XMPP gateway translates such a SIP request into a <presence/> stanza of type "probe" if it does not already have presence information about the contact: Example 25: XMPP Transformation of SIP Presence Request | <presence from='romeo@example.net' | to='juliet@example.com' | type='probe'/>8. Privacy and Security Considerations
Detailed privacy and security considerations are given for presence protocols in [RFC2779], for SIP-based presence in [RFC3856] (see also [RFC3261]), and for XMPP-based presence in [RFC6121] (see also [RFC6120]).8.1. Amplification Attacks
There exists the possibility of an amplification attack launched from the XMPP network against a SIP Presence Server, because each long- lived XMPP presence authorization would typically result in multiple notification dialog refreshes on the SIP side of an XMPP-to-SIP gateway. Therefore, access to an XMPP-to-SIP gateway SHOULD be restricted in various ways; for example:
o Only an XMPP service that carefully controls account provisioning and provides effective methods for the administrators to control the behavior of registered users ought to host an XMPP-to-SIP gateway (e.g., not a service that offers open account registration). o An XMPP-to-SIP gateway ought to be associated with only a single domain or trust realm. For example, an XMPP-to-SIP gateway hosted at simple.example.com ought to allow only users within the example.com domain to access the XMPP-to-SIP gateway, not users within example.org, example.net, or any other domain (unless they are part of the same multi-tenanted environment as example.com). This helps to prevent the gateway equivalent of open relays that are shared across XMPP domains from different trust realms. If a SIP Presence Server receives communications through an XMPP-to- SIP gateway from users who are not associated with a domain that is so related to the hostname of the XMPP-to-SIP gateway, it SHOULD (based on local service provisioning) refuse to service such users or refuse to receive traffic from the XMPP-to-SIP gateway. As a further check, whenever an XMPP-to-SIP gateway seeks to refresh an XMPP user's long-lived authorization to a SIP user's presence, it first sends an XMPP <presence/> stanza of type "probe" from the address of the XMPP-to-SIP gateway to the "bare Jabber Identifier (JID)" (user@domain.tld) of the XMPP user, to which the user's XMPP server responds in accordance with [RFC6121]; this puts an equal burden on the XMPP server and the SIP proxy.8.2. Presence Leaks
Presence notifications can contain sensitive information (e.g., about network availability). In addition, it is possible in both SIP and XMPP for an entity to send different presence notifications to different subscribers. Therefore, a gateway MUST NOT route or deliver a presence notification to any entity other than the intended recipient (as represented by the 'to' address for XMPP and by the Request-URI for SIP), because it does not possess information about authorization to receive presence notifications for such entities -- that information resides at the user's home service, not at the receiving gateway.
9. References
9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>. [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, DOI 10.17487/RFC3261, June 2002, <http://www.rfc-editor.org/info/rfc3261>. [RFC3856] Rosenberg, J., "A Presence Event Package for the Session Initiation Protocol (SIP)", RFC 3856, DOI 10.17487/RFC3856, August 2004, <http://www.rfc-editor.org/info/rfc3856>. [RFC3857] Rosenberg, J., "A Watcher Information Event Template- Package for the Session Initiation Protocol (SIP)", RFC 3857, DOI 10.17487/RFC3857, August 2004, <http://www.rfc-editor.org/info/rfc3857>. [RFC3863] Sugano, H., Fujimoto, S., Klyne, G., Bateman, A., Carr, W., and J. Peterson, "Presence Information Data Format (PIDF)", RFC 3863, DOI 10.17487/RFC3863, August 2004, <http://www.rfc-editor.org/info/rfc3863>. [RFC6120] Saint-Andre, P., "Extensible Messaging and Presence Protocol (XMPP): Core", RFC 6120, DOI 10.17487/RFC6120, March 2011, <http://www.rfc-editor.org/info/rfc6120>. [RFC6121] Saint-Andre, P., "Extensible Messaging and Presence Protocol (XMPP): Instant Messaging and Presence", RFC 6121, DOI 10.17487/RFC6121, March 2011, <http://www.rfc-editor.org/info/rfc6121>. [RFC6665] Roach, A.B., "SIP-Specific Event Notification", RFC 6665, DOI 10.17487/RFC6665, July 2012, <http://www.rfc-editor.org/info/rfc6665>.
[RFC7247] Saint-Andre, P., Houri, A., and J. Hildebrand, "Interworking between the Session Initiation Protocol (SIP) and the Extensible Messaging and Presence Protocol (XMPP): Architecture, Addresses, and Error Handling", RFC 7247, DOI 10.17487/RFC7247, May 2014, <http://www.rfc-editor.org/info/rfc7247>. [RFC7622] Saint-Andre, P., "Extensible Messaging and Presence Protocol (XMPP): Address Format", RFC 7622, DOI 10.17487/RFC7622, September 2015, <http://www.rfc-editor.org/info/rfc7622>.9.2. Informative References
[RFC2778] Day, M., Rosenberg, J., and H. Sugano, "A Model for Presence and Instant Messaging", RFC 2778, DOI 10.17487/RFC2778, February 2000, <http://www.rfc-editor.org/info/rfc2778>. [RFC2779] Day, M., Aggarwal, S., Mohr, G., and J. Vincent, "Instant Messaging / Presence Protocol Requirements", RFC 2779, DOI 10.17487/RFC2779, February 2000, <http://www.rfc-editor.org/info/rfc2779>. [RFC3860] Peterson, J., "Common Profile for Instant Messaging (CPIM)", RFC 3860, DOI 10.17487/RFC3860, August 2004, <http://www.rfc-editor.org/info/rfc3860>. [RFC4480] Schulzrinne, H., Gurbani, V., Kyzivat, P., and J. Rosenberg, "RPID: Rich Presence Extensions to the Presence Information Data Format (PIDF)", RFC 4480, DOI 10.17487/RFC4480, July 2006, <http://www.rfc-editor.org/info/rfc4480>. [RFC4825] Rosenberg, J., "The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)", RFC 4825, DOI 10.17487/RFC4825, May 2007, <http://www.rfc-editor.org/info/rfc4825>. [RFC7572] Saint-Andre, P., Houri, A., and J. Hildebrand, "Interworking between the Session Initiation Protocol (SIP) and the Extensible Messaging and Presence Protocol (XMPP): Instant Messaging", RFC 7572, DOI 10.17487/RFC7572, June 2015, <http://www.rfc-editor.org/info/rfc7572>.
[RFC7573] Saint-Andre, P. and S. Loreto, "Interworking between the Session Initiation Protocol (SIP) and the Extensible Messaging and Presence Protocol (XMPP): One-to-One Text Chat Sessions", RFC 7573, DOI 10.17487/RFC7573, June 2015, <http://www.rfc-editor.org/info/rfc7573>. [RFC7702] Saint-Andre, P., Ibarra, S., and S. Loreto, "Interworking between the Session Initiation Protocol (SIP) and the Extensible Messaging and Presence Protocol (XMPP): Groupchat", RFC 7702, DOI 10.17487/RFC7702, December 2015, <http://www.rfc-editor.org/info/rfc7702>. [XEP-0107] Saint-Andre, P. and R. Meijer, "User Mood", XSF XEP 0107, October 2008, <http://xmpp.org/extensions/xep-0107.html>. [XEP-0108] Meijer, R. and P. Saint-Andre, "User Activity", XSF XEP 0108, October 2008, <http://xmpp.org/extensions/xep-0108.html>.
Appendix A. Changes from RFC 7248
RFC 7248 had already been published when the STOX working group discovered that a related document (since published as [RFC7702]) contained problems that also applied to RFC 7248. Specifically, the diagrams and protocol flows in RFC 7248 contained errors that reflected an incorrect architecture with gateways on both sides of the protocol exchange; in theory and in practice, presence traffic from an XMPP system would be translated by an XMPP-to-SIMPLE gateway on the XMPP side and received by a normal SIP/SIMPLE system directly (without a receiving gateway on the SIP/SIMPLE side), and traffic from a SIP system would be translated by a SIMPLE-to-XMPP gateway on the SIP side and received by a normal XMPP system (without a receiving gateway on the XMPP side). Therefore, this document makes the following substantive changes from RFC 7248: o Corrects the architectural assumptions, diagrams, and protocol flows to reflect a single-gateway model in each direction. o Adjusts terminology to replace the term "SIP Server" with the term "SIP Proxy" or "SIP Presence Server" as appropriate, and to use the term "notification dialog" for a SIP subscription and the term "presence authorization" for an XMPP subscription instead of the generic term "subscription" in both contexts. o Clarifies that SIP notification dialogs are used to handle presence authorizations in SIP (e.g., there is no dedicated way to signal outbound cancellation of an authorization as there is in XMPP). o Clarifies the use of the 'presence.winfo' event package, of the SIP Subscription-State headers (specifically with values of "pending", "active", "closed", or "terminated"), and of SIP NOTIFY messages with no body. o Clarifies the durations of notification dialogs and presence authorizations, and how they are extended in SIP and handled in XMPP. o Removes the mapping of the XMPP 'id' attribute to the SIP "CSeq" header. o Describes the handling of multiple connected resources in XMPP. o Provides information about mitigations for leaks of presence information.
Acknowledgements
Thanks to the authors, contributors, and other individuals acknowledged in RFC 7248. Thanks to Saul Ibarra Corretge and Markus Isomaki for their reviews during working group consideration. Special thanks to Ben Campbell for identifying the underlying discrepancy that resulted in the need to obsolete RFC 7248. Thanks also to Markus Isomaki and Yana Stamcheva as the working group chairs and Alissa Cooper as the sponsoring Area Director.Author's Address
Peter Saint-Andre Filament Email: peter@filament.com URI: https://filament.com/