Subject: [Sip] New text for ua-privacy

From: "Elwell, John" <[email-masked]>
Date: Thu, 05 Mar 2009 07:29:09 +0000

I previously commented on the last sentence of the following text in
5.1.1 (Contact header field) of draft-ietf-sip-ua-privacy-05:
"   When using this header field in a dialog-forming request or response
   or in a mid-dialog request or response, the user agent MUST anonymize
   the Contact header field using an anonymous URI ("temp-gruu")
   obtained through the GRUU mechanism, unless an equivalent functional
   anonymous URI is provided by some other means.  For out-of-dialog
   request, anonymous URI MAY be set when anonymization is required."

The reason for my comment was that I wasn't certain where the last
sentence would apply.

Of course, a REGISTER request or 200 response is "out of dialog", but
clearly an anonymized Contact URI is inappropriate.

In addition I have identified the following requests:
- OPTIONS - Contact MAY be included.
- PUBLISH - Contact, if present, doesn't have any meaning in the context
of event publication.
- MESSAGE - Contact not allowed.

Furthermore, non-dialog-forming responses to things like INVITE and
SUBSCRIBE do not require Contact, with the exception of 3xx where the
URI clearly cannot be anonymized.

So how to cover this concisely? I would propose replacing the last
sentence above with the following:

"For other requests and responses, with the exception of 3xx responses,
REGISTER requests and REGISTER 200 responses, the UA MUST either omit
the Contact header field or use an anonymous URI."

Would this be acceptable? Have I captured all exceptions?

John

---

From: Mayumi Munakata <[email-masked]>
Date: Thu, 05 Mar 2009 17:14:56 +0900

John,

See inline.

 > The reason for my comment was that I wasn't certain where the last

The original intent of the sentence was to anonymize
the Contact except for the REGISTER requests and 3xx
responses, as you pointed out in November, but I agree
that it is hard to tell from the current sentence.

 > - MESSAGE - Contact not allowed.

The Contact header is not allowed in PUBLISH request,
I believe.  Therefore, the Contact in OPTIONS is the
only case we should care as out-of-dialog request.

 > Would this be acceptable? Have I captured all exceptions?

This text is much clearer than the original text.
I think this captures all the exceptions.
If there is no more exceptions, I will replace
the last sentence with your text.

Thank you!

Mayumi

 >
 > John
 > _______________________________________________
 > Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
 > This list is for NEW development of the core SIP Protocol
 > Use [email-masked] for questions on current sip
 > Use [email-masked] for new developments on the application of sip
 >