Subject: [Simple] Updated presence specs

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 03 Dec 2002 15:22:28 -0500

Folks,

I've just submitted an update to all three core presence specs 
(presence, watcherinfo package, watcherinfo format) based on comments 
received during last call, including those from our AD. Until they 
appear in the archives, you can pick them up at:

http://www.jdrosen.net/papers/draft-ietf-simple-presence-08.txt
http://www.jdrosen.net/papers/draft-ietf-simple-winfo-package-03.txt
http://www.jdrosen.net/papers/draft-ietf-simple-winfo-format-03.txt

THe changes are mostly minor. Below you will find a summary.

PRESENCE
--------
* reduced the author list to one, as I have been the primary author
and editor for some time. This was at the request of Patrik, and is
consistent with RFC-editor policy on author lists. The remainder of
the author list was moved to a contributor section.

* Section 4, overview of operation, reported that a SUBSCRIBE with
Expires: 0, used for fetch, was identical to processing of a SUBSCRIBE
with a non-zero Expires, in that both result in an immediate
NOTIFY. This isn't true. An immediate NOTIFY is only sent, in all
cases, when the SUBSCRIBE is either pending or authorized. Clarified
that.

* Reworked the section on replay prevention. Added a few paragraphs
describing why replay was bad. Remvoed the text which talked about
including Call-ID, CSeq and Date headers in the signature; that
requires the use of message/sip signed bodies and was not the
intent. Rather, the signature is just over the PIDF document. PIDF
provides its own timestamp for replay prevention; the spec now
mandates its usage. I also added some verbiage on how and when http
digest can be used to provide replay protection.

* The section on DoS attack prevention described a check that the UA
could make. If the From field domain and the Contact domain didn't
match, inform the user. However, this is really useless, since
frequently the Contact header field will contain an IP address. This
attack is better prevented by authentication and authorization, and if
it does happen, timeouts and NOTIFY rejections remove a subscription
anyway. Thus, it is adequately handled without this text. The text was
therefore removed.

* Split the DoS protection section into two - one section addressing
attacks against third parties (the text that was there before), and a
new subsection on attacks against the server itself. In that section,
added a brief discussion on standard sip techniques for dealing with
such attacks.

* Made section heading capitalizations consistent.

* More formal terminology alignment with rfc 2778 in the introduction.

* Updated references

* Change CPIM references to CPP, based on the document split in IMPP.

* Updated the usage of presence URIs to reflect current consensus on
this issue in IMPP.

* Removed the text in 6.6 about generating a 403 if the PA doesn't
want to accept forwarded subscribe requests. This text pre-dated the
inclusion of equivalent text in RFC 3261. Since the text is now in RFC
3261, there is no need to repeat it here.

* Removed text in section 6.6.1 about obtaining subscriber identity in
networks of transitive trust. This paragraph predates the now
extensive work on network asserted identity for sip. The paragraph
merely states that identity establishment through transitive trust is
one approach in inter-domain networks, and cites the relevant I-Ds on
the subject as non-normative approaches. This includes the P-NAI
header and the more recent identity work using authenticated identity
bodies.

* aligned with latest caller preferences spec. In particular, it is
now a SHOULD for a PUA that can support PA function to indicate
support for both SUBSCRIBE method and the presence event package.

* fixed up the presentation of the section on migration and state
agents. In particular, the text is more explicit in meeting the
requirements outlined in RFC 3265 for this section, in that it now
talks about authentication and authorization. The migration text was
streamlined a bit, removing some of the redundant definitions.

* There was never a normative strength associated with implementing
the watcherinfo package in presence servers. Since authorization in
state agents must be considered by any event package, support for
that package was made a SHOULD.

* general improvements in wording, attempting to be more brief and
switch from passive to active tense (I have a habit of writing in
passive tense).

* Updated the text on creating presence documents from registrations -
terminology fixes and clarifications. Also state that the means by
which registrations are turned into presence documents is a matter of
policy.

WINFO PACKAGE
--------------

* changed title to reflect SIP guidelines

* fixed Via header in example NOTIFY request in Section 3.1

* updated references

WINFO FORMAT
------------

* updated references

* indicate that version numbers dont wrap.

Thanks,
Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
simple mailing list
[email-masked]
http://mailman.dynamicsoft.com/mailman/listinfo/simple