A Clarification on the Use of Globally Routable User Agent URIs (GRUUs) in the SIP Event Notification Framework
updates
- rfc-6665 — SIP-Specific Event Notification
Extracted elements (8)
GRUUs are required in the SIP event notification context to allow subscribers to send SUBSCRIBE or REFER requests to a specific user agent instance, targeting something like an INVITE dialog on a specific device. The original RFC 6665 text was ambiguous about whether this applied only to SUBSCRIBE-created dialogs or to all dialogs.
The strict GRUU requirement is relaxed for dialogs where a notifier will never accept subscriptions, because the restriction serves no purpose in that case, though use of GRUUs in such context causes no harm either.
This document updates RFC 6665 to clarify GRUU handling requirements, replacing the original normative paragraph in Section 4.5.1 of RFC 6665. Implementations of RFC 6665 that did not apply the GRUU requirement to INVITE-created dialogs are non-conformant with this clarification.
An implementation that uses a non-GRUU local contact under the subscription-rejection exception MUST reject any request that might create a subscription to the associated dialog, whether via SUBSCRIBE or REFER.
Notifiers MUST implement the GRUU extension defined in RFC 5627. Notifiers MUST use a GRUU as their local target for all dialog-forming methods and all target-refresh methods, except for dialogs where they will reject all subscription requests (implicit or explicit).
The requirements to implement and use GRUUs specifically include dialogs created by the INVITE method, not only SUBSCRIBE-created dialogs.
When rejecting a subscription request under the non-GRUU exception, the rejection code SHOULD be 403 (Forbidden) unless some other code is more appropriate to the circumstances.
This mechanism does not introduce any security issues beyond those discussed in RFC 6665. No new attack surface is created by this clarification.