Obtaining and Using Globally Routable User Agent URIs (GRUUs) in the Session Initiation Protocol (SIP)
Extracted elements (30)
Public GRUUs are designed to expose the underlying AOR because it allows call logs and user interfaces to present meaningful identifiers to users, and because RFC 3261 URI equality rules (which ignore unknown parameters) make the public GRUU 'look like' the AOR to systems that don't understand GRUU, easing backward compatibility.
Public GRUUs are given a semi-permanent property (SHOULD remain valid after contact expiry, returning 480) rather than a MUST because registrar failures could cause the set of valid GRUUs to be lost; however, public GRUUs can be constructed stateless (e.g., AOR plus instance ID in 'gr' parameter) so no extra state is required.
Temporary GRUUs accumulate during the lifetime of a registration (each refresh produces a new valid temporary GRUU rather than replacing prior ones) to support scenarios like ad-hoc conferencing where a UA has handed out a previous GRUU in an ongoing session that must continue to be reachable.
A UA implementing both RFC 3680 (SIP registration event package) and GRUU MUST also implement RFC 5628 (extension to RFC 3680 for GRUU), as RFC 3680 allows registrars to shorten registrations forcefully and RFC 5628 is necessary to keep the set of valid temporary GRUUs synchronized between UA and registrar.
When RFC 5626 (SIP outbound) is in use for multiple flows for redundancy, temporary GRUUs remain valid as long as at least one flow is registered, and if a REGISTER refresh for a reg-id changes the Call-ID, all temporary GRUUs for the entire UA instance (not just one flow) are invalidated.
A registrar MUST be able to determine the instance ID and AOR when presented with a GRUU. GRUUs associated with different AORs or different instance IDs MUST be different based on URI equality comparison. A GRUU MUST NOT be equivalent to any AOR in the domain except the one associated with it.
A terminating authoritative proxy MUST record-route when the Request-URI is a URI in the location service, the selected contact has an instance ID bound to a GRUU, and the registration contains a Path URI.
A UA MUST be prepared for a Contact header field in a REGISTER response to contain just a 'pub-gruu', just a 'temp-gruu', neither, or both. If the Call-ID changed from a previous REGISTER for the same contact or reg-id, the UA MUST discard all temporary GRUUs learned through prior responses.
A UA SHOULD use a GRUU when populating the Contact header field of dialog-forming and target refresh requests and responses (INVITE, SUBSCRIBE, NOTIFY, REFER, UPDATE, and their 2xx responses). A UA MUST have an active registration before using a GRUU and MUST NOT reuse a GRUU from a lapsed registration.
An originating authoritative proxy MUST record-route when it receives a dialog-forming request where the Contact contains a valid GRUU in the proxy's domain associated with the authenticated requestor's AOR, and the request contains Record-Route headers. Forwarding services SHOULD NOT be applied to requests sent to a GRUU.
If a mid-dialog request arriving at the authoritative proxy has Route header field values beyond the one pointing to the proxy itself, stored Path URIs MUST be discarded to avoid call spirals and failures; this is required local policy when GRUUs are in use.
If a proxy receives a request with a 'gr' URI parameter in the Request-URI that does not match a currently valid GRUU in the domain, it SHOULD reject with 404. If there are no registered contacts bound to the GRUU, the proxy MUST return 480.
If a UA wishes its previously obtained temporary GRUUs to remain valid, it MUST utilize the same Call-ID in REGISTER refreshes; changing the Call-ID causes the registrar to invalidate all temporary GRUUs for that UA instance.
If the Call-ID in a REGISTER request differs from the most recently registered contact with the same AOR and instance ID, the registrar MUST invalidate all previously generated temporary GRUUs for that AOR and instance ID; subsequent requests to those GRUUs will be rejected with a 404.
If the contact URI in a REGISTER request is equivalent to the AOR, or is a GRUU for the AOR, the registrar MUST reject with a 403. If the contact is not a SIP URI, the request MUST also be rejected with a 403.
If the REGISTER request's Supported header includes 'gruu' and the registrar has at least one temporary GRUU for the instance, the registrar MUST add a 'temp-gruu' Contact header parameter with the most recently created temporary GRUU; similarly it MUST add 'pub-gruu' if a public GRUU is assigned.
The contact URI in a REGISTER request MUST NOT be equivalent (based on RFC 3261 URI equality rules) to the AOR in the To header field, and if the contact URI is a GRUU, it MUST NOT be a GRUU for that AOR, to prevent routing loops.
The temporary GRUU construction algorithm MUST ensure: (1) the likelihood of collision with another GRUU is vanishingly small; and (2) given a pair of GRUUs, it MUST be computationally infeasible to determine whether they were issued for the same AOR or instance ID.
The user and host parts of a GRUU learned in a REGISTER response MUST be treated opaquely by the UA; the UA MUST NOT modify them, MUST NOT modify or remove unrecognized URI parameters, and MUST NOT add, remove, or modify transport, lr, maddr, ttl, user, or comp URI parameters.
When a temporary GRUU has no more registered contacts bound to it (due to expiration or de-registration of the last contact for the instance ID), the temporary GRUU MUST be invalidated. A public GRUU SHOULD remain valid after contact expiry and return 480 (Temporarily Unavailable) until re-registration.
When a UA compliant to this specification generates a REGISTER request, it MUST include the Supported header field with 'gruu' as one of the option tags, and for each contact for which it desires a GRUU, MUST include a '+sip.instance' media feature tag as a UA characteristic.
When using a temporary GRUU for anonymous calls per RFC 3323, a UA MUST NOT use a temporary GRUU learned in a REGISTER response whose Call-ID differs from the most recent REGISTER request for the same AOR, instance ID, and reg-id.
A UA wishing to invalidate a temporary GRUU to limit reachability SHOULD change the Call-ID in a REGISTER refresh rather than forcefully expiring and re-registering, which would cause unnecessary unreachability. The specification does not provide the ability to invalidate individual temporary GRUUs.
Temporary GRUUs replace the RFC 3323 user-provided privacy Contact format (bare IP address) and provide equivalent or better privacy: using a different temporary GRUU per call prevents call correlation by correspondents via the Contact header, though SDP IP address information still allows correlation independent of GRUU usage.
A GRUU is a SIP URI with the 'gr' URI parameter (with or without a value) that routes to a specific UA instance and is globally routable. There are two types: public GRUUs (expose the underlying AOR, constructed by adding 'gr' with the instance ID value to the AOR) and temporary GRUUs (hide the AOR for privacy).
The 'gruu' SIP option tag is included in Supported headers to indicate support for the GRUU extension, and optionally in a Require header of a REGISTER request to mandate that the registrar support the extension before processing the registration.
Three IANA registrations are made: two Contact header field parameters ('pub-gruu' and 'temp-gruu') in the registry created by RFC 3968, one SIP URI parameter ('gr') in the registry created by RFC 3969, and a SIP option tag ('gruu') per RFC 3261 Section 27.1.
A malicious insider can use a GRUU observed from a call to launch an amplification DoS attack by placing the victim's GRUU as the Contact in a SUBSCRIBE to a presence server, directing traffic towards the victim. Proxies SHOULD validate that the GRUU in the Contact matches the authenticated identity of the sender to mitigate this.
A UA SHOULD use SIPS URI when registering to ensure integrity of the GRUU returned in the response; tampering with the GRUU could cause denial of service. Proxies and registrars MUST support SIPS and MUST support TLS.
Two new Contact header field parameters are defined: 'temp-gruu' (EQUAL quoted-string containing the temporary GRUU SIP URI) and 'pub-gruu' (EQUAL quoted-string containing the public GRUU SIP URI). A new SIP URI parameter 'gr' is defined as 'gr' optionally followed by '=' and a pvalue.