Indicating WebSocket Protocol as a Transport in the Session Initiation Protocol (SIP) Common Log Format (CLF)

The WebSocket protocol enables bidirectional message exchange between clients and servers on top of a persistent TCP connection (optionally secured with TLS ). The initial protocol handshake makes use of HTTP semantics, allowing the WebSocket protocol to reuse existing transport connections. RFC 7118 defines a WebSocket subprotocol for transporting SIP messages between a WebSocket client and server. SIP messages can be logged using the Common Log Format defined in RFC 6873 . In order to make such SIP CLF logging possible for SIP messages transported over the WebSocket protocol, a new WebSocket "Transport Flag" ('W') must be added to the "Transport Flags" already defined in RFC 6873 (i.e., UDP, TCP, and SCTP). This document updates RFC 6873 by defining a new SIP CLF "Transport Flag" value for WebSocket.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

This document contains several examples of SIP CLF records showing messages over plain and secure WebSocket connections. The formatting described in this document does not permit the examples to be unambiguously rendered due to the constraints imposed by the formatting rules for RFCs. To avoid ambiguity and to meet the RFC layout requirements, this document uses the <allOneLine/> markup convention established in . This markup convention is described in detail in Section 3 of RFC 6873 and used throughout that document for representing the syntax of SIP CLF records.

Section 4.2 of RFC6873 specifies the mandatory fields in a SIP CLF record. The fourth and fifth bytes of the five-byte "Flags Field" are the "Transport Flag" and the "Encryption Flag", respectively. SIP messages transported over both a plain and secure WebSocket connection can be clearly distinguished by appropriately setting these two flag fields. The currently registered values of the "Transport Flag" (Section 9.2 of RFC 6873) are UDP ('U'), TCP ('T'), and SCTP ('S'). This document defines and registers a new "Transport Flag" value 'W' for WebSocket transport of SIP messages and consequently updates RFC 6873 and the IANA "SIP CLF Transport Flag Values" registry. SIP CLF records of messages transported over a plain WebSocket connection (WS) MUST set the "Transport Flag" to this new 'W' value and the "Encryption Flag" value to 'U' (Unencrypted). SIP CLF records of messages transported over a secure WebSocket (WSS) connection (i.e., WS over TLS) MUST set the "Transport Flag" to this new 'W' value and the "Encryption Flag" value to 'E' (Encrypted).

The following examples show sample SIP CLF records logged for SIP messages transported over both plain and secure WebSocket connections.

The following example represents a SIP INVITE request sent over a plain WebSocket connection. For the sake of brevity, the Session Description Protocol (SDP) body is omitted.

Contact: Content-Type: application/sdp Content-Length: 418 ]]> Shown below is approximately how this message would appear as a single record in a SIP CLF logging file if encoded according to the syntax described in . Due to RFC conventions, this log entry has been split into five lines, instead of the two lines that actually appear in a log file; and the tab characters have been padded out using spaces to simulate their appearance in a text terminal.

1328821153.010 RORWU 1 INVITE - sip:bob@example.com 192.0.2.10:80 192.0.2.200:56485 sip:bob@example.com - sip:alice@example.com asdyka899 asidkj3ss S1781761-88 C67651-11 ]]> A bit-exact version of the actual log entry is provided here, Base64 encoded , using the uuencode utility.

The original SIP CLF format can be obtained by reversing the effects of uuencode by simply applying the uudecode transform. Additionally, to recover the unencoded file, the Base64 text above may be passed as input to the following perl script (the output should be redirected to a file).

#!/usr/bin/perl use strict; my $bdata = ""; use MIME::Base64; while(<>) { if (/begin-base64 644 clf_ws_record/ .. /-- ==== --/) { if ( m/^\s*[^\s]+\s*$/) { $bdata = $bdata . $_; } } } print decode_base64($bdata);

]]>



      
        The following example represents a SIP INVITE request sent
        over a secure WebSocket connection (i.e., WebSocket over TLS
        ). For the sake of brevity, the SDP
        body is omitted. 
            
Contact: 
Content-Type: application/sdp
Content-Length: 439
      ]]>
           Shown below is approximately how this message
        would appear as a single record in a SIP CLF logging file if
        encoded according to the syntax described in . Due to RFC conventions, this log entry has
        been split into five lines, instead of the two lines that
        actually appear in a log file; and the tab characters have
        been padded out using spaces to simulate their appearance in a
        text terminal. 
            
1328821153.010    RORWE    1 INVITE    -    sip:bob@example.com
192.0.2.10:443    192.0.2.200:56485    sip:bob@example.com    -    
sip:alice@example.com:5060    asdyka899    asidkj3ss    S1781761-88    
C67651-11

      ]]>
           A bit-exact version of the actual log entry is
        provided here, Base64 encoded.



    
      This document merely adds a new "Transport Flag" value for
      the WebSocket protocol. This value may be set in a SIP CLF
      record, but its use does not intrinsically introduce any new
      security considerations. 

When logging protocol information, such
      as with SIP CLF, there are a myriad of security, privacy, and
      data protection issues to consider. These are exhaustively described in
      RFC 6872  and RFC 6873 .

      Any security considerations specific to the WebSocket
      protocol or its application as a transport for SIP are detailed
      in the relevant specifications (the WebSocket protocol  and SIP over WebSockets ) and are considered outside the scope of this
      document.
    

    
      This document defines a new value ('W') for SIP CLF
      "Transport Flag". IANA has registered this value in the
      "SIP CLF Transport Flag Values" registry, as shown in
       below.

      
        Value

        Transport Protocol

        Reference

        W

        WebSocket

        RFC 7118, RFC 7355

        
      

    

    
      The authors would like to thank Vijay Gurbani for shepherding
      this document and Area Director Richard Barnes for his
      sponsorship. This work benefitted from the thorough review and
      constructive comments of Richard Barnes, Barry Leiba, Benoit
      Claise, Pete Resnick, Stephen Farrel, and Vijay Gurbani.