<title>Jingle SOCKS5 Bytestreams Transport Method</title>
<abstract>This specification defines a Jingle transport method that results in sending data via the SOCKS5 Bytestreams (S5B) protocol defined in XEP-0065. Essentially this transport method reuses XEP-0065 semantics for sending the data and defines native Jingle methods for starting and ending an S5B session.</abstract>
<remark><p>Minor changes to track modifications to XEP-0166; updated security considerations for consistency with other transport methods; added section on service discovery.</p></remark>
<remark><p>Initial published version.</p></remark>
</revision>
<revision>
<version>0.0.3</version>
<date>2009-02-18</date>
<initials>psa</initials>
<remark><p>Clarified order of events to be consistent with raw-udp and ice-udp.</p></remark>
</revision>
<revision>
<version>0.0.2</version>
<date>2009-02-11</date>
<initials>dm</initials>
<remark><p>Add additional text to use NAT assisting protocols and allow the responder to also send <streamhost/> information. This change required the introduction of streamhost-used and streamhost-error.</p></remark>
</revision>
<revision>
<version>0.0.1</version>
<date>2009-02-10</date>
<initials>psa</initials>
<remark><p>Rough draft.</p></remark>
</revision>
</header>
<section1topic='Introduction'anchor='intro'>
<p>&xep0166; defines a framework for negotiating and managing data sessions over XMPP. In order to provide a flexible framework, the base Jingle specification defines neither data transport methods nor application formats, leaving that up to separate specifications. The current document defines a transport method for establishing and managing data exchanges between XMPP entities using the existing SOCKS5 Bytestreams (S5B) protocol specified in &xep0065;. This "jingle-s5b" method results in a streaming transport method suitable for use in Jingle application types where packet loss cannot be tolerated (e.g., file transfer).</p>
<p>It is RECOMMENDED that a client offers as much <streamhost/> elements with itself as StreamHost as possible. This includes opening the TCP port on all available interfaces the user wants to use (e.g. maybe not an expensive UMTS link), both the IPv4 and IPv6 of that interface (if available), and using an assisting NAT protocol if possible. If the client knows it is behind and the router announces UPnP IGD or NAT-PMP support, the client SHOULD map the open port to the external interface of the router and include the public IP address and port information in the <streamhost/> offers. To increase the chance of success without using a proxy, this specification allows the responder to also send offers.</p>
</section1>
<section1topic='Protocol'anchor='protocol'>
<para>The basic flow is as follows.</para>
<code><![CDATA[
Romeo Juliet
| |
| session-initiate |
| (with S5B info) |
|--------------------------------->|
| ack |
|<---------------------------------|
| session-accept |
| (with S5B info) |
|<---------------------------------|
| ack |
|--------------------------------->|
| streamhost transport-info |
|<---------------------------------|
| ack |
|--------------------------------->|
| streamhost-used transport-info |
|--------------------------------->|
| ack |
|<---------------------------------|
| S5B "SESSION" |
|<================================>|
| session-terminate |
|<---------------------------------|
| ack |
|--------------------------------->|
| |
]]></code>
<p>This flow is illustrated in the following examples (to prevent confusion these use a "stub" transport instead of a real application type).</p>
<p>First the initiator sends a Jingle session-initiate request that contains one or more transport candidates, which in jingle-s5b are XEP-0065 streamhosts.</p>
<p>Depending on the application type, a user agent controlled by a human user might need to wait for the user to affirm a desire to proceed with the session before continuing. When the user agent has received such affirmation (or if the user agent can automatically proceed for any reason, e.g. because no human intervention is expected or because a human user has configured the user agent to automatically accept sessions with a given entity), it returns a Jingle session-accept message. This message MUST contain a &TRANSPORT; element qualified by the 'urn:xmpp:jingle:transports:s5b:0' namespace, which SHOULD in turn contain one <streamhost/> element for each SOCKS5 Bytestreams candidate generated by or known to the responder, but MAY instead be empty if the responder does not wish to offer any streamhosts or wishes to send each candidate as the payload of a transport-info message.</p>
<p>Note: If the responder sends streamhost candidates, the chances of a successful connection are increased. For example, the initiator might be behind a NAT or might have no access to a proxy, whereas the responder might have a public IP address, might know about a streamhost proxy, or might have NAT penetration support like NAT-PMP in the router.</p>
<p>In the following example, Juliet's client is the StreamHost and opens one port. The provided <streamhost/> elements are the (private) IPv4 address of the interface, a (public) IPv6 address, and the public IPv4 address created by mapping the private IP address/port using NAT-PMP.</p>
<examplecaption="Responder sends session-accept with streamhost candidates"><![CDATA[
<p>Once one client has successfully created a connection with a StreamHost, it sends the <streamhost-used/> element defined in XEP-0065 to the peer; as a result, both clients will stop trying to connect to other candidates. <note>If both clients happen to send the streamhost-used message at the same time (two connections are open), the StreamHost chosen by the initiator wins (consistent with the rules in <cite>XEP-0166</cite>) and the responder closes the streamhost connection it was able to establish.</note></p>
<examplecaption="Initiator sends streamhost-used in Jingle transport-info"><![CDATA[
<p>The initiator can then immediately begin sending data over the SOCKS5 bytestream as described in XEP-0065 (in fact the streamhost is bidirectional, so the responder can use it as well).</p>
<p>Once the parties have finished using the bytestream (e.g., because a complete file has been sent), either party can send a Jingle session-terminate action.</p>
<examplecaption="Initiator terminates the session"><![CDATA[
<p>If the initiator receives such an error message from the responder and was also unable to connect to any StreamHosts (or did not receive any from the responder), it MUST either terminate the Jingle session with a Jingle reason of <connectivity-error/> or replace the transport by something else using the transport-replace action. Typically the fallback option is &xep0047;. Therefore the initiator sends a transport-replace action including a transport of IBB.</p>
<examplecaption="Initiator replaces transport with IBB"><![CDATA[
<p>If the transport replacement is acceptable, the responder then sends a transport-accept action to the initiator (if not, the responder sends a transport-reject action).</p>
<p>Now the initiator sends data using In-Band Bytestreams as defined in <cite>XEP-0047</cite>.</p>
</section1>
<section1topic='Processing Rules and Usage Guidelines'anchor='rules'>
<p>The same processing rules and usage guidelines defined in XEP-0065 apply to the Jingle S5B Transport Method. Additional implementation suggestions are:</p>
<ol>
<li>A client should try the offered StreamHosts in the given order.</li>
<li>If more than one <streamhost/> element is present a client should wait 200ms before trying the next one.</li>
<li>If the JID of a StreamHosts is not the one of the peer it indicates the usage of a proxy. If the client had offered direct connection information it MAY want to wait a little bit longer than 200ms before trying the first proxy to allow the peer to connect without the usage of a proxy.</li>
<li>A client should NOT wait for a TCP timeout on connect. If it is unable to connect to any StreamHost within 5 seconds it should send the streamhost-error.</li>
<p>To advertise its support for the Jingle SOCKS5 Bytestreams Transport Method, when replying to &xep0030; information requests an entity MUST return URNs for any version of this protocol that the entity supports -- e.g., "urn:xmpp:jingle:transports:s5b:0" for this version &VNOTE;.</p>
<examplecaption="Service discovery information request"><![CDATA[
<p>In order for an application to determine whether an entity supports this protocol, where possible it SHOULD use the dynamic, presence-based profile of service discovery defined in &xep0115;. However, if an application has not received entity capabilities information from an entity, it SHOULD use explicit service discovery instead.</p>
<section2topic='Sharing IP Addresses'anchor='security-sharing'>
<p>The exchange of StreamHosts might result in exposure of the sender's IP addresses, which comprise a form of personally identifying information. A Jingle client MUST enable a user to control which entities will be allowed to receive such information. If a human user explicitly accepts a session request, then the client SHOULD consider that action to imply approval of IP address sharing. However, waiting for a human user to explicitly accept the session request can result in delays during session setup, since it is more efficient to immediately begin sharing transport candidates. Therefore, it is RECOMMENDED for the client to immediately send transport candidates to a contact (without waiting for explicit user approval of the session request) in the following cases:</p>
<ol>
<li>The user has permanently and formally authorized the contact to view the user's presence information via a presence subscription as reflected in an XMPP roster item (see &xmppim;).</li>
<li>The user has temporarily and dynamically shared presence with the contact via "directed presence" as described in <cite>RFC 3921</cite>.</li>
<li>The user has explicitly added the contact to a "whitelist" of entities who are allowed to access the user's personally-identifying information.</li>
</ol>
</section2>
<section2topic='Encryption of Media'anchor='security-media'>
<p>A Jingle implementation SHOULD support security preconditions that are enforced before application media is allowed to flow over the bytestream, such as those described in &xtls;.</p>
<p>The ®ISTRAR; shall add to its registry of Jingle transport methods a definition for the "jingle-s5b" transport method. The registry submission is as follows:</p>