%ents; ]>
Jabber OOB Broadcast Service (JOBS) A protocol for enabling uni-directional multicast data transfers out of band. &LEGALNOTICE; 0042 Retracted Standards Track Standards JEP-0004 (OPTIONAL), JEP-0011 (RECOMMENDED) JEP-0029 (REQUIRED) None JEP-0065 JOBS Matthew Miller linuxwolf@outer-planes.net linuxwolf@outer-planes.net 0.5 2003-04-11 psa At the request of the JEP author, changed status to Retracted. This JEP will not be considered further by the Jabber Software Foundation and should not be used as a basis for implementations. 0.4 2002-10-22 lw More restrictive on usage of "action" attributes; Reduced session information returned in most use-cases; Added action for retrieving session information; Added action for service ("proxy") invites 0.3 2002-10-20 lw Complete overhaul (redesign to allow for peer-to-peer operation; reduced element-set; removed "session types"; reorganized into use-cases) 0.2 2002-08-20 lw Added "detailed" description of OOB headers 0.1 2002-08-14 lw Initial Release

Distributing data out-of-band (OOB) to one or more end-points is a requirement for many Jabber clients. The Jabber OOB Broadcast Service (JOBS) is a mechanism to allow end-points to open uni-directional data streams between each other, on top of which any number of applications can be built Possible applications include file transfer, audio/video streaming, and some gaming implementations..

The aim of this JEP is to define a process of connecting a sender to one or more receivers through a secondary TCP port.

As the name implies, JOBS is designed to enable multicast, uni-directional OOB connections. These connections are usually between a "sender" client, a JOBS "service", and one or more "receiver" clients. Each such set of connections is collectively called a session. JOBS is designed to allow a single service to handle multiple sessions over a single host/port combination.

To address a large number of typical uses efficiently, JOBS can multicast the data from a sender to multiple receivers. In order to keep the protcol as simple as possible, it only allows data to flow in one direction.

JOBS utilizes a "two-band" authentication mechanism. This allows the end-points to know practically nothing about each other, yet still be assured that the OOB connection is really to/from the Jabber entity its intended to be. The authentication system is then backed-up with explicit authorization requests.

For the OOB portion, clients connect to the host/address and port of the JOBS service for a given session. Once connected, a client-initiated handshake process occurs, and (if successful), then data is routed from the sender's connection to each receiver's connection. The only point at which any error information may be conveyed over the OOB connection is during the handshake process.

Term Description
OOB Out-Of-Band. Any network connection that exists outside of the normal Jabber protocol traffic.
session A session registered with a "server" for clients to connect to.
client An end-point on a JOBS session.
service The JOBS Jabber component/server.
server A particular host/port of the JOBS service.
sender The client sending data.
receiver A client receiving data.

Discovering support for JOBS involves either &xep0011; or &xep0030;. This determines if the end-point understands the JOBS protocol.

To determine support for JOBS via jabber:iq:browse, look for an item with a nested <ns/> with a value of "http://jabber.org/protocol/jobs":

]]> ... http://jabber.org/protocol/jobs ... ]]>

The JOBS protocol supports various scenarios to create sessions. Most of these scenarios allow an entity to determine the possible parameters to create a session with. To actually create a session, the (would-be) sender sends an "iq-set" with a <session action="create"/>. This returns the details of the newly created session, including the ID and OOB host/port.

This use-case can be completely ignored for true "peer-to-peer" systems.

The simplest create request is:

]]> ]]>

This creates a session between sender@domain/resource and any one receiver. At this point, the JOBS service is ready to accept connections for this session. The <session/> element describes the details for the session. The value returned in the "id" attribute is the JOBS session ID The exact value of the ID is left to JOBS implementations..

When creating a session, parameters to <session/> can be supplied, explicitly requesting that certain parameters be met (such as buffer size, time to expire, and receiver limit). Since these parameters have lower- and upper-bounds specific to the JOBS service, a sender may need to determine these limits.

To determine the limits, the sender sends an "iq-get" with a <session action="create"/>:

]]> ]]>

The returned <session/> is also prefilled with default values for all known parameters.

To create a session with specific parameters, the sender sends an "iq-set" as in the "simple" use-case, but then specifying the parameter values desired:

]]> ]]>

The above example creates a session that does not timeout. A JOBS service uses values from the default information set for any parameters that are missing.

Any parameters that exceed the minimums/maximums causes an error.

In some cases, the session creation process requires an interface more suitable for human consumption. In such cases the JOBS protocol helps by allowing for contained elements governed by other namespaces. For form-based creation, a &xep0004; form can be embedded in the <session/>.

To create a session using forms, send a <session action="create"/> with an embedded <x xmlns="jabber:x:data"/>:

]]> Please specify values for the given fields. 0 30 1 ]]>

The exact fields present in the form are dependent upon the JOBS implementation. The form SHOULD allow a user to at least specify the <session/> attributes.

Using the form-based approach, the session is then created by sending a <session action='create'/> with a form submission (as defined for "jabber:x:data"):

jobs.domain:12676 0 300 1 ]]> ]]>

Once the session is created, the sender invites receivers to connect. The sender can invite receivers either directly, or via the JOBS service. Most invitations are distributed via <message/>.

The sender can invite receivers directly. This is done using a <message/>:

Let's connect! ]]>

When inviting directly, the <session/> MUST contain enough information for a receiver to connect OOB. The required information is:

  • host
  • id
  • port

Alternatively, a sender can invite receivers via the JOBS service. This is also done using a <message/>, with a <session action="notify"/> containing one or more <item action="invite" type="connection"/>:

Let's connect! receiver@domain ]]>

This results in the JOBS service sending the <message/> to each <item/>. Any additional elements (such as a <body/>) are passed onto those invited:

Let's connect! ]]>

At any time, a client can request information about sessions for a JOBS service. The request can be directed for "all" sessions, or a specific sessionWho is allowed to perform this action is left up to the JOBS service implementation..

A client can request all the sessions for a JOBS service by sending an "iq-get" containing a <session action="info"/> with no ID:

]]>

The JOBS service responds with all the sessions within the "iq-result". This is the only case where a result can have more than one <session/>.

sender@domain/res ]]>

Alternatively, a client can request the information for a specific session by sending an "iq-get" containing a <session action="info"/> with the ID:

]]>

The service responds with an "iq-result" of just the requested session.

sender@domain/res ]]>

When a client connects (sender or receivers), a client-initiated handshake takes place. The purpose of this handshake is to authenticate the OOB connection, in relation to the client's JID. This authentication utilizes both in-band and OOB packets.

To start the handshake, the client sends an "init" packet on its established connection:

If the session exists, and the client's JID is not automatically rejected, the JOBS service responds with an auth-challenge packet, containing an unique, arbitrary token:

Once received, the client then sends an "iq-set" containing a <session action="authenticate"/>, which itself contains an <item type='auth' action='confirm'/> with this confirm key:

SID00001234 hehe ]]>

The service then compares this confirm key to that sent with the "auth-challenge" OOB packet. If this matches correctly, and the service determines this connection is authorized, the session will respond with a <session action="authenticate"/> containing a <item type="auth" action="accept"/> with the accept key:

SID88884321 ]]>

At this point, the client responds on the OOB data stream with an "auth-response" packet:

If the connection is accepted, the JOBS service sends a "connected" packet:

and after this, the data transfer occurs. If this connection is the sender, they may start sending data now (regardless if receivers are connected). If this connection is a receiver, the sender's data immediately follows the terminating "newline".

Authenticating ensures the OOB connection matches a particular JID. Authorizing ensures to the service that receiver is allowed to be connected to the session. To determine if the session connection should be accepted or rejected, the JOBS service first checks if the JID matches the sender. This matches against the "full" JID, including node, domain, and resource. If this connection is the sender, it is allowed. Otherwise, the service confirms the connection with the sender.

If a confirmation is required, the service sends an "iq-get" to the sender, with a <session action="authorize"/> containing an <item type"connection" action="confirm"/> with the full JID of the receiver:

receiver@domain/res ]]>

One or more <item type="connection" action="confirm/> elements, each specifying a JID to accept/reject. To accept (or reject) a connection, the sender responds with an "iq-result", wrapping each JID in either an <item type="connection" action="accept"/> or <item type="connection" action="reject"/>.

receiver@domain/res ]]> receiver@domain/res ]]>

If the connection is rejected, the service drops the connection, and notifies the sender and receiver of the dropped connection.

The sender may drop a connection at any time. To drop a connection, the sender sends an "iq-set" with the <session/> containing the "connection" to drop:

receiver@domain/res ]]>

If the connection is successfully dropped, the service returns an "iq-result":

]]>

The service also sends notification messages to the sender and the JID of the dropped connection (detailed in the "Being Notified about Events" section).

Sessions are deleted either by timeout or explicitly. Sessions are deleted by timeout automatically under certain conditions. Sessions can also be deleted explicity by their senders, at any time. Regardless of the method of deletion, a notice is sent to all connected.

This use-case can be completely ignored for true "peer-to-peer" systems.

The exact conditions that expire a session are mostly up to the implementation. At a minimum, a session SHOULD be expired when there are less than two connections, and the "expires" time is reached.

To explictly delete a session, the sender sends an "iq-set" containing a <session action="delete"/>:

]]> ]]>

When a connection is accepted, the service sends a "notify" message to the sender and (if appropriate) the accepted receiver, with a <item type='connection' action='accept'/>:

]]>

If the notification is not about the recipient of the message, then the <item/> contains the JID this notification pertains to.

When a connection is rejected, the service sends a "notify" message to the sender and (if appropriate) the accepted receiver, with a <item type='connection' action='reject'/>:

]]>

If the notification is not about the recipient of the message, then the <item/> contains the JID this notification pertains to.

When a connection is dropped, the service sends a "notify" message to the sender and (if appropriate) the accepted receiver, with a <item type='connection' action='drop'/>:

]]>

If the notification is not about the recipient of the message, then the <item/> contains the JID this notification pertains to.

When a session is deleted, any clients connected to the session are immediately disconnected. The "notify" message is sent to the sender and any receivers still connected, with the <session action="notify"/> containing an <item type="status"/>:

]]> ]]>

The reason the session is deleted is specified by the action attribute. A value of "delete" means it was explicitly deleted. A value of "expire" means it timed out.

]]>

The <session/> element is the core element to the protocol. This element provides both information about a session and the action applied to it. It has a large number of attributes, and contains zero or more <item/> elements, zero or more <connect/> elements, and zero or three <limit/> elements. It may also contain elements governed by other namespaces.

The "action" attribute specifies the action to apply or being applied to the session. From clients, this attribute MUST be specified. From the service this attribute MAY be specified (to prevent ambiguity). The value of "action" MUST be one of the following:

Value Description
authenticate Authenticating one or more connections.
authorize Authorizing one or more connections.
create Create a new session.
delete Delete an existing session.
notify Notification about the session.

The "status" attribute specifies the current status of the session. This attribute MUST NOT be present if the session does not have an identifier (i.e. does not yet exist). Only the service can provide this attribute. The value of "status" MUST be one of the following:

Value Description
active The session is active, but not yet in use.
closed The session has closed.
in-use The session is in use (e.g. data is being transferred).
pending The session is ready, but not yet active (e.g. not enough connections).

The "host" attribute specifies the OOB hostname for the session. This attribute SHOULD be specified when possible. The value of this attribute can either be the "raw" dotted-decimal address or a fully-qualified domain name.

The "id" attribute identifies the session. This attribute is required for all uses of <session/> except the request to create a session. This value is any string that the service and clients can use to uniquely identify it.

The "port" attribute specifies the OOB port number for the session. This attribute SHOULD be specified when possible.

The "sender" attribute specifies the JID of the sender. This attribute SHOULD be specified when possible. The value of this attribute MUST be the full JID of the sender, including node and resource (if possible).

The "buffer" attribute specifies the size of a temporary transfer buffer. This attribute MAY be present at any time, and SHOULD be presented by the service wherever possible. The value of this attribute MUST be a non-negative number. A value of 0 means there is no buffer. This value has limits defined by the "jobs:buffer" parameter statistic.

The "expires" attribute specifies the number of seconds before this session times out. This attribute MAY be present at any time, and SHOULD be presented by the service wherever possible. The value of this attribute MUST be either a positive number or -1. A value of -1 means this session does not expire. This value has limits defined by the "jobs:expires" parameter statistic.

The "receivers" attribute specifies the maximum number of receivers this session can have. this attribute MAY be present at any time, and SHOULD be presented by the service wherever possible. The value of this attribute MUST be either a positive number of -1. A value of -1 means this session can (theoretically) have any number of receivers. This value has limits defined by the "jobs:receivers" parameter statistic.

The <item/> element is used for detailed information about specific items of a session. It is used to contain authentication keys, to define connections, and provide more detailed status for a session. It has attributes for the type of item and the action associated with this item. This element contains only character data.

The "action" attribute specifies the action to apply or being applied to this item. From clients, this attribute SHOULD be specified. From the service, this attribute MUST be specified (to prevent ambiguity). The value of "action" MUST be one of the following:

Value Description Notes
accept The item is accepted. This value MUST only be used when the type is "auth" or "connection".
confirm The item needs confirmation. This value MUST only be used when the type is "auth" or "connection".
delete The item is deleted. This value MUST only be used when the type is "status".
drop The item is dropped. This value MUST only be used when the type is "connection".
expire The item has expired. This value MUST only be used when the type is "status".
invite The item is invited to the session. This value MUST only be used when the type is "connection".
reject The item is rejected. This value MUST only be used when the type is "auth" or "connection".

The "type" attribute specifies the type of item. This attribute MUST be present. The value of "type" MUST be one of the following:

Value Description
auth The item pertains to authentication keys.
connection The item details a session connection. The CDATA is the JID that is connected.
status The item details a session status event.

The <connect/> element specifies a valid host/port combination for a session. An instance of this element MUST be present for each host/port combination possible. This element SHOULD only be present when information on creating sessions is requested. It has attributes to define the OOB hostname and port number. This element is empty.

The "host" attribute specifies the OOB hostname. This attribute MUST be present. The value is either the "raw" dotted-decimal IP address, or the fully-qualified domain name.

The "port" attribute specifies the OOB port number. This attribute MUST be present. The value MUST be a positive integer in the range (0 < port <= 1024).

The <limit/> element specifies a valid host/port combination for a session. An instance of this element MUST be present for each "type". This element SHOULD only be present when information on creating sessions is requested. It has attributes to define the type of limit, the default value, the minimum value, and the maximum value. This element is empty.

The "type" attribute specifies the type of limit. This attribute MUST be present. Each type corresponds to an attribute of <session/>. The value of "type" MUST be one of the following:

Value Description
buffer The buffer size limits. The units for "default", "max", and "min" are bytes.
expires The expires time limits. The units for "default", "max", and "min" are seconds.
receivers The receiver count limits. The units for "default", "max", and "min" are number of connections.

The "default" attribute specifies the default value for this limit. This attribute MUST be present. The value of "default" MUST be a number.

The "max" attribute specifies the maximum value for this limit. This attribute MUST be present. The value of "max" MUST be a number. A value of -1 means there is no maximum value.

The "min" attribute specifies the minimum value for this limit. This attribute MUST be present. The value of "min" MUST be a number. A value of -1 means there is no minimum value.

Code Message Cause
400 Bad Request The JOBS service did not understand the request.
403 Forbidden The JOBS service cannot accept the authentication request from the requesting JID.
404 Not Found The JOBS service could not find the given session.
406 Not Acceptable The authentication is not valid.
Code Message Cause
400 Bad Request The JOBS service did not understand the request.
403 Forbidden The JOBS service cannot accept the authorization request from the requesting JID.
404 Not Found The JOBS service could not find the given session.
406 Not Acceptable The authorization is not valid.
Code Message Cause
400 Bad Request The JOBS service did not understand the request.
403 Forbidden The JOBS service cannot accept any creation requests from this JID.
406 Server Not Acceptable The JOBS service cannot accept any creation requests using the requested <server/> parameters.
406 Restrictions Not Acceptable The JOBS service cannot accept any creation requests using the requested <accept/>, <confirm/>, and/or <reject/> parameters.
503 Service Unavailable The JOBS service cannot accept any additional sessions at this time. Future requests may be accepted.
Code Message Cause
400 Bad Request The JOBS service did not understand the request.
403 Forbidden The JOBS service cannot accept deletion requests from the requesting JID.
404 Not Found The JOBS service could not find a given session.
Code Message Cause
400 Bad Request The JOBS service did not understand the request.
403 Forbidden The JOBS service denied the connection for any reason.
404 Not Found The JOBS service could not find a given connection and/or JID.
406 Not Acceptable The JOBS service denied the notify for some reason.
504 Remote Server Timeout The JOBS connection timed out.

The OOB protocol consists of a series of hanshaking headers, then the normal data transfer process. The syntax of the hanshake packets is similar to HTTP and SIP, in that it includes a "version and method" line, followed by zero or more "headers". The end of a packet is marked by two adjacent carriage returns (i.e. a single "empty" line). The primary difference is with the first line ("version and method"), where the protocol name and version precede the method.

OCTET := CTL := UALPHA := LALPHA := DIGIT := SP := CR := LF := BINDATA := ]]>
Comand-line (example) jobs/0.4 init
Expected header-fields
  • "session-id" - The JOBS session ID
  • "client-jid" - The (full) client JID
Comand-line (example) jobs/0.4 auth-challenge
Expected header-fields
  • confirm - A unique <item type="auth" action="confirm"/> token
Comand-line (example) jobs/0.4 auth-response
Expected header-fields
  • accept - A unique <item type="auth" action="accept"/> token
Comand-line (example) jobs/0.4 connected
Expected header-fields NONE
Comand-line (example) jobs/0.4 error
Expected header-fields
  • error-code - The HTTP-like error code
  • error-msg - Detailed error message