xep-0260.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE xep SYSTEM 'xep.dtd' [
  <!ENTITY % ents SYSTEM 'xep.ent'>
%ents;
]>
<?xml-stylesheet type='text/xsl' href='xep.xsl'?>
<xep>
<header>
  <title>Jingle SOCKS5 Bytestreams Transport Method</title>
  <abstract>This specification defines a Jingle transport method that results in sending data via the SOCKS5 Bytestreams (S5B) protocol defined in XEP-0065. Essentially this transport method reuses XEP-0065 semantics for sending the data and defines native Jingle methods for starting and ending an S5B session.</abstract>
  &LEGALNOTICE;
  <number>0260</number>
  <status>Draft</status>
  <type>Standards Track</type>
  <sig>Standards</sig>
  <approver>Council</approver>
  <dependencies>
    <spec>XMPP Core</spec>
    <spec>XEP-0030</spec>
    <spec>XEP-0065</spec>
  </dependencies>
  <supersedes/>
  <supersededby/>
  <shortname>jingle-s5b</shortname>
  <schemaloc>
    <url>http://xmpp.org/schemas/jingle-transports-s5b.xsd</url>
  </schemaloc>
  <discuss>jingle</discuss>
  &stpeter;
  &dmeyer;
  &infiniti;
  &mlundblad;
  &tobias;
  <author>
    <firstname>Klaus</firstname>
    <surname>Hartke</surname>
    <email>klaus.hartke@googlemail.com</email>
    <jid>nx@jabber.org</jid>
  </author>
  <revision>
    <version>1.0.3</version>
    <date>2018-05-15</date>
    <initials>fs</initials>
    <remark><p>Replace broken link using archive.org</p></remark>
  </revision>
  <revision>
    <version>1.0.2</version>
    <date>2018-05-04</date>
    <initials>egp</initials>
    <remark><p>Fix the schema to mention @sid is required rather than optional.</p></remark>
  </revision>
  <revision>
    <version>1.0.1</version>
    <date>2016-05-17</date>
    <initials>ssw</initials>
    <remark><p>Fix broken ICE-TCP reference.</p></remark>
  </revision>
  <revision>
    <version>1.0</version>
    <date>2011-09-23</date>
    <initials>psa</initials>
    <remark><p>Per a vote of the XMPP Council, advanced specification from Experimental to Draft; also added a further note about calculation of the 'dstaddr' attribute.</p></remark>
  </revision>
  <revision>
    <version>0.9</version>
    <date>2011-09-13</date>
    <initials>psa/tm</initials>
    <remark><p>Further clarified use of the dstaddr attribute, especially when the responder shares a proxy candidate with the initiator.</p></remark>
  </revision>
  <revision>
    <version>0.8</version>
    <date>2011-09-08</date>
    <initials>psa/tm</initials>
    <remark><p>More clearly described how to activate the bytestream.</p></remark>
  </revision>
  <revision>
    <version>0.7</version>
    <date>2011-08-31</date>
    <initials>psa</initials>
    <remark><p>Per feedback from the XMPP Council, changed some implementation guidelines from normative to informative and modified the security considerations to remove user interface recommendations and the recommendation to use XTLS (since it is not longer being actively developed).</p></remark>
  </revision>
  <revision>
    <version>0.6</version>
    <date>2011-08-26</date>
    <initials>psa/tm</initials>
    <remark><p>Added a 'dstaddr' attribute for feature-parity with XEP-0065.</p></remark>
  </revision>
  <revision>
    <version>0.5</version>
    <date>2010-04-13</date>
    <initials>psa</initials>
    <remark><p>Removed 'zeroconf' attribute for consistency with XEP-0065; clarified use of proxy-error condition; corrected schema.</p></remark>
  </revision>
  <revision>
    <version>0.4</version>
    <date>2010-02-17</date>
    <initials>ml/psa</initials>
    <remark><p>Added proxy-error action; added a block-size attribute in the transport-accept action when negotiating fallback to another transport, analogous to changes in XEP-0261; editorial review.</p></remark>
  </revision>
  <revision>
    <version>0.3</version>
    <date>2009-07-14</date>
    <initials>dm/kh/psa/jk</initials>
    <remark><p>Major update to make Jingle S5B inherit more features from ICE and ICE-TCP. Added priorities and candidate identifiers. Renamed streamhost element to candidate element. Updated candidate selection to use priorities, and it is now required for both clients to send a candidate-used or candidate-error notification. Defined type attribute to differentiate between various kinds of candidates. More clearly described how S5B negotiation is completed, including an activated notification from responder to initiator when the candidate used is a proxy. Noted reuse of fast-mode methodology from S5B optimization specification. Because of incompatibilities with the previous version, changed the namespace to urn:xmpp:jingle:transports:s5b:1.</p></remark>
  </revision>
  <revision>
    <version>0.2</version>
    <date>2009-03-09</date>
    <initials>psa</initials>
    <remark><p>Minor changes to track modifications to XEP-0166; updated security considerations for consistency with other transport methods; added section on service discovery.</p></remark>
  </revision>
  <revision>
    <version>0.1</version>
    <date>2009-02-19</date>
    <initials>psa</initials>
    <remark><p>Initial published version.</p></remark>
  </revision>
  <revision>
    <version>0.0.3</version>
    <date>2009-02-18</date>
    <initials>psa</initials>
    <remark><p>Clarified order of events to be consistent with raw-udp and ice-udp.</p></remark>
  </revision>
  <revision>
    <version>0.0.2</version>
    <date>2009-02-11</date>
    <initials>dm/jk</initials>
    <remark><p>Specified that the responder can send &lt;streamhost/&gt; candidates, consistent with the earlier S5B optimization extension; this change required the introduction of streamhost-used and streamhost-error. Also added text to encourage the use of NAT-assisting protocols.</p></remark>
  </revision>
  <revision>
    <version>0.0.1</version>
    <date>2009-02-10</date>
    <initials>psa</initials>
    <remark><p>Rough draft.</p></remark>
  </revision>
</header>

<section1 topic='Introduction' anchor='intro'>
  <p>&xep0166; defines a framework for negotiating and managing data sessions over XMPP. In order to provide a flexible framework, the base Jingle specification defines neither data transport methods nor application formats, leaving that up to separate specifications. The current document defines a transport method for establishing and managing data exchanges between XMPP entities using the existing SOCKS5 Bytestreams (S5B) protocol specified in &xep0065;. This "jingle-s5b" method results in a streaming transport method suitable for use in Jingle application types where packet loss cannot be tolerated (e.g., file transfer). Jingle-S5B reuses the protocol flow from &xep0065; for the communication with a SOCKS5 streamhost; the communication between two clients to negotiate the possible candidates differs from <cite>XEP-0065</cite> and shares similarities with &xep0176;</p>
</section1>

<section1 topic='Protocol' anchor='protocol'>
  <p>The basic flow is as follows.</p>
  <code><![CDATA[
Initiator                        Responder
  |                                  |
  |  session-initiate                |
  |  (with S5B candidates)           |
  |--------------------------------->|
  |  ack                             |
  |<---------------------------------|
  |  session-accept                  |
  |  (with S5B candidates)           |
  |<---------------------------------|
  |  ack                             |
  |--------------------------------->|
  |  candidate-used transport-info   |
  |<---------------------------------|
  |  ack                             |
  |--------------------------------->|
  |  candidate-used transport-info   |
  |--------------------------------->|
  |  ack                             |
  |<---------------------------------|
  |  S5B "SESSION"                   |
  |<================================>|
  |  session-terminate               |
  |<---------------------------------|
  |  ack                             |
  |--------------------------------->|
  |                                  |
]]></code>
  <p>This flow is illustrated in the following examples (to simplify the presentation these use an "example" application instead of a real application type).</p>
  <section2 topic='Selecting Candidates' anchor='select'>
    <p>It is RECOMMENDED that a client will offer as many &lt;candidate/&gt; elements as possible with itself as the host (i.e., non-proxy candidates). Such candidates might be found using the following methods:</p>
    <ul>
      <li>Opening the TCP port on all available interfaces the user wants to use (e.g., maybe not an expensive UMTS link), including the IPv4 and IPv6 addresses of that interface (if available).</li>
      <li>Using the client's external IP address as discovered through an assisting NAT protocol or other means.</li>
    </ul>
    <p>If the client knows it is behind a NAT and the router announces UPnP IGD or NAT-PMP support, the client SHOULD map the open port to the external interface of the router and include the public IP address and port information in the &lt;candidate/&gt; offers. To increase the chance of success without using a proxy, this specification encourages the responder to also send offers, effectively equivalent to the "fast-mode" for SOCKS5 Bytestreams as previously described at &lt;<link url='https://web.archive.org/web/20161019171450/http://delta.affinix.com/specs/stream.html'>http://delta.affinix.com/specs/stream.html</link>&gt;.</p>
  </section2>
  <section2 topic='Exchanging Candidates' anchor='exchange'>
    <p>Once the initiator has a set of candidates, it sends a Jingle session-initiate request that contains one or more transport candidates which are a mixture of &xep0065; streamhosts and ICE candidates used in <cite>XEP-0176</cite>.</p>
    <p>Just as with the &QUERY; element from &xep0065;, here the &lt;transport/&gt; element contains the candidates. The following rules apply to the defined attributes of the &lt;transport/&gt; element when sent by the initiator in a Jingle session-initate message:</p>
    <ol>
      <li>The 'sid' attribute MUST be included. This attribute specifies the Stream ID for this bytestream.</li>
      <li>The 'dstaddr' attribute SHOULD be included if the initiator includes at least one candidate of the "proxy" type. This attribute enables the initiator to communicate the value it has calculated for the SOCKS5 DST.ADDR field (see Section 5.3.2 and Section 7 of &xep0065;) so that the responder can provide an accurate value to the proxy during SOCKS5 negotiation. Here the value is calculated as SHA1(SID + Initiator JID + Responder JID) since the initiator will be the entity that activates the bytestream at the proxy. <note>In <cite>XEP-0065</cite>, the DST.ADDR is always calculated as SHA1(SID + Requester JID + Target JID); in <cite>XEP-0260</cite> the Jingle "initiator" is the SOCKS5 Bytestreams "requester" and the Jingle "responder" is the SOCKS5 Bytestreams "target", so for proxy candidates sent from the initiator/requester to the responder/target the DST.ADDR is calculated as SHA1(SID + Initiator JID + Responder JID). Note well that the calcuation for proxy candidates sent from the responder/target to the initiator/requester is SHA1(SID + Responder JID + Initiator JID); this scenario is not covered by <cite>XEP-0065</cite> since in that specification only the SOCKS5 Bytestreams "requester" provides candidates.</note></li>
      <li>The 'mode' attribute MAY be included. This attribute specifies whether the underlying transport for the bytestream will be TCP (a value of "tcp", which is the default) or UDP (a value of "udp", see Section 8 of &xep0065;).</li>
    </ol>
    <p>In the following example, Romeo's client has two interfaces, one on port 5086 and the other on port 5087. The provided candidates are the IPv4 address of one interface, the IPv4 address of the second interface, and a proxy address at streamer.shakespeare.lit. Because Romeo's client has included a proxy candidate, it includes its computed value for the DST.ADDR field in the 'dstaddr' attribute (here computed as the SHA-1 hash of "vj3hs98yromeo@montague.lit/orchardjuliet@capulet.lit/balcony").</p>
    <example caption="Initiator sends session-initiate"><![CDATA[
<iq from='romeo@montague.lit/orchard'
    id='xn28s7gk'
    to='juliet@capulet.lit/balcony'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='session-initiate'
          initiator='romeo@montague.lit/orchard'
          sid='a73sjjvkla37jfea'>
    <content creator='initiator' name='ex'>
      <description xmlns='urn:xmpp:example'/>
      <transport xmlns='urn:xmpp:jingle:transports:s5b:1'
                 dstaddr='972b7bf47291ca609517f67f86b5081086052dad'
        	 mode='tcp'
                 sid='vj3hs98y'>
        <candidate cid='hft54dqy'
                   host='192.168.4.1'
                   jid='romeo@montague.lit/orchard'
                   port='5086'
                   priority='8257636'
                   type='direct'/>
        <candidate cid='hutr46fe'
                   host='24.24.24.1'
                   jid='romeo@montague.lit/orchard'
                   port='5087'
                   priority='8258636'
                   type='direct'/>
        <candidate cid='xmdh4b7i'
                   host='123.456.7.8'
                   jid='streamer.shakespeare.lit'
                   port='7625'
                   priority='7878787'
                   type='proxy'/>
      </transport>
    </content>
  </jingle>
</iq>
]]></example>
    <p>The responder immediately acknowledges receipt.</p>
    <example caption="Responder acknowledges session-initiate"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='xn28s7gk'
    to='romeo@montague.lit/orchard'
    type='result'/>
]]></example>
    <p>Depending on the application type, a user agent controlled by a human user might need to wait for the user to affirm a desire to proceed with the session before continuing. When the user agent has received such affirmation (or if the user agent can automatically proceed for any reason, e.g. because no human intervention is expected or because a human user has configured the user agent to automatically accept sessions with a given entity), it returns a Jingle session-accept message.</p>
    <p>This message MUST contain a &TRANSPORT; element qualified by the 'urn:xmpp:jingle:transports:s5b:1' namespace, which SHOULD in turn contain one &lt;candidate/&gt; element for each SOCKS5 Bytestreams candidate generated by or known to the responder, but MAY instead be empty if the responder does not wish to offer any candidates or wishes to send each candidate as the payload of a transport-info message. If the responder sends candidates in the session-accept, the chances of a successful connection are increased. For example, the initiator might be behind a NAT or might have no access to an S5B proxy, whereas the responder might have a public IP address, might know about a proxy, or might have NAT penetration support like NAT-PMP in a router. However, the responder MUST NOT offer as a candidate any host/port combination that has already been offered by the initiator; this helps to prevent failure of negotiation with S5B proxies.</p>
    <p>The following rules apply to the defined attributes of the &lt;transport/&gt; element when sent by the responder in a Jingle session-accept message:</p>
    <ol>
      <li>The 'sid' attribute MUST be included and MUST be the same Stream ID communicated by the initiator in the Jingle session-initiate message.</li>
      <li>The 'dstaddr' attribute SHOULD be included if the responder includes at least one candidate of the "proxy" type. This attribute enables the responder to communicate the value it has calculated for the SOCKS5 DST.ADDR field (see Section 5.3.2 and Section 7 of &xep0065;) so that the initiator can provide an accurate value to the proxy during SOCKS5 negotiation. Here the value is calculated as SHA1(SID + Responder JID + Initiator JID) since the responder will be the entity that activates the bytestream at the proxy. <note>As noted, the calculation for proxy candidates sent from the responder/target to the initiator/requester is SHA1(SID + Responder JID + Initiator JID); this scenario is not covered by <cite>XEP-0065</cite> since in that specification only the SOCKS5 Bytestreams "requester" provides candidates.</note></li>
      <li>The 'mode' attribute MUST NOT be included since the underlying transport for the bytestream is determined by the initiator.</li>
    </ol>
    <p>In the following example, Juliet's client opens one port. The provided candidates are the (private) IPv4 address of the interface, a (public) IPv6 address, the public IPv4 address created by mapping the private IP address/port using NAT-PMP, and a proxy address. Because Juliet's client has included a proxy candidate, it includes its computed value for the DST.ADDR field in the 'dstaddr' attribute (here computed as the SHA-1 hash of "vj3hs98yjuliet@capulet.lit/balconyromeo@montague.lit/orchard").</p>
    <example caption="Responder sends session-accept with candidates"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='hwd987h'
    to='romeo@montague.lit/orchard'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='session-accept'
          responder='juliet@capulet.lit/balcony'
          sid='a73sjjvkla37jfea'>
    <content creator='initiator' name='ex'>
      <description xmlns='urn:xmpp:example'/>
      <transport xmlns='urn:xmpp:jingle:transports:s5b:1'
                 dstaddr='1a12fb7bc625e55f3ed5b29a53dbe0e4aa7d80ba'
                 sid='vj3hs98y'>
        <candidate cid='ht567dq'
                   host='192.169.1.10'
                   jid='juliet@capulet.lit/balcony'
                   port='6539'
                   priority='8257636'
                   type='direct'/>
        <candidate cid='grt654q2'
                   host='2001:638:708:30c9:219:d1ff:fea4:a17d'
                   jid='juliet@capulet.lit/balcony'
                   port='6539'
                   priority='8257606'
                   type='direct'/>
        <candidate cid='hr65dqyd'
                   host='134.102.201.180'
                   jid='juliet@capulet.lit/balcony'
                   port='16453'
                   priority='7929856'
                   type='assisted'/>
        <candidate cid='pzv14s74'
                   host='234.567.8.9'
                   jid='proxy.marlowe.lit'
                   port='7676'
                   priority='7788877'
                   type='proxy'/>
      </transport>
    </content>
  </jingle>
</iq>
]]></example>
    <p>The initiator acknowledges receipt and tries to connect to the offered candidates.</p>
    <example caption="Initiator acknowledges session-accept"><![CDATA[
<iq from='romeo@montague.lit/orchard'
    id='hwd987h'
    to='juliet@capulet.lit/balcony'
    type='result'/>
]]></example>
    <p>A client SHOULD check the offered candidates in order of their priority, starting with the highest value. How the priority is calculated depends on the actual available interfaces. An implementation SHOULD use the following formula:</p>
    <code>
priority = (2^16)*(type preference) + (local preference)
     </code>
    <p>The type preference is an integer value between 0 and 127. The following types and their suggested preference values are defined.</p>
    <table caption='Defined Types'>
      <tr>
	<th>Type</th>
	<th>Description</th>
	<th>Preference Value</th>
      </tr>
      <tr>
	<td>direct</td>
	<td>Direct connection using the given interface</td>
	<td>126</td>
      </tr>
      <tr>
	<td>assisted</td>
	<td>Direct connection using NAT assisting technologies like NAT-PMP or UPnP-IGD</td>
	<td>120</td>
      </tr>
      <tr>
	<td>tunnel</td>
	<td>Tunnel protocols such as Teredo</td>
	<td>110</td>
      </tr>
      <tr>
	<td>proxy</td>
	<td>SOCKS5 Relay</td>
	<td>10</td>
      </tr>
    </table>
    <p>The local preference is used to rate different candidates of the same type, e.g. a DSL link might be preferred over a VPN connection. The value of the local preference SHOULD be between 0 and 65535. The proposed values are only guidelines. If a client wants to increase or decrease the value of a specific candidate it is free to do so. For instance, a client might have an expensive UMTS link as a last resort and might rate this link lower than all SOCKS5 relays.</p>
  </section2>
  <section2 topic='Connecting to Candidates' anchor='connect'>
    <p>After receiving its peer's candidates, a client start to connect to them in order of the priority. A detailed description of the protocol can be found in &xep0065;.</p>
    <p>Once one client has successfully created a connection, it sends the &lt;candidate-used/&gt; element to the peer inside a Jingle transport-info message. If a client receives a candidate-used notification it SHOULD continue trying to connect to candidates sent by its peer if it has not tried all candidates with a higher priority than the one successfully used by the peer.</p>
    <example caption="Initiator sends candidate-used in Jingle transport-info"><![CDATA[
<iq from='romeo@montague.lit/orchard'
    id='hjdi8'
    to='juliet@capulet.lit/balcony'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='transport-info'
          initiator='romeo@montague.lit/orchard'
          sid='a73sjjvkla37jfea'>
    <content creator='initiator' name='ex'>
      <transport xmlns='urn:xmpp:jingle:transports:s5b:1'
                 sid='vj3hs98y'>
        <candidate-used cid='hr65dqyd'/>
      </transport>
    </content>
  </jingle>
</iq>
]]></example>
    <p>The peer immediately acknowledges receipt.</p>
    <example caption="Responder acknowledges candidate-used message"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='hjdi8'
    to='romeo@montague.lit/orchard'
    type='result'/>
]]></example>
    <p>If a client is unable to connect to <em>any</em> candidate sent by its peer, or if it stopped trying to connect because its peer sent a candidate-used notification with a priority higher than its remaining candidate(s), it sends a candidate-error Jingle transport-info message (this is equivalent to the IQ-error with code='500' from the "fast-mode" extension).</p>
    <example caption="Responder sends candidate-error in Jingle transport-info"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='gft65ewd'
    to='romeo@montague.lit/orchard'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='transport-info'
          initiator='romeo@montague.lit/orchard'
          sid='a73sjjvkla37jfea'>
    <content creator='initiator' name='ex'>
      <transport xmlns='urn:xmpp:jingle:transports:s5b:1'
                 sid='vj3hs98y'>
        <candidate-error/>
      </transport>
    </content>
  </jingle>
</iq>
]]></example>
    <p>The peer immediately acknowledges receipt.</p>
    <example caption="Responder acknowledges candidate-error message"><![CDATA[
<iq from='romeo@montague.lit/orchard'
    id='gft65ewd'
    to='juliet@capulet.lit/balcony'
    type='result'/>
]]></example>
  </section2>
  <section2 topic='Completing the Negotiation' anchor='complete'>
    <p>The transport negotiation is completed in one of the following ways:</p>
    <ol start='1'>
      <li>If both parties send a candidate-error notification then the SOCKS5 negotiation has failed and the parties need to fall back to some other transport method, typically (but not necessarily) IBB; see the <link url='#fallback'>Fallback Methods</link> section of this document for details.</li>
      <li>If one of the parties sends a candidate-error notification and the other party sends a candidate-used notification, then the candidate-used shall be considered the nominated candidate.</li>
      <li>If both parties send a candidate-used notification but the candidates have a different priority, then the candidate with the higher priority shall be considered the nominated candidate.</li>
      <li>If both parties send a candidate-used notification with candidates having the same priority, then the candidate chosen by the initiator shall be considered the nominated candidate (this is consistent with the rules in &xep0166;).</li>
    </ol>
    <p>The parties shall use the nominated candidate for the data transfer. However, if the nominated candidate is of the "proxy" type, then the peer has no way to know when it can send data. Therefore the party that offered the nominated candidate MUST do two things...</p>
    <p>First, it activates the bytestream, as described in &xep0065;:</p>
    <example caption="Responder activates the bytestream at proxy"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='vy1fa63k'
    to='streamer.shakespeare.lit'
    type='set'>
  <query xmlns='http://jabber.org/protocol/bytestreams'
         sid='a73sjjvkla37jfea'>
    <activate>romeo@montague.lit/orchard</activate>
  </query>
</iq>
]]></example>
    <example caption="Proxy informs responder of activation"><![CDATA[
<iq from='streamer.shakespeare.lit'
    id='vy1fa63k'
    to='juliet@capulet.lit/balcony'
    type='result'/>
]]></example>
    <p>Second, it sends an activated notification to the peer; it does so by sending a transport-info message containing an &lt;activated/&gt; element:</p>
    <example caption="Responder informs initiator that bytestream has been activated"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='bv73bs91'
    to='romeo@montague.lit/orchard'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='transport-info'
          initiator='romeo@montague.lit/orchard'
          sid='a73sjjvkla37jfea'>
    <content creator='initiator' name='ex'>
      <transport xmlns='urn:xmpp:jingle:transports:s5b:1'
                 sid='vj3hs98y'>
        <activated cid='xmdh4b7i'/>
      </transport>
    </content>
  </jingle>
</iq>
]]></example>
    <p>If the nominated candidate is of the proxy type and either party cannot connect to the proxy (for example because of a restrictive firewall), the failing party shall send a transport-info message containing an &lt;proxy-error/&gt; element.</p>
    <example caption="Responder informs initiator of inability to connect to the proxy"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='bv73bs91'
    to='romeo@montague.lit/orchard'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='transport-info'
          initiator='romeo@montague.lit/orchard'
          sid='a73sjjvkla37jfea'>
    <content creator='initiator' name='ex'>
      <transport xmlns='urn:xmpp:jingle:transports:s5b:1'
                 sid='vj3hs98y'>
        <proxy-error/>
      </transport>
    </content>
  </jingle>
</iq>
]]></example>
    <p>The parties shall then consider the bytestream unsuccessful and SHOULD attempt to fall back to another transport as described in <link url='#fallback'>Fallback Methods</link>.</p>
  </section2>
  <section2 topic='Exchanging Data' anchor='data'>
    <p>Once the parties have chosen (and if necessary activated) a streamhost, they can exchange data as defined in &xep0065;.</p>
  </section2>
  <section2 topic='Closing the Bytestream' anchor='close'>
    <p>Once the parties have finished using the bytestream (e.g., because a complete file has been sent), either party can send a Jingle session-terminate action.</p>
    <example caption="Initiator terminates the session"><![CDATA[
<iq from='romeo@montague.lit/orchard'
    id='hz81vf48'
    to='juliet@capulet.lit/balcony'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='session-terminate'
          initiator='romeo@montague.lit/orchard'
          sid='a73sjjvkla37jfea'>
    <reason><success/></reason>
  </jingle>
</iq>
]]></example>
    <p>The other party then acknowledges the session-terminate and the Jingle session is finished.</p>
    <example caption="Responder acknowledges session-terminate"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='hz81vf48'
    to='romeo@montague.lit/orchard'
    type='result'/>
]]></example>
  </section2>
</section1>

<section1 topic='Fallback Methods' anchor='fallback'>
  <p>If the SOCKS5 Bytestreams negotiation fails, the parties might want to "fall back" to another transport. Currently the transport of last resort for a streaming exchange is &xep0047; as described for Jingle in &xep0261;, however if other transport methods are defined in the future (e.g. &rfc6544;) then clients could fall back to those methods instead of IBB. The protocol flow for fallback from S5B to IBB is as follows.</p>
  <code><![CDATA[
Romeo                               Juliet
  |                                  |
  |  session-initiate                |
  |  (with S5B info)                 |
  |--------------------------------->|
  |  ack                             |
  |<---------------------------------|
  |  session-accept                  |
  |  (with S5B info)                 |
  |<---------------------------------|
  |  [ SOCKS5 failure! ]             |
  |x--------------------------------x|
  |  transport-replace (IBB)         |
  |--------------------------------->|
  |  ack                             |
  |<---------------------------------|
  |  transport-accept (IBB)          |
  |<---------------------------------|
  |  ack                             |
  |--------------------------------->|
  |  IBB "SESSION"                   |
  |=================================>|
  |  terminate                       |
  |<---------------------------------|
  |  ack                             |
  |--------------------------------->|
  |                                  |
]]></code>
  <p>First the initiator sends a Jingle session-initiate, in this case with a transport of SOCKS5 Bytestreams. The protocol flow is exactly the same as described above. If both parties are unable to connect to a candidate provided by the peer, they send candidate-error messages to indicate that SOCKS5 has failed. The initiator MUST either terminate the Jingle session with a Jingle reason of &lt;connectivity-error/&gt; or replace the transport with something else using the transport-replace action. Typically the fallback option is IBB (see, for example, &xep0234;). Therefore the initiator sends a transport-replace action including a transport of IBB.</p>
    <example caption="Initiator replaces transport with IBB"><![CDATA[
<iq from='romeo@montague.lit/orchard'
    id='hs92n57'
    to='juliet@capulet.lit/balcony'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='transport-replace'
          initiator='romeo@montague.lit/orchard'
          sid='a73sjjvkla37jfea'>
    <content creator='initiator' name='ex'>
      <transport xmlns='urn:xmpp:jingle:transports:ibb:1'
                 block-size='4096'
                 sid='ch3d9s71'/>
    </content>
  </jingle>
</iq>
]]></example>
    <p>The responder then acknowledges the transport-replace action.</p>
    <example caption="Responder acknowledges transport-replace"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='hs92n57'
    to='romeo@montague.lit/orchard'
    type='result'/>
]]></example>
    <p>If the transport replacement is acceptable, the responder then sends a transport-accept action to the initiator (if not, the responder sends a transport-reject action). If the responder wishes to use a smaller block size than the one specified in the transport-replace offer, this can be done by specifying a block-size attribute in the transport-accept action.</p>
    <example caption="Responder sends transport-accept"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='is71ns63'
    to='romeo@montague.lit/orchard'
    type='set'>
  <jingle xmlns='urn:xmpp:jingle:1'
          action='transport-accept'
          initiator='romeo@montague.lit/orchard'
          sid='a73sjjvkla37jfea'>
    <content creator='initiator' name='ex'>
      <transport xmlns='urn:xmpp:jingle:transports:ibb:1'
                 block-size='2048'
                 sid='ch3d9s71'/>
    </content>
  </jingle>
</iq>
]]></example>
    <p>The initiator acknowledges the Jingle transport-accept action.</p>
    <example caption="Initiator acknowledges transport-accept"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='is71ns63'
    to='romeo@montague.lit/orchard'
    type='result'/>
]]></example>
    <p>Now the parties can send data using In-Band Bytestreams as defined in &xep0261; and <cite>XEP-0047</cite>.</p>
</section1>

<section1 topic='Processing Rules and Usage Guidelines' anchor='rules'>
  <p>The same processing rules and usage guidelines defined in &xep0065; apply to the Jingle S5B Transport Method. This document adds the following implementation suggestions in the context of Jingle:</p>
  <ol>
    <li>Try the offered candidates in the order of their priority, from highest to lowest.</li>
    <li>Stagger the connection attempts (e.g., initiate communications with the highest-priority candidate, then wait 200ms before initiating communications with the second-highest-priority candidate).</li>
    <li>To increase the potential for using a direct connection, consider waiting a bit longer than 200ms to initiate communications with proxy candidates.</li>
  </ol>
</section1>

<section1 topic='Determining Support' anchor='support'>
  <p>To advertise its support for the Jingle SOCKS5 Bytestreams Transport Method, when replying to &xep0030; information requests an entity MUST return URNs for any version of this protocol that the entity supports -- e.g., "urn:xmpp:jingle:transports:s5b:1" for this version &VNOTE;.</p>
  <example caption="Service discovery information request"><![CDATA[
<iq from='romeo@montague.lit/orchard'
    id='uw72g176'
    to='juliet@capulet.lit/balcony'
    type='get'>
  <query xmlns='http://jabber.org/protocol/disco#info'/>
</iq>
]]></example>
  <example caption="Service discovery information response"><![CDATA[
<iq from='juliet@capulet.lit/balcony'
    id='uw72g176'
    to='romeo@montague.lit/orchard'
    type='result'>
  <query xmlns='http://jabber.org/protocol/disco#info'>
    <feature var='urn:xmpp:jingle:1'/>
    <feature var='urn:xmpp:jingle:transports:s5b:1'/>
  </query>
</iq>
]]></example>
  <p>In order for an application to determine whether an entity supports this protocol, where possible it SHOULD use the dynamic, presence-based profile of service discovery defined in &xep0115;. However, if an application has not received entity capabilities information from an entity, it SHOULD use explicit service discovery instead.</p>
</section1>

<section1 topic='Security Considerations' anchor='security'>
  <section2 topic='Sharing IP Addresses' anchor='security-sharing'>
    <p>The exchange of candidates might result in exposure of the sender's IP addresses, which comprise a form of personally identifying information. A Jingle client MUST enable a user to control which entities will be allowed to receive such information. If a human user explicitly accepts a session request, then the client can consider that action to imply approval of IP address sharing.</p>
  </section2>
  <section2 topic='Encryption of Media' anchor='security-media'>
    <p>This specification, like &xep0065; before it, does not directly support end-to-end encryption of the media sent over the transport.</p>
  </section2>
</section1>

<section1 topic='IANA Considerations' anchor='iana'>
  <p>This document requires no interaction with &IANA;.</p>
</section1>

<section1 topic='XMPP Registrar Considerations' anchor='registrar'>
  <section2 topic='Protocol Namespaces' anchor='registrar-ns'>
    <p>The &REGISTRAR; includes 'urn:xmpp:jingle:transports:s5b:1' in its registry of protocol namespaces at &NAMESPACES;, as described in Section 4 of &xep0053;.</p>
  </section2>
  <section2 topic='Protocol Versioning' anchor='registrar-versioning'>
    &NSVER;
  </section2>
  <section2 topic='Jingle Transport Methods' anchor='registrar-transports'>
    <p>The &REGISTRAR; includes "jingle-s5b" in its registry of Jingle transport methods at &JINGLETRANSPORTS;. The registry submission is as follows:</p>
    <code><![CDATA[
<transport>
  <name>s5b</name>
  <desc>
    A method for negotiating data exchange over SOCKS5 Bytestreams.
  </desc>
  <type>streaming</type>
  <doc>XEP-0260</doc>
</transport>
]]></code>
  </section2>
</section1>

<section1 topic='Schema' anchor='schema'>
  <code><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>

<xs:schema
    xmlns:xs='http://www.w3.org/2001/XMLSchema'
    targetNamespace='urn:xmpp:jingle:transports:s5b:1'
    xmlns='urn:xmpp:jingle:transports:s5b:1'
    elementFormDefault='qualified'>

  <xs:annotation>
    <xs:documentation>
      The protocol documented by this schema is defined in
      XEP-0260: http://www.xmpp.org/extensions/xep-0260.html
    </xs:documentation>
  </xs:annotation>

  <xs:element name='transport'>
    <xs:complexType>
      <xs:choice>
        <xs:element ref='activated'
                    minOccurs='0' maxOccurs='1'/>
        <xs:element ref='candidate'
                    minOccurs='0' maxOccurs='unbounded'/>
        <xs:element name='candidate-error'
                    minOccurs='0' maxOccurs='1' type='empty'/>
        <xs:element ref='candidate-used'
                    minOccurs='0' maxOccurs='1'/>
        <xs:element name='proxy-error'
                    minOccurs='0' maxOccurs='1' type='empty'/>
      </xs:choice>
      <xs:attribute name='dstaddr' use='optional' type='xs:string'/>
      <xs:attribute name='mode' use='optional' default='tcp'>
        <xs:simpleType>
          <xs:restriction base='xs:NCName'>
            <xs:enumeration value='tcp'/>
            <xs:enumeration value='udp'/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute name='sid' type='xs:string' use='required'/>
    </xs:complexType>
  </xs:element>

  <xs:element name='candidate'>
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base='empty'>
          <xs:attribute name='cid'
                        type='xs:string' use='required'/>
          <xs:attribute name='host'
                        type='xs:string' use='required'/>
          <xs:attribute name='jid'
                        type='xs:string' use='required'/>
          <xs:attribute name='port'
                        type='xs:positiveInteger' use='optional'/>
          <xs:attribute name='priority'
                        type='xs:positiveInteger' use='required'/>
          <xs:attribute name='type'
                        use='optional' default='direct'>
            <xs:simpleType>
              <xs:restriction base='xs:NCName'>
                <xs:enumeration value='assisted'/>
                <xs:enumeration value='direct'/>
                <xs:enumeration value='proxy'/>
                <xs:enumeration value='tunnel'/>
              </xs:restriction>
            </xs:simpleType>
          </xs:attribute>
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>

  <xs:element name='candidate-used'>
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base='empty'>
          <xs:attribute name='cid' type='xs:string' use='required'/>
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>

  <xs:element name='activated'>
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base='empty'>
          <xs:attribute name='cid' type='xs:string' use='required'/>
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>

  <xs:simpleType name='empty'>
    <xs:restriction base='xs:string'>
      <xs:enumeration value=''/>
    </xs:restriction>
  </xs:simpleType>

</xs:schema>
]]></code>
</section1>

<section1 topic='Acknowledgements' anchor='acks'>
  <p>Thanks to Steffen Larsen, Florian Schmaus, Kevin Smith, and Remko Tronçon for their feedback.</p>
</section1>

</xep>