[sip-clf] Strawman proposal to handle bodies

["Vijay K. Gurbani" <[e-mail]>]

Folks: In the virtual meeting we had this morning, I volunteered
to draft a proposal for handling message bodies.

As I understand it, the bounds are that logging bodies is optional
and that bodies should not be logged as vendor extensions as that
will hinder interoperability.

Furthermore, we are interested in logging different body types,
or more concretely bodies containing:

   - SDP (Content-Type: application/sdp)
   - XML payloads (Content-type: application/*+xml)
   - binary (Content-Type: application/{isup,qsig})
   - miscellaneous text content (Content-type: message/sipfrag,
     message/http, text/plain, ...)

To support this, we reserve a tag field for bodies as described
in [1], say 0x0004.  The value of this tag field would be the
content type itself plus the body.

To take a concrete example,

    Type: 0x0004
    Length: 160
    Value: application/sdp v=0\r\no=alice 2890844526 2890844526 IN IP4
     host.atlanta.example.com\r\ns=\r\nc=IN IP4
     host.atlanta.example.com\r\nt=0 0\r\n
     m=audio 49170 RTP/AVP 0 8 97\r\n

Couple of points to note: (a) the MIME type is saved in the Value;
(b) the octets in Value are all logically on one line; (c) the
Length includes the payload + length of the MIME type + LWS separator
between the MIME type and the content.

Also note that for now let's keep aside the \r\n tokens delimiting
the lines in the example above.  Once we agree to the proposal, we
can work the details out on how to represent \r\n in a text-based
body.

Binary bodies would have to be byte encoded to render them in the
ASCII file.

Please comment on this approach so I can update the problem statement
and Gonzalo can start thinking about the representation format for
these in [1].

[1] http://tools.ietf.org/html/draft-salgueiro-sipclf-indexed-ascii-02

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{bell-labs.com,acm.org} / [e-mail]
Web:   http://ect.bell-labs.com/who/vkg/