Subject: [MMUSIC] DTLS-SDP: "actress" to always trigger new DTLS association?

From: Christer Holmberg <[email-masked]>
Date: Mon, 25 Apr 2016 12:59:15 +0000

Hi,

Assume that Alice and Bob have negotiated a DTLS association. Alice has the “active” role, and Bob has the “passive” role.

Now, if Alice sends a new offer, with “passive”, the roles will change and the DTLS association will have to be re-established.

If Alice in the new offer sends “actpass”, it is yet not known whether the roles will change.

However, as the roles MAY change, it has been suggested that the fingerprint/dtls-assocation-id combination needs to be updated in the offer – which by itself requires a new DTLS association :)

MY QUESTION: Is there a case for sending “actpass” without the intention of establishing a new DTLS association – no matter if the roles change or not?

Regards,

Christer

---

From: Roman Shpount <[email-masked]>
Date: Mon, 25 Apr 2016 10:36:44 -0400

Christer,

This is a very common topic ofr confusion. See
https://github.com/rtcweb-wg/jsep/issues/72 for a similar discussion.

The whole issue is that answerer can initiate a new DTLS association. So if
offerer generates an offer that allows an answerer start a new DTLS
association, i.e. an offer without ICE or offer with ICE restart, this
offer should have actpass. Without actpass role, the answerer when starting
a new DTLS association would have to reuse the old negotiated role, which,
if answerer was previously passive, can slow down the association setup by
half a round trip.

So, basic rules should be:
1. Do not change fingerprints/association-id unless you want to setup a new
DTLS association.
2. Set the setup role to actpass if answerer MAY initiate a new DTLS
association
3. Getting a setup role actpass is not enough to start a new DTLS
association. Change of negotiated role, i.e. change of answerer's setup
role, is necessary as a condition for setting up new DTLS association.

Setting up a new DTLS association on role change only is for backwards
compatibility only and should be discouraged.

Regards,

_____________
Roman Shpount

On Mon, Apr 25, 2016 at 8:59 AM, Christer Holmberg <
[email-masked]> wrote:

> Hi,
>
> Assume that Alice and Bob have negotiated a DTLS association. Alice has
> the “active” role, and Bob has the “passive” role.
>
> Now, if Alice sends a new offer, with “passive”, the roles will change and
> the DTLS association will have to be re-established.
>
> However, as the roles MAY change, it has been suggested that the
> fingerprint/dtls-assocation-id combination needs to be updated in the offer
> – which by itself requires a new DTLS association :)
>
> MY QUESTION: Is there a case for sending “actpass” without the intention
> of establishing a new DTLS association – no matter if the roles change or
> not?
>
> Regards,
>
> Christer
>
>
>
>
>
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mmusic
>
>

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 25 Apr 2016 18:53:18 +0000

Hi,

>This is a very common topic ofr confusion. See https://github.com/rtcweb-wg/jsep/issues/72 for a similar discussion.
>
>The whole issue is that answerer can initiate a new DTLS association. So if offerer generates an offer that allows an
>answerer start a new DTLS association, i.e. an offer without ICE or offer with ICE restart, this offer should have
>actpass. Without actpass role, the answerer when starting a new DTLS association would have to reuse the old
>negotiated role, which, if answerer was previously passive, can slow down the association setup by half a round trip.

I agree.

My question was whether there is a case where one would offer “actpass”, and a new DTLS association would NOT be created.

>1. Do not change fingerprints/association-id unless you want to setup a new DTLS association.
>2. Set the setup role to actpass if answerer MAY initiate a new DTLS association
>3. Getting a setup role actpass is not enough to start a new DTLS association. Change of negotiated role, i.e. change of answerer's setup role, is necessary as a condition for setting up new >DTLS association.

So, if I offer “actpass”, but I do NOT change the fingerprint/dtls-association-id, it is still ok for the answerer to change the setup role in the answer (read: create a new DTLS association)?

I thought you earlier said that the fingerprint/dtls-association-id combination must change when a new DTLS association is created, but in this example the offerer will not change the combination.

Regards,

Christer

On Mon, Apr 25, 2016 at 8:59 AM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

Regards,

Christer

_______________________________________________
mmusic mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mmusic

---

From: Roman Shpount <[email-masked]>
Date: Mon, 25 Apr 2016 15:15:20 -0400

On Mon, Apr 25, 2016 at 2:53 PM, Christer Holmberg <
[email-masked]> wrote:

> My question was whether there is a case where one would offer “actpass”,
> and a new DTLS association would NOT be created.
>

There are a lot of use cases when offerer does not create a new DTLS
association but would still want to allow the answerer to create one.

1. One example would be creating an offer in response to offerless INVITE.
Offerer does not know if this offer will be sent to the same end point or
to a new one. So it would create an offer with existing fingerprints and
association id, but will put actpass setup role to allow answerer to create
a new association.

2. Another common example is when different media resources are managed by
the same signaling agent. When offerer send an offer the for instance adds
video, signaling agent might send this offer to a different media resource
which might cause a new DTLS association to be created.

3. Yet another example are SBCs that bridge DTLS-SRTP with non DTLS
network. When such SBC receives an offer with the same transport/DTLS
parameters it sends an offer on the non DTLS side using an existing
transport. If it gets an answer on non DTLS side with the same remote
transport, it sends an answer with an existing transport on DTLS side. If
it gets an answer with the new remote transport on non DTLS side, it
allocates a new transport on DTLS side and sends an answer that uses new
transport and creates a new DTLS association. This way anything received on
the old transport on DTLS side is sent to the old transport on non DTLS
side and anything received on the new transport on DTLS side is sent to a
new transport on non DTLS side.

> I thought you earlier said that the fingerprint/dtls-association-id
> combination must change when a new DTLS association is created, but in this
> example the offerer will not change the combination.
>
>
>
Yes, for new implementation fingerprints/dtls-association-id must change
for ONE OF THE SIDES. So, offerer might keep the the same
fingerprint/dtls-association-id, but if answerer changes them, new DTLS
association will be created. I would like to disallow changing just the
role by the answerer for anything new, but for legacy interop creating a
new association on just the role change needs to be supported (even though
I do not think anybody does this).

Regards,
_____________
Roman Shpount

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 26 Apr 2016 07:26:36 +0000

Hi,

…
>>I thought you earlier said that the fingerprint/dtls-association-id combination must change when a new DTLS association is created, but in this example the offerer will not change the combination
>Yes, for new implementation fingerprints/dtls-association-id must change for ONE OF THE SIDES. So, offerer might keep the the same fingerprint/dtls-association-id, but if answerer changes them, new DTLS association will be created.

Ok. So, the draft needs to be clear that the combination of the offerer may not change even if a new association is created.

>I would like to disallow changing just the role by the answerer for anything new, but for legacy intro
>creating a new association on just the role change needs to be supported (even though I do not think anybody does this).

We could always say that the answerer SHOULD NOT change the role, as long as the offerer is prepared for it to happen.

Regards,

Christer

---

From: Roman Shpount <[email-masked]>
Date: Tue, 26 Apr 2016 15:48:33 -0400

On Tue, Apr 26, 2016 at 3:26 AM, Christer Holmberg <
[email-masked]> wrote:

> example the offerer will not change the combination
> association will be created.
>
> Ok. So, the draft needs to be clear that the combination of the offerer
> may not change even if a new association is created.
>

We need to be clear that even if fingerprints and dtls-association-id
stayed the same in the offer, new DTLS association must be created if they
changed in the answer. Answerer SHOULD change
fingerprints/dtls-association-id when new DTLS association is set up, but
offerer should be able to handle answers with the same
fingerprints/dtls-association-id even though
fingerprints/dtls-association-id changed in the offer.

> >creating a new association on just the role change needs to be supported
> (even though I do not think anybody does this).
>
> We could always say that the answerer SHOULD NOT change the role, as long
> as the offerer is prepared for it to happen.
>

We should say that answerer SHOULD NOT change only the role in the answer
without changing fingerprints/dtls-association-id, but offerer must be
prepared to receive an answer with just the setup role changed and setup
new DTLS association in this case.

Regards,
_____________
Roman Shpount