Re: [rtcweb] What is consent?

[Harald Alvestrand <[e-mail]>]

On 09/12/2012 10:55 AM, Martin Thomson wrote:
> On 12 September 2012 10:39, Dan Wing <[e-mail]> wrote:
>> The volume of data is separate from USE-CANDIDATE, though.  ICE does
>> not currently have a way to indicate bandwidth.
> Yes.
>
>> There was a bandwidth extension for TURN, but it did not achieve
>> working group consensus and is not in the TURN RFC.  There is
>> a bandwidth extension to ICE that Microsoft documents and I believe
>> use in their products, http://msdn.microsoft.com/en-us/library/cc339480,
>> MS-ICE2BWM and MS-TURNBWM.
> There are two bandwidth-related things in use.  One is related to
> bandwidth estimation and not really pertinent to this.  The other
> potentially relevant one is the bandwidth parameter (the one that
> never reached consensus) is used to manage bandwidth for relay
> allocations.
>
> The latter is interesting to me, particularly if that parameter can be
> applied to ICE.  There are some gotchas that need careful
> consideration, particularly around this area of having consent on
> multiple valid candidate pairs.
I may be hopelessly naive here, but isn't the b= parameter of the SDP 
negotiation supposed to give an upper limit on how much data the 
recipient expects to receive on a connection?

RFC 3264 section 5.1 (unicast offer):

    If the bandwidth attribute is present for a stream, it indicates the
    desired bandwidth that the offerer would like to receive.

Section 6.1 (unicast answer):

    The answerer MAY include a bandwidth attribute for any media stream;
    this indicates the bandwidth that the answerer would like the offerer
    to use when sending media.

(note that "media stream" here is != MediaStream)

The browser being used to stage an attack will of course not know this 
value, since its signalling is controlled by the attacker, but the 
browser being attacked will be able to tell the difference between a 
within-contract amount of data and an out-of-contract amount of data.

               Harald