Re: [rtcweb] JSEP: Why always offer actpass?

[Christer Holmberg <[e-mail]>]

Hi,

>>>>> Once a DTLS connection has been established, if the 
>>>>> 'active/passive' status of the endpoints change during a session, 
>>>>> a new DTLS connection MUST be established.  Therefore, endpoints 
>>>>> SHOULD NOT change the 'active/passive' status in subsequent offers 
>>>>> and answers,
>>>>
>>>> Did not the discussion (for rtcweb) conclude that subsequent offers 
>>>> should offer actpass, but that subsequent answers must say the same 
>>>> as the previous answer?
>>>
>>> In the Offer/Answer section, I can define more details regarding the 
>>> values (actpass etc) to use.
>>>
>>> BUT, the question is whether we want to allow the endpoints to 
>>> trigger a new DTLS connection by changing the active/passive status 
>>> or not. The text above says SHOULD NOT change the active/passive 
>>> status.
>> 
>> OK, makes sense to me.
>
> <Raju>
> I am ok with it as well.
>
> The strength "SHOULD NOT" seems intentional and I think that is right; so it is still allowed but not recommended.

Yes.

> May be obvious, but please be sure to mention that, independent of last offer/answer direction, new 
> offerer SHOULD include actpass and answerer SHOULD answer with previously negotiated role.

Yes.

Of course, if the fingerprint and/or transport parameters change, a new DTLS connections MUST be established. And, in that case I guess it doesn't matter if the TLS roles are also re-negotiated?

Regards,

Christer