Re: [rtcweb] DTLS, DTLS-SRTP, and 5-tuples

["Makaraju, Maridi Raju (Raju)" <[e-mail]>]

> 2015-03-05 14:01 GMT+01:00 Makaraju, Maridi Raju (Raju)
> <[e-mail]>:
> >> Anyhow, I'm sorry but I no longer remember whether DTLS (which is just
> >> media from the ICE point of view) can be sent before receiving the
> >> STUN response or not. From the point of view of the peer performing
> >> aggressive ICE nomination, it is sending USE-CANDIDATE Binding
> >> requests so I can understand that it assumes a "valid-pair" (even if
> >> it's not replied/confirmed yet by the remote) so media can begin (and
> >> DTLS is just media).
> >
> > <Raju>
> > Aggressive nomination is to avoid 2nd round of checks with USE-CANDIDATE,
> but not to send media before the nomination is complete. Per [1], nomination
> is complete only when checks on all valid pairs are complete. A pair becomes
> "valid" only when you get response. That means, you can't send media (DTLS
> ClientHello) before you get STUN response.
> 
> Thanks. I remember now what it may happens:
> 
> - A sends USE-CANDIDATE requests in parallel.
> - A receives the ok response from one of them.
> - A sends DTLS ClientHello.

<Raju>
This is not allowed by http://tools.ietf.org/html/rfc5245#section-8.1.1.2 , unless webrtc overrides it.
A can only send DTLS once final nomination, which happens after all valid pairs are found, is done.
</Raju>

> - A receives the ok response with higher priority from another pair.
> - A then continues sending media (maybe remaining DTLS stuff or RTP)
> for that pair.
> 
> At the end DTLS packets can be sent over any valid and confirmed
> candidate-pair. 

<Raju> As mentioned above, http://tools.ietf.org/html/rfc5245#section-8.1.1.2 does not allow sending media (DTLS) on any valid pairs until final nomination is complete.
</Raju>

BR
Raju