Re: [rtcweb] How to determine TLS roles?

[Tim Panton <[e-mail]>]

On 10 Feb 2014, at 20:30, Christer Holmberg <[e-mail]> wrote:

> Hi,
> 
>>>>>> This is defined in RFC 5763 S 5:
>>>>>> http://tools.ietf.org/html/rfc5763#section-5
>>>>>> 
>>>>>> Which points to:
>>>>>> http://tools.ietf.org/html/rfc4145
>>>>> 
>>>>> Ok. So, a few questions to for clarification:
>>>>> 
>>>>> Q1: This means that the JS App must set the setup attrbute value before passing an SDP to the browser?
>>>> No, peer-to-peer browser calls should 'do the right thing' - based on the initator/ice-controlling rule Both browsers set a=setup:act-pass meaning that we fall back to the old rules.
>>> 
>>> What "old rules"? :)
>>> 
>> 
>> Sorry that was unclear - As I read it, putting a=setup:actpass in the SDP indicates that the ice-controlling entity should act as DTLS client, and typically the ice-controlling entity is the initiator of the session. So it isn't a matter of O/A negotiation.
> 
> Do you have a reference to where you read that?

No, I don't think I have seen it explicitly stated.


> 
>>>> If however you have a gateway initating a call to a browser, and it 
>>>> wants to do early media (it's an 800 number gateway for example) then it sets a=setup:active in the SDP it sends (or you create on it's behalf).
>>> 
>>> There doesn't necessarily have to be a gateway. It may be a browser-to-browser call, using SIP and SDP O/A on the wire - meaning that the SDP setup attribute is used to determine the roles.
>> 
>> But there is no concept of early media on a peer-to-peer webRTC call, so there isn't any need to manage which side is the DTLS client or server.
> 
> Not sure what this has to do with early media. You can have two browser based applications, using SDP O/A to negotiate the DTLS roles.

You only care about manipulating the DTLS roles if you want the side that _didn't_ initiate the call to initiate the media flow. The only instance
where that happens is early media. 
Without early media there is no need to manipulate which end is client/server since the default or initiator is client makes sense - or am I missing something?

> 
> Regards,
> 
> Christer