{"action":"opened","number":16,"pull_request":{"url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls/16","id":90937230,"html_url":"https://github.com/cdh4u/draft-dtls-sdp/pull/16","diff_url":"https://github.com/cdh4u/draft-dtls-sdp/pull/16.diff","patch_url":"https://github.com/cdh4u/draft-dtls-sdp/pull/16.patch","issue_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/issues/16","number":16,"state":"open","locked":false,"title":"dtls-id clarifications","user":{"login":"rshpount","id":4749642,"avatar_url":"https://avatars.githubusercontent.com/u/4749642?v=3","gravatar_id":"","url":"https://api.github.com/users/rshpount","html_url":"https://github.com/rshpount","followers_url":"https://api.github.com/users/rshpount/followers","following_url":"https://api.github.com/users/rshpount/following{/other_user}","gists_url":"https://api.github.com/users/rshpount/gists{/gist_id}","starred_url":"https://api.github.com/users/rshpount/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rshpount/subscriptions","organizations_url":"https://api.github.com/users/rshpount/orgs","repos_url":"https://api.github.com/users/rshpount/repos","events_url":"https://api.github.com/users/rshpount/events{/privacy}","received_events_url":"https://api.github.com/users/rshpount/received_events","type":"User","site_admin":false},"body":"This is the first draft of dtls-id clarifications.\r\n\r\nHere are the things that we discussed with Flemming Andreasen. I will go over the changes in the document to make sure everything is covered.\r\n\r\nFirst of all, dtls-id is not negotiated and dtls-id values in offer and answer are independent. New DTLS association is established when either one of dtls-id values changes. This allows for both offerer and the answerer to establish a new DTLS association, i.e. for answerer to overwrite the continuing use of existing DTLS association. \r\n\r\nWhen answerer indicates that it wants to establish a new DTLS association (i.e. offer came with the same dtls-id and transport protocol address and port, but answered included a new dtls-id in the answer), it needs to make sure that media packets in the existing DTLS association and new DTLS association can be demultiplexed. In case of ordered transport, this can be done simply by sending packets for new DTLS association after all packets for existing DTLS association have been sent. In case of unordered transport, such as UDP, packets for the old DTLS association can arrive after the answer SDP was received and after first packets for the new DTLS association were received. The only way to demultiplex packets belonging to old and new DTLS association is on the basis of transport 5 tuple (protocol, source address/port, destination address/port). Because of this, if answering party uses unordered transport and establishes a new DTLS association, it needs to allocate new local address/port (new transport), so that remote party can demultiplex the DTLS packet. This obviously completely unrelated to the setup role (active/passive) and only related to new DTLS association being established during session update by the answering party.\r\n\r\nThe allocation of dtls-id is not bound by the m= line or offer/answer session. It is bound by the re-use of the certificate. Every time the same certificate is reused, new dtls-id value must be allocated. It does not matter if this dtls-id value is used to establish a new session or update an existing one. So, if a new self-signed certificate is used for each new offer/answer exchange, dtls-id can always be set to the same fixed value. If certificate is reused within the context of a single offer/answer session, new dtls-id value needs to be allocated of each offer/answer exchange when new DTLS association is established. If some pre-provisioned certificate is used across multiple servers, dtls-id value should be allocated using some sort of globally unique scheme. The reason for all of this is third party call control. An offer which establishes a new offer/answer session from the point of view of one end point can be a session update for the point of view of the other end point. Because of this, if for example, certificate is shared across multiple end points and if end point always uses the same initial dtls-id value, as a result of 3pcc, an end point can receive a session update which contains the same fingerprint values (due to certificate reuse) and the same dtls-id in an offer that is supposed to establish a new DTLS association as far as offering end point is concerned, but looks like DTLS association reuse as far as answering end point can see it.\r\n\r\nPer my rather long previous email, dtls-id must be unique as long as the same certificate is reused. So it is allowed to say that new dtls-id value must be used for initial offer which is establishing a new session. If 3pcc is used, this can a new session for one end point and session update for another. If multiple sessions or end points use the same certificate, dtls-id value must be unique across all of them.\r\n\r\n DTLS association is bidirectional. Think of dtls-id as virtual port on top of address (certificate fingerprint). If address (fingerprint) or port (dtls-id) on either side changes, a new bidirectional DTLS association must be established. If addresses (fingerprints) or ports (dtls-id) on both sides of the association stayed the same, existing association continues to run. \r\n\r\nAlso, since dtls-id is unique per certificate, each end point should be able to allocate dtls-id independently. It cannot be negotiated per connection since it can cause dtls-id value collisions on the per certificate level. \r\n\r\nHere is the scenario that highlights the issue with negotiated dtls-id. Imagine that dtls-id value is negotiated.\r\n\r\n1. New session is established by 3pcc controller between end points A and B.\r\n2. Endpoint A sends an SDP offer with dtls-id set to \"1\"\r\n3. Endpoint B sends an SDP answer with newly negotiated dtls-id value set to \"1\"\r\n4. 3pcc sends an empty re-INVITE to endpoint B.\r\n5. Endpoint B does not wants to conserve resources and re-use the existing DTLS association, so it sends an offer with dtls-id value \"1\"\r\n6. 3pcc controller uses the offer SDP it received from endpoint B in an existing offer/answer session with endpoint C.\r\n7. Offer/answer session running on endpoint C was communicating with end point D which was using the same certificate as B. The dtls-id in this session just happened to be \"1\" as well. When endpoint C receives the offer from the 3pcc controller, which was generate by B, it sees the same fingerprints (same certificate) and same dtls-id value (collision). Endpoint C assumes that the same DTLS association is reused and sends it current fingerprint and dtls-id values in answer SDP\r\n8. Problem: Endpoint B thinks it is a new session. Endpoint C thinks it is an existing session. No media is flowing.\r\n\r\nThis is why endpoints must be able to assign dtls-id values independently and DTLS association must be established if either one of them changes.\r\n\r\n","created_at":"2016-10-26T05:05:41Z","updated_at":"2016-10-26T05:05:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"dc27fb6e0cac8dbb23df58f81fd3b270af383b7e","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls/16/commits","review_comments_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls/16/comments","review_comment_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls/comments{/number}","comments_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/issues/16/comments","statuses_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/statuses/875594825156a8e8053aee4b4cc5ba0cc26b286b","head":{"label":"rshpount:dtls-id-clarification","ref":"dtls-id-clarification","sha":"875594825156a8e8053aee4b4cc5ba0cc26b286b","user":{"login":"rshpount","id":4749642,"avatar_url":"https://avatars.githubusercontent.com/u/4749642?v=3","gravatar_id":"","url":"https://api.github.com/users/rshpount","html_url":"https://github.com/rshpount","followers_url":"https://api.github.com/users/rshpount/followers","following_url":"https://api.github.com/users/rshpount/following{/other_user}","gists_url":"https://api.github.com/users/rshpount/gists{/gist_id}","starred_url":"https://api.github.com/users/rshpount/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rshpount/subscriptions","organizations_url":"https://api.github.com/users/rshpount/orgs","repos_url":"https://api.github.com/users/rshpount/repos","events_url":"https://api.github.com/users/rshpount/events{/privacy}","received_events_url":"https://api.github.com/users/rshpount/received_events","type":"User","site_admin":false},"repo":{"id":54361047,"name":"draft-dtls-sdp","full_name":"rshpount/draft-dtls-sdp","owner":{"login":"rshpount","id":4749642,"avatar_url":"https://avatars.githubusercontent.com/u/4749642?v=3","gravatar_id":"","url":"https://api.github.com/users/rshpount","html_url":"https://github.com/rshpount","followers_url":"https://api.github.com/users/rshpount/followers","following_url":"https://api.github.com/users/rshpount/following{/other_user}","gists_url":"https://api.github.com/users/rshpount/gists{/gist_id}","starred_url":"https://api.github.com/users/rshpount/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rshpount/subscriptions","organizations_url":"https://api.github.com/users/rshpount/orgs","repos_url":"https://api.github.com/users/rshpount/repos","events_url":"https://api.github.com/users/rshpount/events{/privacy}","received_events_url":"https://api.github.com/users/rshpount/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rshpount/draft-dtls-sdp","description":"Repository for IETF draft-holmberg-mmusic-sdp-dtls","fork":true,"url":"https://api.github.com/repos/rshpount/draft-dtls-sdp","forks_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/forks","keys_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/teams","hooks_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/hooks","issue_events_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/issues/events{/number}","events_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/events","assignees_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/assignees{/user}","branches_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/branches{/branch}","tags_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/tags","blobs_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/git/refs{/sha}","trees_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/statuses/{sha}","languages_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/languages","stargazers_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/stargazers","contributors_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/contributors","subscribers_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/subscribers","subscription_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/subscription","commits_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/commits{/sha}","git_commits_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/git/commits{/sha}","comments_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/comments{/number}","issue_comment_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/issues/comments{/number}","contents_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/contents/{+path}","compare_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/merges","archive_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/downloads","issues_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/issues{/number}","pulls_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/pulls{/number}","milestones_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/milestones{/number}","notifications_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/labels{/name}","releases_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/releases{/id}","deployments_url":"https://api.github.com/repos/rshpount/draft-dtls-sdp/deployments","created_at":"2016-03-21T05:00:00Z","updated_at":"2016-01-18T13:13:03Z","pushed_at":"2016-10-26T05:02:45Z","git_url":"git://github.com/rshpount/draft-dtls-sdp.git","ssh_url":"git@github.com:rshpount/draft-dtls-sdp.git","clone_url":"https://github.com/rshpount/draft-dtls-sdp.git","svn_url":"https://github.com/rshpount/draft-dtls-sdp","homepage":null,"size":175,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"cdh4u:master","ref":"master","sha":"e37f0fa35f1ece307ee8b6da24b5b20d106ca136","user":{"login":"cdh4u","id":9333380,"avatar_url":"https://avatars.githubusercontent.com/u/9333380?v=3","gravatar_id":"","url":"https://api.github.com/users/cdh4u","html_url":"https://github.com/cdh4u","followers_url":"https://api.github.com/users/cdh4u/followers","following_url":"https://api.github.com/users/cdh4u/following{/other_user}","gists_url":"https://api.github.com/users/cdh4u/gists{/gist_id}","starred_url":"https://api.github.com/users/cdh4u/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cdh4u/subscriptions","organizations_url":"https://api.github.com/users/cdh4u/orgs","repos_url":"https://api.github.com/users/cdh4u/repos","events_url":"https://api.github.com/users/cdh4u/events{/privacy}","received_events_url":"https://api.github.com/users/cdh4u/received_events","type":"User","site_admin":false},"repo":{"id":37642089,"name":"draft-dtls-sdp","full_name":"cdh4u/draft-dtls-sdp","owner":{"login":"cdh4u","id":9333380,"avatar_url":"https://avatars.githubusercontent.com/u/9333380?v=3","gravatar_id":"","url":"https://api.github.com/users/cdh4u","html_url":"https://github.com/cdh4u","followers_url":"https://api.github.com/users/cdh4u/followers","following_url":"https://api.github.com/users/cdh4u/following{/other_user}","gists_url":"https://api.github.com/users/cdh4u/gists{/gist_id}","starred_url":"https://api.github.com/users/cdh4u/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cdh4u/subscriptions","organizations_url":"https://api.github.com/users/cdh4u/orgs","repos_url":"https://api.github.com/users/cdh4u/repos","events_url":"https://api.github.com/users/cdh4u/events{/privacy}","received_events_url":"https://api.github.com/users/cdh4u/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/cdh4u/draft-dtls-sdp","description":"Repository for IETF draft-holmberg-mmusic-sdp-dtls","fork":false,"url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp","forks_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/forks","keys_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/teams","hooks_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/hooks","issue_events_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/issues/events{/number}","events_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/events","assignees_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/assignees{/user}","branches_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/branches{/branch}","tags_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/tags","blobs_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/git/refs{/sha}","trees_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/statuses/{sha}","languages_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/languages","stargazers_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/stargazers","contributors_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/contributors","subscribers_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/subscribers","subscription_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/subscription","commits_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/commits{/sha}","git_commits_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/git/commits{/sha}","comments_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/comments{/number}","issue_comment_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/issues/comments{/number}","contents_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/contents/{+path}","compare_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/merges","archive_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/downloads","issues_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/issues{/number}","pulls_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls{/number}","milestones_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/milestones{/number}","notifications_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/labels{/name}","releases_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/releases{/id}","deployments_url":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/deployments","created_at":"2015-06-18T06:35:04Z","updated_at":"2016-01-18T13:13:03Z","pushed_at":"2016-10-26T05:05:41Z","git_url":"git://github.com/cdh4u/draft-dtls-sdp.git","ssh_url":"git@github.com:cdh4u/draft-dtls-sdp.git","clone_url":"https://github.com/cdh4u/draft-dtls-sdp.git","svn_url":"https://github.com/cdh4u/draft-dtls-sdp","homepage":null,"size":174,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":15,"forks":1,"open_issues":15,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls/16"},"html":{"href":"https://github.com/cdh4u/draft-dtls-sdp/pull/16"},"issue":{"href":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/issues/16"},"comments":{"href":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/issues/16/comments"},"review_comments":{"href":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls/16/comments"},"review_comment":{"href":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/pulls/16/commits"},"statuses":{"href":"https://api.github.com/repos/cdh4u/draft-dtls-sdp/statuses/875594825156a8e8053aee4b4cc5ba0cc26b286b"}},"merged":false,"mergeable":true,"mergeable_state":"clean","merged_by":null,"comments":0,"review_comments":0,"commits":1,"additions":80,"deletions":65,"changed_files":1}}
{"actor":{"display_login":"rshpount"}}