Draft: draft-ietf-ice-rfc5245bis

Commentary: LGTM , modulo the two comments above .
This document describes a protocol for Network Address Translator
(NAT) traversal for UDP-based multimedia.  This protocol is called
Interactive Connectivity Establishment (ICE).  ICE makes use of the
Session Traversal Utilities for NAT (STUN) protocol and its
extension, Traversal Using Relay NAT (TURN).
This document describes a protocol for Network Address Translator
(NAT) traversal for UDP-based communication.  This protocol is called
Interactive Connectivity Establishment (ICE).  ICE makes use of the
Session Traversal Utilities for NAT (STUN) protocol and its
extension, Traversal Using Relay NAT (TURN).
Protocols establishing multimedia sessions between peers typically
involve exchanging IP addresses and ports for the media sources and
sinks.  However this poses challenges when operated through Network
Address Translators (NATs) RFC3235.  These protocols also seek to
create a media flow directly between participants, so that there is
no application layer intermediary between them.  This is done to
reduce media latency, decrease packet loss, and reduce the
operational costs of deploying the application.  However, this is
difficult to accomplish through NATs.  A full treatment of the
reasons for this is beyond the scope of this specification.
Protocols establishing communication sessions between peers typically
involve exchanging IP addresses and ports for the media sources and
sinks.  However this poses challenges when operated through Network
Address Translators (NATs) RFC3235.  These protocols also seek to
create a media flow directly between participants, so that there is
no application layer intermediary between them.  This is done to
reduce media latency, decrease packet loss, and reduce the
operational costs of deploying the application.  However, this is
difficult to accomplish through NATs.  A full treatment of the
reasons for this is beyond the scope of this specification.
A component is a piece of a media stream requiring a single
transport address; a media stream may require multiple components,
each of which has to work for the media stream as a whole to work.
For media streams based on RTP, unless RTP and RTCP are
multiplexed in the same port, there are two components per media
stream -- one for RTP, and one for RTCP.
An agent gathers candidates when it believes that communication is
imminent.  An initiating agent can do this based on a user interface
cue, or based on an explicit request to initiate a session.  Every
candidate is a transport address.  It also has a type and a base.
Four types are defined and gathered by this specification -- host
candidates, server reflexive candidates, peer reflexive candidates,
and relayed candidates.  The server reflexive candidates are gathered
using STUN or TURN, and relayed candidates are obtained through TURN.
Peer reflexive candidates are obtained in later phases of ICE, as a
consequence of connectivity checks.
An agent gathers candidates when it believes that communication is
imminent.  An initiating agent can do this based on a user interface
cue, or based on an explicit request to initiate a session.  Every
candidate has a transport address.  It also has a type and a base.
Four types are defined and gathered by this specification -- host
candidates, server reflexive candidates, peer reflexive candidates,
and relayed candidates.  The server reflexive candidates are gathered
using STUN or TURN, and relayed candidates are obtained through TURN.
Peer reflexive candidates are obtained in later phases of ICE, as a
consequence of connectivity checks.
The process for gathering candidates at the responding agent is
identical to the process for the initiating agent.  It is RECOMMENDED
that the responding agent begins this process immediately on receipt
of the candidate information, prior to alerting the user.  Such
gathering MAY begin when an agent starts.
The process for gathering candidates at the responding agent is
identical to the process for the initiating agent.  It is RECOMMENDED
that the responding agent begins this process immediately on receipt
of the candidate information, prior to alerting the user of the
application associated with the ICE session.  Such gathering MAY
begin when an agent starts.
If one or more host candidates corresponding to an IPv6 address
generated using a mechanism that prevents location tracking
RFC7721 are gathered, host candidates corresponding to IPv6
addresses that do allow location tracking, that are configured on
the same interface, and are part of the same network prefix MUST
NOT be gathered; and host candidates corresponding to IPv6 link-
local addresses MUST NOT be gathered.
If one or more host candidates corresponding to an IPv6 address
generated using a mechanism that prevents location tracking
RFC7721 are gathered, host candidates corresponding to IPv6
addresses that do allow location tracking, that are configured on
the same interface, and are part of the same network prefix MUST
NOT be gathered.
Host candidates corresponding to IPv6 link-local addresses MUST
NOT be gathered.
The IPv6 default address selection specification RFC6724 specifies
that temporary addresses RFC4941 are to be preferred over permanent
addresses.
Every Ta milliseconds thereafter, the agent can generate another new
STUN or TURN transaction.  This transaction can either be a retry of
a previous transaction that failed with a recoverable error (such as
authentication failure), or a transaction for a new host candidate
and STUN or TURN server pair.  The agent SHOULD NOT generate
transactions more frequently than one every Ta milliseconds.  See
sec-ta for guidance on how to set Ta and the STUN retransmit timer,
RTO.
Allocate requests SHOULD be authenticated using a long-term
credential obtained by the client through some other means.
The gathering process is controlled using a timer, Ta.  Every time Ta
expires, the agent can generate another new STUN or TURN transaction.
This transaction can either be a retry of a previous transaction that
failed with a recoverable error (such as authentication failure), or
a transaction for a new host candidate and STUN or TURN server pair.
The agent SHOULD NOT generate transactions more frequently than one
every time Ta expires.  See sec-ta for guidance on how to set Ta and
the STUN retransmit timer, RTO.
Host candidates do not time out, but the candidate addresses may
change or disappear for a number of reasons.  An ICE agent SHOULD
monitor the interfaces it uses, invalidate candidates whose base has
gone away, and acquire new candidates as appropriate when new
interfaces appear.
An agent SHOULD compute this priority using the formula in sec-rec-
form and choose its parameters using the guidelines in sec-
guidelines.  If an agent elects to use a different formula, ICE may
take longer to converge since both agents will not be coordinated in
their checks.
An ICE agent SHOULD compute this priority using the formula in sec-
rec-form and choose its parameters using the guidelines in sec-
guidelines.  If an agent elects to use a different formula, ICE may
take longer to converge since the agents will not be coordinated in
their checks.
Certain middleboxes, such as ALGs, can alter signaling information
that breaks ICE.  This is referred to as ICE mismatch.  If the using
protocol is vulnerable to ICE mismatch, the responding agent needs to
be able to detect it and inform the peer agent about the ICE
mismatch.
Certain middleboxes, such as ALGs, can alter signaling information in
ways that break ICE.  This is referred to as ICE mismatch.  If the
using protocol is vulnerable to ICE mismatch, the responding agent
needs to be able to detect it and inform the peer agent about the ICE
mismatch.
The check list is neither Completed yet nor Failed yet.  Check
lists are initially set to the Running state.
The check list is neither Completed nor Failed yet.  Check lists
are initially set to the Running state.
The agent pairs each local candidate with each remote candidate for
the same component of the same media stream with the same IP address
family.  It is possible that some of the local candidates won't get
paired with remote candidates, and some of the remote candidates
won't get paired with local candidates.  This can happen if one agent
doesn't include candidates for the all of the components for a media
stream.  If this happens, the number of components for that media
stream is effectively educed, and considered to be equal to the
minimum across both agents of the maximum component ID provided by
each agent across all components for the media stream.
The agent pairs each local candidate with each remote candidate for
the same component of the same media stream with the same IP address
family.  It is possible that some of the local candidates won't get
paired with remote candidates, and some of the remote candidates
won't get paired with local candidates.  This can happen if one agent
doesn't include candidates for the all of the components for a media
stream.  If this happens, the number of components for that media
stream is effectively reduced, and considered to be equal to the
minimum across both agents of the maximum component ID provided by
each agent across all components for the media stream.
For each foundation, the agent sets the state of exactly one
candidate pair to the Waiting state (unfreezing it).  The
candidate pair to unfreeze is choosen by finding the first
candidate pair (ordered by lowest component ID and then highest
priority if component IDs are equal) in the first check list
(ordered by the check list set) that has that foundation.
For each foundation, the agent sets the state of exactly one
candidate pair to the Waiting state (unfreezing it).  The
candidate pair to unfreeze is choosen by finding the first
candidate pair (ordered by lowest component ID and then highest
priority if component IDs are equal) in the first check list
(according to the usage-defined check list set order) that has
that foundation.
Once the agent has computed the check lists and created the check
list set, as described in sec-forming, the agent will begin
performing connectivity checks (ordinary and triggered).  For
triggered connectivity checks, the agent maintains a FIFO queue for
each check list, called the TRIGGERED CHECK QUEUE, which contains
candidate pairs for which checks are to be sent at the next available
opportunity.
Once the agent has computed the check lists and created the check
list set, as described in sec-forming, the agent will begin
performing connectivity checks (ordinary and triggered).  For
triggered connectivity checks, the agent maintains a FIFO queue for
each check list, referred to as the triggered check queue, which
contains candidate pairs for which checks are to be sent at the next
available opportunity.  The triggered check queue is initially empty.
On determining the role for a lite implementation being the
controlling agent means selecting a candidate pair based on the ones
in the candidate exchange (for IPv4, there is only ever one pair),
and then updating the peer with the new candidate information
reflecting that selection, when needed (it is never needed for an
IPv4-only host).  The controlled agent is told which candidate pairs
to use for each media stream, and no further candidate updates are
needed to signal this information.
An ICE agent MUST be compliant to to RFC5389.  A full implementation
acts both as a STUN client and a STUN server, while a lite
implementation only acts as a STUN server (as it does not generate
connectivity checks).
If the lite implementation is the controlling agent (which will only
happen if the peer agent is also a lite implementation), it selects a
candidate pair based on the ones in the candidate exchange (for IPv4,
there is only ever one pair), and then updating the peer with the new
candidate information reflecting that selection, when needed (it is
never needed for an IPv4-only host).  The controlled agent is told
which candidate pairs to use for each media stream, and no further
candidate updates are needed to signal this information.
An ICE agent MUST be compliant to RFC5389.  A full implementation
acts both as a STUN client and a STUN server, while a lite
implementation only acts as a STUN server (as it does not generate
connectivity checks).
If multiple DSCP markings are used on the media packets, the agent
SHOULD choose one of them for use with the connectivity check.
NOTE: When the ICE agent sets the candidate pair state to Failed as a
result a connectivity check error, the agent does not change the
states of other candidate pairs with the same foundation.
NOTE: When the ICE agent sets the candidate pair state to Failed as a
result of a connectivity check error, the agent does not change the
states of other candidate pairs with the same foundation.
If the Binding request generates a STUN error response that is
unrecoverable RFC5389 or times out, the ICE agent SHOULD set the
candidate pair state to Failed.
If the Binding request times out, the ICE agent SHOULD set the
candidate pair state to Failed.
If the Binding request generates a STUN error response that is
unrecoverable RFC5389 the ICE agent SHOULD set the candidate pair
state to Failed.
If a check is considered a success, the ICE agent performs (in order)
the actions described in the following sections.
The ICE agent maintains a separate list, called the VALID LIST, for
each check list in the check list set.  The valid list will contain
valid pairs.  Initially each valid list is empty.
The ICE agent maintains a separate list, referred to as the valid
list.  There is a valid list for each check list in the check list
set.  The valid list will contain valid pairs.  Initially each valid
list is empty.
If the controlled agent receives a Binding request with the USE-
CANDIDATE attribute set, and if the agent accepts the request, the
agent constructs a candidate pair whose local candidate is equal to
the transport address on which the request was received, and whose
remote candidate is equal to the source transport address of the
request that was received.  This candidate pair is assigned an
arbitrary priority, and placed into a list of valid candidates called
the valid list.  The agent sets the nominated flag for that pair to
true.
If the controlled agent receives a Binding request with the USE-
CANDIDATE attribute set, and if the agent accepts the request, the
agent constructs a candidate pair whose local candidate is equal to
the transport address on which the request was received, and whose
remote candidate is equal to the source transport address of the
request that was received.  This candidate pair is assigned an
arbitrary priority, and placed into the valid list of the associated
check list.  The agent sets the nominated flag for that pair to true.
If an agent is not able to produce selected pairs for a media stream,
the agent MUST take proper actions for informing the other agent, and
e.g.,removing the stream.  The exact actions are outside the sope of
this specification.
If an agent is not able to produce selected pairs for a media stream,
the agent MUST take proper actions for informing the other agent, and
e.g., removing the stream.  The exact actions are outside the scope
of this specification.
NOTE: A controlling agent that does not support this specification
(i.e. it is implemented according to RFC 5245) might nominate more
than one candidate pair.  This was referred to as aggressive
nomination in RFC 5245.  The usage of the 'ice2' ice option by
endpoints supporting this specification should prevent such
controlling agents from using aggressive nomination.
NOTE: A controlling agent that does not support this specification
(i.e. it is implemented according to RFC 5245) might nominate more
than one candidate pair.  This was referred to as aggressive
nomination in RFC 5245.  The usage of the 'ice2' ice option sec-ice-
option by endpoints supporting this specification should prevent such
controlling agents from using aggressive nomination.
For each candidate pair that an agent is using to send media, if no
packet has been sent on that pair in the last Tr seconds, an agent
MUST send a keepalive on that pair.  Agents SHOULD use a Tr value of
15 seconds.  Agents MUST NOT use a Tr value smaller than 15 seconds.
For each candidate pair that an agent is using to send media, if no
packet has been sent on that pair in the last Tr seconds, an agent
MUST send a keepalive on that pair.  Agents SHOULD use a Tr value of
15 seconds.  Agents MAY use a bigger value, but MUST NOT use a value
smaller than 15 seconds.
ICE agents MUST by default use STUN keepalives.  Individual ICE
usages and ICE extensions MAY specify usage/extension-specific
keepalives.
RFC 3550 RFC3550 describes an algorithm in Section 8.2 for detecting
synchronization source (SSRC) collisions and loops.  These algorithms
are based, in part, on seeing different source transport addresses
with the same SSRC.  However, when ICE is used, such changes will
sometimes occur as the media streams switch between candidates.  An
agent will be able to determine that a media stream is from the same
peer as a consequence of the STUN exchange that proceeds media
transmission.  Thus, if there is a change in source transport
address, but the media packets come from the same peer agent, this
SHOULD NOT be treated as an SSRC collision.
RFC 3550 RFC3550 describes an algorithm in Section 8.2 for detecting
synchronization source (SSRC) collisions and loops.  These algorithms
are based, in part, on seeing different source transport addresses
with the same SSRC.  However, when ICE is used, such changes will
sometimes occur as the media streams switch between candidates.  An
agent will be able to determine that a media stream is from the same
peer as a consequence of the STUN exchange that proceeds media
transmission.  Thus, if there is a change in source transport
address, but the media packets come from the same peer agent, this
MUST NOT be treated as an SSRC collision.
If an ICE agent wants to use another Ta value than the default value,
the agent MUST indicate the proposed value to its peer during the ICE
exchange.  Both agents MUST use the higher value of the proposed
values.  If an agent does not propose a value, the default value is
used for that agent when comparing which value is higher.
If an ICE agent wants to use another Ta value than the default value,
the agent MUST indicate the proposed value to its peer during the
establishment of the ICE session.  Both agents MUST use the higher
value of the proposed values.  If an agent does not propose a value,
the default value is used for that agent when comparing which value
is higher.
A false mapped address learned by these attacks will be used as a
server reflexive candidate in the ICE exchange.  For this candidate
to actually be used for media, the attacker must also attack the
connectivity checks, and in particular, force a false valid on a
false candidate.  This attack is very hard to launch if the false
address identifies a fourth party (neither the initiator, responder,
nor attacker), since it requires attacking the checks generated by
each agent in the session, and is prevented by SRTP if it identifies
the attacker themself.
A false mapped address learned by these attacks will be used as a
server reflexive candidate in the establishment of the ICE session.
For this candidate to actually be used for media, the attacker must
also attack the connectivity checks, and in particular, force a false
valid on a false candidate.  This attack is very hard to launch if
the false address identifies a fourth party (neither the initiator,
responder, nor attacker), since it requires attacking the checks
generated by each agent in the session, and is prevented by SRTP if
it identifies the attacker themself.
The process of gathering of candidates and performing of connectivity
checks can be bandwidth intensive.  ICE has been designed to pace
both of these processes.  The gathering phase and the connectivity
check phase are meant to generate traffic at roughly the same
bandwidth as the media traffic itself.  This was done to ensure that,
if a network is designed to support multimedia traffic of a certain
type (voice, video, or just text), it will have sufficient capacity
to support the ICE checks for that media.  Of course, the ICE checks
will cause a marginal increase in the total utilization; however,
this will typically be an extremely small increase.
The process of gathering of candidates and performing of connectivity
checks can be bandwidth intensive.  ICE has been designed to pace
both of these processes.  The gathering phase and the connectivity
check phase are meant to generate traffic at roughly the same
bandwidth as the media traffic itself.  This was done to ensure that,
if a network is designed to support communication traffic of a
certain type (voice, video, or just text), it will have sufficient
capacity to support the ICE checks for that media.  Of course, the
ICE checks will cause a marginal increase in the total utilization;
however, this will typically be an extremely small increase.