Subject: [Perc] MD notifying KD of client exit

From: Paul Ellenbogen <[email-masked]>
Date: Thu, 18 Aug 2016 14:38:22 -0700

Although I believe a call participant can close the DTLS association, if
the client does not exit gracefully the KD may never know. The MD is in a
better position to know if this is the case because the client's stream of
SRTP packets to the MD will stop. If we want to re-key the conference
whenever a client leaves, there should be a message from the MD to the KD
when the MD detects a participant drops out of the call.

Thoughts?

Paul Ellenbogen

---

From: Richard Barnes <[email-masked]>
Date: Thu, 18 Aug 2016 17:43:47 -0400

Seems sensible.  You would just want to have another MD->KD message that
says "$ASSOC_ID dropped"?

On Thu, Aug 18, 2016 at 5:38 PM, Paul Ellenbogen <[email-masked]>
wrote:

> _______________________________________________
> Perc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perc
>
>

---

From: Paul Ellenbogen <[email-masked]>
Date: Thu, 18 Aug 2016 14:59:06 -0700

I see two possible approaches.

One is what you suggest where you have status message type. The status
message would have association id and the status, which in this case is
dropped. This allows statuses to be added later.

Alternatively we have a "Dropped" message type that just has the
association ID of the dropped client.

I don't feel strongly about either.

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 18 Aug 2016 23:33:05 +0000

Paul,

This would be reasonable to do so long as we can ensure that some 
packets are sent from the client to the server on a regular basis that 
the server can authenticate.  Usually, there is some kind of traffic 
(voice, video, or STUN) quite frequently.  In the past with voice-only 
calls, I've seen some devices literally stop sending audio packets when 
the user hit the mute button.  There should at least "silence" frames, 
instead.

Just so there is no doubt, should we have something written that says an 
endpoint must send either a media or STUN packet ever N seconds to 
ensure that the the Media Distributor recognizes that the endpoint is 
still present. Likewise, It must not be a packet that can be replayed.  
All RTP and RTCP packets work for that.  It could be STUN, but I'll 
venture to guess that I could replay those to a Media Distributor and it 
would not be the wiser.  A NONCE attribute could be inserted, but 
keeping up with what values have and have not been used would be a pain. 
  Perhaps you can think of a better solution, but I'd prefer to just 
mandate an RTP or RTCP packet at least every N seconds.  No reason that 
cannot happen.

There are other points of failure that can be equally problematic for 
secure deployments where re-keying is needed if a person leaves the 
conference. For example, if the Key Distributor failed, then it would be 
impossible to re-key the conference.  If the "conference controller" 
(whatever is directing the media distributor to allocate ports / process 
SDP / whatever) fails, that could also be a problem.  Perhaps for this 
limited class of conferences, we might also specify that the conference 
should be torn down if either the Key Distributor or conference 
controller become unresponsive.

We could introduce an application level "ping" for the tunnel interface 
to be used when the conference is active, but there are no other 
messages traversing the tunnel.

Since we are not defining the protocol that communicates with the Media 
Distributor to allocate ports, perhaps we put something in the framework 
that speaks to it.  That's a problem outside the scope of the WG.

Paul

------ Original Message ------
From: "Paul Ellenbogen" <[email-masked]>
To: [email-masked]
Sent: 8/18/2016 5:38:22 PM
Subject: [Perc] MD notifying KD of client exit

>Although I believe a call participant can close the DTLS association, 
>if the client does not exit gracefully the KD may never know. The MD is 
>in a better position to know if this is the case because the client's 
>stream of SRTP packets to the MD will stop. If we want to re-key the 
>conference whenever a client leaves, there should be a message from the 
>MD to the KD when the MD detects a participant drops out of the call.
>
>Thoughts?
>
>Paul Ellenbogen

---

From: Adam Roach <[email-masked]>
Date: Thu, 18 Aug 2016 18:45:20 -0500

On 8/18/16 18:33, Paul E. Jones wrote:
> calls, I've seen some devices literally stop sending audio packets 
> when the user hit the mute button.

I'm okay reiterating in the PERC documents that RTCP is not, and has 
never been, optional.

/a