1. 30 Jul, 2019 1 commit
  2. 29 Jul, 2019 1 commit
    • Fabrice Bellet's avatar
      conncheck: update a misleading debug statement · 1607f920
      Fabrice Bellet authored
      We may not have received remote candidates yet, but we may have
      discovered remote candidates from the early incoming checks. Only
      having stream credentials is required to react to these checks.
  3. 12 Jul, 2019 1 commit
    • Fabrice Bellet's avatar
      conncheck: avoid transport association mismatch · 85a5c0a0
      Fabrice Bellet authored
      In some rare cases, the same address and port number may match two
      remotes candidates, a tcp and an udp one, and lead to buggy pair
      construction with incompatible transport. This supplementary check
      prevents this problem. The matching test is not aimed to be exhaustive
      but just a way to discard obviously broken associations, and fallback to
      accept everything else (because socket type has a great diversity, with
      socket types based on other sockets types).
      It should fix #81, where such bogus transport association has been
      reported (tcp-pass:udp).
  4. 11 Jul, 2019 3 commits
    • Fabrice Bellet's avatar
      conncheck: test inbound stun address on the candidate base address · 0b70e024
      Fabrice Bellet authored
      When receiving an stun packet on a socket, and looking for the matching
      local candidate, normally it doesn't make a difference to test the
      address or the base address. Because a pair cannot have a local candidate
      of type srv-rflx, where there would be a difference, the local candidate
      obtained will be part of a pair of the conncheck list.
      Except for the case of a pairs with tcp-act local candidate, where the
      addr has a port number of zero (tcp-act socket before connect), and the
      socket of the stun packet has a non-null port number (tcp-act socket
      after connect), corresponding to the base address of another
      peer-reflexive tcp-act local candidate, previously discoverd.
      The selection of the local candidate concerned by an inbound stun
      request happens when early incoming checks are processed, and when
      inbound stun packets are normally received during the conncheck.
      This commit complete commit e6a19418 (for early incoming checks)
      in the normal inbound stun packets code path, where is similar
      modification is needed.
    • Fabrice Bellet's avatar
      conncheck: improve comment on local peer-reflexive selection · e4d65ba7
      Fabrice Bellet authored
      This patch rewrites the comment surrounding this code snippet, to make it
      clear, that this pair selection is not specific to the tcp transport.
    • Fabrice Bellet's avatar
      conncheck: nominate matching pairs across components and streams · 1e40ee6d
      Fabrice Bellet authored
      The current valid pair nomination makes no effort to select pairs that
      could have some similarities across different components and different
      streams. This is normally not required by the RFC8445, but some well
      known applications will misbehave when the libnice agent is in this
      position to choose the nominated pairs (regular nomination mode, and
      controlling mode) and if it makes an unexpected choice from the peer
      This patch improves the stopping criterion and the selection of the
      preferred pair to nominate in that case.
      When no other pair has been nominated yet (across all streams), the
      previous stopping criterion still applies, and the best ranked pair of
      the checklist is selected.
      When a nominated pair exists from another component, we try to nominate
      a pair of the same kind (same local and remote addresses and same
      transport) if we have one, and possibly the best pair we have in the
      checklist, and else we look for a nominated pair from another stream.
  5. 04 Jul, 2019 9 commits
    • Fabrice Bellet's avatar
      conncheck: define a property for a final idle timeout · 0512ecaa
      Fabrice Bellet authored
      This final idle timeout is renamed from the
      NICE_AGENT_MAX_TIMER_GRACE_PERIOD macro, and keeps its semantic.
      We also increase the default value of this timeout from 1 second to 5
      seconds.  This is useful for the sipe pidgin plugin that has to deal
      with SfB agents, that may take some time in controlling mode before
      choosing and testing the nominated pair
    • Fabrice Bellet's avatar
      conncheck: fix pair priorities uniqueness · 2118cbae
      Fabrice Bellet authored
      This patch fixes the priority assigned to a peer reflexive discovered
      local candidate, when the agent has the stun client role and receives an
      stun reply. This priority must be the value put in the stun request, ie
      the pair->rflx_priority from the parent pair. This ensures two similar
      ordered pairs, will generate discovered pairs ordered in the same way
      for the stun client, and also for the stun server on the other side.
      Without this identical ordered on both sides of the connections, the two
      agents may nominate a different pair with the aggresive nomination
      scenario, since both are valid.
      The other fix concerns the function that ensures local candidates
      priority uniqueness, that breaks the assumption that "two local
      candidates having the same priority should generate the same
      prflx_priority in the pairs they contribute". Respecting this assumption
      is important to stay coherent with the behavior of the other agent, that
      considers that two stun requests coming from the same peer-reflexive
      remote candidate will have the same remote priority (once a remote
      candidate is added to the component remote_candidates list, its priority
      is not supposed to change).
    • Fabrice Bellet's avatar
      conncheck: create the valid pair on early tcp stun requests · 628fc393
      Fabrice Bellet authored
      When replaying the incoming checks, we have to create the succeeded
      valid pair matching this tcp connection the same way we do it
      in conn_check_handle_inbound_stun().
    • Fabrice Bellet's avatar
    • Fabrice Bellet's avatar
      conncheck: test incoming checks on candidate base address · e6a19418
      Fabrice Bellet authored
      The candidate may be a newly discovered peer reflexive one,
      or a server reflexive initial candidate, where address and
      base address differ. Early incoming checks are received on
      the base address. These incoming checks may accumulate if remote
      credentials arrive with a delay.
    • Fabrice Bellet's avatar
      conncheck: increase dumped information in debug · a383faa4
      Fabrice Bellet authored
      In complement to the conncheck list, we dump the pair transport type,
      the socket type, and the incoming checks list.
    • Fabrice Bellet's avatar
    • Fabrice Bellet's avatar
      Revert "conncheck: Don't lookup prflx pair for UDP candidates" · 07d3caa5
      Fabrice Bellet authored
      This reverts commit ca47519f.
    • Fabrice Bellet's avatar
      discovery: fix an use-after-free in SFB user credentials · 8e5809b7
      Fabrice Bellet authored
      The base64 decoded username and password strings given to
      stun_usage_turn_create() should not freed immediately, since they remain
      used when handling the following related inbound stun replies.
  6. 27 Jun, 2019 1 commit
  7. 29 May, 2019 1 commit
  8. 09 May, 2019 1 commit
    • Jakub Adam's avatar
      discovery: Asynchronous removal of TURN refreshes · 0556ec49
      Jakub Adam authored
      When deleting a turn refresh, ensure the assocaited port allocations on
      the TURN server are properly removed. This means wait for a response for
      our 0-lifetime refresh request and implement retransmissions. Only
      delete the refresh after TURN port removal has been confirmed or all
      our retransmissions timed out.
  9. 08 May, 2019 1 commit
  10. 08 Mar, 2019 2 commits
    • Jakub Adam's avatar
      tests: rename test-dribble to test-trickle · 9afd0c8b
      Jakub Adam authored
    • Jakub Adam's avatar
      agent: trickle ICE mode · a6112cec
      Jakub Adam authored
      In this mode, activated by setting "ice-trickle" property of a
      NiceAgent to TRUE, a component without a successful connectivity check
      will wait indefinitely for more remote candidates to come.
      nice_agent_peer_candidate_gathering_done() must be called after
      receiving the last remote candidate for the component to finally change
  11. 29 Jan, 2019 1 commit
    • Olivier Crête's avatar
      turn: Allow lifetimes under 60s · 602d48c4
      Olivier Crête authored
      Don't set a timeout to the very far future if the lifetime sent  by the
      server is under 60s. Instead of doing "lifetime - 60", switch to lifetime/2.
  12. 22 Jan, 2019 1 commit
  13. 14 Jan, 2019 1 commit
  14. 27 Dec, 2018 5 commits
  15. 28 Oct, 2018 3 commits
  16. 21 Oct, 2018 1 commit
  17. 23 Mar, 2018 7 commits