RFC 8841: Session Description Protocol (SDP) Offer/Answer Procedures for Stream Control Transmission Protocol (SCTP) over Datagram Transport Layer Security (DTLS) Transport
- C. Holmberg,
- R. Shpount,
- S. Loreto,
- G. Camarillo
Abstract
The Stream Control Transmission Protocol (SCTP) is a transport protocol used to establish associations between two endpoints. RFC 8261 specifies how SCTP can be used on top of the Datagram Transport Layer Security (DTLS) protocol, which is referred to as SCTP-over-DTLS.¶
This specification defines the following new Session Description Protocol (SDP)
protocol identifiers (proto values): "UDP/DTLS/SCTP" and "TCP
Status of This Memo
This is an Internet Standards Track document.¶
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶
Information about the current status of this document, any
errata, and how to provide feedback on it may be obtained at
https://
Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://
1. Introduction
The Session Description Protocol (SDP) [RFC4566] provides a
general-purpose format for describing multimedia sessions in announcements
or invitations. "TCP-Based Media Transport in the Session Description Protocol
(SDP)" [RFC4145] specifies a general
mechanism for describing and
establishing TCP [RFC0793] streams.
"Connection
The Stream Control Transmission Protocol (SCTP) [RFC4960] is a reliable transport protocol used to transport data between two endpoints using SCTP associations.¶
[RFC8261] specifies how SCTP can be used on top of the Datagram Transport Layer Security (DTLS) protocol, an arrangement referred to as SCTP-over-DTLS.¶
This specification defines the following new SDP
[RFC4566] protocol identifiers (proto
values): "UDP/DTLS/SCTP" and "TCP
2. Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
3. SCTP Terminology
- SCTP association:
- A protocol relationship between SCTP endpoints, composed of the two SCTP endpoints and protocol state information including verification tags and the currently active set of Transmission Sequence Numbers (TSNs), etc. An association can be uniquely identified by the transport addresses used by the endpoints in the association.¶
- SCTP stream:
- A unidirectional logical channel established from one associated SCTP endpoint to another, within which all user messages are delivered in sequence except for those submitted to the unordered delivery service.¶
- SCTP-over-DTLS:
- SCTP used on top of DTLS, as specified in [RFC8261].¶
4. SDP Media Descriptions
4.1. General
This section defines the following new SDP media description ("m="
line) protocol identifiers (proto values) for describing an SCTP
association: "UDP/DTLS/SCTP" and "TCP
The following is the format for an "m=" line, as specified in [RFC4566]:¶
The "UDP/DTLS/SCTP" and "TCP/DTLS/SCTP" proto values are similar to both the "UDP" and "TCP" proto values in that they only describe the transport-layer protocol and not the upper-layer protocol.¶
4.2. Protocol Identifiers
The new proto values are defined as below:¶
4.3. Media-Format Management
[RFC4566] states that specifications defining new proto values must define the rules by which their media format (fmt) namespace is managed.¶
An "m=" line with a proto value of "UDP/DTLS/SCTP" or "TCP/DTLS/SCTP" always describes a single SCTP association.¶
In addition, such an "m=" line MUST further indicate
the application
When the "UDP/DTLS/SCTP" and "TCP/DTLS/SCTP" proto values are
used, the "m=" line fmt value, which identifies the
application
4.4. Syntax
4.4.1. General
This section defines the values that can be used within an SDP media description ("m=" line) associated with an SCTP-over-DTLS association.¶
This specification creates an IANA registry for "association
4.4.2. SDP Media Description Values
When the SCTP association is used to realize a WebRTC data channel
[RFC8832], the <fmt> parameter value is 'webrtc
4.5. Example
5. SDP "sctp-port" Attribute
5.1. General
This section defines a new SDP media-level attribute, "sctp-port". The attribute can be associated with an SDP media description ("m=" line) with a "UDP/DTLS/SCTP" or a "TCP/DTLS/SCTP" proto value. In that case, the "m=" line port value indicates the port of the underlying transport-layer protocol (UDP or TCP), and the "sctp-port" value indicates the SCTP port.¶
No default value is defined for the SDP "sctp-port" attribute. Therefore, if the attribute is not present, the associated "m=" line MUST be considered invalid.¶
5.2. Syntax
The definition of the SDP "sctp-port" attribute is:¶
- Attribute name:
- sctp-port¶
- Type of attribute:
- media¶
- Mux category:
- CAUTION¶
- Subject to charset:
- No¶
- Purpose:
- Indicate the SCTP port value associated with the SDP media description.¶
- Appropriate values:
- Integer¶
- Contact name:
-
Christer Holmberg¶
- Contact e-mail:
- christer
.holmberg @ericsson .com ¶ - Reference:
- RFC 8841¶
- Syntax:
The SCTP port range is between 0 and 65535 (both included). Leading zeroes MUST NOT be used.¶
Example:¶
5.3. Mux Category
The mux category [RFC8859] for the SDP "sctp-port" attribute is CAUTION.¶
As the usage of multiple SCTP associations on top of a single DTLS association is outside the scope of this specification, no mux rules are specified for the "UDP/DTLS/SCTP" and "TCP/DTLS/SCTP" proto values. Future extensions that define how to negotiate multiplexing of multiple SCTP associations of top of a single DTLS association need to also define the mux rules for the attribute.¶
6. SDP "max-message-size" Attribute
6.1. General
This section defines a new SDP media-level attribute, "max
An SCTP endpoint MUST NOT send a SCTP user message with a message size that is larger than the maximum size indicated by the peer, as it cannot be assumed that the peer would accept such a message.¶
If the SDP "max
If the SDP "max
6.2. Syntax
The definition of the SDP "max
- Attribute name:
- max-message-size¶
- Type of attribute:
- media¶
- Mux category:
- CAUTION¶
- Subject to charset:
- No¶
- Purpose:
- Indicate the maximum message size (indicated in bytes) that an SCTP endpoint is willing to receive on the SCTP association associated with the SDP media description.¶
- Appropriate values:
- Integer¶
- Contact name:
-
Christer Holmberg¶
- Contact e-mail:
- christer
.holmberg @ericsson .com ¶ - Reference:
- RFC 8841¶
- Syntax:
Leading zeroes MUST NOT be used.¶
Example:¶
6.3. Mux Category
The mux category for the SDP "max
As the usage of multiple SCTP associations on top of a single DTLS association is outside the scope of this specification, no mux rules are specified for the "UDP/DTLS/SCTP" and "TCP/DTLS/SCTP" proto values.¶
7. UDP/DTLS/SCTP Transport Realization
The UDP/DTLS/SCTP transport is realized as described below:¶
8. TCP/DTLS/SCTP Transport Realization
The TCP/DTLS/SCTP transport is realized as described below:¶
9. Association and Connection Management
9.1. General
This section describes how to manage an SCTP association, DTLS association, and TCP connection using SDP attributes.¶
The SCTP association, the DTLS association, and the TCP connection are managed independently from each other. Each can be established and closed without impacting others.¶
The detailed SDP offer/answer [RFC3264] procedures for the SDP attributes are described in Section 10.¶
9.2. SDP "sendrecv"/"sendonly"/"recvonly"/"inactive" Attributes
This specification does not define semantics for the SDP direction attributes [RFC4566]. Unless the semantics of these attributes for an SCTP association usage have been defined, SDP direction attributes MUST be ignored if present.¶
9.3. SCTP Association
When an SCTP association is established, both SCTP endpoints MUST initiate the SCTP association (i.e., both SCTP endpoints take the "active" role). In addition, both endpoints MUST use the same SCTP port as client port and server port, in order to prevent two separate SCTP associations from being established.¶
As both SCTP endpoints take the "active" role, the SDP "setup" attribute [RFC4145] does not apply to SCTP association establishment. However, the "setup" attribute does apply to establishment of the underlying DTLS association and TCP connection.¶
The SDP "connection" attribute [RFC4145] does not apply to the SCTP association. In order to trigger the closure of an existing SCTP association and establishment of a new SCTP association, the SDP "sctp-port" attribute (Section 5) is used to indicate a new (different than the ones currently used) SCTP port. The existing SCTP association is closed, and the new SCTP association is established, if one or both endpoints signal a new SCTP port. The "connection" attribute does apply to establishment of underlying TCP connections.¶
Alternatively, an SCTP association can be closed using the SDP "sctp-port" attribute with an attribute value of zero. Later, a new SCTP association can be established using the procedures in this section for establishing an SCTP association.¶
SCTP associations might be closed without SDP signaling -- for example, in case of a failure. The procedures in this section MUST be followed to establish a new SCTP association. This requires a new SDP offer/answer exchange. New (different than the ones currently used) SCTP ports MUST be used by both endpoints.¶
9.4. DTLS Association (UDP/DTLS/SCTP and TCP/DTLS/SCTP)
A DTLS association is managed according to the procedures in [RFC8842]. Hence, the SDP "setup" attribute is used to negotiate the (D)TLS roles ("client" and "server") [RFC8122].¶
9.5. TCP Connection (TCP/DTLS/SCTP)
The TCP connection is managed according to the procedures in [RFC4145]. Hence, the SDP "setup" attribute is used to negotiate the TCP roles ("active" and "passive"), and the SDP "connection" attribute is used to indicate whether to use an existing TCP connection or create a new one. The SDP "setup" attribute "holdconn" value MUST NOT be used.¶
10. SDP Offer/Answer Procedures
10.1. General
This section defines the SDP Offer/Answer [RFC3264] procedures for negotiating and establishing an SCTP-over-DTLS association. Unless explicitly stated, the procedures apply to both the "UDP/DTLS/SCTP" and "TCP/DTLS/SCTP" "m=" line proto values.¶
Each endpoint MUST associate one or more certificate fingerprints using the SDP "fingerprint" attribute with the "m=" line, following the procedures in [RFC8122].¶
The authentication certificates are interpreted and validated as defined in [RFC8122]. Self-signed certificates can be used securely, provided that the integrity of the SDP description is assured, as defined in [RFC8122].¶
Each endpoint MUST associate an SDP "tls-id" attribute with the "m=" line, following the procedures in [RFC8842].¶
10.2. Generating the Initial SDP Offer
When the offerer creates an initial offer, the offerer:¶
10.3. Generating the SDP Answer
When the answerer receives an offer that contains an "m=" line describing an SCTP-over-DTLS association, if the answerer accepts the association, the answerer:¶
Once the answerer has sent the answer:¶
If the SDP "sctp-port" attribute in the answer contains an attribute value of zero, the answerer MUST NOT establish an SCTP association. If an SCTP association exists, the offerer MUST close it.¶
If the answerer does not accept the "m=" line in the offer, it MUST assign a zero port value to the corresponding "m=" line in the answer, following the procedures in [RFC3264]. In addition, the answerer MUST NOT initiate the establishment of a TCP connection, a DTLS association, or a DTLS association associated with the "m=" line.¶
10.4. Offerer Processing of the SDP Answer
Once the offerer has received the answer:¶
If the SDP "sctp-port" attribute in the answer contains an attribute value of zero, the offerer MUST NOT establish an SCTP association. If, in addition, an SCTP association exists, the offerer MUST close it.¶
If the "m=" line in the answer contains a zero port value, the offerer MUST NOT initiate the establishment of a TCP connection, a DTLS association, or an SCTP association associated with the "m=" line. If, in addition, a TCP connection, DTLS association, or SCTP association exists, the offerer MUST close it.¶
10.5. Modifying the Session
When an offerer sends an updated offer, in order to modify a previously established SCTP association, it follows the procedures in Section 10.2, with the following exceptions:¶
The offerer follows the procedures in [RFC8842] regarding the DTLS association impacts when modifying a session.¶
In the case of TCP/DTLS/SCTP, the offerer follows the procedures in [RFC4145] regarding the TCP connection impacts when modifying a session.¶
11. Multihoming Considerations
Multihoming is not supported when sending SCTP on top of DTLS, as DTLS does not expose address management of the underlying transport protocols (UDP or TCP) to its upper layer.¶
12. NAT Considerations
12.1. General
When SCTP-over-DTLS is used in a NAT environment, it relies on the NAT traversal procedures for the underlying transport protocol (UDP or TCP).¶
12.2. ICE Considerations
When SCTP-over-DTLS is used with UDP-based ICE candidates [RFC8445], then the procedures for UDP/DTLS/SCTP (Section 7) are used.¶
When SCTP-over-DTLS is used with TCP-based ICE candidates [RFC6544], then the procedures for TCP/DTLS/SCTP (Section 8) are used.¶
In ICE environments, during the nomination process, endpoints go through multiple ICE candidate pairs until the most preferred candidate pair is found. During the nomination process, data can be sent as soon as the first working candidate pair is found, but the nomination process still continues, and selected candidate pairs can still change while data is sent. Furthermore, if endpoints roam between networks -- for instance, when a mobile endpoint switches from mobile connection to WiFi -- endpoints will initiate an ICE restart. This will trigger a new nomination process between the new set of candidates, which will likely result in the new nominated candidate pair.¶
Implementations MUST treat all ICE candidate pairs associated with an SCTP association on top of a DTLS association as part of the same DTLS association. Thus, there will only be one SCTP handshake and one DTLS handshake even if there are multiple valid candidate pairs; shifting from one candidate pair to another, including switching between UDP and TCP candidate pairs, will not impact the SCTP or DTLS associations. If new candidates are added, they will also be part of the same SCTP and DTLS associations. When transitioning between candidate pairs, different candidate pairs can be currently active in different directions, and implementations MUST be ready to receive data on any of the candidates, even if this means sending and receiving data using UDP/DTLS/SCTP and TCP/DTLS/SCTP at the same time in different directions.¶
In order to maximize the likelihood of interoperabilit
When an SDP offer or answer is sent with multiple ICE candidates
during initial connection
negotiation or after ICE restart, UDP-based candidates
SHOULD be included, and the default
candidate SHOULD be chosen from one of those UDP
candidates. The proto value MUST match
the transport protocol associated with the default candidate. If UDP transport is used
for the default candidate, then the "UDP/DTLS/SCTP" proto value
MUST be used. If TCP transport
is used for the default candidate, then the "TCP/DTLS/SCTP" proto
value MUST be used.
Note that under normal circumstances, the proto value for offers
and answers sent during ICE
nomination SHOULD be "UDP
When a subsequent SDP offer or answer is sent after ICE nomination is complete, and it does not initiate ICE restart, it will contain only the nominated ICE candidate pair. In this case, the proto value MUST match the transport protocol associated with the nominated ICE candidate pair. If UDP transport is used for the nominated pair, then the "UDP/DTLS/SCTP" proto value MUST be used. If TCP transport is used for the nominated pair, then the "TCP/DTLS/SCTP" proto value MUST be used. Please note that if an endpoint switches between TCP-based and UDP-based candidates during the nomination process, the endpoint is not required to send an SDP offer for the sole purpose of keeping the proto value of the associated "m=" line in sync.¶
13. Examples
13.1. Establishment of UDP/DTLS/SCTP Association
SDP Offer:¶
SDP Answer:¶
Note that due to RFC formatting conventions, this document splits SDP across lines whose content would exceed 72 characters. A backslash character marks where this line folding has taken place. This backslash and its trailing CRLF and whitespace would not appear in actual SDP content.¶
14. Security Considerations
[RFC4566] defines general SDP security considerations, while [RFC3264], [RFC4145], and [RFC8122] define security considerations when using the SDP offer/answer mechanism to negotiate media streams.¶
[RFC4960] defines general SCTP security considerations, and [RFC8261] defines security considerations when using SCTP on top of DTLS.¶
This specification does not introduce new security considerations in addition to those defined in the specifications listed above.¶
15. IANA Considerations
15.1. New SDP Proto Values
This document updates the "Session Description Protocol (SDP) Parameters" registry, following the procedures in [RFC4566], by adding the following values to the table in the SDP "proto" field registry:¶
15.2. New SDP Attributes
15.2.1. sctp-port
This document defines a new SDP media-level attribute,"sctp
15.2.2. max-message-size
This document defines a new SDP media-level
attribute,"max
15.3. association-usage Name Registry
Per this specification, a new IANA registry has been created, following the procedures in [RFC8126], for the namespace associated with the "UDP/DTLS/SCTP" and "TCP/DTLS/SCTP" protocol identifiers. Each fmt value describes the usage of an entire SCTP association, including all SCTP streams associated with the SCTP association.¶
The fmt value "association
As part of this registry, IANA maintains the following information:¶
- association
-usage name: - The identifier of the subprotocol, as will be used as the fmt value.¶
- association
-usage reference: - A reference to the document in which the association
-usage is defined.¶
association
IANA has added the following initial values to the registry.¶
16. References
16.1. Normative References
- [RFC0793]
-
Postel, J., "Transmission Control Protocol", STD 7, RFC 793, DOI 10
.17487 , , <https:///RFC0793 www >..rfc -editor .org /info /rfc793 - [RFC2119]
-
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10
.17487 , , <https:///RFC2119 www >..rfc -editor .org /info /rfc2119 - [RFC3264]
-
Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model with Session Description Protocol (SDP)", RFC 3264, DOI 10
.17487 , , <https:///RFC3264 www >..rfc -editor .org /info /rfc3264 - [RFC4145]
-
Yon, D. and G. Camarillo, "TCP-Based Media Transport in the Session Description Protocol (SDP)", RFC 4145, DOI 10
.17487 , , <https:///RFC4145 www >..rfc -editor .org /info /rfc4145 - [RFC4566]
-
Handley, M., Jacobson, V., and C. Perkins, "SDP: Session Description Protocol", RFC 4566, DOI 10
.17487 , , <https:///RFC4566 www >..rfc -editor .org /info /rfc4566 - [RFC4571]
-
Lazzaro, J., "Framing Real-time Transport Protocol (RTP) and RTP Control Protocol (RTCP) Packets over Connection
-Oriented , RFC 4571, DOI 10Transport" .17487 , , <https:///RFC4571 www >..rfc -editor .org /info /rfc4571 - [RFC4960]
-
Stewart, R., Ed., "Stream Control Transmission Protocol", RFC 4960, DOI 10
.17487 , , <https:///RFC4960 www >..rfc -editor .org /info /rfc4960 - [RFC6347]
-
Rescorla, E. and N. Modadugu, "Datagram Transport Layer Security Version 1.2", RFC 6347, DOI 10
.17487 , , <https:///RFC6347 www >..rfc -editor .org /info /rfc6347 - [RFC6544]
-
Rosenberg, J., Keranen, A., Lowekamp, B. B., and A. B. Roach, "TCP Candidates with Interactive Connectivity Establishment (ICE)", RFC 6544, DOI 10
.17487 , , <https:///RFC6544 www >..rfc -editor .org /info /rfc6544 - [RFC8122]
-
Lennox, J. and C. Holmberg, "Connection
-Oriented , RFC 8122, DOI 10Media Transport over the Transport Layer Security (TLS) Protocol in the Session Description Protocol (SDP)" .17487 , , <https:///RFC8122 www >..rfc -editor .org /info /rfc8122 - [RFC8126]
-
Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 8126, DOI 10
.17487 , , <https:///RFC8126 www >..rfc -editor .org /info /rfc8126 - [RFC8174]
-
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10
.17487 , , <https:///RFC8174 www >..rfc -editor .org /info /rfc8174 - [RFC8261]
-
Tuexen, M., Stewart, R., Jesup, R., and S. Loreto, "Datagram Transport Layer Security (DTLS) Encapsulation of SCTP Packets", RFC 8261, DOI 10
.17487 , , <https:///RFC8261 www >..rfc -editor .org /info /rfc8261 - [RFC8842]
-
Holmberg, C. and R. Shpount, "Session Description Protocol (SDP) Offer/Answer Considerations for Datagram Transport Layer Security (DTLS) and Transport Layer Security (TLS)", RFC 8842, DOI 10
.17487 , , <https:///RFC8842 www >..rfc -editor .org /info /rfc8842 - [RFC8859]
-
Nandakumar, S., "A Framework for Session Description Protocol (SDP) Attributes When Multiplexing", RFC 8859, DOI 10
.17487 , , <https:///RFC8859 www >..rfc -editor .org /info /rfc8859
16.2. Informative References
- [RFC8445]
-
Keranen, A., Holmberg, C., and J. Rosenberg, "Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal", RFC 8445, DOI 10
.17487 , , <https:///RFC8445 www >..rfc -editor .org /info /rfc8445 - [RFC8831]
-
Jesup, R., Loreto, S., and M. Tüxen, "WebRTC Data Channels", RFC 8831, DOI 10
.17487 , , <https:///RFC8831 www >..rfc -editor .org /info /rfc8831 - [RFC8832]
-
Jesup, R., Loreto, S., and M. Tüxen, "WebRTC Data Channel Establishment Protocol", RFC 8832, DOI 10
.17487 , , <https:///RFC8832 www >..rfc -editor .org /info /rfc8832 - [RFC8864]
-
Drage, K., Makaraju, M., Ejzak, R., Marcon, J., and R. Even, Ed., "Negotiation Data Channels Using the Session Description Protocol (SDP)", RFC 8864, DOI 10
.17487 , , <https:///RFC8864 www >..rfc -editor .org /info /rfc8864
Acknowledgements
The authors wish to thank Harald Alvestrand,
Randell Jesup, Paul Kyzivat, Michael Tüxen, Juergen Stoetzer