RFC 5245 - 交互式连接建立 (ICE)

• 状态: Proposed Standard
• 发布日期: April 2010
• Stream: IETF
• 废弃了: RFC4091, RFC4092
• 被废弃: RFC8445, RFC8839
• 勘误: 无勘误

---

摘要

本文档定义了一种用于网络地址转换 (NAT) 遍历的协议, 适用于基于 UDP 的多媒体会话, 这些会话通过 offer/answer 模型建立.该协议称为交互式连接建立 (Interactive Connectivity Establishment, ICE).ICE 利用了 NAT 会话遍历实用程序 (Session Traversal Utilities for NAT, STUN) 协议及其扩展——通过中继穿越 NAT (Traversal Using Relay NAT, TURN).任何使用 offer/answer 模型的协议 (例如会话发起协议 (Session Initiation Protocol, SIP)) 都可以使用 ICE.

本备忘录的状态

本文档是互联网标准跟踪规范.

本文档是互联网工程任务组 (Internet Engineering Task Force, IETF) 的产品.它代表了 IETF 社区的共识.它已经过公开审查, 并已获得互联网工程指导组 (Internet Engineering Steering Group, IESG) 的批准发布.有关互联网标准的更多信息, 参见 RFC 5741 的第 2 节.

有关本文档当前状态、任何勘误表以及如何提供反馈的信息, 可以在 http://www.rfc-editor.org/info/rfc5245 获得.

版权声明

版权所有 (c) 2010 IETF Trust 和被确认为文档作者的人员.保留所有权利.

本文档受 BCP 78 以及 IETF Trust 关于 IETF 文档的法律规定 (http://trustee.ietf.org/license-info) 的约束, 这些规定在本文档发布之日有效.请仔细阅读这些文档, 因为它们描述了您对本文档的权利和限制.从本文档中提取的代码组件必须包含简化 BSD 许可证文本, 如 Trust 法律规定第 4.e 节所述, 并按简化 BSD 许可证中所述不提供任何担保.

目录

• 1. 简介 (Introduction)
• 2. ICE 概览 (Overview of ICE)
  • 2.1. 收集候选地址 (Gathering Candidate Addresses)
  • 2.2. 连接检查 (Connectivity Checks)
  • 2.3. 候选项排序 (Sorting Candidates)
  • 2.4. 冻结候选项 (Frozen Candidates)
  • 2.5. 检查的安全性 (Security for Checks)
  • 2.6. 结束 ICE (Concluding ICE)
  • 2.7. Lite 实现 (Lite Implementations)
• 3. 术语 (Terminology)
• 4. 发送初始 Offer (Sending the Initial Offer)
  • 4.1. Full 实现的需求 (Full Implementation Requirements)
    • 4.1.1. 收集 Candidates (Gathering Candidates)
      • 4.1.1.1. 主机候选项 (Host Candidates)
      • 4.1.1.2. 服务器反射与中继候选项 (Server Reflexive and Relayed Candidates)
      • 4.1.1.3. 计算 Foundations (Computing Foundations)
      • 4.1.1.4. 保持候选项存活 (Keeping Candidates Alive)
    • 4.1.2. 确定 Candidates 优先级 (Prioritizing Candidates)
      • 4.1.2.1. 推荐公式 (Recommended Formula)
      • 4.1.2.2. 选择类型与本地偏好的准则 (Guidelines for Choosing Type and Local Preferences)
    • 4.1.3. 消除冗余 Candidates (Eliminating Redundant Candidates)
    • 4.1.4. 选择 Default Candidates (Choosing Default Candidates)
  • 4.2. Lite 实现的需求 (Lite Implementation Requirements)
  • 4.3. 编码 SDP (Encoding the SDP)
• 5. 接收初始 Offer (Receiving the Initial Offer)
  • 5.1. 验证 ICE 支持 (Verifying ICE Support)
  • 5.2. 确定角色 (Determining Role)
  • 5.3. 收集 Candidates (Gathering Candidates)
  • 5.4. 确定 Candidates 优先级 (Prioritizing Candidates)
  • 5.5. 选择 Default Candidates (Choosing Default Candidates)
  • 5.6. 编码 SDP (Encoding the SDP)
  • 5.7. 形成检查列表 (Forming the Check Lists)
    • 5.7.1. 形成候选对 (Forming Candidate Pairs)
    • 5.7.2. 计算对优先级与排序 (Computing Pair Priority and Ordering Pairs)
    • 5.7.3. 剪枝对 (Pruning the Pairs)
    • 5.7.4. 计算状态 (Computing States)
  • 5.8. 调度检查 (Scheduling Checks)
• 6. 收到初始应答 (Receipt of the Initial Answer)
  • 6.1. 验证 ICE 支持 (Verifying ICE Support)
  • 6.2. 确定角色 (Determining Role)
  • 6.3. 形成检查列表 (Forming the Check List)
  • 6.4. 执行普通检查 (Performing Ordinary Checks)
• 7. 执行连接检查 (Performing Connectivity Checks)
  • 7.1. STUN Client 过程 (STUN Client Procedures)
    • 7.1.1. 为 Relayed Candidates 创建 Permissions (Creating Permissions for Relayed Candidates)
    • 7.1.2. 发送 Request (Sending the Request)
      • 7.1.2.1. PRIORITY 与 USE-CANDIDATE (PRIORITY and USE-CANDIDATE)
      • 7.1.2.2. ICE-CONTROLLED 与 ICE-CONTROLLING (ICE-CONTROLLED and ICE-CONTROLLING)
      • 7.1.2.3. 形成凭据 (Forming Credentials)
      • 7.1.2.4. DiffServ 处理 (DiffServ Treatment)
    • 7.1.3. 处理 Response (Processing the Response)
      • 7.1.3.1. 失败情况 (Failure Cases)
      • 7.1.3.2. 成功情况 (Success Cases)
        • 7.1.3.2.1. 发现 Peer Reflexive Candidates (Discovering Peer Reflexive Candidates)
        • 7.1.3.2.2. 构造有效对 (Constructing a Valid Pair)
        • 7.1.3.2.3. 更新对状态 (Updating Pair States)
        • 7.1.3.2.4. 更新 Nominated 标志 (Updating the Nominated Flag)
      • 7.1.3.3. 检查列表与计时器状态更新 (Check List and Timer State Updates)
  • 7.2. STUN Server 过程 (STUN Server Procedures)
    • 7.2.1. Full 实现的附加过程 (Additional Procedures for Full Implementations)
      • 7.2.1.1. 检测并修复角色冲突 (Detecting and Repairing Role Conflicts)
      • 7.2.1.2. 计算映射地址 (Computing Mapped Address)
      • 7.2.1.3. 学习 Peer Reflexive Candidates (Learning Peer Reflexive Candidates)
      • 7.2.1.4. 触发检查 (Triggered Checks)
      • 7.2.1.5. 更新 Nominated 标志 (Updating the Nominated Flag)
    • 7.2.2. Lite 实现的附加过程 (Additional Procedures for Lite Implementations)
• 8. 结束 ICE 处理 (Concluding ICE Processing)
  • 8.1. Full 实现的过程 (Procedures for Full Implementations)
    • 8.1.1. 提名对 (Nominating Pairs)
      • 8.1.1.1. 常规提名 (Regular Nomination)
      • 8.1.1.2. 激进提名 (Aggressive Nomination)
    • 8.1.2. 更新状态 (Updating States)
  • 8.2. Lite 实现的过程 (Procedures for Lite Implementations)
    • 8.2.1. 对端为 Full (Peer Is Full)
    • 8.2.2. 对端为 Lite (Peer Is Lite)
  • 8.3. 释放候选项 (Freeing Candidates)
    • 8.3.1. Full 实现的过程 (Full Implementation Procedures)
    • 8.3.2. Lite 实现的过程 (Lite Implementation Procedures)
• 9. 后续 Offer/Answer 交换 (Subsequent Offer/Answer Exchanges)
  • 9.1. 生成 Offer (Generating the Offer)
    • 9.1.1. 所有实现的过程 (Procedures for All Implementations)
      • 9.1.1.1. ICE 重启 (ICE Restarts)
      • 9.1.1.2. 移除媒体流 (Removing a Media Stream)
      • 9.1.1.3. 添加媒体流 (Adding a Media Stream)
    • 9.1.2. Full 实现的过程 (Procedures for Full Implementations)
      • 9.1.2.1. ICE 运行中的现有媒体流 (Existing Media Streams with ICE Running)
      • 9.1.2.2. ICE 已完成的现有媒体流 (Existing Media Streams with ICE Completed)
    • 9.1.3. Lite 实现的过程 (Procedures for Lite Implementations)
      • 9.1.3.1. ICE 运行中的现有媒体流 (Existing Media Streams with ICE Running)
      • 9.1.3.2. ICE 已完成的现有媒体流 (Existing Media Streams with ICE Completed)
  • 9.2. 接收 Offer 并生成 Answer (Receiving the Offer and Generating an Answer)
    • 9.2.1. 所有实现的过程 (Procedures for All Implementations)
      • 9.2.1.1. 检测 ICE 重启 (Detecting ICE Restart)
      • 9.2.1.2. 新的媒体流 (New Media Stream)
      • 9.2.1.3. 移除的媒体流 (Removed Media Stream)
    • 9.2.2. Full 实现的过程 (Procedures for Full Implementations)
      • 9.2.2.1. ICE 运行且无 remote-candidates 的现有媒体流 (Existing Media Streams with ICE Running and no remote-candidates)
      • 9.2.2.2. ICE 完成且无 remote-candidates 的现有媒体流 (Existing Media Streams with ICE Completed and no remote-candidates)
      • 9.2.2.3. 现有媒体流与 remote-candidates (Existing Media Streams and remote-candidates)
    • 9.2.3. Lite 实现的过程 (Procedures for Lite Implementations)
  • 9.3. 更新检查与有效列表 (Updating the Check and Valid Lists)
    • 9.3.1. Full 实现的过程 (Procedures for Full Implementations)
      • 9.3.1.1. ICE 重启 (ICE Restarts)
      • 9.3.1.2. 新的媒体流 (New Media Stream)
      • 9.3.1.3. 移除的媒体流 (Removed Media Stream)
      • 9.3.1.4. 现有媒体流的 ICE 继续 (ICE Continuing for Existing Media Stream)
    • 9.3.2. Lite 实现的过程 (Procedures for Lite Implementations)
• 10. 保活 (Keepalives)
• 11. 媒体处理 (Media Handling)
  • 11.1. 发送媒体 (Sending Media)
    • 11.1.1. Full 实现的过程 (Procedures for Full Implementations)
    • 11.1.2. Lite 实现的过程 (Procedures for Lite Implementations)
    • 11.1.3. 所有实现的过程 (Procedures for All Implementations)
  • 11.2. 接收媒体 (Receiving Media)
• 12. 与 SIP 一起使用 (Usage with SIP)
  • 12.1. 延迟指南 (Latency Guidelines)
    • 12.1.1. INVITE 中的 Offer (Offer in INVITE)
    • 12.1.2. 响应中的 Offer (Offer in Response)
  • 12.2. SIP Option Tags 与 Media Feature Tags (SIP Option Tags and Media Feature Tags)
  • 12.3. 与 Forking 的交互 (Interactions with Forking)
  • 12.4. 与 Preconditions 的交互 (Interactions with Preconditions)
  • 12.5. 与第三方呼叫控制的交互 (Interactions with Third Party Call Control)
• 13. 与 ANAT 的关系 (Relationship with ANAT)
• 14. 可扩展性考虑 (Extensibility Considerations)
• 15. 语法 (Grammar)
  • 15.1. "candidate" 属性 ("candidate" Attribute)
  • 15.2. "remote-candidates" 属性 ("remote-candidates" Attribute)
  • 15.3. "ice-lite" 与 "ice-mismatch" 属性 ("ice-lite" and "ice-mismatch" Attributes)
  • 15.4. "ice-ufrag" 与 "ice-pwd" 属性 ("ice-ufrag" and "ice-pwd" Attributes)
  • 15.5. "ice-options" 属性 ("ice-options" Attribute)
• 16. 设置 Ta 和 RTO (Setting Ta and RTO)
  • 16.1. RTP 媒体流 (RTP Media Streams)
  • 16.2. 非 RTP 会话 (Non-RTP Sessions)
• 17. 示例 (Example)
• 18. 安全考虑 (Security Considerations)
  • 18.1. 对连接检查的攻击 (Attacks on Connectivity Checks)
  • 18.2. 对服务器反射地址收集的攻击 (Attacks on Server Reflexive Address Gathering)
  • 18.3. 对中继候选项收集的攻击 (Attacks on Relayed Candidate Gathering)
  • 18.4. 对 Offer/Answer 交换的攻击 (Attacks on the Offer/Answer Exchanges)
  • 18.5. 内部攻击 (Insider Attacks)
    • 18.5.1. Voice Hammer 攻击 (The Voice Hammer Attack)
    • 18.5.2. STUN 放大攻击 (STUN Amplification Attack)
  • 18.6. 与应用层网关及 SIP 的交互 (Interactions with Application Layer Gateways and SIP)
• 19. STUN 扩展 (STUN Extensions)
  • 19.1. 新属性 (New Attributes)
  • 19.2. 新错误响应码 (New Error Response Codes)
• 20. 运营考虑 (Operational Considerations)
  • 20.1. NAT 与防火墙类型 (NAT and Firewall Types)
  • 20.2. 带宽需求 (Bandwidth Requirements)
    • 20.2.1. STUN 与 TURN Server 容量规划 (STUN and TURN Server Capacity Planning)
    • 20.2.2. 收集与连接检查 (Gathering and Connectivity Checks)
    • 20.2.3. 保活 (Keepalives)
  • 20.3. ICE 与 ICE-lite (ICE and ICE-lite)
  • 20.4. 故障排查与性能管理 (Troubleshooting and Performance Management)
  • 20.5. 终端配置 (Endpoint Configuration)
• 21. IANA 考虑 (IANA Considerations)
  • 21.1. SDP 属性 (SDP Attributes)
    • 21.1.1. candidate 属性 (candidate Attribute)
    • 21.1.2. remote-candidates 属性 (remote-candidates Attribute)
    • 21.1.3. ice-lite 属性 (ice-lite Attribute)
    • 21.1.4. ice-mismatch 属性 (ice-mismatch Attribute)
    • 21.1.5. ice-pwd 属性 (ice-pwd Attribute)
    • 21.1.6. ice-ufrag 属性 (ice-ufrag Attribute)
    • 21.1.7. ice-options 属性 (ice-options Attribute)
  • 21.2. STUN 属性 (STUN Attributes)
  • 21.3. STUN 错误响应 (STUN Error Responses)
• 22. IAB 考虑 (IAB Considerations)
  • 22.1. 问题定义 (Problem Definition)
  • 22.2. 退出策略 (Exit Strategy)
  • 22.3. ICE 引入的脆弱性 (Brittleness Introduced by ICE)
  • 22.4. 长期解决方案的需求 (Requirements for a Long-Term Solution)
  • 22.5. 现有 NAPT 设备的问题 (Issues with Existing NAPT Boxes)
• 23. 致谢 (Acknowledgements)
• 24. 参考文献 (References)
  • 24.1. 规范性参考文献 (Normative References)
  • 24.2. 资料性参考文献 (Informative References)
• Appendix A. Lite 与 Full 实现 (Lite and Full Implementations)
• Appendix B. 设计动机 (Design Motivations)
  • B.1. STUN Transactions 的 Pacing (Pacing of STUN Transactions)
  • B.2. 具有多个 Bases 的 Candidates (Candidates with Multiple Bases)
  • B.3. <rel-addr> 与 <rel-port> 属性的用途 (Purpose of the <rel-addr> and <rel-port> Attributes)
  • B.4. STUN Username 的重要性 (Importance of the STUN Username)
  • B.5. Candidate Pair Priority 公式 (The Candidate Pair Priority Formula)
  • B.6. remote-candidates 属性 (The remote-candidates Attribute)
  • B.7. 为什么需要保活 (Why Are Keepalives Needed?)
  • B.8. 为什么优先使用 Peer Reflexive Candidates? (Why Prefer Peer Reflexive Candidates?)
  • B.9. 为什么要发送更新后的 Offer? (Why Send an Updated Offer?)
  • B.10. 为什么保活使用 Binding Indications? (Why Are Binding Indications Used for Keepalives?)
  • B.11. 为什么需要冲突解决机制? (Why Is the Conflict Resolution Mechanism Needed?)