From 718c3c40a47fbf30c90930d191ac395f6bc138d3 Mon Sep 17 00:00:00 2001 From: Alexander Bakker Date: Tue, 18 Aug 2026 20:01:12 +0200 Subject: [PATCH] Don't restart DTLS after receiving new tls-id while passive When the remote end of a DTLS media session changes their ``tls-id`` in their answer in response to a re-INVITE, they are the one to initiate a new DTLS handshake. Previously, rtpengine would always perform a DTLS restart after seeing a new ``tls-id``, even if rtpengine's DTLS role is currently passive. This could abort an in-progress handshake, leaving the remote end retransmitting DTLS packets without ever getting a response. This patch addresses that. --- daemon/call.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/daemon/call.c b/daemon/call.c index 1387aba24..11b1d9320 100644 --- a/daemon/call.c +++ b/daemon/call.c @@ -2228,8 +2228,13 @@ static void __dtls_logic(const sdp_ng_flags *flags, } else if (other_media->tls_id.len && (sp->tls_id.len == 0 || str_cmp_str(&other_media->tls_id, &sp->tls_id))) { // previously seen tls-id and new tls-id is different or not present - ilogs(crypto, LOG_INFO, "TLS-ID changed, restarting DTLS"); - __dtls_restart(other_media); + if (MEDIA_ISSET(other_media, SETUP_PASSIVE) && !MEDIA_ISSET(other_media, SETUP_ACTIVE)) { + // passive: active peer controls DTLS restart + ilogs(crypto, LOG_INFO, "TLS-ID changed, passive role, not restarting DTLS"); + } else { + ilogs(crypto, LOG_INFO, "TLS-ID changed, restarting DTLS"); + __dtls_restart(other_media); + } } else if (ice_is_restart(other_media->ice_agent, sp) && !other_media->tls_id.len && !sp->tls_id.len) { // Skip DTLS restart if no-tls-id flag is active (user opted out of TLS-ID handling)