Enforce ICE consent

[sirzooro]

Expire consent after 30 seconds without an authenticated successful
Binding response, and fail the selected connection on a matching
STUN 403 response. Allow the Binding Request handler to send an
authenticated error response to revoke consent explicitly.

Reuse existing keepalive requests and preserve disconnect timeouts,
candidate registration, selector interfaces, and role-conflict handling.

[codecov]

Codecov Report

❌ Patch coverage is 97.32143% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.75%. Comparing base (ff25299) to head (f916920).

Files with missing lines	Patch %	Lines
agent.go	96.96%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #894      +/-   ##
==========================================
+ Coverage   91.56%   91.75%   +0.19%     
==========================================
  Files          45       45              
  Lines        5309     5360      +51     
==========================================
+ Hits         4861     4918      +57     
+ Misses        448      442       -6     

Flag	Coverage Δ
go	91.75% <97.32%> (+0.19%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Implements RFC 7675-style consent freshness handling in the ICE agent by tracking consent from existing STUN Binding request/response traffic, enforcing expiry via validateSelectedPair(), and adding support for authenticated inbound STUN Binding Error responses (including 403-driven consent revocation). It also introduces an application hook to emit custom authenticated Binding Error responses for inbound Binding Requests.

Changes:

• Add consent freshness state (consentFreshnessTimeout, lastConsentAt), default timeout configuration, and expiry enforcement.
• Add inbound Binding Error response handling (MESSAGE-INTEGRITY + transaction/destination matching) and 403 consent revocation behavior.
• Add BindingRequestErrorResponseHandler and sendBindingError(...) to allow custom authenticated Binding Error responses (with optional extra STUN attributes).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
selection_test.go	Adds tests validating selector behavior when BindingRequestErrorResponseHandler returns a custom Binding Error response.
selection.go	Evaluates the new error-response handler before pair creation and sends Binding Error responses when requested; renames pending-success helper usage.
gather_test.go	Updates DTLS relay test to use the new DTLS options-style listener API.
gather.go	Updates DTLS TURN client creation to the options-style DTLS client API.
agent_test.go	Adds tests for authenticated inbound 403 error response consent revocation and consent-expiry validation.
agent_options_test.go	Adds coverage for WithConsentFreshnessTimeout and WithBindingRequestErrorResponseHandler.
agent_options.go	Introduces WithConsentFreshnessTimeout and WithBindingRequestErrorResponseHandler options.
agent_config_test.go	Verifies default consent freshness timeout and that a zero timeout disables expiry.
agent_config.go	Adds default consent timeout constant, config fields, and initializes consentFreshnessTimeout.
agent.go	Implements consent timestamping/expiry logic, Binding Error sending, and inbound Binding Error response handling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Sean-Der]

Moved logic out of transport.go but this isn't new

[Sean-Der]

I switched back to sending Binding Requests every 2 seconds.

Old ice-lite Pion instances would go to disconnected because of this. We can address this in a future smaller away, but wanted to land the larger consent change first.

[JoTurk]

I think this is good,

Minor detail we allow agents to disable keepalive and we use it in many tests, some of them are introduced in this pr and recently #988 (review)

So this behavior is documented, but now we use the same timer for consent freshness, and with keepalive = 0, the connection will fail after the failed timeout (30s), I'm not sure how common keepalive=0 is but this sounds like something someone would set while debugging or optimizing I found a similar bug when i was testing the disconnection bug #951 Maybe we should fix or prevent this?