Index: pjproject/trunk/pjlib-util/src/pjlib-util/resolver.c
===================================================================
--- pjproject/trunk/pjlib-util/src/pjlib-util/resolver.c	(revision 2700)
+++ pjproject/trunk/pjlib-util/src/pjlib-util/resolver.c	(revision 2724)
@@ -29,4 +29,5 @@
 #include <pj/pool.h>
 #include <pj/pool_buf.h>
+#include <pj/rand.h>
 #include <pj/string.h>
 #include <pj/sock.h>
@@ -784,4 +785,5 @@
 
     /* Save the ID and key */
+    /* TODO: dnsext-forgery-resilient: randomize id for security */
     q->id = resolver->last_id++;
     if (resolver->last_id == 0)
Index: pjproject/trunk/pjmedia/src/pjmedia-codec/ipp_codecs.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia-codec/ipp_codecs.c	(revision 2700)
+++ pjproject/trunk/pjmedia/src/pjmedia-codec/ipp_codecs.c	(revision 2724)
@@ -234,8 +234,9 @@
 {
 #   if PJMEDIA_HAS_INTEL_IPP_CODEC_AMR
+    /* AMR-NB SID seems to produce noise, so let's just disable its VAD. */
     {1, "AMR",	    PJMEDIA_RTP_PT_AMR,       &USC_GSMAMR_Fxns,  8000, 1, 160, 
-		    5900, 12200, 4, 1, 1, 
-		    &predecode_amr, &parse_amr, &pack_amr
-		    /*, {1, {{{"octet-align", 11}, {"1", 1}}} } */
+		    7400, 12200, 2, 0, 1, 
+		    &predecode_amr, &parse_amr, &pack_amr,
+		    {1, {{{"octet-align", 11}, {"1", 1}}} }
     },
 #   endif
@@ -244,5 +245,6 @@
     {1, "AMR-WB",   PJMEDIA_RTP_PT_AMRWB,     &USC_AMRWB_Fxns,  16000, 1, 320,
 		    15850, 23850, 1, 1, 1, 
-		    &predecode_amr, &parse_amr, &pack_amr
+		    &predecode_amr, &parse_amr, &pack_amr,
+		    {1, {{{"octet-align", 11}, {"1", 1}}} }
     },
 #   endif
@@ -561,5 +563,12 @@
     /* Check Change Mode Request. */
     if ((setting->amr_nb && cmr <= 7) || (!setting->amr_nb && cmr <= 8)) {
+	struct ipp_codec *ippc = &ipp_codec[codec_data->codec_idx];
+
 	s->enc_mode = cmr;
+	codec_data->info->params.modes.bitrate = s->enc_setting.amr_nb?
+				pjmedia_codec_amrnb_bitrates[s->enc_mode] :
+				pjmedia_codec_amrwb_bitrates[s->enc_mode];
+	ippc->fxns->std.Control(&codec_data->info->params.modes, 
+				codec_data->enc);
     }
 
@@ -1034,5 +1043,5 @@
 
     /* Not sure if VAD affects decoder, just try to be safe */
-    codec_data->info->params.modes.vad = ippc->has_native_vad;
+    //codec_data->info->params.modes.vad = ippc->has_native_vad;
 
     /* Get number of memory blocks needed by the decoder */
@@ -1085,23 +1094,51 @@
 	amr_settings_t *s;
 	pj_uint8_t octet_align = 0;
-	const pj_str_t STR_FMTP_OCTET_ALIGN = {"octet-align", 11};
-
-	/* Check octet-align */
+	pj_int8_t enc_mode = -1;
+
+	/* Check AMR specific attributes */
+
 	for (i = 0; i < attr->setting.dec_fmtp.cnt; ++i) {
+	    /* octet-align, one of the parameters that must have same value 
+	     * in offer & answer (RFC 4867 Section 8.3.1). Just check fmtp
+	     * in the decoder side, since it's value is guaranteed to fulfil 
+	     * above requirement (by SDP negotiator).
+	     */
+	    const pj_str_t STR_FMTP_OCTET_ALIGN = {"octet-align", 11};
+	    
 	    if (pj_stricmp(&attr->setting.dec_fmtp.param[i].name, 
 			   &STR_FMTP_OCTET_ALIGN) == 0)
 	    {
 		octet_align=(pj_uint8_t)
-			    (pj_strtoul(&attr->setting.dec_fmtp.param[i].val));
+			    pj_strtoul(&attr->setting.dec_fmtp.param[i].val);
 		break;
 	    }
 	}
-
+	for (i = 0; i < attr->setting.enc_fmtp.cnt; ++i) {
+	    /* mode-set */
+	    const pj_str_t STR_FMTP_MODE_SET = {"mode-set", 8};
+	    
+	    if (pj_stricmp(&attr->setting.enc_fmtp.param[i].name, 
+			   &STR_FMTP_MODE_SET) == 0)
+	    {
+		pj_int8_t tmp;
+
+		/* Just get the first value. */
+		tmp = (pj_int8_t)
+		      pj_strtoul(&attr->setting.enc_fmtp.param[i].val);
+
+		if ((ippc->pt == PJMEDIA_RTP_PT_AMR && tmp > 0 && tmp < 8) ||
+		    (ippc->pt == PJMEDIA_RTP_PT_AMRWB && tmp > 0 && tmp < 9))
+		{
+		    enc_mode = tmp;
+		    PJ_LOG(4,(THIS_FILE, "Remote specifies AMR mode-set attr, "
+			      "selected: %d", enc_mode));
+		}
+		break;
+	    }
+	}
+
+	/* Initialize AMR specific settings */
 	s = PJ_POOL_ZALLOC_T(pool, amr_settings_t);
 	codec_data->codec_setting = s;
-
-	s->enc_mode = pjmedia_codec_amr_get_mode(ippc->def_bitrate);
-	if (s->enc_mode < 0)
-	    goto on_error;
 
 	s->enc_setting.amr_nb = (pj_uint8_t)(ippc->pt == PJMEDIA_RTP_PT_AMR);
@@ -1109,8 +1146,25 @@
 	s->enc_setting.reorder = PJ_TRUE;
 	s->enc_setting.cmr = 15;
-	
+
 	s->dec_setting.amr_nb = (pj_uint8_t)(ippc->pt == PJMEDIA_RTP_PT_AMR);
 	s->dec_setting.octet_aligned = octet_align;
 	s->dec_setting.reorder = PJ_TRUE;
+
+	s->enc_mode = pjmedia_codec_amr_get_mode(
+				    codec_data->info->params.modes.bitrate);
+	if (s->enc_mode < 0)
+	    goto on_error;
+
+	if (enc_mode != -1) {
+	    s->enc_mode = enc_mode;
+
+	    /* Apply requested encoder bitrate */
+	    codec_data->info->params.modes.bitrate = s->enc_setting.amr_nb?
+				    pjmedia_codec_amrnb_bitrates[s->enc_mode] :
+				    pjmedia_codec_amrwb_bitrates[s->enc_mode];
+	    ippc->fxns->std.Control(&codec_data->info->params.modes, 
+				    codec_data->enc);
+	}  
+
     }
 #endif
Index: pjproject/trunk/pjmedia/src/pjmedia/conf_switch.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/conf_switch.c	(revision 2700)
+++ pjproject/trunk/pjmedia/src/pjmedia/conf_switch.c	(revision 2724)
@@ -554,8 +554,30 @@
     }
     
-    /* Check if sink is listening to other ports */
+    /* If sink is currently listening to other ports, it needs to be released
+     * first before the new connection made.
+     */ 
     if (dst_port->transmitter_cnt > 0) {
-	pj_mutex_unlock(conf->mutex);
-	return PJ_ETOOMANYCONN;
+	unsigned j;
+	pj_bool_t transmitter_found = PJ_FALSE;
+
+	pj_assert(dst_port->transmitter_cnt == 1);
+	for (j=0; j<conf->max_ports && !transmitter_found; ++j) {
+	    if (conf->ports[j]) {
+		unsigned k;
+
+		for (k=0; k < conf->ports[j]->listener_cnt; ++k) {
+		    if (conf->ports[j]->listener_slots[k] == sink_slot) {
+			PJ_LOG(4,(THIS_FILE, "Connection [%d->%d] is "
+				  "disconnected forcedly for the new "
+				  "connection [%d->%d]",
+				  j, sink_slot, src_slot, sink_slot));
+			pjmedia_conf_disconnect_port(conf, j, sink_slot);
+			transmitter_found = PJ_TRUE;
+			break;
+		    }
+		}
+	    }
+	}
+	pj_assert(dst_port->transmitter_cnt == 0);
     }
 
Index: pjproject/trunk/pjmedia/src/pjmedia/sdp_neg.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/sdp_neg.c	(revision 2700)
+++ pjproject/trunk/pjmedia/src/pjmedia/sdp_neg.c	(revision 2724)
@@ -866,10 +866,12 @@
 			{
 			    /* Further check for G7221, negotiate bitrate. */
-			    if (pj_strcmp2(&or_.enc_name, "G7221") == 0) {
+			    if (pj_stricmp2(&or_.enc_name, "G7221") == 0) {
 				if (match_g7221(offer, i, answer, j))
 				    break;
 			    } else
 			    /* Further check for AMR, negotiate fmtp. */
-			    if (pj_strcmp2(&or_.enc_name, "AMR") == 0) {
+			    if (pj_stricmp2(&or_.enc_name, "AMR") == 0 ||
+				pj_stricmp2(&or_.enc_name, "AMR-WB") == 0) 
+			    {
 				if (match_amr(offer, i, answer, j, PJ_FALSE, 
 					      NULL))
@@ -1071,5 +1073,5 @@
 		pjmedia_sdp_attr_get_rtpmap(a, &or_);
 
-		if (!pj_strcmp2(&or_.enc_name, "telephone-event")) {
+		if (!pj_stricmp2(&or_.enc_name, "telephone-event")) {
 		    master_has_telephone_event = 1;
 		    if (found_matching_telephone_event)
@@ -1098,5 +1100,5 @@
 			if (!pj_stricmp(&or_.enc_name, &lr.enc_name) &&
 			    or_.clock_rate == lr.clock_rate &&
-			    (pj_strcmp(&or_.param, &lr.param)==0 ||
+			    (pj_stricmp(&or_.param, &lr.param)==0 ||
 			     (or_.param.slen==1 && *or_.param.ptr=='1'))) 
 			{
@@ -1104,5 +1106,5 @@
 			    if (is_codec) {
 				/* Further check for G7221, negotiate bitrate */
-				if (pj_strcmp2(&or_.enc_name, "G7221") == 0 &&
+				if (pj_stricmp2(&or_.enc_name, "G7221") == 0 &&
 				    !match_g7221(master, i, slave, j))
 				{
@@ -1110,5 +1112,7 @@
 				} else 
 				/* Further check for AMR, negotiate fmtp */
-				if (pj_strcmp2(&or_.enc_name, "AMR")==0) {
+				if (pj_stricmp2(&or_.enc_name, "AMR")==0 ||
+				    pj_stricmp2(&or_.enc_name, "AMR-WB")==0) 
+				{
 				    unsigned o_med_idx, a_med_idx;
 
Index: pjproject/trunk/pjmedia/src/pjmedia/tonegen.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/tonegen.c	(revision 2700)
+++ pjproject/trunk/pjmedia/src/pjmedia/tonegen.c	(revision 2724)
@@ -385,11 +385,11 @@
 	{ '1', 697,  1209 },
 	{ '2', 697,  1336 },
-	{ '3', 697,  1447 },
+	{ '3', 697,  1477 },
 	{ '4', 770,  1209 },
 	{ '5', 770,  1336 },
-	{ '6', 770,  1447 },
+	{ '6', 770,  1477 },
 	{ '7', 852,  1209 },
 	{ '8', 852,  1336 },
-	{ '9', 852,  1447 },
+	{ '9', 852,  1477 },
 	{ 'a', 697,  1633 },
 	{ 'b', 770,  1633 },
Index: pjproject/trunk/pjnath/include/pjnath/config.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/config.h	(revision 2700)
+++ pjproject/trunk/pjnath/include/pjnath/config.h	(revision 2724)
@@ -260,4 +260,11 @@
 #define PJ_ICE_MAX_COMP		    (2<<PJ_ICE_COMP_BITS)
 
+/**
+ * Use the priority value according to the ice-draft.
+ */
+#ifndef PJNATH_ICE_PRIO_STD
+#   define PJNATH_ICE_PRIO_STD			    1
+#endif
+
 
 /**
@@ -265,5 +272,9 @@
  */
 #ifndef PJ_ICE_CAND_TYPE_PREF_BITS
-#   define PJ_ICE_CAND_TYPE_PREF_BITS		    2
+#   if PJNATH_ICE_PRIO_STD
+#	define PJ_ICE_CAND_TYPE_PREF_BITS	    8
+#   else
+#	define PJ_ICE_CAND_TYPE_PREF_BITS	    2
+#   endif
 #endif
 
@@ -325,21 +336,58 @@
 
 /**
+ * For a controlled agent, specify how long it wants to wait (in milliseconds)
+ * for the controlling agent to complete sending connectivity check with
+ * nominated flag set to true for all components after the controlled agent
+ * has found that all connectivity checks in its checklist have been completed
+ * and there is at least one successful (but not nominated) check for every
+ * component.
+ *
+ * When selecting the value, bear in mind that the connectivity check from
+ * controlling agent may be delayed because of delay in receiving SDP answer
+ * from the controlled agent.
+ *
+ * Application may set this value to -1 to disable this timer.
+ *
+ * Default: 10000 (milliseconds)
+ */
+#ifndef ICE_CONTROLLED_AGENT_WAIT_NOMINATION_TIMEOUT
+#   define ICE_CONTROLLED_AGENT_WAIT_NOMINATION_TIMEOUT	10000
+#endif
+
+
+/**
+ * For controlling agent if it uses regular nomination, specify the delay to
+ * perform nominated check (connectivity check with USE-CANDIDATE attribute)
+ * after all components have a valid pair.
+ *
+ * Default: 4*PJ_STUN_RTO_VALUE (milliseconds)
+ */
+#ifndef PJ_ICE_NOMINATED_CHECK_DELAY
+#   define PJ_ICE_NOMINATED_CHECK_DELAY		    (4*PJ_STUN_RTO_VALUE)
+#endif
+
+
+/**
  * Minimum interval value to be used for sending STUN keep-alive on the ICE
- * stream transport, in seconds. This minimum interval, plus a random value
- * which maximum is PJ_ICE_ST_KEEP_ALIVE_MAX_RAND, specify the actual interval
+ * session, in seconds. This minimum interval, plus a random value
+ * which maximum is PJ_ICE_SESS_KEEP_ALIVE_MAX_RAND, specify the actual interval
  * of the STUN keep-alive.
  *
- * Default: 20 seconds
- *
- * @see PJ_ICE_ST_KEEP_ALIVE_MAX_RAND
- */
-#ifndef PJ_ICE_ST_KEEP_ALIVE_MIN
-#   define PJ_ICE_ST_KEEP_ALIVE_MIN		    20
-#endif
-
+ * Default: 15 seconds
+ *
+ * @see PJ_ICE_SESS_KEEP_ALIVE_MAX_RAND
+ */
+#ifndef PJ_ICE_SESS_KEEP_ALIVE_MIN
+#   define PJ_ICE_SESS_KEEP_ALIVE_MIN		    20
+#endif
+
+/* Warn about deprecated macro */
+#ifdef PJ_ICE_ST_KEEP_ALIVE_MIN
+#   error PJ_ICE_ST_KEEP_ALIVE_MIN is deprecated
+#endif
 
 /**
  * To prevent STUN keep-alives to be sent simultaneously, application should
- * add random interval to minimum interval (PJ_ICE_ST_KEEP_ALIVE_MIN). This
+ * add random interval to minimum interval (PJ_ICE_SESS_KEEP_ALIVE_MIN). This
  * setting specifies the maximum random value to be added to the minimum
  * interval, in seconds.
@@ -347,8 +395,13 @@
  * Default: 5 seconds
  *
- * @see PJ_ICE_ST_KEEP_ALIVE_MIN
- */
-#ifndef PJ_ICE_ST_KEEP_ALIVE_MAX_RAND
-#   define PJ_ICE_ST_KEEP_ALIVE_MAX_RAND	    5
+ * @see PJ_ICE_SESS_KEEP_ALIVE_MIN
+ */
+#ifndef PJ_ICE_SESS_KEEP_ALIVE_MAX_RAND
+#   define PJ_ICE_SESS_KEEP_ALIVE_MAX_RAND	    5
+#endif
+
+/* Warn about deprecated macro */
+#ifdef PJ_ICE_ST_KEEP_ALIVE_MAX_RAND
+#   error PJ_ICE_ST_KEEP_ALIVE_MAX_RAND is deprecated
 #endif
 
Index: pjproject/trunk/pjnath/include/pjnath/errno.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/errno.h	(revision 2700)
+++ pjproject/trunk/pjnath/include/pjnath/errno.h	(revision 2724)
@@ -197,5 +197,10 @@
  */
 #define PJNATH_EICENOHOSTCAND	    (PJNATH_ERRNO_START+92) /* 370092 */
-
+/**
+ * @hideinitializer
+ * Controlled agent timed-out in waiting for the controlling agent to 
+ * send nominated check after all connectivity checks have completed.
+ */
+#define PJNATH_EICENOMTIMEOUT	    (PJNATH_ERRNO_START+93) /* 370093 */
 
 /************************************************************
Index: pjproject/trunk/pjnath/include/pjnath/ice_session.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/ice_session.h	(revision 2700)
+++ pjproject/trunk/pjnath/include/pjnath/ice_session.h	(revision 2724)
@@ -177,9 +177,16 @@
 {
     /**
-     * The pointer to ICE check which was nominated for this component.
-     * The value will be NULL if a nominated check has not been found
-     * for this component.
+     * Pointer to ICE check with highest priority which connectivity check
+     * has been successful. The value will be NULL if a no successful check
+     * has not been found for this component.
      */
     pj_ice_sess_check	*valid_check;
+
+    /**
+     * Pointer to ICE check with highest priority which connectivity check
+     * has been successful and it has been nominated. The value may be NULL
+     * if there is no such check yet.
+     */
+    pj_ice_sess_check	*nominated_check;
 
     /**
@@ -554,4 +561,42 @@
 
 /**
+ * This structure describes various ICE session options. Application
+ * configure the ICE session with these options by calling 
+ * #pj_ice_sess_set_options().
+ */
+typedef struct pj_ice_sess_options
+{
+    /**
+     * Specify whether to use aggressive nomination.
+     */
+    pj_bool_t		aggressive;
+
+    /**
+     * For controlling agent if it uses regular nomination, specify the delay
+     * to perform nominated check (connectivity check with USE-CANDIDATE 
+     * attribute) after all components have a valid pair.
+     *
+     * Default value is PJ_ICE_NOMINATED_CHECK_DELAY.
+     */
+    unsigned		nominated_check_delay;
+
+    /**
+     * For a controlled agent, specify how long it wants to wait (in 
+     * milliseconds) for the controlling agent to complete sending 
+     * connectivity check with nominated flag set to true for all components
+     * after the controlled agent has found that all connectivity checks in
+     * its checklist have been completed and there is at least one successful
+     * (but not nominated) check for every component.
+     *
+     * Default value for this option is 
+     * ICE_CONTROLLED_AGENT_WAIT_NOMINATION_TIMEOUT. Specify -1 to disable
+     * this timer.
+     */
+    int			controlled_agent_want_nom_timeout;
+
+} pj_ice_sess_options;
+
+
+/**
  * This structure describes the ICE session. For this version of PJNATH,
  * an ICE session corresponds to a single media stream (unlike the ICE
@@ -570,9 +615,11 @@
     pj_mutex_t		*mutex;			    /**< Mutex.		    */
     pj_ice_sess_role	 role;			    /**< ICE role.	    */
+    pj_ice_sess_options	 opt;			    /**< Options	    */
     pj_timestamp	 tie_breaker;		    /**< Tie breaker value  */
     pj_uint8_t		*prefs;			    /**< Type preference.   */
+    pj_bool_t		 is_nominating;		    /**< Nominating stage   */
     pj_bool_t		 is_complete;		    /**< Complete?	    */
     pj_status_t		 ice_status;		    /**< Error status.	    */
-    pj_timer_entry	 completion_timer;	    /**< To call callback.  */
+    pj_timer_entry	 timer;			    /**< ICE timer.	    */
     pj_ice_sess_cb	 cb;			    /**< Callback.	    */
 
@@ -590,4 +637,5 @@
     unsigned		 comp_cnt;		    /**< # of components.   */
     pj_ice_sess_comp	 comp[PJ_ICE_MAX_COMP];	    /**< Component array    */
+    unsigned		 comp_ka;		    /**< Next comp for KA   */
 
     /* Local candidates */
@@ -655,4 +703,10 @@
 				     const pj_sockaddr *base_addr);
 
+/**
+ * Initialize ICE session options with library default values.
+ *
+ * @param opt		ICE session options.
+ */
+PJ_DECL(void) pj_ice_sess_options_default(pj_ice_sess_options *opt);
 
 /**
@@ -690,4 +744,32 @@
 
 /**
+ * Get the value of various options of the ICE session.
+ *
+ * @param ice		The ICE session.
+ * @param opt		The options to be initialized with the values
+ *			from the ICE session.
+ *
+ * @return		PJ_SUCCESS on success, or the appropriate error.
+ */
+PJ_DECL(pj_status_t) pj_ice_sess_get_options(pj_ice_sess *ice,
+					     pj_ice_sess_options *opt);
+
+/**
+ * Specify various options for this ICE session. Application MUST only
+ * call this function after the ICE session has been created but before
+ * any connectivity check is started.
+ *
+ * Application should call #pj_ice_sess_get_options() to initialize the
+ * options with their default values.
+ *
+ * @param ice		The ICE session.
+ * @param opt		Options to be applied to the ICE session.
+ *
+ * @return		PJ_SUCCESS on success, or the appropriate error.
+ */
+PJ_DECL(pj_status_t) pj_ice_sess_set_options(pj_ice_sess *ice,
+					     const pj_ice_sess_options *opt);
+
+/**
  * Destroy ICE session. This will cancel any connectivity checks currently
  * running, if any, and any other events scheduled by this session, as well
Index: pjproject/trunk/pjnath/include/pjnath/ice_strans.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/ice_strans.h	(revision 2700)
+++ pjproject/trunk/pjnath/include/pjnath/ice_strans.h	(revision 2724)
@@ -198,4 +198,11 @@
 
     /**
+     * This contains various STUN session options. Once the ICE stream
+     * transport is created, application may also change the options
+     * with #pj_ice_strans_set_options().
+     */
+    pj_ice_sess_options	 opt;
+
+    /**
      * STUN and local transport settings. This specifies the 
      * settings for local UDP socket, which will be resolved
@@ -210,10 +217,10 @@
 
 	/**
-	 * Disable host candidates. When this option is set, no
-	 * host candidates will be added.
-	 *
-	 * Default: PJ_FALSE
-	 */
-	pj_bool_t	     no_host_cands;
+	 * Maximum number of host candidates to be added. If the
+	 * value is zero, no host candidates will be added.
+	 *
+	 * Default: 64
+	 */
+	unsigned	     max_host_cands;
 
 	/**
@@ -384,4 +391,30 @@
  */
 PJ_DECL(void*) pj_ice_strans_get_user_data(pj_ice_strans *ice_st);
+
+
+/**
+ * Get the value of various options of the ICE stream transport.
+ *
+ * @param ice_st	The ICE stream transport.
+ * @param opt		The options to be initialized with the values
+ *			from the ICE stream transport.
+ *
+ * @return		PJ_SUCCESS on success, or the appropriate error.
+ */
+PJ_DECL(pj_status_t) pj_ice_strans_get_options(pj_ice_strans *ice_st,
+					       pj_ice_sess_options *opt);
+
+/**
+ * Specify various options for this ICE stream transport. Application 
+ * should call #pj_ice_strans_get_options() to initialize the options 
+ * with their default values.
+ *
+ * @param ice_st	The ICE stream transport.
+ * @param opt		Options to be applied to this ICE stream transport.
+ *
+ * @return		PJ_SUCCESS on success, or the appropriate error.
+ */
+PJ_DECL(pj_status_t) pj_ice_strans_set_options(pj_ice_strans *ice_st,
+					       const pj_ice_sess_options *opt);
 
 
Index: pjproject/trunk/pjnath/include/pjnath/stun_msg.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/stun_msg.h	(revision 2700)
+++ pjproject/trunk/pjnath/include/pjnath/stun_msg.h	(revision 2724)
@@ -198,4 +198,8 @@
     PJ_STUN_BINDING_ERROR_RESPONSE	    = 0x0111,
 
+    /**
+     * Binding Indication (ICE)
+     */
+    PJ_STUN_BINDING_INDICATION		    = 0x0011,
 
     /**
Index: pjproject/trunk/pjnath/include/pjnath/stun_session.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/stun_session.h	(revision 2700)
+++ pjproject/trunk/pjnath/include/pjnath/stun_session.h	(revision 2724)
@@ -486,4 +486,16 @@
 PJ_DECL(void) pj_stun_session_set_log(pj_stun_session *sess,
 				      unsigned flags);
+/**
+ * Configure whether the STUN session should utilize FINGERPRINT in
+ * outgoing messages.
+ *
+ * @param sess	    The STUN session instance.
+ * @param use	    Boolean for the setting.
+ *
+ * @return	    The previous configured value of FINGERPRINT
+ *		    utilization of the sessoin.
+ */
+PJ_DECL(pj_bool_t) pj_stun_session_use_fingerprint(pj_stun_session *sess,
+						   pj_bool_t use);
 
 /**
Index: pjproject/trunk/pjnath/src/pjnath-test/ice_test.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath-test/ice_test.c	(revision 2700)
+++ pjproject/trunk/pjnath/src/pjnath-test/ice_test.c	(revision 2724)
@@ -65,4 +65,6 @@
 
     struct test_result expected;/* Expected result		*/
+
+    pj_bool_t   nom_regular;	/* Use regular nomination?	*/
 };
 
@@ -142,7 +144,7 @@
 
     if (ept->cfg.enable_host == 0) {
-	ice_cfg.stun.no_host_cands = PJ_TRUE;
+	ice_cfg.stun.max_host_cands = 0;
     } else {
-	ice_cfg.stun.no_host_cands = PJ_FALSE;
+	//ice_cfg.stun.no_host_cands = PJ_FALSE;
 	ice_cfg.stun.loop_addr = PJ_TRUE;
     }
Index: pjproject/trunk/pjnath/src/pjnath/errno.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/errno.c	(revision 2700)
+++ pjproject/trunk/pjnath/src/pjnath/errno.c	(revision 2724)
@@ -68,4 +68,5 @@
     PJ_BUILD_ERR( PJNATH_EICEINCANDSDP,	    "Invalid SDP \"candidate\" attribute"),
     PJ_BUILD_ERR( PJNATH_EICENOHOSTCAND,    "No host candidate associated with srflx"),
+    PJ_BUILD_ERR( PJNATH_EICENOMTIMEOUT,    "Controlled agent timed out waiting for nomination"),
 
     /* TURN related errors */
Index: pjproject/trunk/pjnath/src/pjnath/ice_session.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/ice_session.c	(revision 2700)
+++ pjproject/trunk/pjnath/src/pjnath/ice_session.c	(revision 2724)
@@ -30,5 +30,4 @@
 #include <pj/string.h>
 
-
 /* String names for candidate types */
 static const char *cand_type_names[] =
@@ -65,4 +64,18 @@
     "Controlled",
     "Controlling"
+};
+
+enum timer_type
+{
+    TIMER_NONE,			/**< Timer not active			*/
+    TIMER_COMPLETION_CALLBACK,	/**< Call on_ice_complete() callback    */
+    TIMER_CONTROLLED_WAIT_NOM,	/**< Controlled agent is waiting for 
+				     controlling agent to send connectivity
+				     check with nominated flag after it has
+				     valid check for every components.	*/
+    TIMER_START_NOMINATED_CHECK,/**< Controlling agent start connectivity
+				     checks with USE-CANDIDATE flag.	*/
+    TIMER_KEEP_ALIVE		/**< ICE keep-alive timer.		*/
+
 };
 
@@ -119,8 +132,12 @@
 
 /* Forward declarations */
+static void on_timer(pj_timer_heap_t *th, pj_timer_entry *te);
+static void on_ice_complete(pj_ice_sess *ice, pj_status_t status);
+static void ice_keep_alive(pj_ice_sess *ice, pj_bool_t send_now);
 static void destroy_ice(pj_ice_sess *ice,
 			pj_status_t reason);
 static pj_status_t start_periodic_check(pj_timer_heap_t *th, 
 					pj_timer_entry *te);
+static void start_nominated_check(pj_ice_sess *ice);
 static void periodic_timer(pj_timer_heap_t *th, 
 			  pj_timer_entry *te);
@@ -226,5 +243,5 @@
 				    const pj_sockaddr *base_addr)
 {
-#if 0
+#if PJNATH_ICE_PRIO_STD
     char buf[64];
     pj_uint32_t val;
@@ -296,4 +313,13 @@
 }
 
+
+/* Init options with default values */
+PJ_DEF(void) pj_ice_sess_options_default(pj_ice_sess_options *opt)
+{
+    opt->aggressive = PJ_TRUE;
+    opt->nominated_check_delay = PJ_ICE_NOMINATED_CHECK_DELAY;
+    opt->controlled_agent_want_nom_timeout = 
+	ICE_CONTROLLED_AGENT_WAIT_NOMINATION_TIMEOUT;
+}
 
 /*
@@ -327,4 +353,7 @@
     ice->tie_breaker.u32.lo = pj_rand();
     ice->prefs = cand_type_prefs;
+    pj_ice_sess_options_default(&ice->opt);
+
+    pj_timer_entry_init(&ice->timer, TIMER_NONE, (void*)ice, &on_timer);
 
     pj_ansi_snprintf(ice->obj_name, sizeof(ice->obj_name),
@@ -346,4 +375,5 @@
 	comp = &ice->comp[i];
 	comp->valid_check = NULL;
+	comp->nominated_check = NULL;
 
 	status = init_comp(ice, i+1, comp);
@@ -390,4 +420,29 @@
 
 /*
+ * Get the value of various options of the ICE session.
+ */
+PJ_DEF(pj_status_t) pj_ice_sess_get_options(pj_ice_sess *ice,
+					    pj_ice_sess_options *opt)
+{
+    PJ_ASSERT_RETURN(ice, PJ_EINVAL);
+    pj_memcpy(opt, &ice->opt, sizeof(*opt));
+    return PJ_SUCCESS;
+}
+
+/*
+ * Specify various options for this ICE session.
+ */
+PJ_DEF(pj_status_t) pj_ice_sess_set_options(pj_ice_sess *ice,
+					    const pj_ice_sess_options *opt)
+{
+    PJ_ASSERT_RETURN(ice && opt, PJ_EINVAL);
+    pj_memcpy(&ice->opt, opt, sizeof(*opt));
+    LOG5((ice->obj_name, "ICE nomination type set to %s",
+	  (ice->opt.aggressive ? "aggressive" : "regular")));
+    return PJ_SUCCESS;
+}
+
+
+/*
  * Destroy
  */
@@ -407,8 +462,8 @@
     }
 
-    if (ice->completion_timer.id) {
+    if (ice->timer.id) {
 	pj_timer_heap_cancel(ice->stun_cfg.timer_heap, 
-			     &ice->completion_timer);
-	ice->completion_timer.id = PJ_FALSE;
+			     &ice->timer);
+	ice->timer.id = PJ_FALSE;
     }
 
@@ -604,5 +659,5 @@
 				  pj_uint32_t comp_id)
 {
-#if 0
+#if PJNATH_ICE_PRIO_STD
     return ((ice->prefs[type] & 0xFF) << 24) + 
 	   ((local_pref & 0xFFFF)    << 8) +
@@ -1040,16 +1095,110 @@
 }
 
-/* Timer callback to call on_ice_complete() callback */
-static void on_completion_timer(pj_timer_heap_t *th, 
-			        pj_timer_entry *te)
+/* Timer callback */
+static void on_timer(pj_timer_heap_t *th, pj_timer_entry *te)
 {
     pj_ice_sess *ice = (pj_ice_sess*) te->user_data;
+    enum timer_type type = (enum timer_type)te->id;
 
     PJ_UNUSED_ARG(th);
 
-    te->id = PJ_FALSE;
-
-    if (ice->cb.on_ice_complete)
-	(*ice->cb.on_ice_complete)(ice, ice->ice_status);
+    pj_mutex_lock(ice->mutex);
+
+    te->id = TIMER_NONE;
+
+    switch (type) {
+    case TIMER_CONTROLLED_WAIT_NOM:
+	LOG4((ice->obj_name, 
+	      "Controlled agent timed-out in waiting for the controlling "
+	      "agent to send nominated check. Setting state to fail now.."));
+	on_ice_complete(ice, PJNATH_EICENOMTIMEOUT);
+	break;
+    case TIMER_COMPLETION_CALLBACK:
+	/* Start keep-alive timer but don't send any packets yet.
+	 * Need to do it here just in case app destroy the session
+	 * in the callback.
+	 */
+	if (ice->ice_status == PJ_SUCCESS)
+	    ice_keep_alive(ice, PJ_FALSE);
+
+	/* Notify app about ICE completion*/
+	if (ice->cb.on_ice_complete)
+	    (*ice->cb.on_ice_complete)(ice, ice->ice_status);
+	break;
+    case TIMER_START_NOMINATED_CHECK:
+	start_nominated_check(ice);
+	break;
+    case TIMER_KEEP_ALIVE:
+	ice_keep_alive(ice, PJ_TRUE);
+	break;
+    case TIMER_NONE:
+	/* Nothing to do, just to get rid of gcc warning */
+	break;
+    }
+
+    pj_mutex_unlock(ice->mutex);
+}
+
+/* Send keep-alive */
+static void ice_keep_alive(pj_ice_sess *ice, pj_bool_t send_now)
+{
+    if (send_now) {
+	/* Send Binding Indication for the component */
+	pj_ice_sess_comp *comp = &ice->comp[ice->comp_ka];
+	pj_stun_tx_data *tdata;
+	pj_ice_sess_check *the_check;
+	pj_ice_msg_data *msg_data;
+	int addr_len;
+	pj_bool_t saved;
+	pj_status_t status;
+
+	/* Must have nominated check by now */
+	pj_assert(comp->nominated_check != NULL);
+	the_check = comp->nominated_check;
+
+	/* Create the Binding Indication */
+	status = pj_stun_session_create_ind(comp->stun_sess, 
+					    PJ_STUN_BINDING_INDICATION,
+					    &tdata);
+	if (status != PJ_SUCCESS)
+	    goto done;
+
+	/* Need the transport_id */
+	msg_data = PJ_POOL_ZALLOC_T(tdata->pool, pj_ice_msg_data);
+	msg_data->transport_id = the_check->lcand->transport_id;
+
+	/* Temporarily disable FINGERPRINT. The Binding Indication 
+	 * SHOULD NOT contain any attributes.
+	 */
+	saved = pj_stun_session_use_fingerprint(comp->stun_sess, PJ_FALSE);
+
+	/* Send to session */
+	addr_len = pj_sockaddr_get_len(&the_check->rcand->addr);
+	status = pj_stun_session_send_msg(comp->stun_sess, msg_data,
+					  PJ_FALSE, PJ_FALSE, 
+					  &the_check->rcand->addr, 
+					  addr_len, tdata);
+
+	/* Restore FINGERPRINT usage */
+	pj_stun_session_use_fingerprint(comp->stun_sess, saved);
+
+done:
+	ice->comp_ka = (ice->comp_ka + 1) % ice->comp_cnt;
+    }
+
+    if (ice->timer.id == TIMER_NONE) {
+	pj_time_val delay = { 0, 0 };
+
+	delay.msec = (PJ_ICE_SESS_KEEP_ALIVE_MIN + 
+		      (pj_rand() % PJ_ICE_SESS_KEEP_ALIVE_MAX_RAND)) * 1000 / 
+		     ice->comp_cnt;
+	pj_time_val_normalize(&delay);
+
+	ice->timer.id = TIMER_KEEP_ALIVE;
+	pj_timer_heap_schedule(ice->stun_cfg.timer_heap, &ice->timer, &delay);
+
+    } else {
+	pj_assert(!"Not expected any timer active");
+    }
 }
 
@@ -1061,4 +1210,9 @@
 	ice->ice_status = status;
     
+	if (ice->timer.id != TIMER_NONE) {
+	    pj_timer_heap_cancel(ice->stun_cfg.timer_heap, &ice->timer);
+	    ice->timer.id = TIMER_NONE;
+	}
+
 	/* Log message */
 	LOG4((ice->obj_name, "ICE process complete, status=%s", 
@@ -1072,15 +1226,35 @@
 	    pj_time_val delay = {0, 0};
 
-	    ice->completion_timer.cb = &on_completion_timer;
-	    ice->completion_timer.user_data = (void*) ice;
-	    ice->completion_timer.id = PJ_TRUE;
-
+	    ice->timer.id = TIMER_COMPLETION_CALLBACK;
 	    pj_timer_heap_schedule(ice->stun_cfg.timer_heap, 
-				   &ice->completion_timer,
-				   &delay);
-	}
-    }
-}
-
+				   &ice->timer, &delay);
+	}
+    }
+}
+
+/* Update valid check and nominated check for the candidate */
+static void update_comp_check(pj_ice_sess *ice, unsigned comp_id, 
+			      pj_ice_sess_check *check)
+{
+    pj_ice_sess_comp *comp;
+
+    comp = find_comp(ice, comp_id);
+    if (comp->valid_check == NULL) {
+	comp->valid_check = check;
+    } else {
+	if (CMP_CHECK_PRIO(comp->valid_check, check) < 0)
+	    comp->valid_check = check;
+    }
+
+    if (check->nominated) {
+	/* Update the nominated check for the component */
+	if (comp->nominated_check == NULL) {
+	    comp->nominated_check = check;
+	} else {
+	    if (CMP_CHECK_PRIO(comp->nominated_check, check) < 0)
+		comp->nominated_check = check;
+	}
+    }
+}
 
 /* This function is called when one check completes */
@@ -1088,7 +1262,10 @@
 				   pj_ice_sess_check *check)
 {
+    pj_ice_sess_comp *comp;
     unsigned i;
 
     pj_assert(check->state >= PJ_ICE_SESS_CHECK_STATE_SUCCEEDED);
+
+    comp = find_comp(ice, check->lcand->comp_id);
 
     /* 7.1.2.2.2.  Updating Pair States
@@ -1105,4 +1282,5 @@
      */
     if (check->err_code==PJ_SUCCESS) {
+
 	for (i=0; i<ice->clist.count; ++i) {
 	    pj_ice_sess_check *c = &ice->clist.checks[i];
@@ -1113,4 +1291,9 @@
 	    }
 	}
+
+	LOG5((ice->obj_name, "Check %d is successful%s",
+	     GET_CHECK_ID(&ice->clist, check),
+	     (check->nominated ? "  and nominated" : "")));
+
     }
 
@@ -1137,10 +1320,4 @@
      */
     if (check->err_code==PJ_SUCCESS && check->nominated) {
-	pj_ice_sess_comp *comp;
-
-	LOG5((ice->obj_name, "Check %d is successful and nominated",
-	     GET_CHECK_ID(&ice->clist, check)));
-
-	comp = find_comp(ice, check->lcand->comp_id);
 
 	for (i=0; i<ice->clist.count; ++i) {
@@ -1179,12 +1356,4 @@
 		}
 	    }
-	}
-
-	/* Update the nominated check for the component */
-	if (comp->valid_check == NULL) {
-	    comp->valid_check = check;
-	} else {
-	    if (CMP_CHECK_PRIO(comp->valid_check, check) < 0)
-		comp->valid_check = check;
 	}
     }
@@ -1212,5 +1381,5 @@
      */
     for (i=0; i<ice->comp_cnt; ++i) {
-	if (ice->comp[i].valid_check == NULL)
+	if (ice->comp[i].nominated_check == NULL)
 	    break;
     }
@@ -1259,21 +1428,14 @@
 	 * If agent's role is controlled, check if all components have
 	 * valid pair. If it does, this means the controlled agent has
-	 * finished the check list early and it's waiting for controlling
-	 * agent to send a check with USE-CANDIDATE flag set.
+	 * finished the check list and it's waiting for controlling
+	 * agent to send checks with USE-CANDIDATE flag set.
 	 */
 	if (ice->role == PJ_ICE_SESS_ROLE_CONTROLLED) {
-	    unsigned comp_id;
-	    for (comp_id=1; comp_id <= ice->comp_cnt; ++comp_id) {
-		unsigned j;
-		for (j=0; j<ice->valid_list.count; ++j) {
-		    pj_ice_sess_check *vc = &ice->valid_list.checks[j];
-		    if (vc->lcand->comp_id == comp_id)
-			break;
-		}
-		if (j == ice->valid_list.count)
+	    for (i=0; i < ice->comp_cnt; ++i) {
+		if (ice->comp[i].valid_check == NULL)
 		    break;
 	    }
 
-	    if (comp_id <= ice->comp_cnt) {
+	    if (i < ice->comp_cnt) {
 		/* This component ID doesn't have valid pair.
 		 * Mark ICE as failed. 
@@ -1285,10 +1447,107 @@
 		 * We should wait until we receive nominated checks.
 		 */
+		if (ice->timer.id == TIMER_NONE &&
+		    ice->opt.controlled_agent_want_nom_timeout >= 0) 
+		{
+		    pj_time_val delay;
+
+		    delay.sec = 0;
+		    delay.msec = ice->opt.controlled_agent_want_nom_timeout;
+		    pj_time_val_normalize(&delay);
+
+		    ice->timer.id = TIMER_CONTROLLED_WAIT_NOM;
+		    pj_timer_heap_schedule(ice->stun_cfg.timer_heap, 
+					   &ice->timer,
+					   &delay);
+
+		    LOG5((ice->obj_name, 
+			  "All checks have completed. Controlled agent now "
+			  "waits for nomination from controlling agent "
+			  "(timeout=%d msec)",
+			  ice->opt.controlled_agent_want_nom_timeout));
+		}
 		return PJ_FALSE;
 	    }
-	}
-
-	on_ice_complete(ice, PJNATH_EICEFAILED);
-	return PJ_TRUE;
+
+	    /* Unreached */
+
+	} else if (ice->is_nominating) {
+	    /* We are controlling agent and all checks have completed but
+	     * there's at least one component without nominated pair (or
+	     * more likely we don't have any nominated pairs at all).
+	     */
+	    on_ice_complete(ice, PJNATH_EICEFAILED);
+	    return PJ_TRUE;
+
+	} else {
+	    /* We are controlling agent and all checks have completed. If
+	     * we have valid list for every component, then move on to
+	     * sending nominated check, otherwise we have failed.
+	     */
+	    for (i=0; i<ice->comp_cnt; ++i) {
+		if (ice->comp[i].valid_check == NULL)
+		    break;
+	    }
+
+	    if (i < ice->comp_cnt) {
+		/* At least one component doesn't have a valid check. Mark
+		 * ICE as failed.
+		 */
+		on_ice_complete(ice, PJNATH_EICEFAILED);
+		return PJ_TRUE;
+	    }
+
+	    /* Now it's time to send connectivity check with nomination 
+	     * flag set.
+	     */
+	    LOG4((ice->obj_name, 
+		  "All checks have completed, starting nominated checks now"));
+	    start_nominated_check(ice);
+	    return PJ_FALSE;
+	}
+    }
+
+    /* If this connectivity check has been successful, scan all components
+     * and see if they have a valid pair, if we are controlling and we haven't
+     * started our nominated check yet.
+     */
+    if (check->err_code == PJ_SUCCESS && 
+	ice->role==PJ_ICE_SESS_ROLE_CONTROLLING &&
+	!ice->is_nominating &&
+	ice->timer.id == TIMER_NONE) 
+    {
+	pj_time_val delay;
+
+	for (i=0; i<ice->comp_cnt; ++i) {
+	    if (ice->comp[i].valid_check == NULL)
+		break;
+	}
+
+	if (i < ice->comp_cnt) {
+	    /* Some components still don't have valid pair, continue
+	     * processing.
+	     */
+	    return PJ_FALSE;
+	}
+
+	LOG4((ice->obj_name, 
+	      "Scheduling nominated check in %d ms",
+	      ice->opt.nominated_check_delay));
+
+	if (ice->timer.id != TIMER_NONE) {
+	    pj_timer_heap_cancel(ice->stun_cfg.timer_heap, &ice->timer);
+	    ice->timer.id = TIMER_NONE;
+	}
+
+	/* All components have valid pair. Let connectivity checks run for
+	 * a little bit more time, then start our nominated check.
+	 */
+	delay.sec = 0;
+	delay.msec = ice->opt.nominated_check_delay;
+	pj_time_val_normalize(&delay);
+
+	ice->timer.id = TIMER_START_NOMINATED_CHECK;
+	pj_timer_heap_schedule(ice->stun_cfg.timer_heap, &ice->timer, &delay);
+	return PJ_FALSE;
     }
 
@@ -1296,5 +1555,4 @@
     return PJ_FALSE;
 }
-
 
 
@@ -1431,8 +1689,9 @@
 }
 
-/* Perform check on the specified candidate pair */
+/* Perform check on the specified candidate pair. */
 static pj_status_t perform_check(pj_ice_sess *ice, 
 				 pj_ice_sess_checklist *clist,
-				 unsigned check_id)
+				 unsigned check_id,
+				 pj_bool_t nominate)
 {
     pj_ice_sess_comp *comp;
@@ -1473,6 +1732,11 @@
 
     /* Add PRIORITY */
+#if PJNATH_ICE_PRIO_STD
+    prio = CALC_CAND_PRIO(ice, PJ_ICE_CAND_TYPE_PRFLX, 65535, 
+			  lcand->comp_id);
+#else
     prio = CALC_CAND_PRIO(ice, PJ_ICE_CAND_TYPE_PRFLX, 0, 
 			  lcand->comp_id);
+#endif
     pj_stun_msg_add_uint_attr(check->tdata->pool, check->tdata->msg, 
 			      PJ_STUN_ATTR_PRIORITY, prio);
@@ -1482,7 +1746,9 @@
      */
     if (ice->role == PJ_ICE_SESS_ROLE_CONTROLLING) {
-	pj_stun_msg_add_empty_attr(check->tdata->pool, check->tdata->msg, 
-				   PJ_STUN_ATTR_USE_CANDIDATE);
-	check->nominated = PJ_TRUE;
+	if (nominate) {
+	    pj_stun_msg_add_empty_attr(check->tdata->pool, check->tdata->msg,
+				       PJ_STUN_ATTR_USE_CANDIDATE);
+	    check->nominated = PJ_TRUE;
+	}
 
 	pj_stun_msg_add_uint64_attr(check->tdata->pool, check->tdata->msg, 
@@ -1550,5 +1816,5 @@
 
 	if (check->state == PJ_ICE_SESS_CHECK_STATE_WAITING) {
-	    status = perform_check(ice, clist, i);
+	    status = perform_check(ice, clist, i, ice->is_nominating);
 	    if (status != PJ_SUCCESS) {
 		pj_mutex_unlock(ice->mutex);
@@ -1569,5 +1835,5 @@
 
 	    if (check->state == PJ_ICE_SESS_CHECK_STATE_FROZEN) {
-		status = perform_check(ice, clist, i);
+		status = perform_check(ice, clist, i, ice->is_nominating);
 		if (status != PJ_SUCCESS) {
 		    pj_mutex_unlock(ice->mutex);
@@ -1596,4 +1862,64 @@
 }
 
+
+/* Start sending connectivity check with USE-CANDIDATE */
+static void start_nominated_check(pj_ice_sess *ice)
+{
+    pj_time_val delay;
+    unsigned i;
+    pj_status_t status;
+
+    LOG4((ice->obj_name, "Starting nominated check.."));
+
+    pj_assert(ice->is_nominating == PJ_FALSE);
+
+    /* Stop our timer if it's active */
+    if (ice->timer.id == TIMER_START_NOMINATED_CHECK) {
+	pj_timer_heap_cancel(ice->stun_cfg.timer_heap, &ice->timer);
+	ice->timer.id = TIMER_NONE;
+    }
+
+    /* For each component, set the check state of valid check with
+     * highest priority to Waiting (it should have Success state now).
+     */
+    for (i=0; i<ice->comp_cnt; ++i) {
+	unsigned j;
+	const pj_ice_sess_check *vc = ice->comp[i].valid_check;
+
+	pj_assert(ice->comp[i].nominated_check == NULL);
+	pj_assert(vc->err_code == PJ_SUCCESS);
+
+	for (j=0; j<ice->clist.count; ++j) {
+	    pj_ice_sess_check *c = &ice->clist.checks[j];
+	    if (c->lcand->transport_id == vc->lcand->transport_id &&
+		c->rcand == vc->rcand)
+	    {
+		pj_assert(c->err_code == PJ_SUCCESS);
+		c->state = PJ_ICE_SESS_CHECK_STATE_FROZEN;
+		check_set_state(ice, c, PJ_ICE_SESS_CHECK_STATE_WAITING, 
+			        PJ_SUCCESS);
+		break;
+	    }
+	}
+    }
+
+    /* And (re)start the periodic check */
+    if (!ice->clist.timer.id) {
+	pj_timer_heap_cancel(ice->stun_cfg.timer_heap, &ice->clist.timer);
+	ice->clist.timer.id = PJ_FALSE;
+    }
+
+    ice->clist.timer.id = PJ_TRUE;
+    delay.sec = delay.msec = 0;
+    status = pj_timer_heap_schedule(ice->stun_cfg.timer_heap, 
+				    &ice->clist.timer, &delay);
+    if (status != PJ_SUCCESS) {
+	ice->clist.timer.id = PJ_FALSE;
+    } else {
+	LOG5((ice->obj_name, "Periodic timer rescheduled.."));
+    }
+
+    ice->is_nominating = PJ_TRUE;
+}
 
 /* Timer callback to perform periodic check */
@@ -1642,4 +1968,8 @@
 
     LOG4((ice->obj_name, "Starting ICE check.."));
+
+    /* If we are using aggressive nomination, set the is_nominating state */
+    if (ice->opt.aggressive)
+	ice->is_nominating = PJ_TRUE;
 
     /* The agent examines the check list for the first media stream (a
@@ -1827,5 +2157,6 @@
 	    LOG4((ice->obj_name, "Resending check because of role conflict"));
 	    check_set_state(ice, check, PJ_ICE_SESS_CHECK_STATE_WAITING, 0);
-	    perform_check(ice, clist, msg_data->data.req.ckid);
+	    perform_check(ice, clist, msg_data->data.req.ckid, 
+			  check->nominated || ice->is_nominating);
 	    pj_mutex_unlock(ice->mutex);
 	    return;
@@ -1960,17 +2291,32 @@
      */
 
-    /* Add pair to valid list */
-    pj_assert(ice->valid_list.count < PJ_ICE_MAX_CHECKS);
-    new_check = &ice->valid_list.checks[ice->valid_list.count++];
-    new_check->lcand = lcand;
-    new_check->rcand = check->rcand;
-    new_check->prio = CALC_CHECK_PRIO(ice, lcand, check->rcand);
-    new_check->state = PJ_ICE_SESS_CHECK_STATE_SUCCEEDED;
-    new_check->nominated = check->nominated;
-    new_check->err_code = PJ_SUCCESS;
+    /* Add pair to valid list, if it's not there, otherwise just update
+     * nominated flag
+     */
+    for (i=0; i<ice->valid_list.count; ++i) {
+	if (ice->valid_list.checks[i].lcand == lcand &&
+	    ice->valid_list.checks[i].rcand == check->rcand)
+	    break;
+    }
+
+    if (i==ice->valid_list.count) {
+	pj_assert(ice->valid_list.count < PJ_ICE_MAX_CHECKS);
+	new_check = &ice->valid_list.checks[ice->valid_list.count++];
+	new_check->lcand = lcand;
+	new_check->rcand = check->rcand;
+	new_check->prio = CALC_CHECK_PRIO(ice, lcand, check->rcand);
+	new_check->state = PJ_ICE_SESS_CHECK_STATE_SUCCEEDED;
+	new_check->nominated = check->nominated;
+	new_check->err_code = PJ_SUCCESS;
+    } else {
+	new_check = &ice->valid_list.checks[i];
+	ice->valid_list.checks[i].nominated = check->nominated;
+    }
 
     /* Sort valid_list */
     sort_checklist(&ice->valid_list);
 
+    /* Update valid check and nominated check for the component */
+    update_comp_check(ice, new_check->lcand->comp_id, new_check);
 
     /* 7.1.2.2.2.  Updating Pair States
@@ -2313,6 +2659,9 @@
 	    c->state == PJ_ICE_SESS_CHECK_STATE_WAITING)
 	{
+	    /* See if we shall nominate this check */
+	    pj_bool_t nominate = (c->nominated || ice->is_nominating);
+
 	    LOG5((ice->obj_name, "Performing triggered check for check %d",i));
-	    perform_check(ice, &ice->clist, i);
+	    perform_check(ice, &ice->clist, i, nominate);
 
 	} else if (c->state == PJ_ICE_SESS_CHECK_STATE_IN_PROGRESS) {
@@ -2337,6 +2686,15 @@
 		for (j=0; j<ice->valid_list.count; ++j) {
 		    pj_ice_sess_check *vc = &ice->valid_list.checks[j];
-		    if (vc->lcand == c->lcand && vc->rcand == c->rcand) {
+		    if (vc->lcand->transport_id == c->lcand->transport_id && 
+			vc->rcand == c->rcand) 
+		    {
+			/* Set nominated flag */
 			vc->nominated = PJ_TRUE;
+
+			/* Update valid check and nominated check for the component */
+			update_comp_check(ice, vc->lcand->comp_id, vc);
+
+			dump_check(ice->tmp.txt, sizeof(ice->tmp.txt), &ice->valid_list, vc);
+			LOG5((ice->obj_name, "Valid check %s is nominated", ice->tmp.txt));
 		    }
 		}
@@ -2362,4 +2720,5 @@
 
 	pj_ice_sess_check *c = &ice->clist.checks[ice->clist.count];
+	pj_bool_t nominate;
 
 	c->lcand = lcand;
@@ -2370,7 +2729,9 @@
 	c->err_code = PJ_SUCCESS;
 
+	nominate = (c->nominated || ice->is_nominating);
+
 	LOG4((ice->obj_name, "New triggered check added: %d", 
 	     ice->clist.count));
-	perform_check(ice, &ice->clist, ice->clist.count++);
+	perform_check(ice, &ice->clist, ice->clist.count++, nominate);
 
     } else {
@@ -2389,4 +2750,6 @@
 					 unsigned src_addr_len)
 {
+    struct stun_data *sd;
+
     PJ_UNUSED_ARG(sess);
     PJ_UNUSED_ARG(pkt);
@@ -2397,7 +2760,16 @@
     PJ_UNUSED_ARG(src_addr_len);
 
-    PJ_TODO(SUPPORT_RX_BIND_REQUEST_AS_INDICATION);
-
-    return PJ_ENOTSUP;
+    sd = (struct stun_data*) pj_stun_session_get_user_data(sess);
+
+    if (msg->hdr.type == PJ_STUN_BINDING_INDICATION) {
+	LOG5((sd->ice->obj_name, "Received Binding Indication keep-alive "
+	      "for component %d", sd->comp_id));
+    } else {
+	LOG4((sd->ice->obj_name, "Received unexpected %s indication "
+	      "for component %d", pj_stun_get_method_name(msg->hdr.type), 
+	      sd->comp_id));
+    }
+
+    return PJ_SUCCESS;
 }
 
Index: pjproject/trunk/pjnath/src/pjnath/ice_strans.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/ice_strans.c	(revision 2700)
+++ pjproject/trunk/pjnath/src/pjnath/ice_strans.c	(revision 2724)
@@ -51,13 +51,26 @@
  * specify preference among candidates with the same type. Since
  * we don't have the facility to specify that, we'll just set it
- * all to zero.
- */
-#define SRFLX_PREF  0
-#define HOST_PREF   0
-#define RELAY_PREF  0
+ * all to the same value.
+ */
+#if PJNATH_ICE_PRIO_STD
+#   define SRFLX_PREF  65535
+#   define HOST_PREF   65535
+#   define RELAY_PREF  65535
+#else
+#   define SRFLX_PREF  0
+#   define HOST_PREF   0
+#   define RELAY_PREF  0
+#endif
+
 
 /* The candidate type preference when STUN candidate is used */
 static pj_uint8_t srflx_pref_table[4] = 
 {
+#if PJNATH_ICE_PRIO_STD
+    100,    /**< PJ_ICE_HOST_PREF	    */
+    126,    /**< PJ_ICE_SRFLX_PREF	    */
+    110,    /**< PJ_ICE_PRFLX_PREF	    */
+    0	    /**< PJ_ICE_RELAYED_PREF    */
+#else
     /* Keep it to 2 bits */
     1,	/**< PJ_ICE_HOST_PREF	    */
@@ -65,4 +78,5 @@
     3,	/**< PJ_ICE_PRFLX_PREF	    */
     0	/**< PJ_ICE_RELAYED_PREF    */
+#endif
 };
 
@@ -198,7 +212,11 @@
     pj_turn_alloc_param_default(&cfg->turn.alloc_param);
 
+    pj_ice_sess_options_default(&cfg->opt);
+
     cfg->af = pj_AF_INET();
     cfg->stun.port = PJ_STUN_PORT;
     cfg->turn.conn_type = PJ_TURN_TP_UDP;
+
+    cfg->stun.max_host_cands = 64;
 }
 
@@ -246,5 +264,5 @@
 
     /* Create STUN transport if configured */
-    if (ice_st->cfg.stun.server.slen || !ice_st->cfg.stun.no_host_cands) {
+    if (ice_st->cfg.stun.server.slen || ice_st->cfg.stun.max_host_cands) {
 	pj_stun_sock_cb stun_sock_cb;
 	pj_ice_sess_cand *cand;
@@ -310,8 +328,8 @@
 	}
 
-	/* Add local addresses to host candidates, unless no_host_cands
-	 * flag is set.
+	/* Add local addresses to host candidates, unless max_host_cands
+	 * is set to zero.
 	 */
-	if (ice_st->cfg.stun.no_host_cands == PJ_FALSE) {
+	if (ice_st->cfg.stun.max_host_cands) {
 	    pj_stun_sock_info stun_sock_info;
 	    unsigned i;
@@ -322,5 +340,7 @@
 		return status;
 
-	    for (i=0; i<stun_sock_info.alias_cnt; ++i) {
+	    for (i=0; i<stun_sock_info.alias_cnt && 
+		      i<ice_st->cfg.stun.max_host_cands; ++i) 
+	    {
 		char addrinfo[PJ_INET6_ADDRSTRLEN+10];
 		const pj_sockaddr *addr = &stun_sock_info.aliases[i];
@@ -648,4 +668,28 @@
 
 /*
+ * Get the value of various options of the ICE stream transport.
+ */
+PJ_DEF(pj_status_t) pj_ice_strans_get_options( pj_ice_strans *ice_st,
+					       pj_ice_sess_options *opt)
+{
+    PJ_ASSERT_RETURN(ice_st && opt, PJ_EINVAL);
+    pj_memcpy(opt, &ice_st->cfg.opt, sizeof(*opt));
+    return PJ_SUCCESS;
+}
+
+/*
+ * Specify various options for this ICE stream transport. 
+ */
+PJ_DEF(pj_status_t) pj_ice_strans_set_options(pj_ice_strans *ice_st,
+					      const pj_ice_sess_options *opt)
+{
+    PJ_ASSERT_RETURN(ice_st && opt, PJ_EINVAL);
+    pj_memcpy(&ice_st->cfg.opt, opt, sizeof(*opt));
+    if (ice_st->ice)
+	pj_ice_sess_set_options(ice_st->ice, &ice_st->cfg.opt);
+    return PJ_SUCCESS;
+}
+
+/*
  * Create ICE!
  */
@@ -682,4 +726,7 @@
     /* Associate user data */
     ice_st->ice->user_data = (void*)ice_st;
+
+    /* Set options */
+    pj_ice_sess_set_options(ice_st->ice, &ice_st->cfg.opt);
 
     /* If default candidate for components are SRFLX one, upload a custom
Index: pjproject/trunk/pjnath/src/pjnath/stun_auth.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/stun_auth.c	(revision 2700)
+++ pjproject/trunk/pjnath/src/pjnath/stun_auth.c	(revision 2724)
@@ -529,4 +529,5 @@
     case PJ_STUN_SC_BAD_REQUEST:	    /* 400 (Bad Request)	    */
     case PJ_STUN_SC_UNAUTHORIZED:	    /* 401 (Unauthorized)	    */
+    case PJ_STUN_SC_STALE_NONCE:	    /* 438 (Stale Nonce)	    */
 
     /* Due to the way this response is generated here, we can't really
Index: pjproject/trunk/pjnath/src/pjnath/stun_msg_dump.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/stun_msg_dump.c	(revision 2700)
+++ pjproject/trunk/pjnath/src/pjnath/stun_msg_dump.c	(revision 2724)
@@ -58,9 +58,17 @@
 {
     char *p = buffer, *end = buffer + length;
+    const char *attr_name = pj_stun_get_attr_name(ahdr->type);
+    char attr_buf[32];
     int len;
+
+    if (*attr_name == '?') {
+	pj_ansi_snprintf(attr_buf, sizeof(attr_buf), "Attr 0x%x", 
+			 ahdr->type);
+	attr_name = attr_buf;
+    }
 
     len = pj_ansi_snprintf(p, end-p,
 			   "  %s: length=%d",
-			   pj_stun_get_attr_name(ahdr->type),
+			   attr_name,
 			   (int)ahdr->length);
     APPLY();
Index: pjproject/trunk/pjnath/src/pjnath/stun_session.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/stun_session.c	(revision 2700)
+++ pjproject/trunk/pjnath/src/pjnath/stun_session.c	(revision 2724)
@@ -220,8 +220,13 @@
     /* If the agent is sending a request, it SHOULD add a SOFTWARE attribute
      * to the request. The server SHOULD include a SOFTWARE attribute in all 
-     * responses 
+     * responses.
+     *
+     * If magic value is not PJ_STUN_MAGIC, only apply the attribute for
+     * responses.
      */
-    if (sess->srv_name.slen && !PJ_STUN_IS_INDICATION(msg->hdr.type) &&
-	pj_stun_msg_find_attr(msg, PJ_STUN_ATTR_SOFTWARE, 0)==NULL) 
+    if (sess->srv_name.slen && 
+	pj_stun_msg_find_attr(msg, PJ_STUN_ATTR_SOFTWARE, 0)==NULL &&
+	(PJ_STUN_IS_RESPONSE(msg->hdr.type) ||
+	 PJ_STUN_IS_REQUEST(msg->hdr.type) && msg->hdr.magic==PJ_STUN_MAGIC)) 
     {
 	pj_stun_msg_add_string_attr(pool, msg, PJ_STUN_ATTR_SOFTWARE,
@@ -629,4 +634,16 @@
     PJ_ASSERT_ON_FAIL(sess, return);
     sess->log_flag = flags;
+}
+
+PJ_DEF(pj_bool_t) pj_stun_session_use_fingerprint(pj_stun_session *sess,
+						  pj_bool_t use)
+{
+    pj_bool_t old_use;
+
+    PJ_ASSERT_RETURN(sess, PJ_FALSE);
+
+    old_use = sess->use_fingerprint;
+    sess->use_fingerprint = use;
+    return old_use;
 }
 
Index: pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c
===================================================================
--- pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c	(revision 2700)
+++ pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c	(revision 2724)
@@ -265,5 +265,6 @@
     puts  ("Media Transport Options:");
     puts  ("  --use-ice           Enable ICE (default:no)");
-    puts  ("  --ice-no-host       Disable ICE host candidates (default: no)");
+    puts  ("  --ice-regular       Use ICE regular nomination (default: aggressive)");
+    puts  ("  --ice-max-hosts=N   Set maximum number of ICE host candidates");
     puts  ("  --ice-no-rtcp       Disable RTCP component in ICE (default: no)");
     puts  ("  --rtp-port=N        Base port to try for RTP (default=4000)");
@@ -477,6 +478,6 @@
 	   OPT_AUTO_ANSWER, OPT_AUTO_PLAY, OPT_AUTO_PLAY_HANGUP, OPT_AUTO_LOOP,
 	   OPT_AUTO_CONF, OPT_CLOCK_RATE, OPT_SND_CLOCK_RATE, OPT_STEREO,
-	   OPT_USE_ICE, OPT_USE_SRTP, OPT_SRTP_SECURE,
-	   OPT_USE_TURN, OPT_ICE_NO_HOST, OPT_ICE_NO_RTCP, OPT_TURN_SRV, 
+	   OPT_USE_ICE, OPT_ICE_REGULAR, OPT_USE_SRTP, OPT_SRTP_SECURE,
+	   OPT_USE_TURN, OPT_ICE_MAX_HOSTS, OPT_ICE_NO_RTCP, OPT_TURN_SRV, 
 	   OPT_TURN_TCP, OPT_TURN_USER, OPT_TURN_PASSWD,
 	   OPT_PLAY_FILE, OPT_PLAY_TONE, OPT_RTP_PORT, OPT_ADD_CODEC, 
@@ -554,6 +555,7 @@
 
 	{ "use-ice",    0, 0, OPT_USE_ICE},
+	{ "ice-regular",0, 0, OPT_ICE_REGULAR},
 	{ "use-turn",	0, 0, OPT_USE_TURN},
-	{ "ice-no-host",0, 0, OPT_ICE_NO_HOST},
+	{ "ice-max-hosts",1, 0, OPT_ICE_MAX_HOSTS},
 	{ "ice-no-rtcp",0, 0, OPT_ICE_NO_RTCP},
 	{ "turn-srv",	1, 0, OPT_TURN_SRV},
@@ -993,10 +995,14 @@
 	    break;
 
+	case OPT_ICE_REGULAR:
+	    cfg->media_cfg.ice_opt.aggressive = PJ_FALSE;
+	    break;
+
 	case OPT_USE_TURN:
 	    cfg->media_cfg.enable_turn = PJ_TRUE;
 	    break;
 
-	case OPT_ICE_NO_HOST:
-	    cfg->media_cfg.ice_no_host_cands = PJ_TRUE;
+	case OPT_ICE_MAX_HOSTS:
+	    cfg->media_cfg.ice_max_host_cands = my_atoi(pj_optarg);
 	    break;
 
@@ -1645,9 +1651,15 @@
 	pj_strcat2(&cfg, "--use-ice\n");
 
+    if (config->media_cfg.ice_opt.aggressive == PJ_FALSE)
+	pj_strcat2(&cfg, "--ice-regular\n");
+
     if (config->media_cfg.enable_turn)
 	pj_strcat2(&cfg, "--use-turn\n");
 
-    if (config->media_cfg.ice_no_host_cands)
-	pj_strcat2(&cfg, "--ice-no-host\n");
+    if (config->media_cfg.ice_max_host_cands >= 0) {
+	pj_ansi_sprintf(line, "--ice_max_host_cands %d\n",
+			config->media_cfg.ice_max_host_cands);
+	pj_strcat2(&cfg, line);
+    }
 
     if (config->media_cfg.ice_no_rtcp)
@@ -1886,5 +1898,5 @@
     }
 
-    if (config->cfg.force_lr) {
+    if (!config->cfg.force_lr) {
 	pj_strcat2(&cfg, "--no-force-lr\n");
     }
@@ -3688,5 +3700,7 @@
 		}
 
-		pjsua_call_xfer_replaces(call, dst_call, 0, &msg_data);
+		pjsua_call_xfer_replaces(call, dst_call, 
+					 PJSUA_XFER_NO_REQUIRE_REPLACES, 
+					 &msg_data);
 	    }
 	    break;
@@ -4719,4 +4733,6 @@
     for (i=0; i<app_config.cfg.max_calls; ++i) {
 	enum { MAX_RETRY = 10 };
+	pj_sock_t sock[2];
+	pjmedia_sock_info si;
 	unsigned j;
 
@@ -4725,11 +4741,52 @@
 
 	for (j=0; j<MAX_RETRY; ++j) {
-	    status = pjmedia_transport_udp_create3(pjsua_get_pjmedia_endpt(), 
-						   pj_AF_INET6(),
-						   NULL, 
-						   &app_config.rtp_cfg.bound_addr,
-						   port, 
-						   0, &tp[i].transport);
-
+	    unsigned k;
+
+	    for (k=0; k<2; ++k) {
+		pj_sockaddr bound_addr;
+
+		status = pj_sock_socket(pj_AF_INET6(), pj_SOCK_DGRAM(), 0, &sock[k]);
+		if (status != PJ_SUCCESS)
+		    break;
+
+		status = pj_sockaddr_init(pj_AF_INET6(), &bound_addr,
+					  &app_config.rtp_cfg.bound_addr, 
+					  (unsigned short)(port+k));
+		if (status != PJ_SUCCESS)
+		    break;
+
+		status = pj_sock_bind(sock[k], &bound_addr, 
+				      pj_sockaddr_get_len(&bound_addr));
+		if (status != PJ_SUCCESS)
+		    break;
+	    }
+	    if (status != PJ_SUCCESS) {
+		if (k==1)
+		    pj_sock_close(sock[0]);
+
+		if (port != 0)
+		    port += 10;
+		else
+		    break;
+
+		continue;
+	    }
+
+	    pj_bzero(&si, sizeof(si));
+	    si.rtp_sock = sock[0];
+	    si.rtcp_sock = sock[1];
+	
+	    pj_sockaddr_init(pj_AF_INET6(), &si.rtp_addr_name, 
+			     &app_config.rtp_cfg.public_addr, 
+			     (unsigned short)(port));
+	    pj_sockaddr_init(pj_AF_INET6(), &si.rtcp_addr_name, 
+			     &app_config.rtp_cfg.public_addr, 
+			     (unsigned short)(port+1));
+
+	    status = pjmedia_transport_udp_attach(pjsua_get_pjmedia_endpt(),
+						  NULL,
+						  &si,
+						  0,
+						  &tp[i].transport);
 	    if (port != 0)
 		port += 10;
Index: pjproject/trunk/pjsip-apps/src/samples/debug.c
===================================================================
--- pjproject/trunk/pjsip-apps/src/samples/debug.c	(revision 2700)
+++ pjproject/trunk/pjsip-apps/src/samples/debug.c	(revision 2724)
@@ -29,4 +29,4 @@
  *  #include "playfile.c"
  */
-#include "auddemo.c"
+#include "icedemo.c"
 
Index: pjproject/trunk/pjsip-apps/src/samples/icedemo.c
===================================================================
--- pjproject/trunk/pjsip-apps/src/samples/icedemo.c	(revision 2700)
+++ pjproject/trunk/pjsip-apps/src/samples/icedemo.c	(revision 2724)
@@ -40,5 +40,6 @@
 	unsigned    comp_cnt;
 	pj_str_t    ns;
-	pj_bool_t   no_host;
+	int	    max_host;
+	pj_bool_t   regular;
 	pj_str_t    stun_srv;
 	pj_str_t    turn_srv;
@@ -307,6 +308,13 @@
     /* -= Start initializing ICE stream transport config =- */
 
-    /* Disable host candidates? */
-    icedemo.ice_cfg.stun.no_host_cands = icedemo.opt.no_host;
+    /* Maximum number of host candidates */
+    if (icedemo.opt.max_host != -1)
+	icedemo.ice_cfg.stun.max_host_cands = icedemo.opt.max_host;
+
+    /* Nomination strategy */
+    if (icedemo.opt.regular)
+	icedemo.ice_cfg.opt.aggressive = PJ_FALSE;
+    else
+	icedemo.ice_cfg.opt.aggressive = PJ_TRUE;
 
     /* Configure STUN/srflx candidate resolution */
@@ -961,5 +969,5 @@
     */
 
-    if (comp_id > pj_ice_strans_get_running_comp_cnt(icedemo.icest)) {
+    if (comp_id<1||comp_id>pj_ice_strans_get_running_comp_cnt(icedemo.icest)) {
 	PJ_LOG(1,(THIS_FILE, "Error: invalid component ID"));
 	return;
@@ -1138,5 +1146,6 @@
     puts(" --nameserver, -n IP       Configure nameserver to activate DNS SRV");
     puts("                           resolution");
-    puts(" --no-host, -H             Disable host candidates");
+    puts(" --max-host, -H N          Set max number of host candidates to N");
+    puts(" --regular, -R             Use regular nomination (default aggressive)");
     puts(" --help, -h                Display this screen.");
     puts("");
@@ -1166,5 +1175,5 @@
 	{ "comp-cnt",           1, 0, 'c'},
 	{ "nameserver",		1, 0, 'n'},
-	{ "no-host",		0, 0, 'H'},
+	{ "max-host",		1, 0, 'H'},
 	{ "help",		0, 0, 'h'},
 	{ "stun-srv",		1, 0, 's'},
@@ -1173,5 +1182,6 @@
 	{ "turn-username",	1, 0, 'u'},
 	{ "turn-password",	1, 0, 'p'},
-	{ "turn-fingerprint",	0, 0, 'F'}
+	{ "turn-fingerprint",	0, 0, 'F'},
+	{ "regular",		0, 0, 'R'}
     };
     int c, opt_id;
@@ -1179,6 +1189,7 @@
 
     icedemo.opt.comp_cnt = 1;
-
-    while((c=pj_getopt_long(argc,argv, "n:s:t:u:p:HhTF", long_options, &opt_id))!=-1) {
+    icedemo.opt.max_host = -1;
+
+    while((c=pj_getopt_long(argc,argv, "c:n:s:t:u:p:H:hTFR", long_options, &opt_id))!=-1) {
 	switch (c) {
 	case 'c':
@@ -1193,5 +1204,5 @@
 	    break;
 	case 'H':
-	    icedemo.opt.no_host = PJ_TRUE;
+	    icedemo.opt.max_host = atoi(pj_optarg);
 	    break;
 	case 'h':
@@ -1216,4 +1227,7 @@
 	    icedemo.opt.turn_fingerprint = PJ_TRUE;
 	    break;
+	case 'R':
+	    icedemo.opt.regular = PJ_TRUE;
+	    break;
 	default:
 	    printf("Argument \"%s\" is not valid. Use -h to see help",
Index: pjproject/trunk/pjsip-apps/src/samples/siprtp_report.c
===================================================================
--- pjproject/trunk/pjsip-apps/src/samples/siprtp_report.c	(revision 2700)
+++ pjproject/trunk/pjsip-apps/src/samples/siprtp_report.c	(revision 2724)
@@ -78,5 +78,5 @@
     /* Call identification */
     len = pjsip_hdr_print_on(dlg->remote.info, userinfo, sizeof(userinfo));
-    if (len < 1)
+    if (len < 0)
 	pj_ansi_strcpy(userinfo, "<--uri too long-->");
     else
Index: pjproject/trunk/pjsip/include/pjsip/sip_config.h
===================================================================
--- pjproject/trunk/pjsip/include/pjsip/sip_config.h	(revision 2700)
+++ pjproject/trunk/pjsip/include/pjsip/sip_config.h	(revision 2724)
@@ -228,4 +228,19 @@
 
 /**
+ * RFC 3261 section 18.1.1:
+ * If a request is within 200 bytes of the path MTU, or if it is larger
+ * than 1300 bytes and the path MTU is unknown, the request MUST be sent
+ * using an RFC 2914 [43] congestion controlled transport protocol, such
+ * as TCP.
+ *
+ * This setting controls the threshold of the UDP packet, which if it's
+ * larger than this value the request will be sent with TCP. Default is
+ * 1300 bytes.
+ */
+#ifndef PJSIP_UDP_SIZE_THRESHOLD
+#   define PJSIP_UDP_SIZE_THRESHOLD	1300
+#endif
+
+/**
  * Encode SIP headers in their short forms to reduce size. By default,
  * SIP headers in outgoing messages will be encoded in their full names. 
Index: pjproject/trunk/pjsip/include/pjsip/sip_transport.h
===================================================================
--- pjproject/trunk/pjsip/include/pjsip/sip_transport.h	(revision 2700)
+++ pjproject/trunk/pjsip/include/pjsip/sip_transport.h	(revision 2724)
@@ -579,4 +579,15 @@
  */
 PJ_DECL(pj_status_t) pjsip_tx_data_dec_ref( pjsip_tx_data *tdata );
+
+/**
+ * Print the SIP message to transmit data buffer's internal buffer. This
+ * may allocate memory for the buffer, if the buffer has not been allocated
+ * yet, and encode the SIP message to that buffer.
+ *
+ * @param tdata	    The transmit buffer.
+ *
+ * @return	    PJ_SUCCESS on success of the appropriate error code.
+ */
+PJ_DECL(pj_status_t) pjsip_tx_data_encode(pjsip_tx_data *tdata);
 
 /**
Index: pjproject/trunk/pjsip/include/pjsua-lib/pjsua.h
===================================================================
--- pjproject/trunk/pjsip/include/pjsua-lib/pjsua.h	(revision 2700)
+++ pjproject/trunk/pjsip/include/pjsua-lib/pjsua.h	(revision 2724)
@@ -4261,7 +4261,14 @@
 
     /**
-     * Disable ICE host candidates.
-     */
-    pj_bool_t		ice_no_host_cands;
+     * Set the maximum number of host candidates.
+     *
+     * Default: -1 (maximum not set)
+     */
+    int			ice_max_host_cands;
+
+    /**
+     * ICE session options.
+     */
+    pj_ice_sess_options	ice_opt;
 
     /**
Index: pjproject/trunk/pjsip/src/pjsip/sip_msg.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_msg.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/pjsip/sip_msg.c	(revision 2724)
@@ -457,14 +457,16 @@
     /* Print each of the headers. */
     for (hdr=msg->hdr.next; hdr!=&msg->hdr; hdr=hdr->next) {
-	len = (*hdr->vptr->print_on)(hdr, p, end-p);
-	if (len < 1)
+	len = pjsip_hdr_print_on(hdr, p, end-p);
+	if (len < 0)
 	    return -1;
-	p += len;
-
-	if (p+3 >= end)
-	    return -1;
-
-	*p++ = '\r';
-	*p++ = '\n';
+
+	if (len > 0) {
+	    p += len;
+	    if (p+3 >= end)
+		return -1;
+
+	    *p++ = '\r';
+	    *p++ = '\n';
+	}
     }
 
@@ -1602,4 +1604,23 @@
     char *endbuf = buf + size;
     const pjsip_parser_const_t *pc = pjsip_parser_const();
+    pjsip_sip_uri *sip_uri;
+    pjsip_param *p;
+
+    /* Check the proprietary param 'hide', don't print this header 
+     * if it exists in the route URI.
+     */
+    sip_uri = (pjsip_sip_uri*) pjsip_uri_get_uri(hdr->name_addr.uri);
+    p = sip_uri->other_param.next;
+    while (p != &sip_uri->other_param) {
+	const pj_str_t st_hide = {"hide", 4};
+
+	if (pj_stricmp(&p->name, &st_hide) == 0) {
+	    /* Check if param 'hide' is specified without 'lr'. */
+	    pj_assert(sip_uri->lr_param != 0);
+	    return 0;
+	}
+	p = p->next;
+    }
+
     /* Route and Record-Route don't compact forms */
 
Index: pjproject/trunk/pjsip/src/pjsip/sip_transaction.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_transaction.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/pjsip/sip_transaction.c	(revision 2724)
@@ -1726,4 +1726,17 @@
 		      pjsip_tx_data_get_info(send_state->tdata), -sent,
 		      pj_strerror(-sent, errmsg, sizeof(errmsg)).ptr));
+
+	    /* Reset retransmission count */
+	    tsx->retransmit_count = 0;
+
+	    /* And reset timeout timer */
+	    if (tsx->timeout_timer.id) {
+		pjsip_endpt_cancel_timer(tsx->endpt, &tsx->timeout_timer);
+		tsx->timeout_timer.id = TIMER_INACTIVE;
+
+		tsx->timeout_timer.id = TIMER_ACTIVE;
+		pjsip_endpt_schedule_timer( tsx->endpt, &tsx->timeout_timer, 
+					    &timeout_timer_val);
+	    }
 	}
     }
Index: pjproject/trunk/pjsip/src/pjsip/sip_transport.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_transport.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/pjsip/sip_transport.c	(revision 2724)
@@ -435,4 +435,43 @@
 }
 
+/*
+ * Print the SIP message to transmit data buffer's internal buffer.
+ */
+PJ_DEF(pj_status_t) pjsip_tx_data_encode(pjsip_tx_data *tdata)
+{
+    /* Allocate buffer if necessary. */
+    if (tdata->buf.start == NULL) {
+	PJ_USE_EXCEPTION;
+
+	PJ_TRY {
+	    tdata->buf.start = (char*) 
+			       pj_pool_alloc(tdata->pool, PJSIP_MAX_PKT_LEN);
+	}
+	PJ_CATCH_ANY {
+	    return PJ_ENOMEM;
+	}
+	PJ_END
+
+	tdata->buf.cur = tdata->buf.start;
+	tdata->buf.end = tdata->buf.start + PJSIP_MAX_PKT_LEN;
+    }
+
+    /* Do we need to reprint? */
+    if (!pjsip_tx_data_is_valid(tdata)) {
+	pj_ssize_t size;
+
+	size = pjsip_msg_print( tdata->msg, tdata->buf.start, 
+			        tdata->buf.end - tdata->buf.start);
+	if (size < 0) {
+	    return PJSIP_EMSGTOOLONG;
+	}
+	pj_assert(size != 0);
+	tdata->buf.cur[size] = '\0';
+	tdata->buf.cur += size;
+    }
+
+    return PJ_SUCCESS;
+}
+
 PJ_DEF(pj_bool_t) pjsip_tx_data_is_valid( pjsip_tx_data *tdata )
 {
@@ -568,36 +607,5 @@
 static pj_status_t mod_on_tx_msg(pjsip_tx_data *tdata)
 {
-    /* Allocate buffer if necessary. */
-    if (tdata->buf.start == NULL) {
-	PJ_USE_EXCEPTION;
-
-	PJ_TRY {
-	    tdata->buf.start = (char*) 
-			       pj_pool_alloc(tdata->pool, PJSIP_MAX_PKT_LEN);
-	}
-	PJ_CATCH_ANY {
-	    return PJ_ENOMEM;
-	}
-	PJ_END
-
-	tdata->buf.cur = tdata->buf.start;
-	tdata->buf.end = tdata->buf.start + PJSIP_MAX_PKT_LEN;
-    }
-
-    /* Do we need to reprint? */
-    if (!pjsip_tx_data_is_valid(tdata)) {
-	pj_ssize_t size;
-
-	size = pjsip_msg_print( tdata->msg, tdata->buf.start, 
-			        tdata->buf.end - tdata->buf.start);
-	if (size < 0) {
-	    return PJSIP_EMSGTOOLONG;
-	}
-	pj_assert(size != 0);
-	tdata->buf.cur[size] = '\0';
-	tdata->buf.cur += size;
-    }
-
-    return PJ_SUCCESS;
+    return pjsip_tx_data_encode(tdata);
 }
 
Index: pjproject/trunk/pjsip/src/pjsip/sip_ua_layer.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_ua_layer.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/pjsip/sip_ua_layer.c	(revision 2724)
@@ -908,5 +908,5 @@
 
     len = pjsip_hdr_print_on(dlg->remote.info, userinfo, sizeof(userinfo));
-    if (len < 1)
+    if (len < 0)
 	pj_ansi_strcpy(userinfo, "<--uri too long-->");
     else
Index: pjproject/trunk/pjsip/src/pjsip/sip_util.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_util.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/pjsip/sip_util.c	(revision 2724)
@@ -1136,4 +1136,6 @@
 	via->rport_param = 0;
 
+	pjsip_tx_data_invalidate_msg(tdata);
+
 	/* Send message using this transport. */
 	status = pjsip_transport_send( stateless_data->cur_transport,
@@ -1181,4 +1183,49 @@
     /* Copy server addresses */
     pj_memcpy( &stateless_data->addr, addr, sizeof(pjsip_server_addresses));
+
+    /* RFC 3261 section 18.1.1:
+     * If a request is within 200 bytes of the path MTU, or if it is larger
+     * than 1300 bytes and the path MTU is unknown, the request MUST be sent
+     * using an RFC 2914 [43] congestion controlled transport protocol, such
+     * as TCP.
+     */
+    if (stateless_data->tdata->msg->type == PJSIP_REQUEST_MSG &&
+	addr->count > 0 && 
+	addr->entry[0].type == PJSIP_TRANSPORT_UDP)
+    {
+	int len;
+
+	/* Encode the request */
+	status = pjsip_tx_data_encode(stateless_data->tdata);
+	if (status != PJ_SUCCESS) {
+	    if (stateless_data->app_cb) {
+		pj_bool_t cont = PJ_FALSE;
+		(*stateless_data->app_cb)(stateless_data, -status, &cont);
+	    }
+	    pjsip_tx_data_dec_ref(stateless_data->tdata);
+	    return;
+	}
+
+	/* Check if request message is larger than 1300 bytes. */
+	len = stateless_data->tdata->buf.cur - 
+		stateless_data->tdata->buf.start;
+	if (len >= PJSIP_UDP_SIZE_THRESHOLD) {
+	    int i;
+	    int count = stateless_data->addr.count;
+
+	    /* Insert "TCP version" of resolved UDP addresses at the
+	     * beginning.
+	     */
+	    if (count * 2 > PJSIP_MAX_RESOLVED_ADDRESSES)
+		count = PJSIP_MAX_RESOLVED_ADDRESSES / 2;
+	    for (i = 0; i < count; ++i) {
+		pj_memcpy(&stateless_data->addr.entry[i+count],
+			  &stateless_data->addr.entry[i],
+			  sizeof(stateless_data->addr.entry[0]));
+		stateless_data->addr.entry[i].type = PJSIP_TRANSPORT_TCP;
+	    }
+	    stateless_data->addr.count = count * 2;
+	}
+    }
 
     /* Process the addresses. */
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_call.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_call.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_call.c	(revision 2724)
@@ -2695,5 +2695,5 @@
 
     len = pjsip_hdr_print_on(dlg->remote.info, userinfo, sizeof(userinfo));
-    if (len < 1)
+    if (len < 0)
 	pj_ansi_strcpy(userinfo, "<--uri too long-->");
     else
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c	(revision 2724)
@@ -183,4 +183,7 @@
     cfg->snd_auto_close_time = 1;
 
+    cfg->ice_max_host_cands = -1;
+    pj_ice_sess_options_default(&cfg->ice_opt);
+
     cfg->turn_conn_type = PJ_TURN_TP_UDP;
 }
@@ -648,5 +651,6 @@
     if (log_cfg) {
 	status = pjsua_reconfigure_logging(log_cfg);
-	PJ_ASSERT_RETURN(status == PJ_SUCCESS, status);
+	if (status != PJ_SUCCESS)
+	    return status;
     }
 
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_media.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_media.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_media.c	(revision 2724)
@@ -805,4 +805,6 @@
     ice_cfg.resolver = pjsua_var.resolver;
     
+    ice_cfg.opt = pjsua_var.media_cfg.ice_opt;
+
     /* Configure STUN settings */
     if (pj_sockaddr_has_addr(&pjsua_var.stun_srv)) {
@@ -811,5 +813,6 @@
 	ice_cfg.stun.port = pj_sockaddr_get_port(&pjsua_var.stun_srv);
     }
-    ice_cfg.stun.no_host_cands = pjsua_var.media_cfg.ice_no_host_cands;
+    if (pjsua_var.media_cfg.ice_max_host_cands >= 0)
+	ice_cfg.stun.max_host_cands = pjsua_var.media_cfg.ice_max_host_cands;
 
     /* Configure TURN settings */
Index: pjproject/trunk/pjsip/src/test/msg_test.c
===================================================================
--- pjproject/trunk/pjsip/src/test/msg_test.c	(revision 2700)
+++ pjproject/trunk/pjsip/src/test/msg_test.c	(revision 2724)
@@ -366,6 +366,6 @@
 
     while (hdr1 != &parsed_msg->hdr && hdr2 != &ref_msg->hdr) {
-	len = hdr1->vptr->print_on(hdr1, str1.ptr, BUFLEN);
-	if (len < 1) {
+	len = pjsip_hdr_print_on(hdr1, str1.ptr, BUFLEN);
+	if (len < 0) {
 	    status = -40;
 	    goto on_return;
@@ -374,6 +374,6 @@
 	str1.slen = len;
 
-	len = hdr2->vptr->print_on(hdr2, str2.ptr, BUFLEN);
-	if (len < 1) {
+	len = pjsip_hdr_print_on(hdr2, str2.ptr, BUFLEN);
+	if (len < 0) {
 	    status = -50;
 	    goto on_return;
@@ -1945,5 +1945,5 @@
 	output = (char*) pj_pool_alloc(pool, 1024);
 	len = pjsip_hdr_print_on(parsed_hdr1, output, 1024);
-	if (len < 1 || len >= 1024) {
+	if (len < 0 || len >= 1024) {
 	    PJ_LOG(3,(THIS_FILE, "    header too long: %s: %s", test->hname, test->hcontent));
 	    return -530;
