Merging upstream version 127.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

27 files changed, 466 insertions, 465 deletions

diff --git a/third_party/libwebrtc/p2p/base/basic_ice_controller.cc b/third_party/libwebrtc/p2p/base/basic_ice_controller.cc
index 182845cdd7..f5b3eca3a4 100644
--- a/third_party/libwebrtc/p2p/base/basic_ice_controller.cc
+++ b/third_party/libwebrtc/p2p/base/basic_ice_controller.cc
@@ -16,8 +16,8 @@ namespace {
 const int kMinImprovement = 10;
 
 bool IsRelayRelay(const cricket::Connection* conn) {
-  return conn->local_candidate().type() == cricket::RELAY_PORT_TYPE &&
-         conn->remote_candidate().type() == cricket::RELAY_PORT_TYPE;
+  return conn->local_candidate().is_relay() &&
+         conn->remote_candidate().is_relay();
 }
 
 bool IsUdp(const cricket::Connection* conn) {
diff --git a/third_party/libwebrtc/p2p/base/basic_ice_controller.h b/third_party/libwebrtc/p2p/base/basic_ice_controller.h
index 724609d2d7..f9f4d45c7a 100644
--- a/third_party/libwebrtc/p2p/base/basic_ice_controller.h
+++ b/third_party/libwebrtc/p2p/base/basic_ice_controller.h
@@ -19,7 +19,6 @@
 
 #include "p2p/base/ice_controller_factory_interface.h"
 #include "p2p/base/ice_controller_interface.h"
-#include "p2p/base/p2p_transport_channel.h"
 
 namespace cricket {
 
diff --git a/third_party/libwebrtc/p2p/base/basic_packet_socket_factory.cc b/third_party/libwebrtc/p2p/base/basic_packet_socket_factory.cc
index 6a811af71a..816d964360 100644
--- a/third_party/libwebrtc/p2p/base/basic_packet_socket_factory.cc
+++ b/third_party/libwebrtc/p2p/base/basic_packet_socket_factory.cc
@@ -119,11 +119,7 @@ AsyncPacketSocket* BasicPacketSocketFactory::CreateClientTcpSocket(
                       << socket->GetError();
   }
 
-  // If using a proxy, wrap the socket in a proxy socket.
-  if (proxy_info.type == PROXY_SOCKS5) {
-    socket = new AsyncSocksProxySocket(
-        socket, proxy_info.address, proxy_info.username, proxy_info.password);
-  } else if (proxy_info.type == PROXY_HTTPS) {
+  if (proxy_info.type == PROXY_HTTPS) {
     socket =
         new AsyncHttpsProxySocket(socket, user_agent, proxy_info.address,
                                   proxy_info.username, proxy_info.password);
diff --git a/third_party/libwebrtc/p2p/base/candidate_pair_interface.h b/third_party/libwebrtc/p2p/base/candidate_pair_interface.h
index 2b68fd7ea9..a04ab130cf 100644
--- a/third_party/libwebrtc/p2p/base/candidate_pair_interface.h
+++ b/third_party/libwebrtc/p2p/base/candidate_pair_interface.h
@@ -23,6 +23,18 @@ class CandidatePairInterface {
   virtual const Candidate& remote_candidate() const = 0;
 };
 
+// Specific implementation of the interface, suitable for being a
+// data member of other structs.
+struct CandidatePair final : public CandidatePairInterface {
+  ~CandidatePair() override = default;
+
+  const Candidate& local_candidate() const override { return local; }
+  const Candidate& remote_candidate() const override { return remote; }
+
+  Candidate local;
+  Candidate remote;
+};
+
 }  // namespace cricket
 
 #endif  // P2P_BASE_CANDIDATE_PAIR_INTERFACE_H_
diff --git a/third_party/libwebrtc/p2p/base/connection.cc b/third_party/libwebrtc/p2p/base/connection.cc
index bf07dec607..93a9a3f791 100644
--- a/third_party/libwebrtc/p2p/base/connection.cc
+++ b/third_party/libwebrtc/p2p/base/connection.cc
@@ -19,25 +19,26 @@
 #include <vector>
 
 #include "absl/algorithm/container.h"
-#include "absl/strings/escaping.h"
-#include "absl/strings/match.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 #include "api/array_view.h"
 #include "api/units/timestamp.h"
-#include "p2p/base/port_allocator.h"
+#include "p2p/base/p2p_constants.h"
+#include "rtc_base/byte_buffer.h"
 #include "rtc_base/checks.h"
-#include "rtc_base/crc32.h"
 #include "rtc_base/helpers.h"
 #include "rtc_base/logging.h"
-#include "rtc_base/mdns_responder_interface.h"
-#include "rtc_base/message_digest.h"
+#include "rtc_base/net_helper.h"
 #include "rtc_base/network.h"
+#include "rtc_base/network/sent_packet.h"
+#include "rtc_base/network_constants.h"
 #include "rtc_base/numerics/safe_minmax.h"
+#include "rtc_base/socket.h"
+#include "rtc_base/socket_address.h"
 #include "rtc_base/string_encode.h"
 #include "rtc_base/string_utils.h"
 #include "rtc_base/strings/string_builder.h"
-#include "rtc_base/third_party/base64/base64.h"
+#include "rtc_base/time_utils.h"
 
 namespace cricket {
 namespace {
@@ -74,17 +75,16 @@ inline bool TooLongWithoutResponse(
 
 // Helper methods for converting string values of log description fields to
 // enum.
-webrtc::IceCandidateType GetCandidateTypeByString(absl::string_view type) {
-  if (type == LOCAL_PORT_TYPE) {
-    return webrtc::IceCandidateType::kLocal;
-  } else if (type == STUN_PORT_TYPE) {
-    return webrtc::IceCandidateType::kStun;
-  } else if (type == PRFLX_PORT_TYPE) {
+webrtc::IceCandidateType GetRtcEventLogCandidateType(const Candidate& c) {
+  if (c.is_local()) {
+    return webrtc::IceCandidateType::kHost;
+  } else if (c.is_stun()) {
+    return webrtc::IceCandidateType::kSrflx;
+  } else if (c.is_prflx()) {
     return webrtc::IceCandidateType::kPrflx;
-  } else if (type == RELAY_PORT_TYPE) {
-    return webrtc::IceCandidateType::kRelay;
   }
-  return webrtc::IceCandidateType::kUnknown;
+  RTC_DCHECK(c.is_relay());
+  return webrtc::IceCandidateType::kRelay;
 }
 
 webrtc::IceCandidatePairProtocol GetProtocolByString(
@@ -213,7 +213,7 @@ int Connection::ConnectionRequest::resend_delay() {
   return CONNECTION_RESPONSE_TIMEOUT;
 }
 
-Connection::Connection(rtc::WeakPtr<Port> port,
+Connection::Connection(rtc::WeakPtr<PortInterface> port,
                        size_t index,
                        const Candidate& remote_candidate)
     : network_thread_(port->thread()),
@@ -1330,11 +1330,11 @@ std::string Connection::ToString() const {
   const Candidate& local = local_candidate();
   const Candidate& remote = remote_candidate();
   ss << local.id() << ":" << local.component() << ":" << local.generation()
-     << ":" << local.type() << ":" << local.protocol() << ":"
+     << ":" << local.type_name() << ":" << local.protocol() << ":"
      << local.address().ToSensitiveString() << "->" << remote.id() << ":"
-     << remote.component() << ":" << remote.priority() << ":" << remote.type()
-     << ":" << remote.protocol() << ":" << remote.address().ToSensitiveString()
-     << "|";
+     << remote.component() << ":" << remote.priority() << ":"
+     << remote.type_name() << ":" << remote.protocol() << ":"
+     << remote.address().ToSensitiveString() << "|";
 
   ss << CONNECT_STATE_ABBREV[connected_] << RECEIVE_STATE_ABBREV[receiving_]
      << WRITE_STATE_ABBREV[write_state_] << ICESTATE[static_cast<int>(state_)]
@@ -1365,16 +1365,13 @@ const webrtc::IceCandidatePairDescription& Connection::ToLogDescription() {
   const Candidate& local = local_candidate();
   const Candidate& remote = remote_candidate();
   const rtc::Network* network = port()->Network();
-  log_description_ = webrtc::IceCandidatePairDescription();
-  log_description_->local_candidate_type =
-      GetCandidateTypeByString(local.type());
+  log_description_ = webrtc::IceCandidatePairDescription(
+      GetRtcEventLogCandidateType(local), GetRtcEventLogCandidateType(remote));
   log_description_->local_relay_protocol =
       GetProtocolByString(local.relay_protocol());
   log_description_->local_network_type = ConvertNetworkType(network->type());
   log_description_->local_address_family =
       GetAddressFamilyByInt(local.address().family());
-  log_description_->remote_candidate_type =
-      GetCandidateTypeByString(remote.type());
   log_description_->remote_address_family =
       GetAddressFamilyByInt(remote.address().family());
   log_description_->candidate_pair_protocol =
@@ -1692,10 +1689,9 @@ void Connection::MaybeUpdateLocalCandidate(StunRequest* request,
     return;
   }
   const uint32_t priority = priority_attr->value();
-  std::string id = rtc::CreateRandomString(8);
 
   // Create a peer-reflexive candidate based on the local candidate.
-  local_candidate_.set_id(id);
+  local_candidate_.generate_id();
   local_candidate_.set_type(PRFLX_PORT_TYPE);
   // Set the related address and foundation attributes before changing the
   // address.
@@ -1784,7 +1780,7 @@ void Connection::ForgetLearnedState() {
   pings_since_last_response_.clear();
 }
 
-ProxyConnection::ProxyConnection(rtc::WeakPtr<Port> port,
+ProxyConnection::ProxyConnection(rtc::WeakPtr<PortInterface> port,
                                  size_t index,
                                  const Candidate& remote_candidate)
     : Connection(std::move(port), index, remote_candidate) {}
diff --git a/third_party/libwebrtc/p2p/base/connection.h b/third_party/libwebrtc/p2p/base/connection.h
index cf54dc800f..583e62e264 100644
--- a/third_party/libwebrtc/p2p/base/connection.h
+++ b/third_party/libwebrtc/p2p/base/connection.h
@@ -11,19 +11,31 @@
 #ifndef P2P_BASE_CONNECTION_H_
 #define P2P_BASE_CONNECTION_H_
 
+#include <stddef.h>
+
+#include <cstdint>
+#include <functional>
 #include <memory>
 #include <string>
+#include <type_traits>
 #include <utility>
 #include <vector>
 
+#include "absl/functional/any_invocable.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 #include "api/candidate.h"
+#include "api/rtc_error.h"
+#include "api/sequence_checker.h"
+#include "api/task_queue/task_queue_base.h"
 #include "api/transport/stun.h"
+#include "logging/rtc_event_log/events/rtc_event_ice_candidate_pair.h"
+#include "logging/rtc_event_log/events/rtc_event_ice_candidate_pair_config.h"
 #include "logging/rtc_event_log/ice_logger.h"
 #include "p2p/base/candidate_pair_interface.h"
 #include "p2p/base/connection_info.h"
 #include "p2p/base/p2p_transport_channel_ice_field_trials.h"
+#include "p2p/base/port_interface.h"
 #include "p2p/base/stun_request.h"
 #include "p2p/base/transport_description.h"
 #include "rtc_base/async_packet_socket.h"
@@ -32,6 +44,8 @@
 #include "rtc_base/numerics/event_based_exponential_moving_average.h"
 #include "rtc_base/rate_tracker.h"
 #include "rtc_base/system/rtc_export.h"
+#include "rtc_base/third_party/sigslot/sigslot.h"
+#include "rtc_base/thread_annotations.h"
 #include "rtc_base/weak_ptr.h"
 
 namespace cricket {
@@ -40,23 +54,9 @@ namespace cricket {
 // adding other flavors in the future.
 constexpr int kGoogPingVersion = 1;
 
-// Connection and Port has circular dependencies.
-// So we use forward declaration rather than include.
-class Port;
-
 // Forward declaration so that a ConnectionRequest can contain a Connection.
 class Connection;
 
-struct CandidatePair final : public CandidatePairInterface {
-  ~CandidatePair() override = default;
-
-  const Candidate& local_candidate() const override { return local; }
-  const Candidate& remote_candidate() const override { return remote; }
-
-  Candidate local;
-  Candidate remote;
-};
-
 // Represents a communication link between a port on the local client and a
 // port on the remote client.
 class RTC_EXPORT Connection : public CandidatePairInterface {
@@ -102,7 +102,7 @@ class RTC_EXPORT Connection : public CandidatePairInterface {
   bool writable() const;
   bool receiving() const;
 
-  const Port* port() const {
+  const PortInterface* port() const {
     RTC_DCHECK_RUN_ON(network_thread_);
     return port_.get();
   }
@@ -326,8 +326,8 @@ class RTC_EXPORT Connection : public CandidatePairInterface {
   void SendResponseMessage(const StunMessage& response);
 
   // An accessor for unit tests.
-  Port* PortForTest() { return port_.get(); }
-  const Port* PortForTest() const { return port_.get(); }
+  PortInterface* PortForTest() { return port_.get(); }
+  const PortInterface* PortForTest() const { return port_.get(); }
 
   std::unique_ptr<IceMessage> BuildPingRequestForTest() {
     RTC_DCHECK_RUN_ON(network_thread_);
@@ -364,7 +364,9 @@ class RTC_EXPORT Connection : public CandidatePairInterface {
   class ConnectionRequest;
 
   // Constructs a new connection to the given remote port.
-  Connection(rtc::WeakPtr<Port> port, size_t index, const Candidate& candidate);
+  Connection(rtc::WeakPtr<PortInterface> port,
+             size_t index,
+             const Candidate& candidate);
 
   // Called back when StunRequestManager has a stun packet to send
   void OnSendStunPacket(const void* data, size_t size, StunRequest* req);
@@ -393,7 +395,7 @@ class RTC_EXPORT Connection : public CandidatePairInterface {
   void set_connected(bool value);
 
   // The local port where this connection sends and receives packets.
-  Port* port() { return port_.get(); }
+  PortInterface* port() { return port_.get(); }
 
   // NOTE: A pointer to the network thread is held by `port_` so in theory we
   // shouldn't need to hold on to this pointer here, but rather defer to
@@ -402,7 +404,7 @@ class RTC_EXPORT Connection : public CandidatePairInterface {
   // TODO(tommi): This ^^^ should be fixed.
   webrtc::TaskQueueBase* const network_thread_;
   const uint32_t id_;
-  rtc::WeakPtr<Port> port_;
+  rtc::WeakPtr<PortInterface> port_;
   Candidate local_candidate_ RTC_GUARDED_BY(network_thread_);
   Candidate remote_candidate_;
 
@@ -515,7 +517,7 @@ class RTC_EXPORT Connection : public CandidatePairInterface {
 // ProxyConnection defers all the interesting work to the port.
 class ProxyConnection : public Connection {
  public:
-  ProxyConnection(rtc::WeakPtr<Port> port,
+  ProxyConnection(rtc::WeakPtr<PortInterface> port,
                   size_t index,
                   const Candidate& remote_candidate);
 
diff --git a/third_party/libwebrtc/p2p/base/fake_port_allocator.h b/third_party/libwebrtc/p2p/base/fake_port_allocator.h
index 0bb7dd0139..a51a7ca4ee 100644
--- a/third_party/libwebrtc/p2p/base/fake_port_allocator.h
+++ b/third_party/libwebrtc/p2p/base/fake_port_allocator.h
@@ -93,6 +93,7 @@ class FakePortAllocatorSession : public PortAllocatorSession {
                              ice_ufrag,
                              ice_pwd,
                              allocator->flags()),
+        allocator_(allocator),
         network_thread_(network_thread),
         factory_(factory),
         ipv4_network_("network",
@@ -110,7 +111,6 @@ class FakePortAllocatorSession : public PortAllocatorSession {
         field_trials_(field_trials) {
     ipv4_network_.AddIP(rtc::IPAddress(INADDR_LOOPBACK));
     ipv6_network_.AddIP(rtc::IPAddress(in6addr_loopback));
-    set_ice_tiebreaker(/*kTiebreakerDefault = */ 44444);
   }
 
   void SetCandidateFilter(uint32_t filter) override {
@@ -127,7 +127,7 @@ class FakePortAllocatorSession : public PortAllocatorSession {
                                       username(), password(), false,
                                       field_trials_));
       RTC_DCHECK(port_);
-      port_->SetIceTiebreaker(ice_tiebreaker());
+      port_->SetIceTiebreaker(allocator_->ice_tiebreaker());
       port_->SubscribePortDestroyed(
           [this](PortInterface* port) { OnPortDestroyed(port); });
       AddPort(port_.get());
@@ -199,6 +199,7 @@ class FakePortAllocatorSession : public PortAllocatorSession {
     port_.release();
   }
 
+  PortAllocator* allocator_;
   rtc::Thread* network_thread_;
   rtc::PacketSocketFactory* factory_;
   rtc::Network ipv4_network_;
diff --git a/third_party/libwebrtc/p2p/base/p2p_constants.h b/third_party/libwebrtc/p2p/base/p2p_constants.h
index d51ee17a07..c5a2b7058d 100644
--- a/third_party/libwebrtc/p2p/base/p2p_constants.h
+++ b/third_party/libwebrtc/p2p/base/p2p_constants.h
@@ -95,6 +95,8 @@ extern const int CONNECTION_WRITE_TIMEOUT;
 // Default value of IceConfig.stun_keepalive_interval;
 extern const int STUN_KEEPALIVE_INTERVAL;
 
+static const int MIN_PINGS_AT_WEAK_PING_INTERVAL = 3;
+
 // The following constants are used at the candidate pair level to determine the
 // state of a candidate pair.
 //
@@ -109,6 +111,19 @@ extern const int CONNECTION_RESPONSE_TIMEOUT;
 // it.
 extern const int MIN_CONNECTION_LIFETIME;
 
+// The type preference MUST be an integer from 0 to 126 inclusive.
+// https://datatracker.ietf.org/doc/html/rfc5245#section-4.1.2.1
+enum IcePriorityValue : uint8_t {
+  ICE_TYPE_PREFERENCE_RELAY_TLS = 0,
+  ICE_TYPE_PREFERENCE_RELAY_TCP = 1,
+  ICE_TYPE_PREFERENCE_RELAY_UDP = 2,
+  ICE_TYPE_PREFERENCE_PRFLX_TCP = 80,
+  ICE_TYPE_PREFERENCE_HOST_TCP = 90,
+  ICE_TYPE_PREFERENCE_SRFLX = 100,
+  ICE_TYPE_PREFERENCE_PRFLX = 110,
+  ICE_TYPE_PREFERENCE_HOST = 126
+};
+
 }  // namespace cricket
 
 #endif  // P2P_BASE_P2P_CONSTANTS_H_
diff --git a/third_party/libwebrtc/p2p/base/p2p_transport_channel.cc b/third_party/libwebrtc/p2p/base/p2p_transport_channel.cc
index 35d7f85d69..eb3553b52a 100644
--- a/third_party/libwebrtc/p2p/base/p2p_transport_channel.cc
+++ b/third_party/libwebrtc/p2p/base/p2p_transport_channel.cc
@@ -164,7 +164,7 @@ P2PTransportChannel::P2PTransportChannel(
       error_(0),
       remote_ice_mode_(ICEMODE_FULL),
       ice_role_(ICEROLE_UNKNOWN),
-      tiebreaker_(0),
+      ice_tiebreaker_(0),
       gathering_state_(kIceGatheringNew),
       weak_ping_interval_(GetWeakPingIntervalInFieldTrial(field_trials)),
       config_(RECEIVING_TIMEOUT,
@@ -326,7 +326,7 @@ void P2PTransportChannel::SetIceTiebreaker(uint64_t tiebreaker) {
     return;
   }
 
-  tiebreaker_ = tiebreaker;
+  ice_tiebreaker_ = tiebreaker;
 }
 
 IceTransportState P2PTransportChannel::GetState() const {
@@ -885,7 +885,6 @@ void P2PTransportChannel::MaybeStartGathering() {
                                       ice_parameters_.ufrag,
                                       ice_parameters_.pwd);
     if (pooled_session) {
-      pooled_session->set_ice_tiebreaker(tiebreaker_);
       AddAllocatorSession(std::move(pooled_session));
       PortAllocatorSession* raw_pooled_session =
           allocator_sessions_.back().get();
@@ -902,7 +901,6 @@ void P2PTransportChannel::MaybeStartGathering() {
       AddAllocatorSession(allocator_->CreateSession(
           transport_name(), component(), ice_parameters_.ufrag,
           ice_parameters_.pwd));
-      allocator_sessions_.back()->set_ice_tiebreaker(tiebreaker_);
       allocator_sessions_.back()->StartGettingPorts();
     }
   }
@@ -930,7 +928,7 @@ void P2PTransportChannel::OnPortReady(PortAllocatorSession* session,
   // if one is pending.
 
   port->SetIceRole(ice_role_);
-  port->SetIceTiebreaker(tiebreaker_);
+  port->SetIceTiebreaker(ice_tiebreaker_);
   ports_.push_back(port);
   port->SignalUnknownAddress.connect(this,
                                      &P2PTransportChannel::OnUnknownAddress);
@@ -1418,7 +1416,8 @@ bool P2PTransportChannel::CreateConnection(PortInterface* port,
     if ((port->Type() != remote_candidate.type()) &&
         (port->Type() == RELAY_PORT_TYPE || remote_candidate.is_relay())) {
       RTC_LOG(LS_INFO) << ToString() << ": skip creating connection "
-                       << port->Type() << " to " << remote_candidate.type();
+                       << port->Type() << " to "
+                       << remote_candidate.type_name();
       return false;
     }
   }
@@ -1693,7 +1692,7 @@ void P2PTransportChannel::OnStartedPinging() {
   regathering_controller_->Start();
 }
 
-bool P2PTransportChannel::IsPortPruned(const Port* port) const {
+bool P2PTransportChannel::IsPortPruned(const PortInterface* port) const {
   RTC_DCHECK_RUN_ON(network_thread_);
   return !absl::c_linear_search(ports_, port);
 }
diff --git a/third_party/libwebrtc/p2p/base/p2p_transport_channel.h b/third_party/libwebrtc/p2p/base/p2p_transport_channel.h
index 47f37c8c67..f7472df38a 100644
--- a/third_party/libwebrtc/p2p/base/p2p_transport_channel.h
+++ b/third_party/libwebrtc/p2p/base/p2p_transport_channel.h
@@ -79,8 +79,6 @@ class RtcEventLog;
 
 namespace cricket {
 
-static const int MIN_PINGS_AT_WEAK_PING_INTERVAL = 3;
-
 bool IceCredentialsChanged(absl::string_view old_ufrag,
                            absl::string_view old_pwd,
                            absl::string_view new_ufrag,
@@ -372,7 +370,7 @@ class RTC_EXPORT P2PTransportChannel : public IceTransportInternal,
   }
 
   // Indicates if the given local port has been pruned.
-  bool IsPortPruned(const Port* port) const;
+  bool IsPortPruned(const PortInterface* port) const;
 
   // Indicates if the given remote candidate has been pruned.
   bool IsRemoteCandidatePruned(const Candidate& cand) const;
@@ -441,7 +439,7 @@ class RTC_EXPORT P2PTransportChannel : public IceTransportInternal,
       RTC_GUARDED_BY(network_thread_);
   IceMode remote_ice_mode_ RTC_GUARDED_BY(network_thread_);
   IceRole ice_role_ RTC_GUARDED_BY(network_thread_);
-  uint64_t tiebreaker_ RTC_GUARDED_BY(network_thread_);
+  uint64_t ice_tiebreaker_ RTC_GUARDED_BY(network_thread_);
   IceGatheringState gathering_state_ RTC_GUARDED_BY(network_thread_);
   std::unique_ptr<webrtc::BasicRegatheringController> regathering_controller_
       RTC_GUARDED_BY(network_thread_);
diff --git a/third_party/libwebrtc/p2p/base/p2p_transport_channel_unittest.cc b/third_party/libwebrtc/p2p/base/p2p_transport_channel_unittest.cc
index a0446c7965..b180ab8d2b 100644
--- a/third_party/libwebrtc/p2p/base/p2p_transport_channel_unittest.cc
+++ b/third_party/libwebrtc/p2p/base/p2p_transport_channel_unittest.cc
@@ -141,7 +141,6 @@ const cricket::IceParameters kIceParams[4] = {
 
 const uint64_t kLowTiebreaker = 11111;
 const uint64_t kHighTiebreaker = 22222;
-const uint64_t kTiebreakerDefault = 44444;
 
 cricket::IceConfig CreateIceConfig(
     int receiving_timeout,
@@ -286,14 +285,6 @@ class P2PTransportChannelTestBase : public ::testing::Test,
         main_(ss_.get()),
         stun_server_(TestStunServer::Create(ss_.get(), kStunAddr, main_)),
         turn_server_(&main_, ss_.get(), kTurnUdpIntAddr, kTurnUdpExtAddr),
-        socks_server1_(ss_.get(),
-                       kSocksProxyAddrs[0],
-                       ss_.get(),
-                       kSocksProxyAddrs[0]),
-        socks_server2_(ss_.get(),
-                       kSocksProxyAddrs[1],
-                       ss_.get(),
-                       kSocksProxyAddrs[1]),
         force_relay_(false) {
     ep1_.role_ = ICEROLE_CONTROLLING;
     ep2_.role_ = ICEROLE_CONTROLLED;
@@ -307,10 +298,6 @@ class P2PTransportChannelTestBase : public ::testing::Test,
         &ep2_.network_manager_, socket_factory_.get(), stun_servers,
         kTurnUdpIntAddr, rtc::SocketAddress()));
 
-    ep1_.SetIceTiebreaker(kTiebreakerDefault);
-    ep1_.allocator_->SetIceTiebreaker(kTiebreakerDefault);
-    ep2_.SetIceTiebreaker(kTiebreakerDefault);
-    ep2_.allocator_->SetIceTiebreaker(kTiebreakerDefault);
     webrtc::metrics::Reset();
   }
 
@@ -330,7 +317,6 @@ class P2PTransportChannelTestBase : public ::testing::Test,
     BLOCK_UDP_AND_INCOMING_TCP,   // Firewall, UDP in/out and TCP in blocked
     BLOCK_ALL_BUT_OUTGOING_HTTP,  // Firewall, only TCP out on 80/443
     PROXY_HTTPS,                  // All traffic through HTTPS proxy
-    PROXY_SOCKS,                  // All traffic through SOCKS proxy
     NUM_CONFIGS
   };
 
@@ -599,13 +585,13 @@ class P2PTransportChannelTestBase : public ::testing::Test,
     return GetEndpoint(endpoint)->SetAllowTcpListen(allow_tcp_listen);
   }
 
-  // Return true if the approprite parts of the expected Result, based
+  // Return true if the appropriate parts of the expected Result, based
   // on the local and remote candidate of ep1_ch1, match.  This can be
   // used in an EXPECT_TRUE_WAIT.
   bool CheckCandidate1(const Result& expected) {
-    const std::string& local_type = LocalCandidate(ep1_ch1())->type();
+    auto local_type = LocalCandidate(ep1_ch1())->type();
     const std::string& local_protocol = LocalCandidate(ep1_ch1())->protocol();
-    const std::string& remote_type = RemoteCandidate(ep1_ch1())->type();
+    auto remote_type = RemoteCandidate(ep1_ch1())->type();
     const std::string& remote_protocol = RemoteCandidate(ep1_ch1())->protocol();
     return (local_protocol == expected.controlling_protocol &&
             remote_protocol == expected.controlled_protocol &&
@@ -613,7 +599,7 @@ class P2PTransportChannelTestBase : public ::testing::Test,
             remote_type == expected.controlled_type);
   }
 
-  // EXPECT_EQ on the approprite parts of the expected Result, based
+  // EXPECT_EQ on the appropriate parts of the expected Result, based
   // on the local and remote candidate of ep1_ch1.  This is like
   // CheckCandidate1, except that it will provide more detail about
   // what didn't match.
@@ -622,9 +608,9 @@ class P2PTransportChannelTestBase : public ::testing::Test,
       return;
     }
 
-    const std::string& local_type = LocalCandidate(ep1_ch1())->type();
+    auto local_type = LocalCandidate(ep1_ch1())->type();
     const std::string& local_protocol = LocalCandidate(ep1_ch1())->protocol();
-    const std::string& remote_type = RemoteCandidate(ep1_ch1())->type();
+    auto remote_type = RemoteCandidate(ep1_ch1())->type();
     const std::string& remote_protocol = RemoteCandidate(ep1_ch1())->protocol();
     EXPECT_EQ(expected.controlling_type, local_type);
     EXPECT_EQ(expected.controlled_type, remote_type);
@@ -632,13 +618,13 @@ class P2PTransportChannelTestBase : public ::testing::Test,
     EXPECT_EQ(expected.controlled_protocol, remote_protocol);
   }
 
-  // Return true if the approprite parts of the expected Result, based
+  // Return true if the appropriate parts of the expected Result, based
   // on the local and remote candidate of ep2_ch1, match.  This can be
   // used in an EXPECT_TRUE_WAIT.
   bool CheckCandidate2(const Result& expected) {
-    const std::string& local_type = LocalCandidate(ep2_ch1())->type();
+    auto local_type = LocalCandidate(ep2_ch1())->type();
     const std::string& local_protocol = LocalCandidate(ep2_ch1())->protocol();
-    const std::string& remote_type = RemoteCandidate(ep2_ch1())->type();
+    auto remote_type = RemoteCandidate(ep2_ch1())->type();
     const std::string& remote_protocol = RemoteCandidate(ep2_ch1())->protocol();
     return (local_protocol == expected.controlled_protocol &&
             remote_protocol == expected.controlling_protocol &&
@@ -646,7 +632,7 @@ class P2PTransportChannelTestBase : public ::testing::Test,
             remote_type == expected.controlling_type);
   }
 
-  // EXPECT_EQ on the approprite parts of the expected Result, based
+  // EXPECT_EQ on the appropriate parts of the expected Result, based
   // on the local and remote candidate of ep2_ch1.  This is like
   // CheckCandidate2, except that it will provide more detail about
   // what didn't match.
@@ -655,9 +641,9 @@ class P2PTransportChannelTestBase : public ::testing::Test,
       return;
     }
 
-    const std::string& local_type = LocalCandidate(ep2_ch1())->type();
+    auto local_type = LocalCandidate(ep2_ch1())->type();
     const std::string& local_protocol = LocalCandidate(ep2_ch1())->protocol();
-    const std::string& remote_type = RemoteCandidate(ep2_ch1())->type();
+    auto remote_type = RemoteCandidate(ep2_ch1())->type();
     const std::string& remote_protocol = RemoteCandidate(ep2_ch1())->protocol();
     EXPECT_EQ(expected.controlled_type, local_type);
     EXPECT_EQ(expected.controlling_type, remote_type);
@@ -839,7 +825,7 @@ class P2PTransportChannelTestBase : public ::testing::Test,
 
   // We pass the candidates directly to the other side.
   void OnCandidateGathered(IceTransportInternal* ch, const Candidate& c) {
-    if (force_relay_ && c.type() != RELAY_PORT_TYPE)
+    if (force_relay_ && !c.is_relay())
       return;
 
     if (GetEndpoint(ch)->save_candidates_) {
@@ -1028,8 +1014,6 @@ class P2PTransportChannelTestBase : public ::testing::Test,
       PendingTaskSafetyFlag::Create();
   TestStunServer::StunServerPtr stun_server_;
   TestTurnServer turn_server_;
-  rtc::SocksProxyServer socks_server1_;
-  rtc::SocksProxyServer socks_server2_;
   Endpoint ep1_;
   Endpoint ep2_;
   RemoteIceParameterSource remote_ice_parameter_source_ = FROM_CANDIDATE;
@@ -1179,7 +1163,6 @@ class P2PTransportChannelTest : public P2PTransportChannelTestBase {
       case BLOCK_UDP_AND_INCOMING_TCP:
       case BLOCK_ALL_BUT_OUTGOING_HTTP:
       case PROXY_HTTPS:
-      case PROXY_SOCKS:
         AddAddress(endpoint, kPublicAddrs[endpoint]);
         // Block all UDP
         fw()->AddRule(false, rtc::FP_UDP, rtc::FD_ANY, kPublicAddrs[endpoint]);
@@ -1202,13 +1185,6 @@ class P2PTransportChannelTest : public P2PTransportChannelTestBase {
           fw()->AddRule(false, rtc::FP_TCP, rtc::FD_ANY,
                         kPublicAddrs[endpoint]);
           SetProxy(endpoint, rtc::PROXY_HTTPS);
-        } else if (config == PROXY_SOCKS) {
-          // Block all TCP to/from the endpoint except to the proxy server
-          fw()->AddRule(true, rtc::FP_TCP, kPublicAddrs[endpoint],
-                        kSocksProxyAddrs[endpoint]);
-          fw()->AddRule(false, rtc::FP_TCP, rtc::FD_ANY,
-                        kPublicAddrs[endpoint]);
-          SetProxy(endpoint, rtc::PROXY_SOCKS5);
         }
         break;
       default:
@@ -1253,42 +1229,28 @@ class P2PTransportChannelMatrixTest : public P2PTransportChannelTest,
 const P2PTransportChannelMatrixTest::Result*
     P2PTransportChannelMatrixTest::kMatrix[NUM_CONFIGS][NUM_CONFIGS] = {
         //      OPEN  CONE  ADDR  PORT  SYMM  2CON  SCON  !UDP  !TCP  HTTP  PRXH
-        //      PRXS
-        /*OP*/ {LULU, LUSU, LUSU, LUSU, LUPU, LUSU, LUPU, LTPT, LTPT, LSRS,
-                NULL, LTPT},
+        /*OP*/
+        {LULU, LUSU, LUSU, LUSU, LUPU, LUSU, LUPU, LTPT, LTPT, LSRS, NULL},
         /*CO*/
-        {SULU, SUSU, SUSU, SUSU, SUPU, SUSU, SUPU, NULL, NULL, LSRS, NULL,
-         LTRT},
+        {SULU, SUSU, SUSU, SUSU, SUPU, SUSU, SUPU, NULL, NULL, LSRS, NULL},
         /*AD*/
-        {SULU, SUSU, SUSU, SUSU, SUPU, SUSU, SUPU, NULL, NULL, LSRS, NULL,
-         LTRT},
+        {SULU, SUSU, SUSU, SUSU, SUPU, SUSU, SUPU, NULL, NULL, LSRS, NULL},
         /*PO*/
-        {SULU, SUSU, SUSU, SUSU, RUPU, SUSU, RUPU, NULL, NULL, LSRS, NULL,
-         LTRT},
+        {SULU, SUSU, SUSU, SUSU, RUPU, SUSU, RUPU, NULL, NULL, LSRS, NULL},
         /*SY*/
-        {PULU, PUSU, PUSU, PURU, PURU, PUSU, PURU, NULL, NULL, LSRS, NULL,
-         LTRT},
+        {PULU, PUSU, PUSU, PURU, PURU, PUSU, PURU, NULL, NULL, LSRS, NULL},
         /*2C*/
-        {SULU, SUSU, SUSU, SUSU, SUPU, SUSU, SUPU, NULL, NULL, LSRS, NULL,
-         LTRT},
+        {SULU, SUSU, SUSU, SUSU, SUPU, SUSU, SUPU, NULL, NULL, LSRS, NULL},
         /*SC*/
-        {PULU, PUSU, PUSU, PURU, PURU, PUSU, PURU, NULL, NULL, LSRS, NULL,
-         LTRT},
+        {PULU, PUSU, PUSU, PURU, PURU, PUSU, PURU, NULL, NULL, LSRS, NULL},
         /*!U*/
-        {LTPT, NULL, NULL, NULL, NULL, NULL, NULL, LTPT, LTPT, LSRS, NULL,
-         LTRT},
+        {LTPT, NULL, NULL, NULL, NULL, NULL, NULL, LTPT, LTPT, LSRS, NULL},
         /*!T*/
-        {PTLT, NULL, NULL, NULL, NULL, NULL, NULL, PTLT, LTRT, LSRS, NULL,
-         LTRT},
+        {PTLT, NULL, NULL, NULL, NULL, NULL, NULL, PTLT, LTRT, LSRS, NULL},
         /*HT*/
-        {LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, NULL,
-         LSRS},
+        {LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, LSRS, NULL},
         /*PR*/
-        {NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-         NULL},
-        /*PR*/
-        {LTRT, LTRT, LTRT, LTRT, LTRT, LTRT, LTRT, LTRT, LTRT, LSRS, NULL,
-         LTRT},
+        {NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL},
 };
 
 // The actual tests that exercise all the various configurations.
@@ -1316,8 +1278,7 @@ const P2PTransportChannelMatrixTest::Result*
   P2P_TEST(x, BLOCK_UDP)                   \
   P2P_TEST(x, BLOCK_UDP_AND_INCOMING_TCP)  \
   P2P_TEST(x, BLOCK_ALL_BUT_OUTGOING_HTTP) \
-  P2P_TEST(x, PROXY_HTTPS)                 \
-  P2P_TEST(x, PROXY_SOCKS)
+  P2P_TEST(x, PROXY_HTTPS)
 
 P2P_TEST_SET(OPEN)
 P2P_TEST_SET(NAT_FULL_CONE)
@@ -1330,7 +1291,6 @@ P2P_TEST_SET(BLOCK_UDP)
 P2P_TEST_SET(BLOCK_UDP_AND_INCOMING_TCP)
 P2P_TEST_SET(BLOCK_ALL_BUT_OUTGOING_HTTP)
 P2P_TEST_SET(PROXY_HTTPS)
-P2P_TEST_SET(PROXY_SOCKS)
 
 INSTANTIATE_TEST_SUITE_P(
     All,
@@ -1571,16 +1531,16 @@ TEST_F(P2PTransportChannelTest, PeerReflexiveCandidateBeforeSignaling) {
   ASSERT_TRUE_WAIT(
       (selected_connection = ep1_ch1()->selected_connection()) != nullptr,
       kMediumTimeout);
-  EXPECT_EQ(PRFLX_PORT_TYPE, selected_connection->remote_candidate().type());
+  EXPECT_TRUE(selected_connection->remote_candidate().is_prflx());
   EXPECT_EQ(kIceUfrag[1], selected_connection->remote_candidate().username());
   EXPECT_EQ(kIcePwd[1], selected_connection->remote_candidate().password());
   EXPECT_EQ(1u, selected_connection->remote_candidate().generation());
 
   ResumeCandidates(1);
   // Verify ep1's selected connection is updated to use the 'local' candidate.
-  EXPECT_EQ_WAIT(LOCAL_PORT_TYPE,
-                 ep1_ch1()->selected_connection()->remote_candidate().type(),
-                 kMediumTimeout);
+  EXPECT_TRUE_WAIT(
+      ep1_ch1()->selected_connection()->remote_candidate().is_local(),
+      kMediumTimeout);
   EXPECT_EQ(selected_connection, ep1_ch1()->selected_connection());
   DestroyChannels();
 }
@@ -1608,15 +1568,15 @@ TEST_F(P2PTransportChannelTest, PeerReflexiveRemoteCandidateIsSanitized) {
   // Check the selected candidate pair.
   auto pair_ep1 = ep1_ch1()->GetSelectedCandidatePair();
   ASSERT_TRUE(pair_ep1.has_value());
-  EXPECT_EQ(PRFLX_PORT_TYPE, pair_ep1->remote_candidate().type());
+  EXPECT_TRUE(pair_ep1->remote_candidate().is_prflx());
   EXPECT_TRUE(pair_ep1->remote_candidate().address().ipaddr().IsNil());
 
   IceTransportStats ice_transport_stats;
   ep1_ch1()->GetStats(&ice_transport_stats);
   // Check the candidate pair stats.
   ASSERT_EQ(1u, ice_transport_stats.connection_infos.size());
-  EXPECT_EQ(PRFLX_PORT_TYPE,
-            ice_transport_stats.connection_infos[0].remote_candidate.type());
+  EXPECT_TRUE(
+      ice_transport_stats.connection_infos[0].remote_candidate.is_prflx());
   EXPECT_TRUE(ice_transport_stats.connection_infos[0]
                   .remote_candidate.address()
                   .ipaddr()
@@ -1626,8 +1586,7 @@ TEST_F(P2PTransportChannelTest, PeerReflexiveRemoteCandidateIsSanitized) {
   ResumeCandidates(1);
   ASSERT_TRUE_WAIT(
       ep1_ch1()->selected_connection() != nullptr &&
-          ep1_ch1()->selected_connection()->remote_candidate().type() ==
-              LOCAL_PORT_TYPE,
+          ep1_ch1()->selected_connection()->remote_candidate().is_local(),
       kMediumTimeout);
 
   // We should be able to reveal the address after it is learnt via
@@ -1636,14 +1595,14 @@ TEST_F(P2PTransportChannelTest, PeerReflexiveRemoteCandidateIsSanitized) {
   // Check the selected candidate pair.
   auto updated_pair_ep1 = ep1_ch1()->GetSelectedCandidatePair();
   ASSERT_TRUE(updated_pair_ep1.has_value());
-  EXPECT_EQ(LOCAL_PORT_TYPE, updated_pair_ep1->remote_candidate().type());
+  EXPECT_TRUE(updated_pair_ep1->remote_candidate().is_local());
   EXPECT_TRUE(HasRemoteAddress(&updated_pair_ep1.value(), kPublicAddrs[1]));
 
   ep1_ch1()->GetStats(&ice_transport_stats);
   // Check the candidate pair stats.
   ASSERT_EQ(1u, ice_transport_stats.connection_infos.size());
-  EXPECT_EQ(LOCAL_PORT_TYPE,
-            ice_transport_stats.connection_infos[0].remote_candidate.type());
+  EXPECT_TRUE(
+      ice_transport_stats.connection_infos[0].remote_candidate.is_local());
   EXPECT_TRUE(ice_transport_stats.connection_infos[0]
                   .remote_candidate.address()
                   .EqualIPs(kPublicAddrs[1]));
@@ -1679,16 +1638,16 @@ TEST_F(P2PTransportChannelTest, PeerReflexiveCandidateBeforeSignalingWithNAT) {
   ASSERT_TRUE_WAIT(
       (selected_connection = ep1_ch1()->selected_connection()) != nullptr,
       kMediumTimeout);
-  EXPECT_EQ(PRFLX_PORT_TYPE, selected_connection->remote_candidate().type());
+  EXPECT_TRUE(selected_connection->remote_candidate().is_prflx());
   EXPECT_EQ(kIceUfrag[1], selected_connection->remote_candidate().username());
   EXPECT_EQ(kIcePwd[1], selected_connection->remote_candidate().password());
   EXPECT_EQ(1u, selected_connection->remote_candidate().generation());
 
   ResumeCandidates(1);
 
-  EXPECT_EQ_WAIT(PRFLX_PORT_TYPE,
-                 ep1_ch1()->selected_connection()->remote_candidate().type(),
-                 kMediumTimeout);
+  EXPECT_TRUE_WAIT(
+      ep1_ch1()->selected_connection()->remote_candidate().is_prflx(),
+      kMediumTimeout);
   EXPECT_EQ(selected_connection, ep1_ch1()->selected_connection());
   DestroyChannels();
 }
@@ -1728,9 +1687,9 @@ TEST_F(P2PTransportChannelTest,
 
   // The caller should have the selected connection connected to the peer
   // reflexive candidate.
-  EXPECT_EQ_WAIT(PRFLX_PORT_TYPE,
-                 ep1_ch1()->selected_connection()->remote_candidate().type(),
-                 kDefaultTimeout);
+  EXPECT_TRUE_WAIT(
+      ep1_ch1()->selected_connection()->remote_candidate().is_prflx(),
+      kDefaultTimeout);
   const Connection* prflx_selected_connection =
       ep1_ch1()->selected_connection();
 
@@ -1744,9 +1703,9 @@ TEST_F(P2PTransportChannelTest,
   // their information to update the peer reflexive candidate.
   ResumeCandidates(1);
 
-  EXPECT_EQ_WAIT(RELAY_PORT_TYPE,
-                 ep1_ch1()->selected_connection()->remote_candidate().type(),
-                 kDefaultTimeout);
+  EXPECT_TRUE_WAIT(
+      ep1_ch1()->selected_connection()->remote_candidate().is_relay(),
+      kDefaultTimeout);
   EXPECT_EQ(prflx_selected_connection, ep1_ch1()->selected_connection());
   DestroyChannels();
 }
@@ -2021,10 +1980,10 @@ TEST_F(P2PTransportChannelTest, TestForceTurn) {
   EXPECT_TRUE(ep1_ch1()->selected_connection() &&
               ep2_ch1()->selected_connection());
 
-  EXPECT_EQ(RELAY_PORT_TYPE, RemoteCandidate(ep1_ch1())->type());
-  EXPECT_EQ(RELAY_PORT_TYPE, LocalCandidate(ep1_ch1())->type());
-  EXPECT_EQ(RELAY_PORT_TYPE, RemoteCandidate(ep2_ch1())->type());
-  EXPECT_EQ(RELAY_PORT_TYPE, LocalCandidate(ep2_ch1())->type());
+  EXPECT_TRUE(RemoteCandidate(ep1_ch1())->is_relay());
+  EXPECT_TRUE(LocalCandidate(ep1_ch1())->is_relay());
+  EXPECT_TRUE(RemoteCandidate(ep2_ch1())->is_relay());
+  EXPECT_TRUE(LocalCandidate(ep2_ch1())->is_relay());
 
   TestSendRecv(&clock);
   DestroyChannels();
@@ -2172,8 +2131,8 @@ TEST_F(P2PTransportChannelTest, TurnToTurnPresumedWritable) {
   // Expect that the TURN-TURN candidate pair will be prioritized since it's
   // "probably writable".
   EXPECT_TRUE_WAIT(ep1_ch1()->selected_connection() != nullptr, kShortTimeout);
-  EXPECT_EQ(RELAY_PORT_TYPE, LocalCandidate(ep1_ch1())->type());
-  EXPECT_EQ(RELAY_PORT_TYPE, RemoteCandidate(ep1_ch1())->type());
+  EXPECT_TRUE(LocalCandidate(ep1_ch1())->is_relay());
+  EXPECT_TRUE(RemoteCandidate(ep1_ch1())->is_relay());
   // Also expect that the channel instantly indicates that it's writable since
   // it has a TURN-TURN pair.
   EXPECT_TRUE(ep1_ch1()->writable());
@@ -2220,8 +2179,8 @@ TEST_F(P2PTransportChannelTest, TurnToPrflxPresumedWritable) {
   EXPECT_TRUE_SIMULATED_WAIT(ep1_ch1()->receiving() && ep1_ch1()->writable(),
                              kShortTimeout, fake_clock);
   ASSERT_NE(nullptr, ep1_ch1()->selected_connection());
-  EXPECT_EQ(RELAY_PORT_TYPE, LocalCandidate(ep1_ch1())->type());
-  EXPECT_EQ(PRFLX_PORT_TYPE, RemoteCandidate(ep1_ch1())->type());
+  EXPECT_TRUE(LocalCandidate(ep1_ch1())->is_relay());
+  EXPECT_TRUE(RemoteCandidate(ep1_ch1())->is_prflx());
   // Make sure that at this point the connection is only presumed writable,
   // not fully writable.
   EXPECT_FALSE(ep1_ch1()->selected_connection()->writable());
@@ -2265,8 +2224,8 @@ TEST_F(P2PTransportChannelTest, PresumedWritablePreferredOverUnreliable) {
   // port available to make a TURN<->TURN pair that's presumed writable.
   ep1_ch1()->AddRemoteCandidate(
       CreateUdpCandidate(RELAY_PORT_TYPE, "2.2.2.2", 2, 0));
-  EXPECT_EQ(RELAY_PORT_TYPE, LocalCandidate(ep1_ch1())->type());
-  EXPECT_EQ(RELAY_PORT_TYPE, RemoteCandidate(ep1_ch1())->type());
+  EXPECT_TRUE(LocalCandidate(ep1_ch1())->is_relay());
+  EXPECT_TRUE(RemoteCandidate(ep1_ch1())->is_relay());
   EXPECT_TRUE(ep1_ch1()->writable());
   EXPECT_TRUE(GetEndpoint(0)->ready_to_send_);
   EXPECT_NE(old_selected_connection, ep1_ch1()->selected_connection());
@@ -2293,8 +2252,8 @@ TEST_F(P2PTransportChannelTest, SignalReadyToSendWithPresumedWritable) {
       CreateUdpCandidate(RELAY_PORT_TYPE, "1.1.1.1", 1, 0));
   // Sanity checking the type of the connection.
   EXPECT_TRUE_WAIT(ep1_ch1()->selected_connection() != nullptr, kShortTimeout);
-  EXPECT_EQ(RELAY_PORT_TYPE, LocalCandidate(ep1_ch1())->type());
-  EXPECT_EQ(RELAY_PORT_TYPE, RemoteCandidate(ep1_ch1())->type());
+  EXPECT_TRUE(LocalCandidate(ep1_ch1())->is_relay());
+  EXPECT_TRUE(RemoteCandidate(ep1_ch1())->is_relay());
 
   // Tell the socket server to block packets (returning EWOULDBLOCK).
   virtual_socket_server()->SetSendingBlocked(true);
@@ -2349,8 +2308,8 @@ TEST_F(P2PTransportChannelTest,
 
   ASSERT_NE(nullptr, ep1_ch1()->selected_connection());
 
-  EXPECT_EQ(RELAY_PORT_TYPE, LocalCandidate(ep1_ch1())->type());
-  EXPECT_EQ(PRFLX_PORT_TYPE, RemoteCandidate(ep1_ch1())->type());
+  EXPECT_TRUE(LocalCandidate(ep1_ch1())->is_relay());
+  EXPECT_TRUE(RemoteCandidate(ep1_ch1())->is_prflx());
 
   DestroyChannels();
 }
@@ -3383,7 +3342,6 @@ class P2PTransportChannelPingTest : public ::testing::Test,
  protected:
   void PrepareChannel(P2PTransportChannel* ch) {
     ch->SetIceRole(ICEROLE_CONTROLLING);
-    ch->SetIceTiebreaker(kTiebreakerDefault);
     ch->SetIceParameters(kIceParams[0]);
     ch->SetRemoteIceParameters(kIceParams[1]);
     ch->SignalNetworkRouteChanged.connect(
@@ -3751,7 +3709,6 @@ TEST_F(P2PTransportChannelPingTest, PingingStartedAsSoonAsPossible) {
                        &field_trials_);
   P2PTransportChannel ch("TestChannel", 1, &pa, &field_trials_);
   ch.SetIceRole(ICEROLE_CONTROLLING);
-  ch.SetIceTiebreaker(kTiebreakerDefault);
   ch.SetIceParameters(kIceParams[0]);
   ch.MaybeStartGathering();
   EXPECT_EQ_WAIT(IceGatheringState::kIceGatheringComplete, ch.gathering_state(),
@@ -5041,22 +4998,22 @@ TEST_F(P2PTransportChannelMostLikelyToWorkFirstTest,
   // Relay/Relay should be the first pingable connection.
   Connection* conn = FindNextPingableConnectionAndPingIt(&ch);
   ASSERT_TRUE(conn != nullptr);
-  EXPECT_EQ(conn->local_candidate().type(), RELAY_PORT_TYPE);
-  EXPECT_EQ(conn->remote_candidate().type(), RELAY_PORT_TYPE);
+  EXPECT_TRUE(conn->local_candidate().is_relay());
+  EXPECT_TRUE(conn->remote_candidate().is_relay());
 
   // Unless that we have a trigger check waiting to be pinged.
   Connection* conn2 = WaitForConnectionTo(&ch, "2.2.2.2", 2);
   ASSERT_TRUE(conn2 != nullptr);
-  EXPECT_EQ(conn2->local_candidate().type(), LOCAL_PORT_TYPE);
-  EXPECT_EQ(conn2->remote_candidate().type(), LOCAL_PORT_TYPE);
+  EXPECT_TRUE(conn2->local_candidate().is_local());
+  EXPECT_TRUE(conn2->remote_candidate().is_local());
   conn2->ReceivedPing();
   EXPECT_EQ(conn2, FindNextPingableConnectionAndPingIt(&ch));
 
   // Make conn3 the selected connection.
   Connection* conn3 = WaitForConnectionTo(&ch, "1.1.1.1", 1);
   ASSERT_TRUE(conn3 != nullptr);
-  EXPECT_EQ(conn3->local_candidate().type(), LOCAL_PORT_TYPE);
-  EXPECT_EQ(conn3->remote_candidate().type(), RELAY_PORT_TYPE);
+  EXPECT_TRUE(conn3->local_candidate().is_local());
+  EXPECT_TRUE(conn3->remote_candidate().is_relay());
   conn3->ReceivedPingResponse(LOW_RTT, "id");
   ASSERT_TRUE(conn3->writable());
   conn3->ReceivedPing();
@@ -5266,16 +5223,16 @@ TEST_F(P2PTransportChannelTest,
   ASSERT_TRUE_WAIT(
       (selected_connection = ep2_ch1()->selected_connection()) != nullptr,
       kMediumTimeout);
-  EXPECT_EQ(PRFLX_PORT_TYPE, selected_connection->remote_candidate().type());
+  EXPECT_TRUE(selected_connection->remote_candidate().is_prflx());
   EXPECT_EQ(kIceUfrag[0], selected_connection->remote_candidate().username());
   EXPECT_EQ(kIcePwd[0], selected_connection->remote_candidate().password());
   // Set expectation before ep1 signals a hostname candidate.
   resolver_fixture.SetAddressToReturn(local_address);
   ResumeCandidates(0);
   // Verify ep2's selected connection is updated to use the 'local' candidate.
-  EXPECT_EQ_WAIT(LOCAL_PORT_TYPE,
-                 ep2_ch1()->selected_connection()->remote_candidate().type(),
-                 kMediumTimeout);
+  EXPECT_TRUE_WAIT(
+      ep2_ch1()->selected_connection()->remote_candidate().is_local(),
+      kMediumTimeout);
   EXPECT_EQ(selected_connection, ep2_ch1()->selected_connection());
 
   DestroyChannels();
@@ -5328,16 +5285,15 @@ TEST_F(P2PTransportChannelTest,
   // There is a caveat in our implementation associated with this expectation.
   // See the big comment in P2PTransportChannel::OnUnknownAddress.
   ASSERT_TRUE_WAIT(ep2_ch1()->selected_connection() != nullptr, kMediumTimeout);
-  EXPECT_EQ(PRFLX_PORT_TYPE,
-            ep2_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep2_ch1()->selected_connection()->remote_candidate().is_prflx());
   // ep2 should also be able resolve the hostname candidate. The resolved remote
   // host candidate should be merged with the prflx remote candidate.
 
   resolver_fixture.FireDelayedResolution();
 
-  EXPECT_EQ_WAIT(LOCAL_PORT_TYPE,
-                 ep2_ch1()->selected_connection()->remote_candidate().type(),
-                 kMediumTimeout);
+  EXPECT_TRUE_WAIT(
+      ep2_ch1()->selected_connection()->remote_candidate().is_local(),
+      kMediumTimeout);
   EXPECT_EQ(1u, ep2_ch1()->remote_candidates().size());
 
   DestroyChannels();
@@ -5380,10 +5336,8 @@ TEST_F(P2PTransportChannelTest, CanConnectWithHostCandidateWithMdnsName) {
   // with a peer reflexive candidate from ep2.
   ASSERT_TRUE_WAIT((ep1_ch1()->selected_connection()) != nullptr,
                    kMediumTimeout);
-  EXPECT_EQ(LOCAL_PORT_TYPE,
-            ep1_ch1()->selected_connection()->local_candidate().type());
-  EXPECT_EQ(PRFLX_PORT_TYPE,
-            ep1_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->local_candidate().is_local());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->remote_candidate().is_prflx());
 
   DestroyChannels();
 }
@@ -5713,10 +5667,8 @@ TEST_F(P2PTransportChannelTest,
   // We should be able to form a srflx-host connection to ep2.
   ASSERT_TRUE_WAIT((ep1_ch1()->selected_connection()) != nullptr,
                    kMediumTimeout);
-  EXPECT_EQ(STUN_PORT_TYPE,
-            ep1_ch1()->selected_connection()->local_candidate().type());
-  EXPECT_EQ(LOCAL_PORT_TYPE,
-            ep1_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->local_candidate().is_stun());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->remote_candidate().is_local());
 
   DestroyChannels();
 }
@@ -5747,31 +5699,25 @@ TEST_F(P2PTransportChannelTest,
                              kDefaultTimeout, clock);
   ASSERT_TRUE_SIMULATED_WAIT(ep2_ch1()->selected_connection() != nullptr,
                              kDefaultTimeout, clock);
-  EXPECT_EQ(RELAY_PORT_TYPE,
-            ep1_ch1()->selected_connection()->local_candidate().type());
-  EXPECT_EQ(RELAY_PORT_TYPE,
-            ep2_ch1()->selected_connection()->local_candidate().type());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->local_candidate().is_relay());
+  EXPECT_TRUE(ep2_ch1()->selected_connection()->local_candidate().is_relay());
 
   // Loosen the candidate filter at ep1.
   ep1->allocator_->SetCandidateFilter(CF_ALL);
   EXPECT_TRUE_SIMULATED_WAIT(
       ep1_ch1()->selected_connection() != nullptr &&
-          ep1_ch1()->selected_connection()->local_candidate().type() ==
-              LOCAL_PORT_TYPE,
+          ep1_ch1()->selected_connection()->local_candidate().is_local(),
       kDefaultTimeout, clock);
-  EXPECT_EQ(RELAY_PORT_TYPE,
-            ep1_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->remote_candidate().is_relay());
 
   // Loosen the candidate filter at ep2.
   ep2->allocator_->SetCandidateFilter(CF_ALL);
   EXPECT_TRUE_SIMULATED_WAIT(
       ep2_ch1()->selected_connection() != nullptr &&
-          ep2_ch1()->selected_connection()->local_candidate().type() ==
-              LOCAL_PORT_TYPE,
+          ep2_ch1()->selected_connection()->local_candidate().is_local(),
       kDefaultTimeout, clock);
   // We have migrated to a host-host candidate pair.
-  EXPECT_EQ(LOCAL_PORT_TYPE,
-            ep2_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep2_ch1()->selected_connection()->remote_candidate().is_local());
 
   // Block the traffic over non-relay-to-relay routes and expect a route change.
   fw()->AddRule(false, rtc::FP_ANY, kPublicAddrs[0], kPublicAddrs[1]);
@@ -5780,12 +5726,10 @@ TEST_F(P2PTransportChannelTest,
   fw()->AddRule(false, rtc::FP_ANY, kPublicAddrs[1], kTurnUdpExtAddr);
 
   // We should be able to reuse the previously gathered relay candidates.
-  EXPECT_EQ_SIMULATED_WAIT(
-      RELAY_PORT_TYPE,
-      ep1_ch1()->selected_connection()->local_candidate().type(),
+  EXPECT_TRUE_SIMULATED_WAIT(
+      ep1_ch1()->selected_connection()->local_candidate().is_relay(),
       kDefaultTimeout, clock);
-  EXPECT_EQ(RELAY_PORT_TYPE,
-            ep1_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->remote_candidate().is_relay());
   DestroyChannels();
 }
 
@@ -5824,22 +5768,18 @@ TEST_F(P2PTransportChannelTest,
   ep1->allocator_->SetCandidateFilter(kCandidateFilterNoHost);
   EXPECT_TRUE_SIMULATED_WAIT(
       ep1_ch1()->selected_connection() != nullptr &&
-          ep1_ch1()->selected_connection()->local_candidate().type() ==
-              STUN_PORT_TYPE,
+          ep1_ch1()->selected_connection()->local_candidate().is_stun(),
       kDefaultTimeout, clock);
-  EXPECT_EQ(RELAY_PORT_TYPE,
-            ep1_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->remote_candidate().is_relay());
 
   // Loosen the candidate filter at ep2.
   ep2->allocator_->SetCandidateFilter(kCandidateFilterNoHost);
   EXPECT_TRUE_SIMULATED_WAIT(
       ep2_ch1()->selected_connection() != nullptr &&
-          ep2_ch1()->selected_connection()->local_candidate().type() ==
-              STUN_PORT_TYPE,
+          ep2_ch1()->selected_connection()->local_candidate().is_stun(),
       kDefaultTimeout, clock);
   // We have migrated to a srflx-srflx candidate pair.
-  EXPECT_EQ(STUN_PORT_TYPE,
-            ep2_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep2_ch1()->selected_connection()->remote_candidate().is_stun());
 
   // Block the traffic over non-relay-to-relay routes and expect a route change.
   fw()->AddRule(false, rtc::FP_ANY, kPrivateAddrs[0], kPublicAddrs[1]);
@@ -5847,12 +5787,10 @@ TEST_F(P2PTransportChannelTest,
   fw()->AddRule(false, rtc::FP_ANY, kPrivateAddrs[0], kTurnUdpExtAddr);
   fw()->AddRule(false, rtc::FP_ANY, kPrivateAddrs[1], kTurnUdpExtAddr);
   // We should be able to reuse the previously gathered relay candidates.
-  EXPECT_EQ_SIMULATED_WAIT(
-      RELAY_PORT_TYPE,
-      ep1_ch1()->selected_connection()->local_candidate().type(),
+  EXPECT_TRUE_SIMULATED_WAIT(
+      ep1_ch1()->selected_connection()->local_candidate().is_relay(),
       kDefaultTimeout, clock);
-  EXPECT_EQ(RELAY_PORT_TYPE,
-            ep1_ch1()->selected_connection()->remote_candidate().type());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->remote_candidate().is_relay());
   DestroyChannels();
 }
 
@@ -5885,13 +5823,11 @@ TEST_F(P2PTransportChannelTest,
   ep1->allocator_->SetCandidateFilter(CF_ALL);
   // Wait for a period for any potential surfacing of new candidates.
   SIMULATED_WAIT(false, kDefaultTimeout, clock);
-  EXPECT_EQ(RELAY_PORT_TYPE,
-            ep1_ch1()->selected_connection()->local_candidate().type());
+  EXPECT_TRUE(ep1_ch1()->selected_connection()->local_candidate().is_relay());
 
   // Loosen the candidate filter at ep2.
   ep2->allocator_->SetCandidateFilter(CF_ALL);
-  EXPECT_EQ(RELAY_PORT_TYPE,
-            ep2_ch1()->selected_connection()->local_candidate().type());
+  EXPECT_TRUE(ep2_ch1()->selected_connection()->local_candidate().is_relay());
   DestroyChannels();
 }
 
@@ -5928,21 +5864,18 @@ TEST_F(P2PTransportChannelTest,
   ResumeCandidates(1);
   ASSERT_TRUE_SIMULATED_WAIT(
       ep1_ch1()->selected_connection() != nullptr &&
-          LOCAL_PORT_TYPE ==
-              ep1_ch1()->selected_connection()->local_candidate().type() &&
+          ep1_ch1()->selected_connection()->local_candidate().is_local() &&
           ep2_ch1()->selected_connection() != nullptr &&
-          LOCAL_PORT_TYPE ==
-              ep1_ch1()->selected_connection()->remote_candidate().type(),
+          ep1_ch1()->selected_connection()->remote_candidate().is_local(),
       kDefaultTimeout, clock);
   ASSERT_TRUE_SIMULATED_WAIT(ep2_ch1()->selected_connection() != nullptr,
                              kDefaultTimeout, clock);
   // Test that we have a host-host candidate pair selected and the number of
   // candidates signaled to the remote peer stays the same.
   auto test_invariants = [this]() {
-    EXPECT_EQ(LOCAL_PORT_TYPE,
-              ep1_ch1()->selected_connection()->local_candidate().type());
-    EXPECT_EQ(LOCAL_PORT_TYPE,
-              ep1_ch1()->selected_connection()->remote_candidate().type());
+    EXPECT_TRUE(ep1_ch1()->selected_connection()->local_candidate().is_local());
+    EXPECT_TRUE(
+        ep1_ch1()->selected_connection()->remote_candidate().is_local());
     EXPECT_THAT(ep2_ch1()->remote_candidates(), SizeIs(3));
   };
 
@@ -6005,11 +5938,9 @@ TEST_F(P2PTransportChannelTest, SurfaceRequiresCoordination) {
   ResumeCandidates(1);
   ASSERT_TRUE_SIMULATED_WAIT(
       ep1_ch1()->selected_connection() != nullptr &&
-          RELAY_PORT_TYPE ==
-              ep1_ch1()->selected_connection()->local_candidate().type() &&
+          ep1_ch1()->selected_connection()->local_candidate().is_relay() &&
           ep2_ch1()->selected_connection() != nullptr &&
-          RELAY_PORT_TYPE ==
-              ep1_ch1()->selected_connection()->remote_candidate().type(),
+          ep1_ch1()->selected_connection()->remote_candidate().is_relay(),
       kDefaultTimeout, clock);
   ASSERT_TRUE_SIMULATED_WAIT(ep2_ch1()->selected_connection() != nullptr,
                              kDefaultTimeout, clock);
@@ -6025,11 +5956,9 @@ TEST_F(P2PTransportChannelTest, SurfaceRequiresCoordination) {
 
   // No p2p connection will be made, it will remain on relay.
   EXPECT_TRUE(ep1_ch1()->selected_connection() != nullptr &&
-              RELAY_PORT_TYPE ==
-                  ep1_ch1()->selected_connection()->local_candidate().type() &&
+              ep1_ch1()->selected_connection()->local_candidate().is_relay() &&
               ep2_ch1()->selected_connection() != nullptr &&
-              RELAY_PORT_TYPE ==
-                  ep1_ch1()->selected_connection()->remote_candidate().type());
+              ep1_ch1()->selected_connection()->remote_candidate().is_relay());
 
   DestroyChannels();
 }
diff --git a/third_party/libwebrtc/p2p/base/port.cc b/third_party/libwebrtc/p2p/base/port.cc
index a3378fe23a..f49bfe524c 100644
--- a/third_party/libwebrtc/p2p/base/port.cc
+++ b/third_party/libwebrtc/p2p/base/port.cc
@@ -10,33 +10,34 @@
 
 #include "p2p/base/port.h"
 
-#include <math.h>
-
-#include <algorithm>
 #include <cstddef>
+#include <cstdint>
 #include <memory>
 #include <utility>
 #include <vector>
 
-#include "absl/algorithm/container.h"
 #include "absl/memory/memory.h"
 #include "absl/strings/match.h"
 #include "absl/strings/string_view.h"
-#include "p2p/base/connection.h"
-#include "p2p/base/port_allocator.h"
+#include "api/array_view.h"
+#include "api/rtc_error.h"
+#include "api/units/time_delta.h"
+#include "p2p/base/p2p_constants.h"
+#include "p2p/base/stun_request.h"
+#include "rtc_base/byte_buffer.h"
 #include "rtc_base/checks.h"
 #include "rtc_base/crc32.h"
 #include "rtc_base/helpers.h"
+#include "rtc_base/ip_address.h"
 #include "rtc_base/logging.h"
 #include "rtc_base/mdns_responder_interface.h"
-#include "rtc_base/message_digest.h"
+#include "rtc_base/net_helper.h"
 #include "rtc_base/network.h"
-#include "rtc_base/numerics/safe_minmax.h"
 #include "rtc_base/socket_address.h"
 #include "rtc_base/string_encode.h"
 #include "rtc_base/string_utils.h"
 #include "rtc_base/strings/string_builder.h"
-#include "rtc_base/third_party/base64/base64.h"
+#include "rtc_base/time_utils.h"
 #include "rtc_base/trace_event.h"
 
 namespace cricket {
@@ -258,14 +259,18 @@ void Port::AddAddress(const rtc::SocketAddress& address,
                       absl::string_view url,
                       bool is_final) {
   RTC_DCHECK_RUN_ON(thread_);
-  if (protocol == TCP_PROTOCOL_NAME && type == LOCAL_PORT_TYPE) {
-    RTC_DCHECK(!tcptype.empty());
-  }
 
   std::string foundation =
       ComputeFoundation(type, protocol, relay_protocol, base_address);
   Candidate c(component_, protocol, address, 0U, username_fragment(), password_,
               type, generation_, foundation, network_->id(), network_cost_);
+
+#if RTC_DCHECK_IS_ON
+  if (protocol == TCP_PROTOCOL_NAME && c.is_local()) {
+    RTC_DCHECK(!tcptype.empty());
+  }
+#endif
+
   c.set_relay_protocol(relay_protocol);
   c.set_priority(
       c.GetPriority(type_preference, network_->preference(), relay_preference,
@@ -278,26 +283,24 @@ void Port::AddAddress(const rtc::SocketAddress& address,
   c.set_url(url);
   c.set_related_address(related_address);
 
-  bool pending = MaybeObfuscateAddress(&c, type, is_final);
+  bool pending = MaybeObfuscateAddress(c, is_final);
 
   if (!pending) {
     FinishAddingAddress(c, is_final);
   }
 }
 
-bool Port::MaybeObfuscateAddress(Candidate* c,
-                                 absl::string_view type,
-                                 bool is_final) {
+bool Port::MaybeObfuscateAddress(const Candidate& c, bool is_final) {
   // TODO(bugs.webrtc.org/9723): Use a config to control the feature of IP
   // handling with mDNS.
   if (network_->GetMdnsResponder() == nullptr) {
     return false;
   }
-  if (type != LOCAL_PORT_TYPE) {
+  if (!c.is_local()) {
     return false;
   }
 
-  auto copy = *c;
+  auto copy = c;
   auto weak_ptr = weak_factory_.GetWeakPtr();
   auto callback = [weak_ptr, copy, is_final](const rtc::IPAddress& addr,
                                              absl::string_view name) mutable {
diff --git a/third_party/libwebrtc/p2p/base/port.h b/third_party/libwebrtc/p2p/base/port.h
index 7b44e534de..a3214af1b8 100644
--- a/third_party/libwebrtc/p2p/base/port.h
+++ b/third_party/libwebrtc/p2p/base/port.h
@@ -11,10 +11,15 @@
 #ifndef P2P_BASE_PORT_H_
 #define P2P_BASE_PORT_H_
 
+#include <stddef.h>
+#include <stdint.h>
+
+#include <functional>
 #include <map>
 #include <memory>
 #include <set>
 #include <string>
+#include <type_traits>
 #include <utility>
 #include <vector>
 
@@ -25,6 +30,7 @@
 #include "api/field_trials_view.h"
 #include "api/packet_socket_factory.h"
 #include "api/rtc_error.h"
+#include "api/sequence_checker.h"
 #include "api/task_queue/task_queue_base.h"
 #include "api/transport/field_trial_based_config.h"
 #include "api/transport/stun.h"
@@ -37,18 +43,22 @@
 #include "p2p/base/p2p_constants.h"
 #include "p2p/base/port_interface.h"
 #include "p2p/base/stun_request.h"
+#include "p2p/base/transport_description.h"
 #include "rtc_base/async_packet_socket.h"
 #include "rtc_base/callback_list.h"
 #include "rtc_base/checks.h"
+#include "rtc_base/dscp.h"
 #include "rtc_base/memory/always_valid_pointer.h"
 #include "rtc_base/net_helper.h"
 #include "rtc_base/network.h"
 #include "rtc_base/network/received_packet.h"
+#include "rtc_base/network/sent_packet.h"
 #include "rtc_base/proxy_info.h"
 #include "rtc_base/rate_tracker.h"
 #include "rtc_base/socket_address.h"
 #include "rtc_base/system/rtc_export.h"
 #include "rtc_base/third_party/sigslot/sigslot.h"
+#include "rtc_base/thread_annotations.h"
 #include "rtc_base/weak_ptr.h"
 
 namespace cricket {
@@ -59,19 +69,6 @@ extern const char TCPTYPE_ACTIVE_STR[];
 extern const char TCPTYPE_PASSIVE_STR[];
 extern const char TCPTYPE_SIMOPEN_STR[];
 
-// The type preference MUST be an integer from 0 to 126 inclusive.
-// https://datatracker.ietf.org/doc/html/rfc5245#section-4.1.2.1
-enum IcePriorityValue : uint8_t {
-  ICE_TYPE_PREFERENCE_RELAY_TLS = 0,
-  ICE_TYPE_PREFERENCE_RELAY_TCP = 1,
-  ICE_TYPE_PREFERENCE_RELAY_UDP = 2,
-  ICE_TYPE_PREFERENCE_PRFLX_TCP = 80,
-  ICE_TYPE_PREFERENCE_HOST_TCP = 90,
-  ICE_TYPE_PREFERENCE_SRFLX = 100,
-  ICE_TYPE_PREFERENCE_PRFLX = 110,
-  ICE_TYPE_PREFERENCE_HOST = 126
-};
-
 enum class MdnsNameRegistrationStatus {
   // IP concealment with mDNS is not enabled or the name registration process is
   // not started yet.
@@ -202,8 +199,8 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
   // Note that the port type does NOT uniquely identify different subclasses of
   // Port. Use the 2-tuple of the port type AND the protocol (GetProtocol()) to
   // uniquely identify subclasses. Whenever a new subclass of Port introduces a
-  // conflit in the value of the 2-tuple, make sure that the implementation that
-  // relies on this 2-tuple for RTTI is properly changed.
+  // conflict in the value of the 2-tuple, make sure that the implementation
+  // that relies on this 2-tuple for RTTI is properly changed.
   const absl::string_view Type() const override;
   const rtc::Network* Network() const override;
 
@@ -227,13 +224,13 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
   void CancelPendingTasks();
 
   // The thread on which this port performs its I/O.
-  webrtc::TaskQueueBase* thread() { return thread_; }
+  webrtc::TaskQueueBase* thread() override { return thread_; }
 
   // The factory used to create the sockets of this port.
-  rtc::PacketSocketFactory* socket_factory() const { return factory_; }
+  rtc::PacketSocketFactory* socket_factory() const override { return factory_; }
 
   // For debugging purposes.
-  const std::string& content_name() const { return content_name_; }
+  const std::string& content_name() const override { return content_name_; }
   void set_content_name(absl::string_view content_name) {
     content_name_ = std::string(content_name);
   }
@@ -241,7 +238,7 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
   int component() const { return component_; }
   void set_component(int component) { component_ = component; }
 
-  bool send_retransmit_count_attribute() const {
+  bool send_retransmit_count_attribute() const override {
     return send_retransmit_count_attribute_;
   }
   void set_send_retransmit_count_attribute(bool enable) {
@@ -249,8 +246,10 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
   }
 
   // Identifies the generation that this port was created in.
-  uint32_t generation() const { return generation_; }
-  void set_generation(uint32_t generation) { generation_ = generation; }
+  uint32_t generation() const override { return generation_; }
+  void set_generation(uint32_t generation) override {
+    generation_ = generation;
+  }
 
   const std::string& username_fragment() const;
   const std::string& password() const { return password_; }
@@ -296,11 +295,11 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
   // defers the `delete` operation to when the call stack has been unwound.
   // Async may be needed when deleting a connection object from within a
   // callback.
-  void DestroyConnection(Connection* conn) {
+  void DestroyConnection(Connection* conn) override {
     DestroyConnectionInternal(conn, false);
   }
 
-  void DestroyConnectionAsync(Connection* conn) {
+  void DestroyConnectionAsync(Connection* conn) override {
     DestroyConnectionInternal(conn, true);
   }
 
@@ -330,8 +329,8 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
     user_agent_ = std::string(user_agent);
     proxy_ = proxy;
   }
-  const std::string& user_agent() { return user_agent_; }
-  const rtc::ProxyInfo& proxy() { return proxy_; }
+  const std::string& user_agent() override { return user_agent_; }
+  const rtc::ProxyInfo& proxy() override { return proxy_; }
 
   void EnablePortPackets() override;
 
@@ -350,12 +349,13 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
   // stun username attribute if present.
   bool ParseStunUsername(const StunMessage* stun_msg,
                          std::string* local_username,
-                         std::string* remote_username) const;
-  std::string CreateStunUsername(absl::string_view remote_username) const;
+                         std::string* remote_username) const override;
+  std::string CreateStunUsername(
+      absl::string_view remote_username) const override;
 
   bool MaybeIceRoleConflict(const rtc::SocketAddress& addr,
                             IceMessage* stun_msg,
-                            absl::string_view remote_ufrag);
+                            absl::string_view remote_ufrag) override;
 
   // Called when a packet has been sent to the socket.
   // This is made pure virtual to notify subclasses of Port that they MUST
@@ -368,9 +368,9 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
   void OnReadyToSend();
 
   // Called when the Connection discovers a local peer reflexive candidate.
-  void AddPrflxCandidate(const Candidate& local);
+  void AddPrflxCandidate(const Candidate& local) override;
 
-  int16_t network_cost() const { return network_cost_; }
+  int16_t network_cost() const override { return network_cost_; }
 
   void GetStunStats(absl::optional<StunStats>* stats) override {}
 
@@ -380,13 +380,14 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
   //   then the foundation will be different.  Two candidate pairs with
   //   the same foundation pairs are likely to have similar network
   //   characteristics. Foundations are used in the frozen algorithm.
-  std::string ComputeFoundation(absl::string_view type,
-                                absl::string_view protocol,
-                                absl::string_view relay_protocol,
-                                const rtc::SocketAddress& base_address);
+  std::string ComputeFoundation(
+      absl::string_view type,
+      absl::string_view protocol,
+      absl::string_view relay_protocol,
+      const rtc::SocketAddress& base_address) override;
 
  protected:
-  virtual void UpdateNetworkCost();
+  void UpdateNetworkCost() override;
 
   rtc::WeakPtr<Port> NewWeakPtr() { return weak_factory_.GetWeakPtr(); }
 
@@ -438,13 +439,13 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
                       size_t size,
                       const rtc::SocketAddress& addr,
                       std::unique_ptr<IceMessage>* out_msg,
-                      std::string* out_username);
+                      std::string* out_username) override;
 
   // Checks if the address in addr is compatible with the port's ip.
   bool IsCompatibleAddress(const rtc::SocketAddress& addr);
 
   // Returns DSCP value packets generated by the port itself should use.
-  virtual rtc::DiffServCodePoint StunDscpValue() const;
+  rtc::DiffServCodePoint StunDscpValue() const override;
 
   // Extra work to be done in subclasses when a connection is destroyed.
   virtual void HandleConnectionDestroyed(Connection* conn) {}
@@ -524,11 +525,9 @@ class RTC_EXPORT Port : public PortInterface, public sigslot::has_slots<> {
                              webrtc::FieldTrialBasedConfig>
       field_trials_;
 
-  bool MaybeObfuscateAddress(Candidate* c,
-                             absl::string_view type,
-                             bool is_final) RTC_RUN_ON(thread_);
+  bool MaybeObfuscateAddress(const Candidate& c, bool is_final)
+      RTC_RUN_ON(thread_);
 
-  friend class Connection;
   webrtc::CallbackList<PortInterface*> port_destroyed_callback_list_;
 };
 
diff --git a/third_party/libwebrtc/p2p/base/port_allocator.cc b/third_party/libwebrtc/p2p/base/port_allocator.cc
index 16f5afe36c..52fc8c1d39 100644
--- a/third_party/libwebrtc/p2p/base/port_allocator.cc
+++ b/third_party/libwebrtc/p2p/base/port_allocator.cc
@@ -11,13 +11,13 @@
 #include "p2p/base/port_allocator.h"
 
 #include <iterator>
+#include <optional>
 #include <set>
 #include <utility>
 
 #include "absl/strings/string_view.h"
 #include "p2p/base/ice_credentials_iterator.h"
 #include "rtc_base/checks.h"
-#include "rtc_base/logging.h"
 
 namespace cricket {
 
@@ -68,8 +68,7 @@ PortAllocatorSession::PortAllocatorSession(absl::string_view content_name,
       content_name_(content_name),
       component_(component),
       ice_ufrag_(ice_ufrag),
-      ice_pwd_(ice_pwd),
-      tiebreaker_(0) {
+      ice_pwd_(ice_pwd) {
   // Pooled sessions are allowed to be created with empty content name,
   // component, ufrag and password.
   RTC_DCHECK(ice_ufrag.empty() == ice_pwd.empty());
@@ -101,7 +100,7 @@ PortAllocator::PortAllocator()
       step_delay_(kDefaultStepDelay),
       allow_tcp_listen_(true),
       candidate_filter_(CF_ALL),
-      tiebreaker_(0) {
+      tiebreaker_(rtc::CreateRandomId64()) {
   // The allocator will be attached to a thread in Initialize.
   thread_checker_.Detach();
 }
@@ -189,7 +188,6 @@ bool PortAllocator::SetConfiguration(
     PortAllocatorSession* pooled_session =
         CreateSessionInternal("", 0, iceCredentials.ufrag, iceCredentials.pwd);
     pooled_session->set_pooled(true);
-    pooled_session->set_ice_tiebreaker(tiebreaker_);
     pooled_session->StartGettingPorts();
     pooled_sessions_.push_back(
         std::unique_ptr<PortAllocatorSession>(pooled_session));
@@ -197,13 +195,6 @@ bool PortAllocator::SetConfiguration(
   return true;
 }
 
-void PortAllocator::SetIceTiebreaker(uint64_t tiebreaker) {
-  tiebreaker_ = tiebreaker;
-  for (auto& pooled_session : pooled_sessions_) {
-    pooled_session->set_ice_tiebreaker(tiebreaker_);
-  }
-}
-
 std::unique_ptr<PortAllocatorSession> PortAllocator::CreateSession(
     absl::string_view content_name,
     int component,
@@ -213,7 +204,6 @@ std::unique_ptr<PortAllocatorSession> PortAllocator::CreateSession(
   auto session = std::unique_ptr<PortAllocatorSession>(
       CreateSessionInternal(content_name, component, ice_ufrag, ice_pwd));
   session->SetCandidateFilter(candidate_filter());
-  session->set_ice_tiebreaker(tiebreaker_);
   return session;
 }
 
diff --git a/third_party/libwebrtc/p2p/base/port_allocator.h b/third_party/libwebrtc/p2p/base/port_allocator.h
index 11462f78f2..63ecfc6904 100644
--- a/third_party/libwebrtc/p2p/base/port_allocator.h
+++ b/third_party/libwebrtc/p2p/base/port_allocator.h
@@ -11,18 +11,26 @@
 #ifndef P2P_BASE_PORT_ALLOCATOR_H_
 #define P2P_BASE_PORT_ALLOCATOR_H_
 
+#include <stdint.h>
+
 #include <deque>
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
+#include "api/candidate.h"
 #include "api/sequence_checker.h"
 #include "api/transport/enums.h"
 #include "p2p/base/port.h"
 #include "p2p/base/port_interface.h"
+#include "p2p/base/transport_description.h"
+#include "rtc_base/checks.h"
 #include "rtc_base/helpers.h"
+#include "rtc_base/network.h"
 #include "rtc_base/proxy_info.h"
+#include "rtc_base/socket_address.h"
 #include "rtc_base/ssl_certificate.h"
 #include "rtc_base/system/rtc_export.h"
 #include "rtc_base/third_party/sigslot/sigslot.h"
@@ -204,10 +212,6 @@ class RTC_EXPORT PortAllocatorSession : public sigslot::has_slots<> {
   const std::string& ice_pwd() const { return ice_pwd_; }
   bool pooled() const { return pooled_; }
 
-  // TODO(bugs.webrtc.org/14605): move this to the constructor
-  void set_ice_tiebreaker(uint64_t tiebreaker) { tiebreaker_ = tiebreaker; }
-  uint64_t ice_tiebreaker() const { return tiebreaker_; }
-
   // Setting this filter should affect not only candidates gathered in the
   // future, but candidates already gathered and ports already "ready",
   // which would be returned by ReadyCandidates() and ReadyPorts().
@@ -324,9 +328,6 @@ class RTC_EXPORT PortAllocatorSession : public sigslot::has_slots<> {
 
   bool pooled_ = false;
 
-  // TODO(bugs.webrtc.org/14605): move this to the constructor
-  uint64_t tiebreaker_;
-
   // SetIceParameters is an implementation detail which only PortAllocator
   // should be able to call.
   friend class PortAllocator;
@@ -379,9 +380,6 @@ class RTC_EXPORT PortAllocator : public sigslot::has_slots<> {
                         const absl::optional<int>&
                             stun_candidate_keepalive_interval = absl::nullopt);
 
-  void SetIceTiebreaker(uint64_t tiebreaker);
-  uint64_t IceTiebreaker() const { return tiebreaker_; }
-
   const ServerAddresses& stun_servers() const {
     CheckRunOnValidThreadIfInitialized();
     return stun_servers_;
@@ -453,6 +451,8 @@ class RTC_EXPORT PortAllocator : public sigslot::has_slots<> {
   // 3. mDNS concealment of private IPs is enabled.
   Candidate SanitizeCandidate(const Candidate& c) const;
 
+  uint64_t ice_tiebreaker() const { return tiebreaker_; }
+
   uint32_t flags() const {
     CheckRunOnValidThreadIfInitialized();
     return flags_;
diff --git a/third_party/libwebrtc/p2p/base/port_allocator_unittest.cc b/third_party/libwebrtc/p2p/base/port_allocator_unittest.cc
index 836a2fa494..2df8662f62 100644
--- a/third_party/libwebrtc/p2p/base/port_allocator_unittest.cc
+++ b/third_party/libwebrtc/p2p/base/port_allocator_unittest.cc
@@ -26,7 +26,6 @@ static const char kIceUfrag[] = "UF00";
 static const char kIcePwd[] = "TESTICEPWD00000000000000";
 static const char kTurnUsername[] = "test";
 static const char kTurnPassword[] = "test";
-constexpr uint64_t kTiebreakerDefault = 44444;
 
 class PortAllocatorTest : public ::testing::Test, public sigslot::has_slots<> {
  public:
@@ -38,9 +37,7 @@ class PortAllocatorTest : public ::testing::Test, public sigslot::has_slots<> {
         allocator_(std::make_unique<cricket::FakePortAllocator>(
             rtc::Thread::Current(),
             packet_socket_factory_.get(),
-            &field_trials_)) {
-    allocator_->SetIceTiebreaker(kTiebreakerDefault);
-  }
+            &field_trials_)) {}
 
  protected:
   void SetConfigurationWithPoolSize(int candidate_pool_size) {
diff --git a/third_party/libwebrtc/p2p/base/port_interface.h b/third_party/libwebrtc/p2p/base/port_interface.h
index fe4b204c95..fb8023b5dd 100644
--- a/third_party/libwebrtc/p2p/base/port_interface.h
+++ b/third_party/libwebrtc/p2p/base/port_interface.h
@@ -11,6 +11,7 @@
 #ifndef P2P_BASE_PORT_INTERFACE_H_
 #define P2P_BASE_PORT_INTERFACE_H_
 
+#include <memory>
 #include <string>
 #include <utility>
 #include <vector>
@@ -18,9 +19,11 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 #include "api/candidate.h"
+#include "api/packet_socket_factory.h"
 #include "p2p/base/transport_description.h"
 #include "rtc_base/async_packet_socket.h"
 #include "rtc_base/callback_list.h"
+#include "rtc_base/proxy_info.h"
 #include "rtc_base/socket_address.h"
 
 namespace rtc {
@@ -137,8 +140,80 @@ class PortInterface {
 
   virtual void GetStunStats(absl::optional<StunStats>* stats) = 0;
 
+  // Removes and deletes a connection object. `DestroyConnection` will
+  // delete the connection object directly whereas `DestroyConnectionAsync`
+  // defers the `delete` operation to when the call stack has been unwound.
+  // Async may be needed when deleting a connection object from within a
+  // callback.
+  virtual void DestroyConnection(Connection* conn) = 0;
+
+  virtual void DestroyConnectionAsync(Connection* conn) = 0;
+
+  // The thread on which this port performs its I/O.
+  virtual webrtc::TaskQueueBase* thread() = 0;
+
+  // The factory used to create the sockets of this port.
+  virtual rtc::PacketSocketFactory* socket_factory() const = 0;
+  virtual const std::string& user_agent() = 0;
+  virtual const rtc::ProxyInfo& proxy() = 0;
+
+  // Identifies the generation that this port was created in.
+  virtual uint32_t generation() const = 0;
+  virtual void set_generation(uint32_t generation) = 0;
+  virtual bool send_retransmit_count_attribute() const = 0;
+  // For debugging purposes.
+  virtual const std::string& content_name() const = 0;
+
+  // Called when the Connection discovers a local peer reflexive candidate.
+  virtual void AddPrflxCandidate(const Candidate& local) = 0;
+
+  // Foundation:  An arbitrary string that is the same for two candidates
+  //   that have the same type, base IP address, protocol (UDP, TCP,
+  //   etc.), and STUN or TURN server.  If any of these are different,
+  //   then the foundation will be different.  Two candidate pairs with
+  //   the same foundation pairs are likely to have similar network
+  //   characteristics. Foundations are used in the frozen algorithm.
+  virtual std::string ComputeFoundation(
+      absl::string_view type,
+      absl::string_view protocol,
+      absl::string_view relay_protocol,
+      const rtc::SocketAddress& base_address) = 0;
+
  protected:
   PortInterface();
+  virtual void UpdateNetworkCost() = 0;
+
+  // Returns DSCP value packets generated by the port itself should use.
+  virtual rtc::DiffServCodePoint StunDscpValue() const = 0;
+
+  // If the given data comprises a complete and correct STUN message then the
+  // return value is true, otherwise false. If the message username corresponds
+  // with this port's username fragment, msg will contain the parsed STUN
+  // message.  Otherwise, the function may send a STUN response internally.
+  // remote_username contains the remote fragment of the STUN username.
+  virtual bool GetStunMessage(const char* data,
+                              size_t size,
+                              const rtc::SocketAddress& addr,
+                              std::unique_ptr<IceMessage>* out_msg,
+                              std::string* out_username) = 0;
+
+  // This method will return local and remote username fragements from the
+  // stun username attribute if present.
+  virtual bool ParseStunUsername(const StunMessage* stun_msg,
+                                 std::string* local_username,
+                                 std::string* remote_username) const = 0;
+  virtual std::string CreateStunUsername(
+      absl::string_view remote_username) const = 0;
+
+  virtual bool MaybeIceRoleConflict(const rtc::SocketAddress& addr,
+                                    IceMessage* stun_msg,
+                                    absl::string_view remote_ufrag) = 0;
+
+  virtual int16_t network_cost() const = 0;
+
+  // Connection and Port are entangled; functions exposed to Port only
+  // should not be public.
+  friend class Connection;
 };
 
 }  // namespace cricket
diff --git a/third_party/libwebrtc/p2p/base/port_unittest.cc b/third_party/libwebrtc/p2p/base/port_unittest.cc
index de35d94259..ab3ff86fd1 100644
--- a/third_party/libwebrtc/p2p/base/port_unittest.cc
+++ b/third_party/libwebrtc/p2p/base/port_unittest.cc
@@ -825,9 +825,9 @@ class PortTest : public ::testing::Test, public sigslot::has_slots<> {
       absl::string_view username,
       absl::string_view password,
       const webrtc::FieldTrialsView* field_trials = nullptr) {
-    auto port = std::make_unique<TestPort>(&main_, "test", &socket_factory_,
-                                           MakeNetwork(addr), 0, 0, username,
-                                           password, field_trials);
+    auto port = std::make_unique<TestPort>(
+        &main_, cricket::LOCAL_PORT_TYPE, &socket_factory_, MakeNetwork(addr),
+        0, 0, username, password, field_trials);
     port->SignalRoleConflict.connect(this, &PortTest::OnRoleConflict);
     return port;
   }
@@ -845,8 +845,9 @@ class PortTest : public ::testing::Test, public sigslot::has_slots<> {
   std::unique_ptr<TestPort> CreateTestPort(const rtc::Network* network,
                                            absl::string_view username,
                                            absl::string_view password) {
-    auto port = std::make_unique<TestPort>(&main_, "test", &socket_factory_,
-                                           network, 0, 0, username, password);
+    auto port = std::make_unique<TestPort>(&main_, cricket::LOCAL_PORT_TYPE,
+                                           &socket_factory_, network, 0, 0,
+                                           username, password);
     port->SignalRoleConflict.connect(this, &PortTest::OnRoleConflict);
     return port;
   }
diff --git a/third_party/libwebrtc/p2p/base/regathering_controller_unittest.cc b/third_party/libwebrtc/p2p/base/regathering_controller_unittest.cc
index 91b7270f77..573c0fd23f 100644
--- a/third_party/libwebrtc/p2p/base/regathering_controller_unittest.cc
+++ b/third_party/libwebrtc/p2p/base/regathering_controller_unittest.cc
@@ -40,7 +40,6 @@ const rtc::SocketAddress kTurnUdpIntAddr("99.99.99.3",
 const cricket::RelayCredentials kRelayCredentials("test", "test");
 const char kIceUfrag[] = "UF00";
 const char kIcePwd[] = "TESTICEPWD00000000000000";
-constexpr uint64_t kTiebreakerDefault = 44444;
 
 }  // namespace
 
@@ -59,7 +58,6 @@ class RegatheringControllerTest : public ::testing::Test,
             rtc::Thread::Current(),
             packet_socket_factory_.get(),
             &field_trials_)) {
-    allocator_->SetIceTiebreaker(kTiebreakerDefault);
     BasicRegatheringController::Config regathering_config;
     regathering_config.regather_on_failed_networks_interval = 0;
     regathering_controller_.reset(new BasicRegatheringController(
diff --git a/third_party/libwebrtc/p2p/base/stun_port_unittest.cc b/third_party/libwebrtc/p2p/base/stun_port_unittest.cc
index 9167081afb..7bc151ee03 100644
--- a/third_party/libwebrtc/p2p/base/stun_port_unittest.cc
+++ b/third_party/libwebrtc/p2p/base/stun_port_unittest.cc
@@ -426,7 +426,7 @@ TEST_F(StunPortTest, TestStunCandidateDiscardedWithMdnsObfuscationNotEnabled) {
   EXPECT_TRUE_SIMULATED_WAIT(done(), kTimeoutMs, fake_clock);
   ASSERT_EQ(1U, port()->Candidates().size());
   EXPECT_TRUE(kLocalAddr.EqualIPs(port()->Candidates()[0].address()));
-  EXPECT_EQ(port()->Candidates()[0].type(), cricket::LOCAL_PORT_TYPE);
+  EXPECT_TRUE(port()->Candidates()[0].is_local());
 }
 
 // Test that a stun candidate (srflx candidate) is generated whose address is
diff --git a/third_party/libwebrtc/p2p/base/tcp_port.cc b/third_party/libwebrtc/p2p/base/tcp_port.cc
index ce61416979..948849800c 100644
--- a/third_party/libwebrtc/p2p/base/tcp_port.cc
+++ b/third_party/libwebrtc/p2p/base/tcp_port.cc
@@ -134,8 +134,7 @@ Connection* TCPPort::CreateConnection(const Candidate& address,
     return NULL;
   }
 
-  if ((address.tcptype() == TCPTYPE_ACTIVE_STR &&
-       address.type() != PRFLX_PORT_TYPE) ||
+  if ((address.tcptype() == TCPTYPE_ACTIVE_STR && !address.is_prflx()) ||
       (address.tcptype().empty() && address.address().port() == 0)) {
     // It's active only candidate, we should not try to create connections
     // for these candidates.
diff --git a/third_party/libwebrtc/p2p/base/transport_description.h b/third_party/libwebrtc/p2p/base/transport_description.h
index 7d28ad52e9..53a1804933 100644
--- a/third_party/libwebrtc/p2p/base/transport_description.h
+++ b/third_party/libwebrtc/p2p/base/transport_description.h
@@ -25,17 +25,6 @@
 
 namespace cricket {
 
-// SEC_ENABLED and SEC_REQUIRED should only be used if the session
-// was negotiated over TLS, to protect the inline crypto material
-// exchange.
-// SEC_DISABLED: No crypto in outgoing offer, ignore any supplied crypto.
-// SEC_ENABLED:  Crypto in outgoing offer and answer (if supplied in offer).
-// SEC_REQUIRED: Crypto in outgoing offer and answer. Fail any offer with absent
-//               or unsupported crypto.
-// TODO(deadbeef): Remove this or rename it to something more appropriate, like
-// SdesPolicy.
-enum SecurePolicy { SEC_DISABLED, SEC_ENABLED, SEC_REQUIRED };
-
 // Whether our side of the call is driving the negotiation, or the other side.
 enum IceRole { ICEROLE_CONTROLLING = 0, ICEROLE_CONTROLLED, ICEROLE_UNKNOWN };
 
diff --git a/third_party/libwebrtc/p2p/base/transport_description_factory.cc b/third_party/libwebrtc/p2p/base/transport_description_factory.cc
index 7eb21da166..6e3af94384 100644
--- a/third_party/libwebrtc/p2p/base/transport_description_factory.cc
+++ b/third_party/libwebrtc/p2p/base/transport_description_factory.cc
@@ -23,7 +23,7 @@ namespace cricket {
 
 TransportDescriptionFactory::TransportDescriptionFactory(
     const webrtc::FieldTrialsView& field_trials)
-    : secure_(SEC_DISABLED), field_trials_(field_trials) {}
+    : field_trials_(field_trials) {}
 
 TransportDescriptionFactory::~TransportDescriptionFactory() = default;
 
@@ -47,13 +47,15 @@ std::unique_ptr<TransportDescription> TransportDescriptionFactory::CreateOffer(
     desc->AddOption(ICE_OPTION_RENOMINATION);
   }
 
-  // If we are trying to establish a secure transport, add a fingerprint.
-  if (secure_ == SEC_ENABLED || secure_ == SEC_REQUIRED) {
-    // Fail if we can't create the fingerprint.
-    // If we are the initiator set role to "actpass".
-    if (!SetSecurityInfo(desc.get(), CONNECTIONROLE_ACTPASS)) {
-      return NULL;
-    }
+  // If we are not trying to establish a secure transport, don't add a
+  // fingerprint.
+  if (insecure_ && !certificate_) {
+    return desc;
+  }
+  // Fail if we can't create the fingerprint.
+  // If we are the initiator set role to "actpass".
+  if (!SetSecurityInfo(desc.get(), CONNECTIONROLE_ACTPASS)) {
+    return NULL;
   }
 
   return desc;
@@ -87,43 +89,49 @@ std::unique_ptr<TransportDescription> TransportDescriptionFactory::CreateAnswer(
   if (options.enable_ice_renomination) {
     desc->AddOption(ICE_OPTION_RENOMINATION);
   }
-
-  // Negotiate security params.
-  if (offer && offer->identity_fingerprint.get()) {
-    // The offer supports DTLS, so answer with DTLS, as long as we support it.
-    if (secure_ == SEC_ENABLED || secure_ == SEC_REQUIRED) {
-      ConnectionRole role = CONNECTIONROLE_NONE;
-      // If the offer does not constrain the role, go with preference.
-      if (offer->connection_role == CONNECTIONROLE_ACTPASS) {
-        role = (options.prefer_passive_role) ? CONNECTIONROLE_PASSIVE
-                                             : CONNECTIONROLE_ACTIVE;
-      } else if (offer->connection_role == CONNECTIONROLE_ACTIVE) {
-        role = CONNECTIONROLE_PASSIVE;
-      } else if (offer->connection_role == CONNECTIONROLE_PASSIVE) {
-        role = CONNECTIONROLE_ACTIVE;
-      } else if (offer->connection_role == CONNECTIONROLE_NONE) {
-        // This case may be reached if a=setup is not present in the SDP.
-        RTC_LOG(LS_WARNING) << "Remote offer connection role is NONE, which is "
-                               "a protocol violation";
-        role = (options.prefer_passive_role) ? CONNECTIONROLE_PASSIVE
-                                             : CONNECTIONROLE_ACTIVE;
-      } else {
-        RTC_LOG(LS_ERROR) << "Remote offer connection role is " << role
-                          << " which is a protocol violation";
-        RTC_DCHECK_NOTREACHED();
-      }
-
-      if (!SetSecurityInfo(desc.get(), role)) {
-        return NULL;
-      }
+  // Special affordance for testing: Answer without DTLS params
+  // if we are insecure without a certificate, or if we are
+  // insecure with a non-DTLS offer.
+  if ((!certificate_ || !offer->identity_fingerprint.get()) && insecure()) {
+    return desc;
+  }
+  if (!offer->identity_fingerprint.get()) {
+    if (require_transport_attributes) {
+      // We require DTLS, but the other side didn't offer it. Fail.
+      RTC_LOG(LS_WARNING) << "Failed to create TransportDescription answer "
+                             "because of incompatible security settings";
+      return NULL;
     }
-  } else if (require_transport_attributes && secure_ == SEC_REQUIRED) {
-    // We require DTLS, but the other side didn't offer it. Fail.
-    RTC_LOG(LS_WARNING) << "Failed to create TransportDescription answer "
-                           "because of incompatible security settings";
+    // This may be a bundled section, fingerprint may legitimately be missing.
+    return desc;
+  }
+  // Negotiate security params.
+  // The offer supports DTLS, so answer with DTLS.
+  RTC_CHECK(certificate_);
+  ConnectionRole role = CONNECTIONROLE_NONE;
+  // If the offer does not constrain the role, go with preference.
+  if (offer->connection_role == CONNECTIONROLE_ACTPASS) {
+    role = (options.prefer_passive_role) ? CONNECTIONROLE_PASSIVE
+                                         : CONNECTIONROLE_ACTIVE;
+  } else if (offer->connection_role == CONNECTIONROLE_ACTIVE) {
+    role = CONNECTIONROLE_PASSIVE;
+  } else if (offer->connection_role == CONNECTIONROLE_PASSIVE) {
+    role = CONNECTIONROLE_ACTIVE;
+  } else if (offer->connection_role == CONNECTIONROLE_NONE) {
+    // This case may be reached if a=setup is not present in the SDP.
+    RTC_LOG(LS_WARNING) << "Remote offer connection role is NONE, which is "
+                           "a protocol violation";
+    role = (options.prefer_passive_role) ? CONNECTIONROLE_PASSIVE
+                                         : CONNECTIONROLE_ACTIVE;
+  } else {
+    RTC_LOG(LS_ERROR) << "Remote offer connection role is " << role
+                      << " which is a protocol violation";
+    RTC_DCHECK_NOTREACHED();
+    return NULL;
+  }
+  if (!SetSecurityInfo(desc.get(), role)) {
     return NULL;
   }
-
   return desc;
 }
 
diff --git a/third_party/libwebrtc/p2p/base/transport_description_factory.h b/third_party/libwebrtc/p2p/base/transport_description_factory.h
index 11352f88b4..bd0cb9078e 100644
--- a/third_party/libwebrtc/p2p/base/transport_description_factory.h
+++ b/third_party/libwebrtc/p2p/base/transport_description_factory.h
@@ -43,15 +43,12 @@ class TransportDescriptionFactory {
       const webrtc::FieldTrialsView& field_trials);
   ~TransportDescriptionFactory();
 
-  SecurePolicy secure() const { return secure_; }
   // The certificate to use when setting up DTLS.
   const rtc::scoped_refptr<rtc::RTCCertificate>& certificate() const {
     return certificate_;
   }
 
-  // Specifies the transport security policy to use.
-  void set_secure(SecurePolicy s) { secure_ = s; }
-  // Specifies the certificate to use (only used when secure != SEC_DISABLED).
+  // Specifies the certificate to use
   void set_certificate(rtc::scoped_refptr<rtc::RTCCertificate> certificate) {
     certificate_ = std::move(certificate);
   }
@@ -76,12 +73,18 @@ class TransportDescriptionFactory {
       IceCredentialsIterator* ice_credentials) const;
 
   const webrtc::FieldTrialsView& trials() const { return field_trials_; }
+  // Functions for disabling encryption - test only!
+  // In insecure mode, the connection will accept a description without
+  // fingerprint, and will generate SDP even if certificate is not set.
+  // If certificate is set, it will accept a description both with and
+  // without fingerprint, but will generate a description with fingerprint.
+  bool insecure() const { return insecure_; }
+  void SetInsecureForTesting() { insecure_ = true; }
 
  private:
   bool SetSecurityInfo(TransportDescription* description,
                        ConnectionRole role) const;
-
-  SecurePolicy secure_;
+  bool insecure_ = false;
   rtc::scoped_refptr<rtc::RTCCertificate> certificate_;
   const webrtc::FieldTrialsView& field_trials_;
 };
diff --git a/third_party/libwebrtc/p2p/base/transport_description_factory_unittest.cc b/third_party/libwebrtc/p2p/base/transport_description_factory_unittest.cc
index 0da5b7c294..0d38ac6d7b 100644
--- a/third_party/libwebrtc/p2p/base/transport_description_factory_unittest.cc
+++ b/third_party/libwebrtc/p2p/base/transport_description_factory_unittest.cc
@@ -33,6 +33,7 @@ using cricket::TransportDescriptionFactory;
 using cricket::TransportOptions;
 using ::testing::Contains;
 using ::testing::Not;
+using ::testing::NotNull;
 
 class TransportDescriptionFactoryTest : public ::testing::Test {
  public:
@@ -43,7 +44,11 @@ class TransportDescriptionFactoryTest : public ::testing::Test {
         cert1_(rtc::RTCCertificate::Create(std::unique_ptr<rtc::SSLIdentity>(
             new rtc::FakeSSLIdentity("User1")))),
         cert2_(rtc::RTCCertificate::Create(std::unique_ptr<rtc::SSLIdentity>(
-            new rtc::FakeSSLIdentity("User2")))) {}
+            new rtc::FakeSSLIdentity("User2")))) {
+    // By default, certificates are supplied.
+    f1_.set_certificate(cert1_);
+    f2_.set_certificate(cert2_);
+  }
 
   void CheckDesc(const TransportDescription* desc,
                  absl::string_view opt,
@@ -75,7 +80,12 @@ class TransportDescriptionFactoryTest : public ::testing::Test {
   // in the offer and answer is changed.
   // If `dtls` is true, the test verifies that the finger print is not changed.
   void TestIceRestart(bool dtls) {
-    SetDtls(dtls);
+    if (dtls) {
+      f1_.set_certificate(cert1_);
+      f2_.set_certificate(cert2_);
+    } else {
+      SetInsecure();
+    }
     cricket::TransportOptions options;
     // The initial offer / answer exchange.
     std::unique_ptr<TransportDescription> offer =
@@ -102,6 +112,8 @@ class TransportDescriptionFactoryTest : public ::testing::Test {
   void VerifyUfragAndPasswordChanged(bool dtls,
                                      const TransportDescription* org_desc,
                                      const TransportDescription* restart_desc) {
+    ASSERT_THAT(org_desc, NotNull());
+    ASSERT_THAT(restart_desc, NotNull());
     EXPECT_NE(org_desc->ice_pwd, restart_desc->ice_pwd);
     EXPECT_NE(org_desc->ice_ufrag, restart_desc->ice_ufrag);
     EXPECT_EQ(static_cast<size_t>(cricket::ICE_UFRAG_LENGTH),
@@ -118,7 +130,9 @@ class TransportDescriptionFactoryTest : public ::testing::Test {
   }
 
   void TestIceRenomination(bool dtls) {
-    SetDtls(dtls);
+    if (!dtls) {
+      SetInsecureNoDtls();
+    }
 
     cricket::TransportOptions options;
     // The initial offer / answer exchange.
@@ -148,16 +162,16 @@ class TransportDescriptionFactoryTest : public ::testing::Test {
   }
 
  protected:
-  void SetDtls(bool dtls) {
-    if (dtls) {
-      f1_.set_secure(cricket::SEC_ENABLED);
-      f2_.set_secure(cricket::SEC_ENABLED);
-      f1_.set_certificate(cert1_);
-      f2_.set_certificate(cert2_);
-    } else {
-      f1_.set_secure(cricket::SEC_DISABLED);
-      f2_.set_secure(cricket::SEC_DISABLED);
-    }
+  // This will enable responding to non-DTLS requests.
+  void SetInsecure() {
+    f1_.SetInsecureForTesting();
+    f2_.SetInsecureForTesting();
+  }
+  // This will disable the ability to respond to DTLS requests.
+  void SetInsecureNoDtls() {
+    SetInsecure();
+    f1_.set_certificate(nullptr);
+    f2_.set_certificate(nullptr);
   }
 
   webrtc::test::ScopedKeyValueConfig field_trials_;
@@ -169,30 +183,18 @@ class TransportDescriptionFactoryTest : public ::testing::Test {
   rtc::scoped_refptr<rtc::RTCCertificate> cert2_;
 };
 
-TEST_F(TransportDescriptionFactoryTest, TestOfferDefault) {
-  std::unique_ptr<TransportDescription> desc =
-      f1_.CreateOffer(TransportOptions(), NULL, &ice_credentials_);
-  CheckDesc(desc.get(), "", "", "", "");
-}
-
 TEST_F(TransportDescriptionFactoryTest, TestOfferDtls) {
-  f1_.set_secure(cricket::SEC_ENABLED);
-  f1_.set_certificate(cert1_);
   std::string digest_alg;
   ASSERT_TRUE(
       cert1_->GetSSLCertificate().GetSignatureDigestAlgorithm(&digest_alg));
   std::unique_ptr<TransportDescription> desc =
       f1_.CreateOffer(TransportOptions(), NULL, &ice_credentials_);
   CheckDesc(desc.get(), "", "", "", digest_alg);
-  // Ensure it also works with SEC_REQUIRED.
-  f1_.set_secure(cricket::SEC_REQUIRED);
-  desc = f1_.CreateOffer(TransportOptions(), NULL, &ice_credentials_);
-  CheckDesc(desc.get(), "", "", "", digest_alg);
 }
 
 // Test generating an offer with DTLS fails with no identity.
 TEST_F(TransportDescriptionFactoryTest, TestOfferDtlsWithNoIdentity) {
-  f1_.set_secure(cricket::SEC_ENABLED);
+  f1_.set_certificate(nullptr);
   std::unique_ptr<TransportDescription> desc =
       f1_.CreateOffer(TransportOptions(), NULL, &ice_credentials_);
   ASSERT_TRUE(desc.get() == NULL);
@@ -201,8 +203,6 @@ TEST_F(TransportDescriptionFactoryTest, TestOfferDtlsWithNoIdentity) {
 // Test updating an offer with DTLS to pick ICE.
 // The ICE credentials should stay the same in the new offer.
 TEST_F(TransportDescriptionFactoryTest, TestOfferDtlsReofferDtls) {
-  f1_.set_secure(cricket::SEC_ENABLED);
-  f1_.set_certificate(cert1_);
   std::string digest_alg;
   ASSERT_TRUE(
       cert1_->GetSSLCertificate().GetSignatureDigestAlgorithm(&digest_alg));
@@ -215,19 +215,25 @@ TEST_F(TransportDescriptionFactoryTest, TestOfferDtlsReofferDtls) {
 }
 
 TEST_F(TransportDescriptionFactoryTest, TestAnswerDefault) {
+  std::string digest_alg;
+  ASSERT_TRUE(
+      cert1_->GetSSLCertificate().GetSignatureDigestAlgorithm(&digest_alg));
   std::unique_ptr<TransportDescription> offer =
       f1_.CreateOffer(TransportOptions(), NULL, &ice_credentials_);
   ASSERT_TRUE(offer.get() != NULL);
   std::unique_ptr<TransportDescription> desc = f2_.CreateAnswer(
       offer.get(), TransportOptions(), true, NULL, &ice_credentials_);
-  CheckDesc(desc.get(), "", "", "", "");
+  CheckDesc(desc.get(), "", "", "", digest_alg);
   desc = f2_.CreateAnswer(offer.get(), TransportOptions(), true, NULL,
                           &ice_credentials_);
-  CheckDesc(desc.get(), "", "", "", "");
+  CheckDesc(desc.get(), "", "", "", digest_alg);
 }
 
 // Test that we can update an answer properly; ICE credentials shouldn't change.
 TEST_F(TransportDescriptionFactoryTest, TestReanswer) {
+  std::string digest_alg;
+  ASSERT_TRUE(
+      cert1_->GetSSLCertificate().GetSignatureDigestAlgorithm(&digest_alg));
   std::unique_ptr<TransportDescription> offer =
       f1_.CreateOffer(TransportOptions(), NULL, &ice_credentials_);
   ASSERT_TRUE(offer.get() != NULL);
@@ -237,13 +243,13 @@ TEST_F(TransportDescriptionFactoryTest, TestReanswer) {
   std::unique_ptr<TransportDescription> desc = f2_.CreateAnswer(
       offer.get(), TransportOptions(), true, old_desc.get(), &ice_credentials_);
   ASSERT_TRUE(desc.get() != NULL);
-  CheckDesc(desc.get(), "", old_desc->ice_ufrag, old_desc->ice_pwd, "");
+  CheckDesc(desc.get(), "", old_desc->ice_ufrag, old_desc->ice_pwd, digest_alg);
 }
 
 // Test that we handle answering an offer with DTLS with no DTLS.
 TEST_F(TransportDescriptionFactoryTest, TestAnswerDtlsToNoDtls) {
-  f1_.set_secure(cricket::SEC_ENABLED);
-  f1_.set_certificate(cert1_);
+  f2_.SetInsecureForTesting();
+  f2_.set_certificate(nullptr);
   std::unique_ptr<TransportDescription> offer =
       f1_.CreateOffer(TransportOptions(), NULL, &ice_credentials_);
   ASSERT_TRUE(offer.get() != NULL);
@@ -255,28 +261,25 @@ TEST_F(TransportDescriptionFactoryTest, TestAnswerDtlsToNoDtls) {
 // Test that we handle answering an offer without DTLS if we have DTLS enabled,
 // but fail if we require DTLS.
 TEST_F(TransportDescriptionFactoryTest, TestAnswerNoDtlsToDtls) {
-  f2_.set_secure(cricket::SEC_ENABLED);
-  f2_.set_certificate(cert2_);
+  f1_.SetInsecureForTesting();
+  f1_.set_certificate(nullptr);
   std::unique_ptr<TransportDescription> offer =
       f1_.CreateOffer(TransportOptions(), NULL, &ice_credentials_);
   ASSERT_TRUE(offer.get() != NULL);
+  // Normal case.
   std::unique_ptr<TransportDescription> desc = f2_.CreateAnswer(
       offer.get(), TransportOptions(), true, NULL, &ice_credentials_);
-  CheckDesc(desc.get(), "", "", "", "");
-  f2_.set_secure(cricket::SEC_REQUIRED);
+  ASSERT_TRUE(desc.get() == NULL);
+  // Insecure case.
+  f2_.SetInsecureForTesting();
   desc = f2_.CreateAnswer(offer.get(), TransportOptions(), true, NULL,
                           &ice_credentials_);
-  ASSERT_TRUE(desc.get() == NULL);
+  CheckDesc(desc.get(), "", "", "", "");
 }
 
-// Test that we handle answering an DTLS offer with DTLS, both if we have
-// DTLS enabled and required.
+// Test that we handle answering an DTLS offer with DTLS,
+// even if we don't require DTLS.
 TEST_F(TransportDescriptionFactoryTest, TestAnswerDtlsToDtls) {
-  f1_.set_secure(cricket::SEC_ENABLED);
-  f1_.set_certificate(cert1_);
-
-  f2_.set_secure(cricket::SEC_ENABLED);
-  f2_.set_certificate(cert2_);
   // f2_ produces the answer that is being checked in this test, so the
   // answer must contain fingerprint lines with cert2_'s digest algorithm.
   std::string digest_alg2;
@@ -289,7 +292,8 @@ TEST_F(TransportDescriptionFactoryTest, TestAnswerDtlsToDtls) {
   std::unique_ptr<TransportDescription> desc = f2_.CreateAnswer(
       offer.get(), TransportOptions(), true, NULL, &ice_credentials_);
   CheckDesc(desc.get(), "", "", "", digest_alg2);
-  f2_.set_secure(cricket::SEC_REQUIRED);
+
+  f2_.SetInsecureForTesting();
   desc = f2_.CreateAnswer(offer.get(), TransportOptions(), true, NULL,
                           &ice_credentials_);
   CheckDesc(desc.get(), "", "", "", digest_alg2);
@@ -325,6 +329,7 @@ TEST_F(TransportDescriptionFactoryTest, AddsTrickleIceOption) {
   cricket::TransportOptions options;
   std::unique_ptr<TransportDescription> offer =
       f1_.CreateOffer(options, nullptr, &ice_credentials_);
+  ASSERT_THAT(offer, NotNull());
   EXPECT_TRUE(offer->HasOption("trickle"));
   std::unique_ptr<TransportDescription> answer =
       f2_.CreateAnswer(offer.get(), options, true, nullptr, &ice_credentials_);
@@ -359,11 +364,6 @@ TEST_F(TransportDescriptionFactoryTest, CreateAnswerIceCredentialsIterator) {
 }
 
 TEST_F(TransportDescriptionFactoryTest, CreateAnswerToDtlsActpassOffer) {
-  f1_.set_secure(cricket::SEC_ENABLED);
-  f1_.set_certificate(cert1_);
-
-  f2_.set_secure(cricket::SEC_ENABLED);
-  f2_.set_certificate(cert2_);
   cricket::TransportOptions options;
   std::unique_ptr<TransportDescription> offer =
       f1_.CreateOffer(options, nullptr, &ice_credentials_);
@@ -374,11 +374,6 @@ TEST_F(TransportDescriptionFactoryTest, CreateAnswerToDtlsActpassOffer) {
 }
 
 TEST_F(TransportDescriptionFactoryTest, CreateAnswerToDtlsActiveOffer) {
-  f1_.set_secure(cricket::SEC_ENABLED);
-  f1_.set_certificate(cert1_);
-
-  f2_.set_secure(cricket::SEC_ENABLED);
-  f2_.set_certificate(cert2_);
   cricket::TransportOptions options;
   std::unique_ptr<TransportDescription> offer =
       f1_.CreateOffer(options, nullptr, &ice_credentials_);
@@ -390,11 +385,6 @@ TEST_F(TransportDescriptionFactoryTest, CreateAnswerToDtlsActiveOffer) {
 }
 
 TEST_F(TransportDescriptionFactoryTest, CreateAnswerToDtlsPassiveOffer) {
-  f1_.set_secure(cricket::SEC_ENABLED);
-  f1_.set_certificate(cert1_);
-
-  f2_.set_secure(cricket::SEC_ENABLED);
-  f2_.set_certificate(cert2_);
   cricket::TransportOptions options;
   std::unique_ptr<TransportDescription> offer =
       f1_.CreateOffer(options, nullptr, &ice_credentials_);
diff --git a/third_party/libwebrtc/p2p/base/turn_port.cc b/third_party/libwebrtc/p2p/base/turn_port.cc
index 1fb3b38bfd..bc35a2250a 100644
--- a/third_party/libwebrtc/p2p/base/turn_port.cc
+++ b/third_party/libwebrtc/p2p/base/turn_port.cc
@@ -22,6 +22,7 @@
 #include "absl/types/optional.h"
 #include "api/task_queue/pending_task_safety_flag.h"
 #include "api/transport/stun.h"
+#include "api/turn_customizer.h"
 #include "p2p/base/connection.h"
 #include "p2p/base/p2p_constants.h"
 #include "rtc_base/async_packet_socket.h"
diff --git a/third_party/libwebrtc/p2p/base/turn_port.h b/third_party/libwebrtc/p2p/base/turn_port.h
index b56f862e61..099d8b258a 100644
--- a/third_party/libwebrtc/p2p/base/turn_port.h
+++ b/third_party/libwebrtc/p2p/base/turn_port.h
@@ -25,7 +25,8 @@
 #include "api/task_queue/pending_task_safety_flag.h"
 #include "api/task_queue/task_queue_base.h"
 #include "p2p/base/port.h"
-#include "p2p/client/basic_port_allocator.h"
+#include "p2p/base/port_allocator.h"
+#include "p2p/client/relay_port_factory_interface.h"
 #include "rtc_base/async_packet_socket.h"
 #include "rtc_base/network/received_packet.h"
 #include "rtc_base/ssl_certificate.h"