search

algesten / str0m

A Sans I/O WebRTC implementation in Rust.
MIT License
317 stars 49 forks source link

Panic in DTLS layer #530

Open OxleyS opened 3 months ago

OxleyS commented 3 months ago

One of our servers panicked at this line: https://github.com/algesten/str0m/blob/3ec91e2981cf7de0a373c1033fa1c6d795b0972b/src/crypto/ossl/io_buf.rs#L14

Unfortunately I don't have a repro or much more information than that. What might be related is every now and then, we get an error like this coming back from Rtc::handle_input():

Dtls(Io(Custom { kind: InvalidData, error: Error { code: ErrorCode(1), cause: Some(Ssl(ErrorStack([Error { code: 167773415, library: "SSL routines", function: "dtls1_read_bytes", file: "ssl/record/rec_layer_d1.c", line: 613, data: "SSL alert number 255" }]))) } }))

I have not been able to establish whether this is legit data that is getting misprocessed, or just random internet junk.

algesten commented 3 months ago

Interesting! On an internet facing server we must of course accept junk. We could probably create a fuzz here which establishes the connection cleanly and then starts sending random UDP gunk maybe mixed with real packets.