Closed paullouisageneau closed 3 years ago
Woot, so excited to see this interop happening :)
I was able to reproduce, should have an answer real quick.
The issue is that the ServerHello doesn't contain a use_srtp
extension. These are the entries in our ClientHello.
Extension: use_srtp (len=7)
Type: use_srtp (14)
Length: 7
SRTP Protection Profiles Length: 4
SRTP Protection Profile: SRTP_AEAD_AES_128_GCM (0x0007)
SRTP Protection Profile: SRTP_AES128_CM_HMAC_SHA1_80 (0x0001)
MKI Length: 0
Oh thanks, I missed it. The issue is that libdatachannel does not negotiate SRTP if media support is disabled, a behavior browsers are fine with but is actually not correct.
Your environment.
What did you do?
Running the libdatachannel client in https://github.com/sipsorcery/webrtc-echoes/pull/28 against the Pion echo server.
What did you expect?
The peer connection should succeed, in particular, the DTLS handshake should succeed.
What happened?
The Pion echo server sends a DTLS alert "insufficient security" in response to the DTLS Server Hello from libdatachannel. This behavior happens with both libdatachannel DTLS backends OpenSSL and GnuTLS.
I've no idea if the issue comes from Pion DTLS or not for now.
The DTLS server (libdatachannel side) chooses the cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, sends an ECDSA certificate with curve secp256r1, sets up ECDH key exchange with secp256r1, and requests a client certificate.
The Server Hello looks OK to me on first sight:
Full packet capture: libdatachannel_pion_handshake_failed.zip