Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[dtls] invalid named curve during of handshake #417

Closed
Shaienn opened this issue Mar 6, 2023 · 0 comments
Closed

[dtls] invalid named curve during of handshake #417

Shaienn opened this issue Mar 6, 2023 · 0 comments

Comments

@Shaienn
Copy link

Shaienn commented Mar 6, 2023

Hello.
Our application receives SDP offer from webrtc.rs and sets setup:active in the answer.
Then our application starts dtls handshake by sending client_hello with list of elliptic curve groups supported by our application.
I expect that webrtc.rs should find curves supported by itself in the received list and then continue handshake using the best curve supported by both sides.

I have noticed that webrtc.rs supports only P384, P256, X25519 curves and make sure that they are included in the client_hello curves list:

image

But during of handshake i have got the error:

warning: [webrtc::peer_connection::peer_connection_internal:654]: Failed to start manager dtls: invalid named curve

And tcpdump:
image

I did an investigation and looks like webrtc.rs just uses the first curve in the received list and forbids handshake if curve is not supported despite that supported curves are present in the list.

I suppose that the code which selects first curve is:

for extension in &client_hello.extensions {
match extension {
Extension::SupportedEllipticCurves(e) => {
if e.elliptic_curves.is_empty() {
return Err((
Some(Alert {
alert_level: AlertLevel::Fatal,
alert_description: AlertDescription::InsufficientSecurity,
}),
Some(Error::ErrNoSupportedEllipticCurves),
));
}
state.named_curve = e.elliptic_curves[0];
}

Also i did an experiment and sent P384 as first element of curves list and unsupported curve as second element. Handshake has been completed:

image

Could you please consider to implement searching of supported curve in received list instead of using first curve.

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants