PSA: DTLS client hello extension permutation will be enabled soon, do interop testing now

[Philipp Hancke]

As announced in

  https://groups.google.com/a/chromium.org/g/blink-dev/c/1CIKec0W1fg

we plan to enable a BoringSSL feature that randomizes the order of TLS extensions in the DTLS client hello soon. This should not have any impact to applications but as usual, some interop testing is required.

Please test your services, in particular if you are not using OpenSSL or BoringSSL and in your scenario(s) the browser is sending the DTLS client hello.

To test, launch Chrome (119.0.6038.0 or later, currency Canary) by starting Chrome with

  --force-fieldtrials=WebRTC-PermuteTlsClientHello/Enabled/

and ensure the DTLS  connection is still established.

In Wireshark this can be observed in the DTLS client hello, in particular the "use_srtp" extension which is normally last as shown below

will be in a different place like this:

You can enable the feature for testing in M119. We expect to turn it on in stable for some percentage of users in M120 (which ships in December) and enable it for all users some time in M121.

Leave feedback either here or in https://bugs.chromium.org/p/webrtc/issues/detail?id=15467

cheers

Philipp

[Iñaki Baz Castillo]

I confirm that it works fine with mediasoup server. I've tested Canary 119.0.6045.0 in macOS Intel.

[Lorenzo Miniero]

I just tested this with Janus, using Chrome 120.0.6062.2 on Linux, and I can confirm it works fine there too.

Lorenzo

[Boris Grozev]

Works fine with Jitsi/bouncycastle, tested using Chrome 121.0.6151.0 on mac.

Boris

[Philipp Hancke]

oops, that got delay a bit. This is enabled by default in M129 as of

  https://chromiumdash.appspot.com/commit/76430c0bf1085a07fbc1b80b4f8e4970193c87ab

Note that Chromium TURN/TLS already behaves that way, webrtc standalone will follow suit soon.

Thanks for the feedback folks!

--
This list falls under the WebRTC Code of Conduct - https://webrtc.org/support/code-of-conduct.
---
You received this message because you are subscribed to the Google Groups "discuss-webrtc" group.
To unsubscribe from this group and stop receiving emails from it, send an email to discuss-webrt...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/discuss-webrtc/928b6fbc-954e-4eda-a4ae-f27087713426n%40googlegroups.com.