This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 837cf8e38fa7b4d860ae8a7ef836ce4f94a956d1 Author: Nariman-Sayed <[email protected]> AuthorDate: Tue May 5 00:12:24 2026 +0300 Commit: Jack Lau <[email protected]> CommitDate: Mon May 11 12:36:58 2026 +0000 avformat/tls_mbedtls: fix DTLS handshake failure when receiving non-DTLS packets Some WebRTC servers such as Pion send STUN packets concurrently during the DTLS handshake. Unlike OpenSSL and GnuTLS which filter non-DTLS packets internally, mbedtls passes all received UDP packets directly to its DTLS state machine, causing the handshake to fail. Fix this by using ff_is_dtls_packet() in mbedtls_recv to discard non-DTLS packets such as STUN by returning WANT_READ, as specified by RFC 5764 Section 5.1.2. Signed-off-by: Nariman-Sayed <[email protected]> --- libavformat/tls_mbedtls.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index d2480ef25b..4f85c51777 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -394,6 +394,9 @@ static int mbedtls_recv(void *ctx, unsigned char *buf, size_t len) } av_log(tls_ctx, AV_LOG_TRACE, "Set UDP remote addr on UDP socket, now 'connected'\n"); } + /* Skip non-DTLS packets such as STUN to avoid failures. */ + if (shr->is_dtls && !ff_is_dtls_packet(buf, ret)) + return MBEDTLS_ERR_SSL_WANT_READ; return ret; } if (h->max_packet_size && len > h->max_packet_size) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
