Default enable DTLS1.3 It is still possible to downgrade to 1.2 using PeerConnection API BUG=webrtc:383141571 Change-Id: I1586a2c8f17fdb47e94d791ff8263a7c1e754cfe Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/459520 Auto-Submit: Jonas Oreland <jonaso@webrtc.org> Commit-Queue: Jonas Oreland <jonaso@webrtc.org> Reviewed-by: Guido Urdaneta <guidou@webrtc.org> Reviewed-by: Tomas Gunnarsson <tommi@webrtc.org> Cr-Commit-Position: refs/heads/main@{#47326}
diff --git a/api/peer_connection_interface.h b/api/peer_connection_interface.h index 48b38d5..dc2834a 100644 --- a/api/peer_connection_interface.h +++ b/api/peer_connection_interface.h
@@ -1517,7 +1517,7 @@ // Sets the maximum supported protocol version. The highest version // supported by both ends will be used for the connection, i.e. if one // party supports DTLS 1.0 and the other DTLS 1.2, DTLS 1.0 will be used. - SSLProtocolVersion ssl_max_version = SSL_PROTOCOL_DTLS_12; + SSLProtocolVersion ssl_max_version = SSL_PROTOCOL_DTLS_13; }; // Set the options to be used for subsequently created PeerConnections.
diff --git a/rtc_base/openssl_stream_adapter.cc b/rtc_base/openssl_stream_adapter.cc index e3a75db..b0464ad 100644 --- a/rtc_base/openssl_stream_adapter.cc +++ b/rtc_base/openssl_stream_adapter.cc
@@ -100,6 +100,12 @@ } #endif +#ifdef DTLS1_3_VERSION +#define MAX_SSL_PROTOCOL_DTLS SSL_PROTOCOL_DTLS_13 +#else +#define MAX_SSL_PROTOCOL_DTLS SSL_PROTOCOL_DTLS_12 +#endif + uint16_t GetMaxVersion(SSLMode ssl_mode, SSLProtocolVersion version) { switch (ssl_mode) { case SSL_MODE_TLS: @@ -120,10 +126,10 @@ case SSL_MODE_DTLS: switch (version) { default: - case SSL_PROTOCOL_NOT_GIVEN: case SSL_PROTOCOL_DTLS_10: case SSL_PROTOCOL_DTLS_12: return DTLS1_2_VERSION; + case SSL_PROTOCOL_NOT_GIVEN: case SSL_PROTOCOL_DTLS_13: #ifdef DTLS1_3_VERSION return DTLS1_3_VERSION; @@ -134,45 +140,6 @@ } } -constexpr int kForceDtls13Off = 0; -#ifdef DTLS1_3_VERSION -constexpr int kForceDtls13Enabled = 1; -constexpr int kForceDtls13Only = 2; -#endif - -int GetForceDtls13(const FieldTrialsView* field_trials) { -#ifdef DTLS1_3_VERSION - if (field_trials) { -#if defined(WEBRTC_CHROMIUM_BUILD) - if (field_trials->IsDisabled("WebRTC-ForceDtls13")) { - RTC_LOG(LS_WARNING) << "WebRTC-ForceDtls13 Disabled"; - return kForceDtls13Off; - } -#else - if (field_trials->IsEnabled("WebRTC-ForceDtls13")) { - RTC_LOG(LS_WARNING) << "WebRTC-ForceDtls13 Enabled"; - return kForceDtls13Enabled; - } -#endif // defined(WEBRTC_CHROMIUM_BUILD) - if (field_trials->Lookup("WebRTC-ForceDtls13") == "Only") { - RTC_LOG(LS_WARNING) << "WebRTC-ForceDtls13 Only"; - return kForceDtls13Only; - } - } - // Default behavior: -#if defined(WEBRTC_CHROMIUM_BUILD) - RTC_LOG(LS_WARNING) << "WebRTC-ForceDtls13 Enabled"; - return kForceDtls13Enabled; -#else - RTC_LOG(LS_WARNING) << "WebRTC-ForceDtls13 Disabled"; - return kForceDtls13Off; -#endif // defined(WEBRTC_CHROMIUM_BUILD) - -#else - return kForceDtls13Off; -#endif // DTLS1_3_VERSION -} - #ifdef OPENSSL_IS_BORINGSSL std::string GetOpenSslError() { std::string error; @@ -334,8 +301,7 @@ ssl_(nullptr), ssl_ctx_(nullptr), ssl_mode_(SSL_MODE_DTLS), - ssl_max_version_(SSL_PROTOCOL_DTLS_12), - force_dtls_13_(GetForceDtls13(field_trials)), + ssl_max_version_(MAX_SSL_PROTOCOL_DTLS), disable_ssl_group_ids_(field_trials && field_trials->IsEnabled( "WebRTC-DisableSslGroupIds")) { stream_->SetEventCallback( @@ -1154,14 +1120,6 @@ auto min_version = ssl_mode_ == SSL_MODE_DTLS ? DTLS1_2_VERSION : TLS1_2_VERSION; auto max_version = GetMaxVersion(ssl_mode_, ssl_max_version_); -#ifdef DTLS1_3_VERSION - if (force_dtls_13_ == kForceDtls13Enabled) { - max_version = DTLS1_3_VERSION; - } else if (force_dtls_13_ == kForceDtls13Only) { - min_version = DTLS1_3_VERSION; - max_version = DTLS1_3_VERSION; - } -#endif SSL_CTX_set_min_proto_version(ctx, min_version); SSL_CTX_set_max_proto_version(ctx, max_version);
diff --git a/rtc_base/openssl_stream_adapter.h b/rtc_base/openssl_stream_adapter.h index b8e531d..50ef419 100644 --- a/rtc_base/openssl_stream_adapter.h +++ b/rtc_base/openssl_stream_adapter.h
@@ -266,11 +266,6 @@ // MTU configured for dtls. int dtls_mtu_ = 1200; - // 0 == Disabled - // 1 == Max - // 2 == Enabled (both min and max) - const int force_dtls_13_ = 0; - int retransmission_count_ = 0; // Kill switch (from field-trial) flag to disable the use of
diff --git a/rtc_base/ssl_stream_adapter_unittest.cc b/rtc_base/ssl_stream_adapter_unittest.cc index 8bd26c3..7704a3b 100644 --- a/rtc_base/ssl_stream_adapter_unittest.cc +++ b/rtc_base/ssl_stream_adapter_unittest.cc
@@ -410,7 +410,8 @@ BufferQueue buffer_; }; -constexpr int kBufferCapacity = 1; +// DTLS1.3 can also write ACK message, so we need to have a buffer of 2. +constexpr int kBufferCapacity = 2; constexpr size_t kDefaultBufferSize = 2048; class SSLStreamAdapterTestBase : public ::testing::Test {