Upgrade github.com/pion/dtls from v2.2.12 to v3.1.8 - #482
Merged
Merged
Conversation
antoninbas
force-pushed
the
bump-pion-dtls-v3
branch
2 times, most recently
from
September 2, 2026 07:45
470f23d to
f567c7e
Compare
The v2.2.12 release is affected by CVE-2026-26014 (GHSA-9f3f-wv7r-qc8r) and is quite old at this point. The main behavior change in v3 is that the handshake is no longer performed by Dial and Accept: it now happens lazily on the first Read or Write. We restore the previous semantics by calling Handshake explicitly in both the exporter and the collector. This matters: without it, a certificate validation failure would no longer be reported by InitExportingProcess, and on the collector side the resulting read error would be misinterpreted as a normal shutdown signal by the existing "size == 0" check, silently dropping the connection. Note that v2 bounded the handshake performed by Dial and Accept with a default 30s timeout (ConnectContextMaker), which has no equivalent in v3: Handshake blocks forever by default. We therefore use HandshakeContext with an explicit 30s timeout, which preserves the v2 semantics. Without it, a peer which starts a handshake and then stops responding would leave the collector goroutine (along with the listener and the connection) around for the lifetime of the process, and InitExportingProcess would never return. Making the handshake explicit also surfaced how its failure was handled on the collector side: a handshake error aborted startUDPServer, which closed the listener and permanently stopped DTLS collection. This was already the case with v2, where the error surfaced from Accept, and it means any peer can take the collector down by failing to authenticate. Accept and the handshake now run in a loop which drops the offending connection and keeps accepting. As before, the DTLS path serves a single exporter once a client completes the handshake. The dtls.Config struct along with Dial and Listen are all deprecated in v3, so we move to the new functional options API. Note that the WithCipherSuites option rejects an empty list, and pion only falls back to its default suites when none were configured, hence we only set the option when the user actually provided cipher suites. Cipher suite IDs are unchanged between the 2 versions (v3 only adds ChaCha20-Poly1305 suites), so the exported CipherSuites configuration fields keep their meaning. DTLS 1.2 also remains the only supported protocol version. One more behavior change had to be worked around: v3 Dial creates the client socket with net.ListenUDP instead of net.DialUDP, as the latter prevents the use of net.PacketConn.WriteTo. We have no use for WriteTo, and an unconnected socket would change the exporter's behavior in 3 ways: the source address of exported packets would be chosen by a route lookup for every datagram, instead of being fixed when we dial, the kernel would no longer discard datagrams from sources other than the collector, and Write would no longer report ICMP errors such as ECONNREFUSED. It would also make DTLS behave differently from plaintext UDP, which goes through net.Dial and is therefore connected. We keep the v2 semantics by dialing the socket ourselves and passing it to dtls.Client as a net.PacketConn, using the PacketConnFromConn wrapper provided by pion, which ignores the address given to WriteTo and writes to the connected socket. Signed-off-by: Antonin Bas <antonin.bas@gmail.com>
antoninbas
force-pushed
the
bump-pion-dtls-v3
branch
from
September 2, 2026 07:55
f567c7e to
bb44f51
Compare
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v2.2.12 release is affected by CVE-2026-26014 (GHSA-9f3f-wv7r-qc8r) and is quite old at this point.
The main behavior change in v3 is that the handshake is no longer performed by Dial and Accept: it now happens lazily on the first Read or Write. We restore the previous semantics by calling Handshake explicitly in both the exporter and the collector. This matters: without it, a certificate validation failure would no longer be reported by InitExportingProcess, and on the collector side the resulting read error would be misinterpreted as a normal shutdown signal by the existing "size == 0" check, silently dropping the connection.
Note that v2 bounded the handshake performed by Dial and Accept with a default 30s timeout (ConnectContextMaker), which has no equivalent in v3: Handshake blocks forever by default. We therefore use HandshakeContext with an explicit 30s timeout, which preserves the v2 semantics. Without it, a peer which starts a handshake and then stops responding would leave the collector goroutine (along with the listener and the connection) around for the lifetime of the process, and InitExportingProcess would never return.
The dtls.Config struct along with Dial and Listen are all deprecated in v3, so we move to the new functional options API. Note that the WithCipherSuites option rejects an empty list, and pion only falls back to its default suites when none were configured, hence we only set the option when the user actually provided cipher suites.
Cipher suite IDs are unchanged between the 2 versions (v3 only adds ChaCha20-Poly1305 suites), so the exported CipherSuites configuration fields keep their meaning. DTLS 1.2 also remains the only supported protocol version.
One more behavior change worth noting: v3 Dial creates the client socket with net.ListenUDP instead of net.DialUDP, as the latter prevents the use of net.PacketConn.WriteTo. The exporter's socket is therefore no longer connected, and the kernel no longer filters out datagrams from other sources. It also means that the local address of the connection is unspecified, which is why TestDTLSCollectingProcess can no longer rely on localConnSessionID to compute the session ID.