DTLS client received unexpected alert: fatal(2), bad_record_mac(20)

[akamilkhan]

I am getting following error once I run WebRTC caller and callee application on the same computer.

[16:30:28 WRN] DTLS client received unexpected alert: fatal(2), bad_record_mac(20).
[16:30:28 WRN] DTLS unexpected Fatal alert bad_record_mac: bad_record_mac(20)
[16:30:28 ERR] SCTP fatal error processing RTCSctpTransport receive. Org.BouncyCastle.Crypto.Tls.TlsFatalAlert: bad_record_mac(20)
   at Org.BouncyCastle.Crypto.Tls.DtlsTransport.Receive(Byte[] buf, Int32 off, Int32 len, Int32 waitMillis)
   at SIPSorcery.Net.RTCSctpTransport.DoReceive(Object state)

[camnewnham]

While not sure on the exact cause of your issue, you might try this fork/branch which uses the new bouncycastle APIs (2+): https://github.com/camnewnham/sipsorcery/tree/bouncycastle-2

Once I have done further testing on it I will PR it here.

[lostmsu]

I'm getting the same over an extensively used data channel.

@camnewnham what's your progress on that PR?

[camnewnham]

I'm getting the same over an extensively used data channel.

@camnewnham what's your progress on that PR?

I'm using the aforementioned branch in production and haven't seen this issue recur.

I haven't made a PR yet as there were two changes that were not straightforward to port - they don't affect my usage but I am unsure of their impact in a broader context:

• Implement legacy DtlsUtils.ConvertBouncyCert
• Investigate whether we need to do something with DtlsSrtpServer.GetSelectedCipherSuite (SupportsClientEccCapabilities)

[lostmsu]

@camnewnham your branch seems to fix the issue for me. How can I help with getting the PR out?

P.S. considering dependency major version bump, SIPSorcery's major version must also be increased AFAIU.

[camnewnham]

Thanks @lostmsu had another look over this - seems fine have made a PR.

[lostmsu]

@sipsorcery since the PR was reverted this issue should be reopened.

[sipsorcery]

I did implement some changes to the DTLS cipher suite selection as well as switched the default signature algorithm to ECDSA. While it does not directly address the cause of the "bad mac" alert it might make a difference. All the browsers have switched from RSA to ECDSA as default and that should help with general DTLS issues.