Reject oversized data messages before they break the data channel - #1137
Merged
Conversation
Sending a data message larger than the negotiated SCTP max message size made libwebrtc abruptly close the publisher data channel. Because DataChannelInterface::Send returns true regardless, publish_data() returned Ok while the channel was silently torn down; every subsequent publish then failed with "could not establish publisher connection: timeout" (15s each) since the channel is never recreated once has_published is set. - Parse the negotiated max message size from the publisher answer SDP (RFC 8841 a=max-message-size), defaulting to 65535 when absent. - Reject packets whose encoded size exceeds it in publish_data(), returning an error to the caller instead of silently aborting the channel. A value of 0 means "no limit". - Log an info when a publisher data channel closes while the session and peer connection are still up (the signature of this failure), without attempting renegotiation.
Contributor
ChangesetThe following package versions will be affected by this PR:
|
ladvoc
reviewed
Jun 5, 2026
| return; | ||
| }; | ||
| if !inner.closed.load(Ordering::Acquire) && inner.publisher_pc.is_connected() { | ||
| log::info!( |
Contributor
There was a problem hiding this comment.
suggestion: This should probably be logged at error level.
| // Log when a publisher data channel closes without the engine or peer | ||
| // connection tearing it down | ||
| for (dc, label) in | ||
| [(&inner.reliable_dc, RELIABLE_DC_LABEL), (&inner.lossy_dc, LOSSY_DC_LABEL)] |
Contributor
There was a problem hiding this comment.
suggestion: For completeness, this should probably also track the data track DC.
pblazej
added a commit
to livekit/client-sdk-swift
that referenced
this pull request
Jun 8, 2026
…nnel Sending more than the negotiated SCTP max-message-size makes libwebrtc return success from `sendData` and then abruptly tear down the publisher data channel; every subsequent publish then fails until the next full reconnect. Mirrors the fix from livekit/rust-sdks#1137. Parse `a=max-message-size` (RFC 8841) from the publisher answer SDP in `Room+SignalClientDelegate.didReceiveAnswer`, clamp to a 64000-byte default, and enforce the cap in `DataChannelPair.makeRequest` after serialization — the encoded byte count is what actually goes on the wire. A value of 0 means "no limit". Also logs an error when the publisher channel transitions to `.closed` without an SDK-initiated reset, surfacing the remaining failure modes for diagnosis. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4 tasks
pblazej
added a commit
to livekit/client-sdk-swift
that referenced
this pull request
Jun 8, 2026
…nnel Sending more than the negotiated SCTP max-message-size makes libwebrtc return success from `sendData` and then abruptly tear down the publisher data channel; every subsequent publish then fails until the next full reconnect. Mirrors the fix from livekit/rust-sdks#1137. Parse `a=max-message-size` (RFC 8841) from the publisher answer SDP in `Room+SignalClientDelegate.didReceiveAnswer`, clamp to a 64000-byte default, and enforce the cap in `DataChannelPair.makeRequest` after serialization — the encoded byte count is what actually goes on the wire. A value of 0 means "no limit". Also logs an error when the publisher channel transitions to `.closed` without an SDK-initiated reset, surfacing the remaining failure modes for diagnosis. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
|
@1egoman , could you please review this PR ? |
pblazej
added a commit
to livekit/client-sdk-swift
that referenced
this pull request
Jun 9, 2026
…nnel (#1031) ## Summary Sending more than the negotiated SCTP max-message-size makes libwebrtc return success from `sendData` and then abruptly tear down the publisher data channel — every subsequent publish fails until a full reconnect. - Parse `a=max-message-size` (RFC 8841) from the publisher answer SDP, clamp to a 64000-byte default. - Reject in `DataChannelPair.makeRequest` after serialization (encoded byte count = what goes on the wire). `0` means "no limit". - Log an error when the publisher channel transitions to `.closed` without an SDK-initiated reset. Ports the fix from [livekit/rust-sdks#1137](livekit/rust-sdks#1137). Android does the simpler hardcoded-constant variant at [`LocalParticipant.kt:984-986`](https://github.com/livekit/client-sdk-android/blob/46da6784bec2ac124972738764a8e18702a78ee3/livekit-android-sdk/src/main/java/io/livekit/android/room/participant/LocalParticipant.kt#L984-L986). ## Test plan - [x] Unit tests: parameterized SDP parser (6 cases) + size-guard tests (`oversizedSendRejectedWithInvalidParameter`, `zeroLimitDisablesTheSizeGuard`) - [x] `xcodebuild build` macOS clean - [x] SwiftLint clean - [ ] CI matrix Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sending a data message larger than the negotiated SCTP max message size made libwebrtc abruptly close the publisher data channel. Because DataChannelInterface::Send returns true regardless, publish_data() returned Ok while the channel was silently torn down; every subsequent publish then failed with "could not establish publisher connection: timeout" (15s each) since the channel is never recreated once has_published is set.