Repository navigation
feat(webrtc)!: run the vendored WebRTC stack on rind - #8229
Merged
Merged
Conversation
Quest-Claim: 39910b0626c3f809
The vendored str0m and dimpl drop their aws-lc-rs backend for rind: DTLS 1.2, SRTP (AES-CM-HMAC-SHA1-80, AEAD AES-128/256-GCM), STUN MESSAGE-INTEGRITY, and the DTLS certificates through rind-rcgen. The providers are ported from moq-dev/rind's rind-dimpl 0.1.12 and its rind-str0m, and the WHIP/WHEP client's reqwest takes rind's rustls provider. moq-webrtc's graph holds no aws-lc-rs. Every Rtc moq-webrtc builds first refuses a CPU rind can't run on, so `Client::new` now returns a Result and both error types gain `UnsupportedCpu`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kixelated
changed the title
kixelated
marked this pull request as ready for review
November 8, 2026 02:03
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 10 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
kixelated
commented
Nov 8, 2026
kixelated
left a comment
kixelated
left a comment
Collaborator
Author
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed d4150b9. No actionable regressions found in the inspected changes. The DTLS cipher/key adapters, SRTP/SRTCP buffer and authentication handling, certificate generation, and fallible CPU/provider initialization paths appear consistent with their callers.
Verification limits: GitHub-only static review; I did not run builds, tests, crypto vectors, or browser interoperability checks. The implementation's reported test and browser results were not independently reproduced. Direction: no corrective change requested from this review.
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
- Vendored crypto providers —
vendor/dimpl/crypto/rind/andvendor/str0m_rind/replace the aws-lc-rs providers, keeping the same DTLS 1.2 suites, SRTP profiles (AES-CM-HMAC-SHA1-80, AEAD GCM), signature schemes, and key-exchange groups. The SRTP adapter matches upstreamrind-str0mat86567aasemantically, including the 96-bit nonce / 32-bit counter split for AES-CM. - CPU guard — Every
Rtcmoq-webrtc builds now goes throughsession::rtc_config(), which runsmoq_crypto::cpu::check()before str0m falls back to rind's provider; WHIP/WHEP accept/dial andp2psurfaceError::UnsupportedCpu. This holds on the epic's Pi 4 and non-AVX2 targets because rind 0.1.12'smissing_cpu_feature()requires nothing on x86_64 and only NEON on aarch64. - Client and HTTP —
Client::newis fallible, installs rind's rustls provider before building reqwest, andrustls-no-providerkeepsrustls-platform-verifieras the root store, so https WHIP/WHEP still verifies. - Certificates — dimpl's self-signed generator uses
rind-rcgenandrind::rand::fill; the 26 fixture certs in moq-tokio/moq-relay/moq-webrtc now set serials explicitly, while production generation already did. - Cleanup —
aws-lc-rs,der,pkcs8, andsec1leave the workspace and moq-webrtc, workspace-hack is regenerated, the CTR scratch padding is gone,doc/bin/rtc.mdnames rind, andquest/m1/rind/rtc.mdis deleted with the epic,dead-api, and m3 WebRTC README reconciled.
Verified the rind 0.1.12 API against the calls the port makes, the remaining aws-lc-rs in the workspace (dev-only via jsonwebtoken), and that no production Rtc construction or stale str0m_aws_lc_rs reference remains. The only public API changes are Client::new -> Result and the two UnsupportedCpu variants, both listed under Impact on #[non_exhaustive] enums.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏
This was referenced Nov 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finishes quest/m1/rind/rtc.md: the vendored str0m and dimpl in moq-webrtc run on rind instead of aws-lc-rs.
Summary
vendor/dimpl/crypto/rind/): replacescrypto/aws_lc_rs/with rind-dimpl 0.1.12 ported in, trimmed to DTLS 1.2: ECDHE-ECDSA with AES-128/256-GCM and ChaCha20-Poly1305 over X25519, P-256, and P-384, ECDSA P-256/P-384 signing and verifying, SHA-256/384, HMAC, and the system RNG. It puts ChaCha20 first on CPUs without AES instructions, as rind-dimpl does. dimpl's PSK AES-128-CCM-8 suite stays on its RustCryptoccmcipher, so the same suites are offered. browser-only removes it.vendor/str0m_rind/): replacesstr0m_aws_lc_rswith rind-str0m (at moq-dev/rind@86567aa, which targeted the vendored str0m revision) ported to rind 0.1.12: SRTP AES-CM-HMAC-SHA1-80 and AEAD-AES-128/256-GCM, STUN MESSAGE-INTEGRITY (HMAC-SHA1), SHA-1/SHA-256 fingerprints, and DTLS through dimpl's rind provider. It also refuses an empty certificate or an unloadable key instead of letting dimpl panic.generate_self_signed_certificateusesrind-rcgen, andrcgenloses itsaws_lc_rsfeature. str0m's provider reuses that generator.Rtcmoq-webrtc builds now goes throughsession::rtc_config(), which first runsmoq_crypto::cpu::check(), so WHIP/WHEP accept and dial andp2ppeers fail withUnsupportedCpuinstead.rustls(aws-lc-rs) torustls-no-provider.Client::newinstalls rind's rustls provider throughmoq_crypto::provider::install_default, the same way moq-hls does.server/mux.rsandis/stun.rs, and the SHA-1 reference indtls-fingerprint.rs, use rind.der,pkcs8, andsec1dependencies, which only the aws-lc-rs signer used.aws-lc-rs,der, andsec1entries, now unused (cargo-shear fails on them).aws_lc_rsfeature from the unified build showed that 26 moq-tokio and moq-relay tests minted certificates without a serial number. They only passed because moq-webrtc's feature leaked in. They now set serials, as their neighbours already do. Production cert generation already set one.cargo tree -p moq-webrtc --all-features --target all -e normal,build -i aws-lc-rs(alsoaws-lc-sys,ring) prints nothing. With moq-webrtc off it, moq-cli's own graph holds none either.Verification
just check: 13660 tests pass, with lint and fmt clean.test/p2pis browser to browser), so I drove headless Playwright against a localmoq import rtc --listen … -- export rtc --listen …. Each browser published a fake camera and mic over WHIP, then played the broadcast back over WHEP:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, DTLS 1.2) with SRTPAEAD_AES_256_GCMin both directions, and 162 video frames decoded on playback.Impact
moq_webrtc::Client::new(config)now returnsmoq_webrtc::Result<Client>. Migrate withClient::new(config)?.moq_webrtc::Errorandmoq_webrtc::p2p::ErrorgainUnsupportedCpu(moq_crypto::cpu::UnsupportedCpu). Both enums are#[non_exhaustive].doc/bin/rtc.mdnames rind.Choices made without asking
legacyHMAC and digest paths.Config::buildwith no provider now returnsConfigError::UnsupportedCpuinstead of falling back to aws-lc-rs. str0m's process-default fallbackexpects rind, which is reached only after moq-webrtc's CPU check.[M]for its remaining CI guard and armv7 release work. The dead-api quest no longer lists this quest under Required.Caused by
No single PR. aws-lc-rs was the backend the vendored stack came with in moq-dev/moq#8163.
Suggested follow-ups
test/recipe that guards the stack's crypto and negotiation against real Chromium and Firefox.Models
Size: M
Implementer: Claude Code, claude-opus-5-5, high effort
(Written by Claude Opus 5.5 with high effort)
Review
Rewritten by
quest reviewafter each round.01a1b8e2-0e04-75e1-a40c-e5470789d7a0, round 1No actionable regressions were found, and the crypto adapters and caller updates appear consistent; builds and tests were not run, as instructed.