Skip to content

Fix IPv6 connections on .NET Framework and TLS of the HTTPS tunnel - #159

Open
jimm98y wants to merge 2 commits into
ngraziano:dotnetcorefrom
jimm98y:fix/connection-address-family-and-tls
Open

jimm98y wants to merge 2 commits into
ngraziano:dotnetcorefrom
jimm98y:fix/connection-address-family-and-tls

Conversation

@jimm98y

@jimm98y jimm98y commented Oct 3, 2026

Copy link
Copy Markdown
Contributor
  • RtspTcpTransport.Reconnect() made its TcpClient without an address family, which on .NET Framework is IPv4 only, so a server reached over IPv6 could not be reconnected to. It now uses the family of the remote end point, with an IPv4 address mapped into IPv6 by a dual mode socket taken back to IPv4.
  • The HTTP tunnel connected both of its connections the same way. It now connects by name, which tries every address of the host.
  • RTSPHttpsTransport ran TLS inside the plain HTTP tunnel: the GET and POST went out unencrypted and the TLS handshake travelled in the base64 POST body, which an HTTPS server cannot read. Each connection is now TLS from its first byte, with the HTTP of the tunnel inside it.
  • RtspTcpTlsTransport checked the server certificate against the remote end point including its port, which never matches a certificate. It now uses the host name of the uri, or TargetHost for a connection made elsewhere, falling back to the remote address.

- RtspTcpTransport.Reconnect() made its TcpClient without an address
  family, which on .NET Framework is IPv4 only, so a server reached over
  IPv6 could not be reconnected to. It now uses the family of the remote
  end point, with an IPv4 address mapped into IPv6 by a dual mode socket
  taken back to IPv4.
- The HTTP tunnel connected both of its connections the same way. It now
  connects by name, which tries every address of the host.
- RTSPHttpsTransport ran TLS inside the plain HTTP tunnel: the GET and POST
  went out unencrypted and the TLS handshake travelled in the base64 POST
  body, which an HTTPS server cannot read. Each connection is now TLS from
  its first byte, with the HTTP of the tunnel inside it.
- RtspTcpTlsTransport checked the server certificate against the remote
  end point including its port, which never matches a certificate. It now
  uses the host name of the uri, or TargetHost for a connection made
  elsewhere, falling back to the remote address.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@Revan1985

Copy link
Copy Markdown

Just to ask.
I am watching this pull, but I found a problem with the TcpClient.
In your code, you use _outClient.Write(...), but Tcp does not have direct Write, must use _outClient.GetStream().Write(...).
I am missing something?

@jimm98y

jimm98y commented Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Do you mean "_outStream.Write"?

@Revan1985

Copy link
Copy Markdown

Do you mean "_outStream.Write"?

Ok, sorry, I am completely gone.
I need a pause from work XD

@jimm98y

jimm98y commented Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

No worries, the same here 😃

@ngraziano

ngraziano commented Oct 6, 2026 •

Copy link
Copy Markdown
Owner

Thanks for the PR, I had already make some small change in my local on the subject of RtspTcpTlsTransport, I will check your change to resolve the conflict but it may take me some time.

After a quick look I think a mix of your solution with an public property and my solution (setting the value in constructor to always have a value and not handle null, is what i will take)

Resolve the conflict in RtspTcpTlsTransport by taking upstream's
TargetHost, which the constructors set from the uri or the remote
address.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants