texas2step 2.2.1__tar.gz → 2.2.2__tar.gz

{texas2step-2.2.1 → texas2step-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: texas2step
-Version: 2.2.1
+Version: 2.2.2
 Summary: Web-centric throughput, latency, jitter and packet-loss measurement between endpoints.
 Project-URL: Homepage, https://github.com/robert-patrick-texas/texas2step
 Project-URL: Documentation, https://robert-patrick-texas.github.io/texas2step/

{texas2step-2.2.1 → texas2step-2.2.2}/docs/roadmap.md

@@ -64,6 +64,20 @@ links and footer credit. Three places still say texas2step:
 - [ ] **The API explorer** (`/api/docs`) is titled "texas2step - Swagger UI".
 - [ ] **The API tab's command-line examples** name the `texas2step` CLI.
 
+### Security
+
+- [ ] **DTLS 1.3 for the UDP probe.** The probe's data channel uses DTLS 1.2
+  ([On the wire](security.md#on-the-wire)): the server offers nothing newer, though Chrome
+  and Firefox now prefer DTLS 1.3. OpenSSL added DTLS 1.3 in 4.1.0 (October 2026). The
+  server's WebRTC library, aiortc, uses the OpenSSL bundled in the `cryptography`
+  package, 4.0 for now. Once `cryptography` ships OpenSSL 4.1, a release's `make upgrade`
+  brings it in. Then check what a browser negotiates (`tlsVersion` `FEFC` in the
+  connection's statistics, not `FEFD`). aiortc may need its DTLS context set to allow
+  1.3, and its 1.3 cipher suites set apart from its 1.2 cipher list. DTLS 1.3 would hide
+  the throwaway certificates, drop the CBC cipher suites and save a round trip, and later
+  allow post-quantum key exchange. The probe carries nothing secret, so this can wait for
+  the libraries.
+
 ### Updates
 
 [`texas2step update`](install.md#with-texas2step-update) could also:
@@ -102,6 +116,11 @@ links and footer credit. Three places still say texas2step:
 
 Newest first. Each release's notes have the details and its upgrade steps.
 
+### [2.2.2](https://github.com/robert-patrick-texas/texas2step/releases/tag/v2.2.2) (2026-10-24)
+
+- [x] UDP works in Firefox: Monitor, Diag and the Test page's packet loss no longer fall
+  back to TCP there.
+
 ### [2.2.1](https://github.com/robert-patrick-texas/texas2step/releases/tag/v2.2.1) (2026-10-24)
 
 - [x] Monitor gets a server back after an outage: HTTPS checks, then a new session, or

{texas2step-2.2.1 → texas2step-2.2.2}/src/texas2step/__init__.py

@@ -1,3 +1,3 @@
 """texas2step: web-centric throughput, latency, jitter and packet-loss measurement."""
 
-__version__ = "2.2.1"
+__version__ = "2.2.2"

{texas2step-2.2.1 → texas2step-2.2.2}/src/texas2step/rtc.py

@@ -85,11 +85,21 @@ RECEIVED_OVERHEAD = 150
 MDNS_CANDIDATE = re.compile(
     r"^a=candidate:\S+ \d+ \S+ \d+ \S+\.local \d+ [^\r\n]*\r?\n", re.M | re.I
 )
+END_OF_CANDIDATES = re.compile(r"^a=end-of-candidates\r?\n", re.M)
 
 
 def without_mdns(sdp: str) -> str:
-    """The offer without the candidates a browser names by multicast DNS."""
-    return MDNS_CANDIDATE.sub("", sdp)
+    """The offer without the candidates a browser names by multicast DNS.
+
+    An offer left with none loses its end-of-candidates too. Firefox sends one: aioice
+    would take the empty list as final, drop the stream's only component, and answer
+    with no candidates of its own, so no UDP session could open. Without it, aioice waits
+    for the browser's checks, as with Chrome, which sends none.
+    """
+    sdp = MDNS_CANDIDATE.sub("", sdp)
+    if not re.search(r"^a=candidate:", sdp, re.M):
+        sdp = END_OF_CANDIDATES.sub("", sdp)
+    return sdp
 
 
 def _bind_in_range(address: str, ports: tuple[int, int]) -> socket.socket | None: