[myleshorton]

Adds rtcprobe, a probe and responder for testing plain pion WebRTC connections with all of Unbounded's own machinery removed: no freddie, no matchmaking, no volunteers.

Why

freddie.producer.outcomes shows that most volunteer attempts fail, about 14% of them after ICE connects. Production data alone can't separate three causes:

• hard NATs;
• pion's own limits;
• a censor interfering with the handshake.

This tool is the control. The responder runs somewhere with an open NAT, and the probe runs from the network under test.

There's a specific reason to suspect the third cause. common/covertdtls says Russia has DPI-filtered pion's DTLS fingerprint since 2026-03-30 (net4people/bbs#603), and covert-dtls shapes the ClientHello of native volunteers. But Unbounded's consumer makes the offer, so it's the DTLS server: it builds pion through newWebRTCAPI with no covert-dtls and sends pion's default ServerHello. The probe can test exactly that case.

What it does

• Probe output: one JSON line per attempt (plus a summary on stderr) with:
  • how long gathering, signaling, ICE, DTLS and data-channel open took;
  • the step it stalled at, if any (gather, signal, ice, dtls or sctp);
  • the probe's srflx addresses, to confirm the vantage point is where it should be;
  • a short transfer's throughput over the whole send, the burst rate, and loss.
• Probe settings:
  • transfer direction;
  • data-channel mode: unreliable (unordered, no retransmits, as Unbounded) or reliable;
  • message size (default 1,200 bytes, about one QUIC packet);
  • DTLS variant: default, alt (different cipher suites and curves), or covert (covert-dtls's randomize+mimic);
  • the responder's DTLS role. The default matches production, with the probe as DTLS server. With server, the probe sends the ClientHello instead.
• Hardening, since the responder sends traffic on request from a public VPS:
  • a shared token;
  • a self-signed TLS certificate whose SHA-256 the probe pins;
  • the probe refuses plain HTTP to a remote responder and doesn't follow redirects;
  • HTTP deadlines;
  • a cap on concurrent sessions;
  • exactly one data channel and one control channel accepted per session.

Findings so far (loopback)

Every arm connects within about 260 ms. Throughput on loopback, with no loss and no latency, is about 43 Mbps with 1,200-byte messages and about 85 Mbps with 16 KB messages. Unbounded sends one QUIC packet per data-channel message, so pion's per-message cost caps a single connection before the network does.

Testing

• go test -race ./rtcprobe/: ok. It covers:
  • probe against responder in process, for each direction and mode, the alt and covert variants, and both roles;
  • connect-only runs;
  • a bad token;
  • certificate pinning, both matching and mismatched;
  • refusal of remote plain HTTP and of redirects;
  • a peer opening duplicate control channels: the responder survives. I confirmed the test panics without the fix.
  • the throughput math when a transfer stalls;
  • the drain waiting for late messages.
• Local runs of rtcprobe serve / rtcprobe probe across the matrix: all connected; numbers above.
• go build ./..., and GOOS=js GOARCH=wasm go build ./cmd: ok. rtcprobe isn't part of the widget.
• Not tested: real vantage points. That's what the tool is for.

Risk

None to production: this is a new standalone command, and nothing imports it. go.mod moves pion/dtls/v3 from indirect to direct.

How to revert

Revert the merge commit.

Pre-PR review (local Codex gate)

• Rounds: 5, run at high reasoning effort for the public-facing responder. Final: CODEX GATE: verdict=approve critical=0 important=0 minor=0 preexisting=0 reviewed=14
• Reviewed at: f27b319
• Exit: approve
• Step back: not needed. Round 3 had no findings; round 4 added the covert arm.
• Round note: one round's range came out empty, because a failed build stopped the commit before the review ran. I discarded that round and reran it on the real commit (r5).
• Fixed:
  • rtcprobe/serve.go — signaling had no read, write or idle deadlines, so slow clients could tie up connections. (r1)
  • rtcprobe/common.go — duplicate ctl channels made the responder send on a nil channel and panic. (r1)
  • rtcprobe/probe.go — the token was sent over plain HTTP. Now TLS with a pinned certificate. (r1)
  • rtcprobe/serve.go, probe.go — counts were finalized 500 ms after done, though data can arrive later. Now it waits for every message (reliable) or for quiet (unreliable), and flags a drain that ran out of time. (r1)
  • rtcprobe/common.go — throughput counted only the burst. Now it's over the sender's whole span. (r1)
  • rtcprobe/probe.go — result write errors were ignored, and a failed answer write didn't release the session slot. (r1)
  • rtcprobe/common.go — send returned its result before the deferred send-duration update, so the r1 throughput fix had no effect. (r2)
  • rtcprobe/common.go — the unreliable drain could stop at once when done overtook the data. (r2)
  • rtcprobe/probe.go — redirects would have carried the token elsewhere. (r2)
• Dismissed: none
• Pre-existing (not introduced here, worth filing): none here. Separately, as a product finding: the consumer's ServerHello is pion's default, with no covert-dtls coverage.
• Proposed AGENTS.md additions: none

🤖 Generated with Claude Code

https://claude.ai/code/session_019DnqgLJf7p4sK87dDvktjx

[coderabbitai]

Warning

Review limit reached

Only developers with an assigned seat can use this organization's usage-based review budget, and seats here are assigned manually. Ask an admin to assign a seat, or change the review continuation mode in Billing.

Next included review available in 19 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d125230b-926a-4aec-a2d7-8c4c30a65692

Commits

Reviewing files that changed from the base of the PR and between 42b2ef0 and f27b319.

Files selected for processing: 6

• go.mod
• rtcprobe/common.go
• rtcprobe/main.go
• rtcprobe/probe.go
• rtcprobe/rtcprobe_test.go
• rtcprobe/serve.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🔵 Needs a closer look

The public-facing responder and DTLS diagnostic controls warrant final human review beyond the reported loopback validation.

No open issues 🎉

What changed in this PR

Adds rtcprobe, a standalone WebRTC diagnostic tool that isolates connection failures and throughput from Unbounded’s signaling, matchmaking, and volunteer infrastructure.

Changes:

• Adds probe and responder commands with connection timings, failure-stage reporting, and transfer measurements.
• Supports configurable DTLS variants, roles, and data-channel modes, with authenticated signaling, certificate pinning, and responder limits.
• Adds integration and regression tests for connections, signaling protections, duplicate channels, and measurement logic.

File	Description
rtcprobe/​serve.go	Implements the responder, session limits, signaling deadlines, and optional TLS.
rtcprobe/​rtcprobe_test.go	Tests probe/responder interoperability, signaling protections, and transfer accounting.
rtcprobe/​probe.go	Implements probe attempts, JSON results, summaries, and secure signaling.
rtcprobe/​main.go	Adds command dispatch and usage documentation.
rtcprobe/​common.go	Provides DTLS configuration, channel management, and transfer measurement helpers.
go.mod	Promotes the existing Pion DTLS dependency from indirect to direct.

_{Review effort: Balanced}