DtlsFactory.hxx

Go to the documentation of this file.

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
 
#ifdef USE_SSL
 
#ifndef DtlsFactory_hxx
#define DtlsFactory_hxx
 
#include <memory>
#include "DtlsTimer.hxx"
 
typedef struct x509_st X509;
typedef struct ssl_ctx_st SSL_CTX;
typedef struct ssl_st SSL;
typedef struct evp_pkey_st EVP_PKEY;
 
namespace dtls
{
class DtlsListener;
class DtlsSocket;
class DtlsSocketContext;
class DtlsTimerContext;
 
//Not threadsafe. Timers must fire in the same thread as dtls processing.
class DtlsFactory
{
   public:
     enum PacketType { rtp, dtls, stun, unknown};
     
     // Creates a DTLS SSL Context and enables srtp extension, also sets the private and public key cert
     DtlsFactory(std::unique_ptr<DtlsTimerContext> tc, X509 *cert, EVP_PKEY *privkey);
 
     // Note: this orphans any DtlsSockets you were stupid enough
     // not to free
     ~DtlsFactory();
     
     // Creates a new DtlsSocket to be used as a client
     DtlsSocket* createClient(std::unique_ptr<DtlsSocketContext> context);
 
     // Creates a new DtlsSocket to be used as a server
     DtlsSocket* createServer(std::unique_ptr<DtlsSocketContext> context);
 
     // Creates a DtlsListener, to create server DtlsSockets only for peers that complete a
     // cookie exchange (see DtlsListener)
     std::unique_ptr<DtlsListener> createListener();
 
     // Returns the fingerprint of the user cert that was passed into the constructor
     void getMyCertFingerprint(char *fingerprint);
 
     // Returns a reference to the timer context that was passed into the constructor
     DtlsTimerContext& getTimerContext() {return *mTimerContext;}
 
     // The default SrtpProfile used at construction time (default is: SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32)
     static const char* DefaultSrtpProfile; 
 
     // Changes the default SRTP profiles supported (default is: SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32)
     void setSrtpProfiles(const char *policyStr);
 
     // Changes the default DTLS Cipher Suites supported
     void setCipherSuites(const char *cipherSuites);
 
     // The largest UDP payload DTLS sends, for sockets created from now on: OpenSSL fits its
     // records to it, and they're sent in datagrams no larger, so a handshake flight doesn't
     // depend on IP fragmentation.  The default, 1200, leaves room for IPv6 and TURN framing.
     static const unsigned int DefaultMtu = 1200;
     void setMtu(unsigned int mtu) { mMtu = mtu; }
     unsigned int getMtu() const { return mMtu; }
 
     // Seconds a server socket's handshake may take, from its creation, before it fails - rather
     // than when OpenSSL stops retransmitting (after several minutes), so a peer that starts a handshake
     // and goes quiet doesn't hold the socket that long.  0 leaves it to OpenSSL.  Client sockets,
     // which we start towards the peer the SDP names, are left to OpenSSL.
     static const unsigned int DefaultServerHandshakeTimeout = 30;
     void setServerHandshakeTimeout(unsigned int seconds) { mServerHandshakeTimeout = seconds; }
 
     // Examines the first few bits of a packet to determine its type: rtp, dtls, stun or unknown
     static PacketType demuxPacket(const unsigned char *buf, size_t len);
     
private:
     friend class DtlsSocket;
     friend class DtlsListener;
 
     // DTLS cookies (RFC 6347 section 4.2.1): an HMAC of the peer's address under a random secret
     static int generateCookie(SSL* ssl, unsigned char* cookie, unsigned int* cookieLen);
     static int verifyCookie(SSL* ssl, const unsigned char* cookie, unsigned int cookieLen);
     static bool computeCookie(SSL* ssl, unsigned char* cookie, unsigned int* cookieLen);
 
     // The SSL ex_data index of the peer (const std::string*) a cookie is for
     static int cookiePeerIndex();
 
     SSL_CTX* mContext;
     std::unique_ptr<DtlsTimerContext> mTimerContext;
     X509 *mCert;
     unsigned char mCookieSecret[32];
     unsigned int mMtu = DefaultMtu;
     unsigned int mServerHandshakeTimeout = DefaultServerHandshakeTimeout;
};
 
}
#endif
 
#endif 
/* ====================================================================
 
 Copyright (c) 2026 SIP Spectrum, Inc. https://www.sipspectrum.com
 Copyright (c) 2007-2008, Eric Rescorla and Derek MacDonald
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are 
 met:
 
 1. Redistributions of source code must retain the above copyright 
    notice, this list of conditions and the following disclaimer. 
 
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution. 
 
 3. None of the contributors names may be used to endorse or promote 
    products derived from this software without specific prior written 
    permission. 
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ==================================================================== */