anotherim/anotherim-desktop
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Add initial support for DTLS-SRTP

Browse source
This commit is contained in:
fiaxh 2021-03-24 14:12:42 +01:00
parent 4b230808b9
commit ec35f95e13
14 changed files with 791 additions and 42 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
cmake/FindGnuTLS.cmake Normal file
View file

@ -0,0 +1,13 @@
include(PkgConfigWithFallback)
find_pkg_config_with_fallback(GnuTLS
PKG_CONFIG_NAME gnutls
LIB_NAMES gnutls
INCLUDE_NAMES gnutls/gnutls.h
INCLUDE_DIR_SUFFIXES gnutls gnutls/include
DEPENDS GLib
)
include(FindPackageHandleStandardArgs)
find_package_handle_standard_args(GnuTLS
REQUIRED_VARS GnuTLS_LIBRARY
VERSION_VAR GnuTLS_VERSION)

22
libdino/src/service/calls.vala
View file

@ -125,7 +125,7 @@ namespace Dino {
call.state = Call.State.ESTABLISHING;
if (sessions.has_key(call)) {
foreach (Xep.Jingle.Content content in sessions[call].contents.values) {
foreach (Xep.Jingle.Content content in sessions[call].contents) {
content.accept();
}
} else {
@ -146,7 +146,7 @@ namespace Dino {
call.state = Call.State.DECLINED;
if (sessions.has_key(call)) {
foreach (Xep.Jingle.Content content in sessions[call].contents.values) {
foreach (Xep.Jingle.Content content in sessions[call].contents) {
content.reject();
}
remove_call_from_datastructures(call);
@ -223,16 +223,6 @@ namespace Dino {
foreach (Jid full_jid in full_jids) {
bool supports_rtc = yield stream.get_module(Xep.JingleRtp.Module.IDENTITY).is_available(stream, full_jid);
if (!supports_rtc) continue;
// dtls support indicates webRTC support. Clients tend to not do normal ice udp in that case. Except Dino.
bool supports_dtls = yield stream_interactor.get_module(EntityInfo.IDENTITY).has_feature(conversation.account, full_jid, "urn:xmpp:jingle:apps:dtls:0");
if (supports_dtls) {
Xep.ServiceDiscovery.Identity? identity = yield stream_interactor.get_module(EntityInfo.IDENTITY).get_identity(conversation.account, full_jid);
bool is_dino = identity != null && identity.name == "Dino";
if (!is_dino) continue;
}
ret.add(full_jid);
}
return ret;
@ -253,7 +243,7 @@ namespace Dino {
private void on_incoming_call(Account account, Xep.Jingle.Session session) {
bool counterpart_wants_video = false;
foreach (Xep.Jingle.Content content in session.contents.values) {
foreach (Xep.Jingle.Content content in session.contents) {
Xep.JingleRtp.Parameters? rtp_content_parameter = content.content_params as Xep.JingleRtp.Parameters;
if (rtp_content_parameter == null) continue;
if (rtp_content_parameter.media == "video" && session.senders_include_us(content.senders)) {
@ -391,7 +381,7 @@ namespace Dino {
on_incoming_content_add(stream, call, session, content)
);
foreach (Xep.Jingle.Content content in session.contents.values) {
foreach (Xep.Jingle.Content content in session.contents) {
Xep.JingleRtp.Parameters? rtp_content_parameter = content.content_params as Xep.JingleRtp.Parameters;
if (rtp_content_parameter == null) continue;
@ -446,7 +436,7 @@ namespace Dino {
Xep.Jingle.Module jingle_module = stream_interactor.module_manager.get_module(account, Xep.Jingle.Module.IDENTITY);
jingle_module.session_initiate_received.connect((stream, session) => {
foreach (Xep.Jingle.Content content in session.contents.values) {
foreach (Xep.Jingle.Content content in session.contents) {
Xep.JingleRtp.Parameters? rtp_content_parameter = content.content_params as Xep.JingleRtp.Parameters;
if (rtp_content_parameter != null) {
on_incoming_call(account, session);
@ -460,7 +450,7 @@ namespace Dino {
if (!call_by_sid[account].has_key(session.sid)) return;
Call call = call_by_sid[account][session.sid];
foreach (Xep.Jingle.Content content in session.contents.values) {
foreach (Xep.Jingle.Content content in session.contents) {
if (name == null || content.content_name == name) {
Xep.JingleRtp.Parameters? rtp_content_parameter = content.content_params as Xep.JingleRtp.Parameters;
if (rtp_content_parameter != null) {

7
plugins/ice/CMakeLists.txt
View file

@ -2,6 +2,7 @@ find_packages(ICE_PACKAGES REQUIRED
Gee
GLib
GModule
GnuTLS
GObject
GTK3
Nice
@ -9,8 +10,9 @@ find_packages(ICE_PACKAGES REQUIRED
vala_precompile(ICE_VALA_C
SOURCES
src/plugin.vala
src/dtls_srtp.vala
src/module.vala
src/plugin.vala
src/transport_parameters.vala
src/util.vala
src/register_plugin.vala
@ -18,6 +20,7 @@ CUSTOM_VAPIS
${CMAKE_BINARY_DIR}/exports/xmpp-vala.vapi
${CMAKE_BINARY_DIR}/exports/dino.vapi
${CMAKE_BINARY_DIR}/exports/qlite.vapi
${CMAKE_BINARY_DIR}/exports/crypto.vapi
PACKAGES
${ICE_PACKAGES}
OPTIONS
@ -26,7 +29,7 @@ OPTIONS
add_definitions(${VALA_CFLAGS} -DG_LOG_DOMAIN="ice")
add_library(ice SHARED ${ICE_VALA_C})
target_link_libraries(ice libdino ${ICE_PACKAGES})
target_link_libraries(ice libdino crypto-vala ${ICE_PACKAGES})
set_target_properties(ice PROPERTIES PREFIX "")
set_target_properties(ice PROPERTIES LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/plugins/)

247
plugins/ice/src/dtls_srtp.vala Normal file
View file

@ -0,0 +1,247 @@
using GnuTLS;
public class DtlsSrtp {
public signal void send_data(uint8[] data);
private X509.Certificate[] own_cert;
private X509.PrivateKey private_key;
private Cond buffer_cond = new Cond();
private Mutex buffer_mutex = new Mutex();
private Gee.LinkedList<Bytes> buffer_queue = new Gee.LinkedList<Bytes>();
private uint pull_timeout = uint.MAX;
private string peer_fingerprint;
private Crypto.Srtp.Session encrypt_session;
private Crypto.Srtp.Session decrypt_session;
public static DtlsSrtp setup() throws GLib.Error {
var obj = new DtlsSrtp();
obj.generate_credentials();
return obj;
}
internal string get_own_fingerprint(DigestAlgorithm digest_algo) {
return format_certificate(own_cert[0], digest_algo);
}
public void set_peer_fingerprint(string fingerprint) {
this.peer_fingerprint = fingerprint;
}
public uint8[] process_incoming_data(uint component_id, uint8[] data) {
if (decrypt_session != null) {
if (component_id == 1) return decrypt_session.decrypt_rtp(data);
if (component_id == 2) return decrypt_session.decrypt_rtcp(data);
} else if (component_id == 1) {
on_data_rec(data);
}
return null;
}
public uint8[] process_outgoing_data(uint component_id, uint8[] data) {
if (encrypt_session != null) {
if (component_id == 1) return encrypt_session.encrypt_rtp(data);
if (component_id == 2) return encrypt_session.encrypt_rtcp(data);
}
return null;
}
public void on_data_rec(owned uint8[] data) {
buffer_mutex.lock();
buffer_queue.add(new Bytes.take(data));
buffer_cond.signal();
buffer_mutex.unlock();
}
private void generate_credentials() throws GLib.Error {
int err = 0;
private_key = X509.PrivateKey.create();
err = private_key.generate(PKAlgorithm.RSA, 2048);
throw_if_error(err);
var start_time = new DateTime.now_local().add_days(1);
var end_time = start_time.add_days(2);
X509.Certificate cert = X509.Certificate.create();
cert.set_key(private_key);
cert.set_version(1);
cert.set_activation_time ((time_t) start_time.to_unix ());
cert.set_expiration_time ((time_t) end_time.to_unix ());
uint32 serial = 1;
cert.set_serial(&serial, sizeof(uint32));
cert.sign(cert, private_key);
own_cert = new X509.Certificate[] { (owned)cert };
}
public async void setup_dtls_connection(bool server) {
InitFlags server_or_client = server ? InitFlags.SERVER : InitFlags.CLIENT;
debug("Setting up DTLS connection. We're %s", server_or_client.to_string());
CertificateCredentials cert_cred = CertificateCredentials.create();
int err = cert_cred.set_x509_key(own_cert, private_key);
throw_if_error(err);
Session? session = Session.create(server_or_client | InitFlags.DATAGRAM);
session.enable_heartbeat(1);
session.set_srtp_profile_direct("SRTP_AES128_CM_HMAC_SHA1_80");
session.set_credentials(GnuTLS.CredentialsType.CERTIFICATE, cert_cred);
session.server_set_request(CertificateRequest.REQUEST);
session.set_priority_from_string("NORMAL:!VERS-TLS-ALL:+VERS-DTLS-ALL:+CTYPE-CLI-X509");
session.set_transport_pointer(this);
session.set_pull_function(pull_function);
session.set_pull_timeout_function(pull_timeout_function);
session.set_push_function(push_function);
session.set_verify_function(verify_function);
Thread<int> thread = new Thread<int> (null, () => {
DateTime maximum_time = new DateTime.now_utc().add_seconds(20);
do {
err = session.handshake();
DateTime current_time = new DateTime.now_utc();
if (maximum_time.compare(current_time) < 0) {
warning("DTLS handshake timeouted");
return -1;
}
} while (err < 0 && !((ErrorCode)err).is_fatal());
Idle.add(setup_dtls_connection.callback);
return err;
});
yield;
err = thread.join();
uint8[] km = new uint8[150];
Datum? client_key, client_salt, server_key, server_salt;
session.get_srtp_keys(km, km.length, out client_key, out client_salt, out server_key, out server_salt);
if (client_key == null || client_salt == null || server_key == null || server_salt == null) {
warning("SRTP client/server key/salt null");
}
Crypto.Srtp.Session encrypt_session = new Crypto.Srtp.Session(Crypto.Srtp.Encryption.AES_CM, Crypto.Srtp.Authentication.HMAC_SHA1, 10, Crypto.Srtp.Prf.AES_CM, 0);
Crypto.Srtp.Session decrypt_session = new Crypto.Srtp.Session(Crypto.Srtp.Encryption.AES_CM, Crypto.Srtp.Authentication.HMAC_SHA1, 10, Crypto.Srtp.Prf.AES_CM, 0);
if (server) {
encrypt_session.setkey(server_key.extract(), server_salt.extract());
decrypt_session.setkey(client_key.extract(), client_salt.extract());
} else {
encrypt_session.setkey(client_key.extract(), client_salt.extract());
decrypt_session.setkey(server_key.extract(), server_salt.extract());
}
this.encrypt_session = (owned)encrypt_session;
this.decrypt_session = (owned)decrypt_session;
}
private static ssize_t pull_function(void* transport_ptr, uint8[] buffer) {
DtlsSrtp self = transport_ptr as DtlsSrtp;
self.buffer_mutex.lock();
while (self.buffer_queue.size == 0) {
self.buffer_cond.wait(self.buffer_mutex);
}
owned Bytes data = self.buffer_queue.remove_at(0);
self.buffer_mutex.unlock();
uint8[] data_uint8 = Bytes.unref_to_data(data);
Memory.copy(buffer, data_uint8, data_uint8.length);
// The callback should return 0 on connection termination, a positive number indicating the number of bytes received, and -1 on error.
return (ssize_t)data.length;
}
private static int pull_timeout_function(void* transport_ptr, uint ms) {
DtlsSrtp self = transport_ptr as DtlsSrtp;
DateTime current_time = new DateTime.now_utc();
current_time.add_seconds(ms/1000);
int64 end_time = current_time.to_unix();
self.buffer_mutex.lock();
while (self.buffer_queue.size == 0) {
self.buffer_cond.wait_until(self.buffer_mutex, end_time);
DateTime new_current_time = new DateTime.now_utc();
if (new_current_time.compare(current_time) > 0) {
break;
}
}
self.buffer_mutex.unlock();
// The callback should return 0 on timeout, a positive number if data can be received, and -1 on error.
return 1;
}
private static ssize_t push_function(void* transport_ptr, uint8[] buffer) {
DtlsSrtp self = transport_ptr as DtlsSrtp;
self.send_data(buffer);
// The callback should return a positive number indicating the bytes sent, and -1 on error.
return (ssize_t)buffer.length;
}
private static int verify_function(Session session) {
DtlsSrtp self = session.get_transport_pointer() as DtlsSrtp;
try {
bool valid = self.verify_peer_cert(session);
if (!valid) {
warning("DTLS certificate invalid. Aborting handshake.");
return 1;
}
} catch (Error e) {
warning("Error during DTLS certificate validation: %s. Aborting handshake.", e.message);
return 1;
}
// The callback function should return 0 for the handshake to continue or non-zero to terminate.
return 0;
}
private bool verify_peer_cert(Session session) throws GLib.Error {
unowned Datum[] cert_datums = session.get_peer_certificates();
if (cert_datums.length == 0) {
warning("No peer certs");
return false;
}
if (cert_datums.length > 1) warning("More than one peer cert");
X509.Certificate peer_cert = X509.Certificate.create();
peer_cert.import(ref cert_datums[0], CertificateFormat.DER);
string peer_fp_str = format_certificate(peer_cert, DigestAlgorithm.SHA256);
if (peer_fp_str.down() != this.peer_fingerprint.down()) {
warning("First cert in peer cert list doesn't equal advertised one %s vs %s", peer_fp_str, this.peer_fingerprint);
return false;
}
return true;
}
private string format_certificate(X509.Certificate certificate, DigestAlgorithm digest_algo) {
uint8[] buf = new uint8[512];
size_t buf_out_size = 512;
certificate.get_fingerprint(digest_algo, buf, ref buf_out_size);
var sb = new StringBuilder();
for (int i = 0; i < buf_out_size; i++) {
sb.append("%02x".printf(buf[i]));
if (i < buf_out_size - 1) {
sb.append(":");
}
}
return sb.str;
}
private uint8[] uint8_pt_to_a(uint8* data, uint size) {
uint8[size] ret = new uint8[size];
for (int i = 0; i < size; i++) {
ret[i] = data[i];
}
return ret;
}
}

48
plugins/ice/src/transport_parameters.vala
View file

@ -9,9 +9,11 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
private bool we_want_connection;
private bool remote_credentials_set;
private Map<uint8, DatagramConnection> connections = new HashMap<uint8, DatagramConnection>();
private DtlsSrtp? dtls_srtp;
private class DatagramConnection : Jingle.DatagramConnection {
private Nice.Agent agent;
private DtlsSrtp? dtls_srtp;
private uint stream_id;
private string? error;
private ulong sent;
@ -20,8 +22,9 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
private ulong recv_reported;
private ulong datagram_received_id;
public DatagramConnection(Nice.Agent agent, uint stream_id, uint8 component_id) {
public DatagramConnection(Nice.Agent agent, DtlsSrtp? dtls_srtp, uint stream_id, uint8 component_id) {
this.agent = agent;
this.dtls_srtp = dtls_srtp;
this.stream_id = stream_id;
this.component_id = component_id;
this.datagram_received_id = this.datagram_received.connect((datagram) => {
@ -41,7 +44,12 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
public override void send_datagram(Bytes datagram) {
if (this.agent != null && is_component_ready(agent, stream_id, component_id)) {
agent.send(stream_id, component_id, datagram.get_data());
uint8[] encrypted_data = null;
if (dtls_srtp != null) {
encrypted_data = dtls_srtp.process_outgoing_data(component_id, datagram.get_data());
if (encrypted_data == null) return;
}
agent.send(stream_id, component_id, encrypted_data ?? datagram.get_data());
sent += datagram.length;
if (sent > sent_reported + 100000) {
debug("Sent %lu bytes via stream %u component %u", sent, stream_id, component_id);
@ -55,6 +63,20 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
base(components, local_full_jid, peer_full_jid, node);
this.we_want_connection = (node == null);
this.agent = agent;
if (this.peer_fingerprint != null || !incoming) {
dtls_srtp = DtlsSrtp.setup();
dtls_srtp.send_data.connect((data) => {
agent.send(stream_id, 1, data);
});
this.own_fingerprint = dtls_srtp.get_own_fingerprint(GnuTLS.DigestAlgorithm.SHA256);
if (incoming) {
dtls_srtp.set_peer_fingerprint(this.peer_fingerprint);
} else {
dtls_srtp.setup_dtls_connection(true);
}
}
agent.candidate_gathering_done.connect(on_candidate_gathering_done);
agent.initial_binding_request_received.connect(on_initial_binding_request_received);
agent.component_state_changed.connect(on_component_state_changed);
@ -112,6 +134,12 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
public override void handle_transport_accept(StanzaNode transport) throws Jingle.IqError {
debug("on_transport_accept from %s", peer_full_jid.to_string());
base.handle_transport_accept(transport);
if (dtls_srtp != null && peer_fingerprint != null) {
dtls_srtp.set_peer_fingerprint(this.peer_fingerprint);
} else {
dtls_srtp = null;
}
}
public override void handle_transport_info(StanzaNode transport) throws Jingle.IqError {
@ -163,9 +191,16 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
int new_candidates = agent.set_remote_candidates(stream_id, i, candidates);
debug("Initiated component %u with %i remote candidates", i, new_candidates);
connections[i] = new DatagramConnection(agent, stream_id, i);
connections[i] = new DatagramConnection(agent, dtls_srtp, stream_id, i);
content.set_transport_connection(connections[i], i);
}
if (incoming && dtls_srtp != null) {
Jingle.DatagramConnection rtp_datagram = (Jingle.DatagramConnection) content.get_transport_connection(1);
rtp_datagram.notify["ready"].connect(() => {
dtls_srtp.setup_dtls_connection(false);
});
}
base.create_transport_connection(stream, content);
}
@ -194,12 +229,17 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
private void on_recv(Nice.Agent agent, uint stream_id, uint component_id, uint8[] data) {
if (stream_id != this.stream_id) return;
uint8[] decrypt_data = null;
if (dtls_srtp != null) {
decrypt_data = dtls_srtp.process_incoming_data(component_id, data);
if (decrypt_data == null) return;
}
may_consider_ready(stream_id, component_id);
if (connections.has_key((uint8) component_id)) {
if (!connections[(uint8) component_id].ready) {
debug("on_recv stream %u component %u when state %s", stream_id, component_id, agent.get_component_state(stream_id, component_id).to_string());
}
connections[(uint8) component_id].datagram_received(new Bytes(data));
connections[(uint8) component_id].datagram_received(new Bytes(decrypt_data ?? data));
} else {
debug("on_recv stream %u component %u length %u", stream_id, component_id, data.length);
}

419
plugins/ice/vapi/gnutls.vapi Normal file
View file

@ -0,0 +1,419 @@
[CCode (cprefix = "gnutls_", lower_case_cprefix = "gnutls_", cheader_filename = "gnutls/gnutls.h")]
namespace GnuTLS {
public int global_init();
[CCode (cname = "gnutls_pull_func", has_target = false)]
public delegate ssize_t PullFunc(void* transport_ptr, [CCode (ctype = "void*", array_length_type="size_t")] uint8[] array);
[CCode (cname = "gnutls_pull_timeout_func", has_target = false)]
public delegate int PullTimeoutFunc(void* transport_ptr, uint ms);
[CCode (cname = "gnutls_push_func", has_target = false)]
public delegate ssize_t PushFunc(void* transport_ptr, [CCode (ctype = "void*", array_length_type="size_t")] uint8[] array);
[CCode (cname = "gnutls_certificate_verify_function", has_target = false)]
public delegate int VerifyFunc(Session session);
[Compact]
[CCode (cname = "struct gnutls_session_int", free_function = "gnutls_deinit")]
public class Session {
public static Session? create(int con_end) throws GLib.Error {
Session result;
var ret = init(out result, con_end);
throw_if_error(ret);
return result;
}
[CCode (cname = "gnutls_init")]
private static int init(out Session session, int con_end);
[CCode (cname = "gnutls_transport_set_push_function")]
public void set_push_function(PushFunc func);
[CCode (cname = "gnutls_transport_set_pull_function")]
public void set_pull_function(PullFunc func);
[CCode (cname = "gnutls_transport_set_pull_timeout_function")]
public void set_pull_timeout_function(PullTimeoutFunc func);
[CCode (cname = "gnutls_transport_set_ptr")]
public void set_transport_pointer(void* ptr);
[CCode (cname = "gnutls_transport_get_ptr")]
public void* get_transport_pointer();
[CCode (cname = "gnutls_heartbeat_enable")]
public int enable_heartbeat(uint type);
[CCode (cname = "gnutls_certificate_server_set_request")]
public void server_set_request(CertificateRequest req);
[CCode (cname = "gnutls_credentials_set")]
public int set_credentials_(CredentialsType type, void* cred);
[CCode (cname = "gnutls_credentials_set_")]
public void set_credentials(CredentialsType type, void* cred) throws GLib.Error {
int err = set_credentials_(type, cred);
throw_if_error(err);
}
[CCode (cname = "gnutls_priority_set_direct")]
public int set_priority_from_string_(string priority, out unowned string err_pos = null);
[CCode (cname = "gnutls_priority_set_direct_")]
public void set_priority_from_string(string priority, out unowned string err_pos = null) throws GLib.Error {
int err = set_priority_from_string_(priority, out err_pos);
throw_if_error(err);
}
[CCode (cname = "gnutls_srtp_set_profile_direct")]
public int set_srtp_profile_direct_(string profiles, out unowned string err_pos = null);
[CCode (cname = "gnutls_srtp_set_profile_direct_")]
public void set_srtp_profile_direct(string profiles, out unowned string err_pos = null) throws GLib.Error {
int err = set_srtp_profile_direct_(profiles, out err_pos);
throw_if_error(err);
}
[CCode (cname = "gnutls_transport_set_int")]
public void transport_set_int(int fd);
[CCode (cname = "gnutls_handshake")]
public int handshake();
[CCode (cname = "gnutls_srtp_get_keys")]
public int get_srtp_keys_(void *key_material, uint32 key_material_size, out Datum client_key, out Datum client_salt, out Datum server_key, out Datum server_salt);
[CCode (cname = "gnutls_srtp_get_keys_")]
public void get_srtp_keys(void *key_material, uint32 key_material_size, out Datum client_key, out Datum client_salt, out Datum server_key, out Datum server_salt) throws GLib.Error {
get_srtp_keys_(key_material, key_material_size, out client_key, out client_salt, out server_key, out server_salt);
}
[CCode (cname = "gnutls_certificate_get_peers", array_length_type = "unsigned int")]
public unowned Datum[]? get_peer_certificates();
[CCode (cname = "gnutls_session_set_verify_function")]
public void set_verify_function(VerifyFunc func);
}
[Compact]
[CCode (cname = "struct gnutls_certificate_credentials_st", free_function = "gnutls_certificate_free_credentials", cprefix = "gnutls_certificate_")]
public class CertificateCredentials {
[CCode (cname = "gnutls_certificate_allocate_credentials")]
private static int allocate(out CertificateCredentials credentials);
public static CertificateCredentials create() throws GLib.Error {
CertificateCredentials result;
var ret = allocate (out result);
throw_if_error(ret);
return result;
}
public void get_x509_crt(uint index, [CCode (array_length_type = "unsigned int")] out unowned X509.Certificate[] x509_ca_list);
public int set_x509_key(X509.Certificate[] cert_list, X509.PrivateKey key);
}
[CCode (cheader_filename = "gnutls/x509.h", cprefix = "GNUTLS_")]
namespace X509 {
[Compact]
[CCode (cname = "struct gnutls_x509_crt_int", cprefix = "gnutls_x509_crt_", free_function = "gnutls_x509_crt_deinit")]
public class Certificate {
[CCode (cname = "gnutls_x509_crt_init")]
private static int init (out Certificate cert);
public static Certificate create() throws GLib.Error {
Certificate result;
var ret = init (out result);
throw_if_error(ret);
return result;
}
[CCode (cname = "gnutls_x509_crt_import")]
public int import_(ref Datum data, CertificateFormat format);
[CCode (cname = "gnutls_x509_crt_import_")]
public void import(ref Datum data, CertificateFormat format) throws GLib.Error {
int err = import_(ref data, format);
throw_if_error(err);
}
[CCode (cname = "gnutls_x509_crt_set_version")]
public int set_version_(uint version);
[CCode (cname = "gnutls_x509_crt_set_version_")]
public void set_version(uint version) throws GLib.Error {
int err = set_version_(version);
throw_if_error(err);
}
[CCode (cname = "gnutls_x509_crt_set_key")]
public int set_key_(PrivateKey key);
[CCode (cname = "gnutls_x509_crt_set_key_")]
public void set_key(PrivateKey key) throws GLib.Error {
int err = set_key_(key);
throw_if_error(err);
}
[CCode (cname = "gnutls_x509_crt_set_activation_time")]
public int set_activation_time_(time_t act_time);
[CCode (cname = "gnutls_x509_crt_set_activation_time_")]
public void set_activation_time(time_t act_time) throws GLib.Error {
int err = set_activation_time_(act_time);
throw_if_error(err);
}
[CCode (cname = "gnutls_x509_crt_set_expiration_time")]
public int set_expiration_time_(time_t exp_time);
[CCode (cname = "gnutls_x509_crt_set_expiration_time_")]
public void set_expiration_time(time_t exp_time) throws GLib.Error {
int err = set_expiration_time_(exp_time);
throw_if_error(err);
}
[CCode (cname = "gnutls_x509_crt_set_serial")]
public int set_serial_(void* serial, size_t serial_size);
[CCode (cname = "gnutls_x509_crt_set_serial_")]
public void set_serial(void* serial, size_t serial_size) throws GLib.Error {
int err = set_serial_(serial, serial_size);
throw_if_error(err);
}
[CCode (cname = "gnutls_x509_crt_sign")]
public int sign_(Certificate issuer, PrivateKey issuer_key);
[CCode (cname = "gnutls_x509_crt_sign_")]
public void sign(Certificate issuer, PrivateKey issuer_key) throws GLib.Error {
int err = sign_(issuer, issuer_key);
throw_if_error(err);
}
[CCode (cname = "gnutls_x509_crt_get_fingerprint")]
public int get_fingerprint_(DigestAlgorithm algo, void* buf, ref size_t buf_size);
[CCode (cname = "gnutls_x509_crt_get_fingerprint_")]
public void get_fingerprint(DigestAlgorithm algo, void* buf, ref size_t buf_size) throws GLib.Error {
int err = get_fingerprint_(algo, buf, ref buf_size);
throw_if_error(err);
}
}
[Compact]
[CCode (cname = "struct gnutls_x509_privkey_int", cprefix = "gnutls_x509_privkey_", free_function = "gnutls_x509_privkey_deinit")]
public class PrivateKey {
private static int init (out PrivateKey key);
public static PrivateKey create () throws GLib.Error {
PrivateKey result;
var ret = init (out result);
throw_if_error(ret);
return result;
}
public int generate(PKAlgorithm algo, uint bits, uint flags = 0);
}
}
[CCode (cname = "gnutls_certificate_request_t", cprefix = "GNUTLS_CERT_", has_type_id = false)]
public enum CertificateRequest {
IGNORE,
REQUEST,
REQUIRE
}
[CCode (cname = "gnutls_pk_algorithm_t", cprefix = "GNUTLS_PK_", has_type_id = false)]
public enum PKAlgorithm {
UNKNOWN,
RSA,
DSA;
}
[CCode (cname = "gnutls_digest_algorithm_t", cprefix = "GNUTLS_DIG_", has_type_id = false)]
public enum DigestAlgorithm {
NULL,
MD5,
SHA1,
RMD160,
MD2,
SHA224,
SHA256,
SHA384,
SHA512;
}
[Flags]
[CCode (cname = "gnutls_init_flags_t", cprefix = "GNUTLS_", has_type_id = false)]
public enum InitFlags {
SERVER,
CLIENT,
DATAGRAM
}
[CCode (cname = "gnutls_credentials_type_t", cprefix = "GNUTLS_CRD_", has_type_id = false)]
public enum CredentialsType {
CERTIFICATE,
ANON,
SRP,
PSK,
IA
}
[CCode (cname = "gnutls_x509_crt_fmt_t", cprefix = "GNUTLS_X509_FMT_", has_type_id = false)]
public enum CertificateFormat {
DER,
PEM
}
[Flags]
[CCode (cname = "gnutls_certificate_status_t", cprefix = "GNUTLS_CERT_", has_type_id = false)]
public enum CertificateStatus {
INVALID, // will be set if the certificate was not verified.
REVOKED, // in X.509 this will be set only if CRLs are checked
SIGNER_NOT_FOUND,
SIGNER_NOT_CA,
INSECURE_ALGORITHM
}
[SimpleType]
[CCode (cname = "gnutls_datum_t", has_type_id = false)]
public struct Datum {
public uint8* data;
public uint size;
public uint8[] extract() {
uint8[size] ret = new uint8[size];
for (int i = 0; i < size; i++) {
ret[i] = data[i];
}
return ret;
}
}
// Gnutls error codes. The mapping to a TLS alert is also shown in comments.
[CCode (cname = "int", cprefix = "GNUTLS_E_", lower_case_cprefix = "gnutls_error_", has_type_id = false)]
public enum ErrorCode {
SUCCESS,
UNKNOWN_COMPRESSION_ALGORITHM,
UNKNOWN_CIPHER_TYPE,
LARGE_PACKET,
UNSUPPORTED_VERSION_PACKET, // GNUTLS_A_PROTOCOL_VERSION
UNEXPECTED_PACKET_LENGTH, // GNUTLS_A_RECORD_OVERFLOW
INVALID_SESSION,
FATAL_ALERT_RECEIVED,
UNEXPECTED_PACKET, // GNUTLS_A_UNEXPECTED_MESSAGE
WARNING_ALERT_RECEIVED,
ERROR_IN_FINISHED_PACKET,
UNEXPECTED_HANDSHAKE_PACKET,
UNKNOWN_CIPHER_SUITE, // GNUTLS_A_HANDSHAKE_FAILURE
UNWANTED_ALGORITHM,
MPI_SCAN_FAILED,
DECRYPTION_FAILED, // GNUTLS_A_DECRYPTION_FAILED, GNUTLS_A_BAD_RECORD_MAC
MEMORY_ERROR,
DECOMPRESSION_FAILED, // GNUTLS_A_DECOMPRESSION_FAILURE
COMPRESSION_FAILED,
AGAIN,
EXPIRED,
DB_ERROR,
SRP_PWD_ERROR,
INSUFFICIENT_CREDENTIALS,
HASH_FAILED,
BASE64_DECODING_ERROR,
MPI_PRINT_FAILED,
REHANDSHAKE, // GNUTLS_A_NO_RENEGOTIATION
GOT_APPLICATION_DATA,
RECORD_LIMIT_REACHED,
ENCRYPTION_FAILED,
PK_ENCRYPTION_FAILED,
PK_DECRYPTION_FAILED,
PK_SIGN_FAILED,
X509_UNSUPPORTED_CRITICAL_EXTENSION,
KEY_USAGE_VIOLATION,
NO_CERTIFICATE_FOUND, // GNUTLS_A_BAD_CERTIFICATE
INVALID_REQUEST,
SHORT_MEMORY_BUFFER,
INTERRUPTED,
PUSH_ERROR,
PULL_ERROR,
RECEIVED_ILLEGAL_PARAMETER, // GNUTLS_A_ILLEGAL_PARAMETER
REQUESTED_DATA_NOT_AVAILABLE,
PKCS1_WRONG_PAD,
RECEIVED_ILLEGAL_EXTENSION,
INTERNAL_ERROR,
DH_PRIME_UNACCEPTABLE,
FILE_ERROR,
TOO_MANY_EMPTY_PACKETS,
UNKNOWN_PK_ALGORITHM,
// returned if libextra functionality was requested but
// gnutls_global_init_extra() was not called.
INIT_LIBEXTRA,
LIBRARY_VERSION_MISMATCH,
// returned if you need to generate temporary RSA
// parameters. These are needed for export cipher suites.
NO_TEMPORARY_RSA_PARAMS,
LZO_INIT_FAILED,
NO_COMPRESSION_ALGORITHMS,
NO_CIPHER_SUITES,
OPENPGP_GETKEY_FAILED,
PK_SIG_VERIFY_FAILED,
ILLEGAL_SRP_USERNAME,
SRP_PWD_PARSING_ERROR,
NO_TEMPORARY_DH_PARAMS,
// For certificate and key stuff
ASN1_ELEMENT_NOT_FOUND,
ASN1_IDENTIFIER_NOT_FOUND,
ASN1_DER_ERROR,
ASN1_VALUE_NOT_FOUND,
ASN1_GENERIC_ERROR,
ASN1_VALUE_NOT_VALID,
ASN1_TAG_ERROR,
ASN1_TAG_IMPLICIT,
ASN1_TYPE_ANY_ERROR,
ASN1_SYNTAX_ERROR,
ASN1_DER_OVERFLOW,
OPENPGP_UID_REVOKED,
CERTIFICATE_ERROR,
CERTIFICATE_KEY_MISMATCH,
UNSUPPORTED_CERTIFICATE_TYPE, // GNUTLS_A_UNSUPPORTED_CERTIFICATE
X509_UNKNOWN_SAN,
OPENPGP_FINGERPRINT_UNSUPPORTED,
X509_UNSUPPORTED_ATTRIBUTE,
UNKNOWN_HASH_ALGORITHM,
UNKNOWN_PKCS_CONTENT_TYPE,
UNKNOWN_PKCS_BAG_TYPE,
INVALID_PASSWORD,
MAC_VERIFY_FAILED, // for PKCS #12 MAC
CONSTRAINT_ERROR,
WARNING_IA_IPHF_RECEIVED,
WARNING_IA_FPHF_RECEIVED,
IA_VERIFY_FAILED,
UNKNOWN_ALGORITHM,
BASE64_ENCODING_ERROR,
INCOMPATIBLE_CRYPTO_LIBRARY,
INCOMPATIBLE_LIBTASN1_LIBRARY,
OPENPGP_KEYRING_ERROR,
X509_UNSUPPORTED_OID,
RANDOM_FAILED,
BASE64_UNEXPECTED_HEADER_ERROR,
OPENPGP_SUBKEY_ERROR,
CRYPTO_ALREADY_REGISTERED,
HANDSHAKE_TOO_LARGE,
UNIMPLEMENTED_FEATURE,
APPLICATION_ERROR_MAX, // -65000
APPLICATION_ERROR_MIN; // -65500
[CCode (cname = "gnutls_error_is_fatal")]
public bool is_fatal();
[CCode (cname = "gnutls_perror")]
public void print();
[CCode (cname = "gnutls_strerror")]
public unowned string to_string();
}
public void throw_if_error(int err_int) throws GLib.Error {
ErrorCode error = (ErrorCode)err_int;
if (error != ErrorCode.SUCCESS) {
throw new GLib.Error(-1, error, "%s%s", error.to_string(), error.is_fatal() ? " fatal" : "");
}
}
}

1
plugins/rtp/CMakeLists.txt
View file

@ -2,6 +2,7 @@ find_packages(RTP_PACKAGES REQUIRED
Gee
GLib
GModule
GnuTLS
GObject
GTK3
Gst

1
xmpp-vala/src/module/xep/0166_jingle/reason_element.vala
View file

@ -24,6 +24,7 @@ namespace Xmpp.Xep.Jingle.ReasonElement {
BUSY,
CANCEL,
DECLINE,
GONE,
SUCCESS
};
}

38
xmpp-vala/src/module/xep/0166_jingle/session.vala
View file

@ -24,9 +24,10 @@ public class Xmpp.Xep.Jingle.Session : Object {
public Jid peer_full_jid { get; private set; }
public bool we_initiated { get; private set; }
public HashMap<string, Content> contents = new HashMap<string, Content>();
public HashMap<string, Content> contents_map = new HashMap<string, Content>();
public Gee.List<Content> contents = new ArrayList<Content>(); // Keep the order contents
public SecurityParameters? security { get { return contents.values.to_array()[0].security_params; } }
public SecurityParameters? security { get { return contents.to_array()[0].security_params; } }
public Session.initiate_sent(XmppStream stream, string sid, Jid local_full_jid, Jid peer_full_jid) {
this.stream = stream;
@ -94,7 +95,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
} else if (action.has_prefix("transport-")) {
ContentNode content_node = get_single_content_node(jingle);
if (!contents.has_key(content_node.name)) {
if (!contents_map.has_key(content_node.name)) {
throw new IqError.BAD_REQUEST("unknown content");
}
@ -102,7 +103,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
throw new IqError.BAD_REQUEST("missing transport node");
}
Content content = contents[content_node.name];
Content content = contents_map[content_node.name];
if (content_node.creator != content.content_creator) {
throw new IqError.BAD_REQUEST("unknown content; creator");
@ -128,11 +129,11 @@ public class Xmpp.Xep.Jingle.Session : Object {
} else if (action == "description-info") {
ContentNode content_node = get_single_content_node(jingle);
if (!contents.has_key(content_node.name)) {
if (!contents_map.has_key(content_node.name)) {
throw new IqError.BAD_REQUEST("unknown content");
}
Content content = contents[content_node.name];
Content content = contents_map[content_node.name];
if (content_node.creator != content.content_creator) {
throw new IqError.BAD_REQUEST("unknown content; creator");
@ -149,7 +150,8 @@ public class Xmpp.Xep.Jingle.Session : Object {
}
internal void insert_content(Content content) {
this.contents[content.content_name] = content;
this.contents_map[content.content_name] = content;
this.contents.add(content);
content.set_session(this);
}
@ -209,7 +211,8 @@ public class Xmpp.Xep.Jingle.Session : Object {
public async void add_content(Content content) {
content.session = this;
this.contents[content.content_name] = content;
this.contents_map[content.content_name] = content;
contents.add(content);
StanzaNode content_add_node = new StanzaNode.build("jingle", NS_URI)
.add_self_xmlns()
@ -228,9 +231,9 @@ public class Xmpp.Xep.Jingle.Session : Object {
private void handle_content_accept(ContentNode content_node) throws IqError {
if (content_node.description == null || content_node.transport == null) throw new IqError.BAD_REQUEST("missing description or transport node");
if (!contents.has_key(content_node.name)) throw new IqError.BAD_REQUEST("unknown content");
if (!contents_map.has_key(content_node.name)) throw new IqError.BAD_REQUEST("unknown content");
Content content = contents[content_node.name];
Content content = contents_map[content_node.name];
if (content_node.creator != content.content_creator) warning("Counterpart accepts content with an unexpected `creator`");
if (content_node.senders != content.senders) warning("Counterpart accepts content with an unexpected `senders`");
@ -242,7 +245,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
private void handle_content_modify(XmppStream stream, StanzaNode jingle_node, Iq.Stanza iq) throws IqError {
ContentNode content_node = get_single_content_node(jingle_node);
Content? content = contents[content_node.name];
Content? content = contents_map[content_node.name];
if (content == null) throw new IqError.BAD_REQUEST("no such content");
if (content_node.creator != content.content_creator) throw new IqError.BAD_REQUEST("mismatching creator");
@ -301,7 +304,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
}
}
foreach (Content content in contents.values) {
foreach (Content content in contents) {
content.terminate(false, reason_name, reason_text);
}
@ -336,7 +339,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
.add_self_xmlns()
.put_attribute("action", "session-accept")
.put_attribute("sid", sid);
foreach (Content content in contents.values) {
foreach (Content content in contents) {
StanzaNode content_node = new StanzaNode.build("content", NS_URI)
.put_attribute("creator", "initiator")
.put_attribute("name", content.content_name)
@ -345,12 +348,13 @@ public class Xmpp.Xep.Jingle.Session : Object {
.put_node(content.transport_params.to_transport_stanza_node());
jingle.put_node(content_node);
}
Iq.Stanza iq = new Iq.Stanza.set(jingle) { to=peer_full_jid };
stream.get_module(Iq.Module.IDENTITY).send_iq(stream, iq);
foreach (Content content in contents.values) {
content.on_accept(stream);
foreach (Content content2 in contents) {
content2.on_accept(stream);
}
state = State.ACTIVE;
@ -359,7 +363,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
internal void accept_content(Content content) {
if (state == State.INITIATE_RECEIVED) {
bool all_accepted = true;
foreach (Content c in contents.values) {
foreach (Content c in contents) {
if (c.state != Content.State.WANTS_TO_BE_ACCEPTED) {
all_accepted = false;
}
@ -413,7 +417,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
} else {
reason_str = "local session-terminate";
}
foreach (Content content in contents.values) {
foreach (Content content in contents) {
content.terminate(true, reason_name, reason_text);
}
}

5
xmpp-vala/src/module/xep/0167_jingle_rtp/content_parameters.vala
View file

@ -34,7 +34,7 @@ public class Xmpp.Xep.JingleRtp.Parameters : Jingle.ContentParameters, Object {
this.parent = parent;
this.media = media;
this.ssrc = ssrc;
this.rtcp_mux = rtcp_mux;
this.rtcp_mux = true;
this.bandwidth = bandwidth;
this.bandwidth_type = bandwidth_type;
this.encryption_required = encryption_required;
@ -175,6 +175,9 @@ public class Xmpp.Xep.JingleRtp.Parameters : Jingle.ContentParameters, Object {
ret.put_node(new StanzaNode.build("encryption", NS_URI)
.put_node(local_crypto.to_xml()));
}
if (rtcp_mux) {
ret.put_node(new StanzaNode.build("rtcp-mux", NS_URI));
}
return ret;
}
}

2
xmpp-vala/src/module/xep/0167_jingle_rtp/jingle_rtp_module.vala
View file

@ -84,7 +84,7 @@ public abstract class Module : XmppStreamModule {
Jid receiver_full_jid = session.peer_full_jid;
Jingle.Content? content = null;
foreach (Jingle.Content c in session.contents.values) {
foreach (Jingle.Content c in session.contents) {
Parameters? parameters = c.content_params as Parameters;
if (parameters == null) continue;

2
xmpp-vala/src/module/xep/0167_jingle_rtp/session_info_type.vala
View file

@ -50,7 +50,7 @@ namespace Xmpp.Xep.JingleRtp {
public void send_mute(Jingle.Session session, bool mute, string media) {
string node_name = mute ? "mute" : "unmute";
foreach (Jingle.Content content in session.contents.values) {
foreach (Jingle.Content content in session.contents) {
Parameters? parameters = content.content_params as Parameters;
if (parameters != null && parameters.media == media) {
StanzaNode session_info_content = new StanzaNode.build(node_name, NS_URI).add_self_xmlns().put_attribute("name", content.content_name);

1
xmpp-vala/src/module/xep/0176_jingle_ice_udp/jingle_ice_udp_module.vala
View file

@ -12,6 +12,7 @@ public abstract class Module : XmppStreamModule, Jingle.Transport {
public override void attach(XmppStream stream) {
stream.get_module(Jingle.Module.IDENTITY).register_transport(this);
stream.get_module(ServiceDiscovery.Module.IDENTITY).add_feature(stream, NS_URI);
stream.get_module(ServiceDiscovery.Module.IDENTITY).add_feature(stream, "urn:xmpp:jingle:apps:dtls:0");
}
public override void detach(XmppStream stream) {
stream.get_module(ServiceDiscovery.Module.IDENTITY).remove_feature(stream, NS_URI);

27
xmpp-vala/src/module/xep/0176_jingle_ice_udp/transport_parameters.vala
View file

@ -13,6 +13,9 @@ public abstract class Xmpp.Xep.JingleIceUdp.IceUdpTransportParameters : Jingle.T
public ConcurrentList<Candidate> unsent_local_candidates = new ConcurrentList<Candidate>(Candidate.equals_func);
public Gee.List<Candidate> remote_candidates = new ArrayList<Candidate>(Candidate.equals_func);
public string? own_fingerprint = null;
public string? peer_fingerprint = null;
public Jid local_full_jid { get; private set; }
public Jid peer_full_jid { get; private set; }
private uint8 components_;
@ -34,6 +37,11 @@ public abstract class Xmpp.Xep.JingleIceUdp.IceUdpTransportParameters : Jingle.T
foreach (StanzaNode candidateNode in node.get_subnodes("candidate")) {
remote_candidates.add(Candidate.parse(candidateNode));
}
StanzaNode? fingerprint_node = node.get_subnode("fingerprint", "urn:xmpp:jingle:apps:dtls:0");
if (fingerprint_node != null) {
peer_fingerprint = fingerprint_node.get_deep_string_content();
}
}
}
@ -57,6 +65,20 @@ public abstract class Xmpp.Xep.JingleIceUdp.IceUdpTransportParameters : Jingle.T
.add_self_xmlns()
.put_attribute("ufrag", local_ufrag)
.put_attribute("pwd", local_pwd);
if (own_fingerprint != null) {
var fingerprint_node = new StanzaNode.build("fingerprint", "urn:xmpp:jingle:apps:dtls:0")
.add_self_xmlns()
.put_attribute("hash", "sha-256")
.put_node(new StanzaNode.text(own_fingerprint));
if (incoming) {
fingerprint_node.put_attribute("setup", "active");
} else {
fingerprint_node.put_attribute("setup", "actpass");
}
node.put_node(fingerprint_node);
}
foreach (Candidate candidate in unsent_local_candidates) {
node.put_node(candidate.to_xml());
}
@ -72,6 +94,11 @@ public abstract class Xmpp.Xep.JingleIceUdp.IceUdpTransportParameters : Jingle.T
foreach (StanzaNode candidateNode in node.get_subnodes("candidate")) {
remote_candidates.add(Candidate.parse(candidateNode));
}
StanzaNode? fingerprint_node = node.get_subnode("fingerprint", "urn:xmpp:jingle:apps:dtls:0");
if (fingerprint_node != null) {
peer_fingerprint = fingerprint_node.get_deep_string_content();
}
}
public virtual void handle_transport_info(StanzaNode node) throws Jingle.IqError {