1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
|
/*
* libjingle
* Copyright 2004--2008, Google Inc.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
* EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
// SecureTunnelSessionClient and SecureTunnelSession.
// SecureTunnelSessionClient extends TunnelSessionClient to exchange
// certificates as part of the session description.
// SecureTunnelSession is a TunnelSession that wraps the underlying
// tunnel stream into an SSLStreamAdapter.
#ifndef TALK_SESSION_TUNNEL_SECURETUNNELSESSIONCLIENT_H_
#define TALK_SESSION_TUNNEL_SECURETUNNELSESSIONCLIENT_H_
#include <string>
#include "talk/session/tunnel/tunnelsessionclient.h"
#include "webrtc/base/sslidentity.h"
#include "webrtc/base/sslstreamadapter.h"
namespace cricket {
class SecureTunnelSession; // below
// SecureTunnelSessionClient
// This TunnelSessionClient establishes secure tunnels protected by
// SSL/TLS. The PseudoTcpChannel stream is wrapped with an
// SSLStreamAdapter. An SSLIdentity must be set or generated.
//
// The TunnelContentDescription is extended to include the client and
// server certificates. The initiator acts as the client. The session
// initiate stanza carries a description that contains the client's
// certificate, and the session accept response's description has the
// server certificate added to it.
class SecureTunnelSessionClient : public TunnelSessionClient {
public:
// The jid is used as the name for sessions for outgoing tunnels.
// manager is the SessionManager to which we register this client
// and its sessions.
SecureTunnelSessionClient(const buzz::Jid& jid, SessionManager* manager);
// Configures this client to use a preexisting SSLIdentity.
// The client takes ownership of the identity object.
// Use either SetIdentity or GenerateIdentity, and only once.
void SetIdentity(rtc::SSLIdentity* identity);
// Generates an identity from nothing.
// Returns true if generation was successful.
// Use either SetIdentity or GenerateIdentity, and only once.
bool GenerateIdentity();
// Returns our identity for SSL purposes, as either set by
// SetIdentity() or generated by GenerateIdentity(). Call this
// method only after our identity has been successfully established
// by one of those methods.
rtc::SSLIdentity& GetIdentity() const;
// Inherited methods
virtual void OnIncomingTunnel(const buzz::Jid& jid, Session *session);
virtual bool ParseContent(SignalingProtocol protocol,
const buzz::XmlElement* elem,
ContentDescription** content,
ParseError* error);
virtual bool WriteContent(SignalingProtocol protocol,
const ContentDescription* content,
buzz::XmlElement** elem,
WriteError* error);
virtual SessionDescription* CreateOffer(
const buzz::Jid &jid, const std::string &description);
virtual SessionDescription* CreateAnswer(
const SessionDescription* offer);
protected:
virtual TunnelSession* MakeTunnelSession(
Session* session, rtc::Thread* stream_thread,
TunnelSessionRole role);
private:
// Our identity (key and certificate) for SSL purposes. The
// certificate part will be communicated within the session
// description. The identity will be passed to the SSLStreamAdapter
// and used for SSL authentication.
rtc::scoped_ptr<rtc::SSLIdentity> identity_;
DISALLOW_EVIL_CONSTRUCTORS(SecureTunnelSessionClient);
};
// SecureTunnelSession:
// A TunnelSession represents one session for one client. It
// provides the actual tunnel stream and handles state changes.
// A SecureTunnelSession is a TunnelSession that wraps the underlying
// tunnel stream into an SSLStreamAdapter.
class SecureTunnelSession : public TunnelSession {
public:
// This TunnelSession will tie together the given client and session.
// stream_thread is passed to the PseudoTCPChannel: it's the thread
// designated to interact with the tunnel stream.
// role is either INITIATOR or RESPONDER, depending on who is
// initiating the session.
SecureTunnelSession(SecureTunnelSessionClient* client, Session* session,
rtc::Thread* stream_thread,
TunnelSessionRole role);
// Returns the stream that implements the actual P2P tunnel.
// This may be called only once. Caller is responsible for freeing
// the returned object.
virtual rtc::StreamInterface* GetStream();
protected:
// Inherited method: callback on accepting a session.
virtual void OnAccept();
// Helper method for GetStream() that Instantiates the
// SSLStreamAdapter to wrap the PseudoTcpChannel's stream, and
// configures it with our identity and role.
rtc::StreamInterface* MakeSecureStream(
rtc::StreamInterface* stream);
// Our role in requesting the tunnel: INITIATOR or
// RESPONDER. Translates to our role in SSL negotiation:
// respectively client or server. Also indicates which slot of the
// SecureTunnelContentDescription our cert goes into: client-cert or
// server-cert respectively.
TunnelSessionRole role_;
// This is the stream representing the usable tunnel endpoint. It's
// a StreamReference wrapping the SSLStreamAdapter instance, which
// further wraps a PseudoTcpChannel::InternalStream. The
// StreamReference is because in the case of CreateTunnel(), the
// stream endpoint is returned early, but we need to keep a handle
// on it so we can setup the peer certificate when we receive it
// later.
rtc::scoped_ptr<rtc::StreamReference> ssl_stream_reference_;
DISALLOW_EVIL_CONSTRUCTORS(SecureTunnelSession);
};
} // namespace cricket
#endif // TALK_SESSION_TUNNEL_SECURETUNNELSESSIONCLIENT_H_
|
