| OLD | NEW |
| (Empty) |
| 1 /* | |
| 2 * libjingle | |
| 3 * Copyright 2004--2008, Google Inc. | |
| 4 * | |
| 5 * Redistribution and use in source and binary forms, with or without | |
| 6 * modification, are permitted provided that the following conditions are met: | |
| 7 * | |
| 8 * 1. Redistributions of source code must retain the above copyright notice, | |
| 9 * this list of conditions and the following disclaimer. | |
| 10 * 2. Redistributions in binary form must reproduce the above copyright notice, | |
| 11 * this list of conditions and the following disclaimer in the documentation | |
| 12 * and/or other materials provided with the distribution. | |
| 13 * 3. The name of the author may not be used to endorse or promote products | |
| 14 * derived from this software without specific prior written permission. | |
| 15 * | |
| 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED | |
| 17 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF | |
| 18 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO | |
| 19 * EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
| 20 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, | |
| 21 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; | |
| 22 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, | |
| 23 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR | |
| 24 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF | |
| 25 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| 26 */ | |
| 27 | |
| 28 // SecureTunnelSessionClient and SecureTunnelSession. | |
| 29 // SecureTunnelSessionClient extends TunnelSessionClient to exchange | |
| 30 // certificates as part of the session description. | |
| 31 // SecureTunnelSession is a TunnelSession that wraps the underlying | |
| 32 // tunnel stream into an SSLStreamAdapter. | |
| 33 | |
| 34 #ifndef WEBRTC_LIBJINGLE_SESSION_TUNNEL_SECURETUNNELSESSIONCLIENT_H_ | |
| 35 #define WEBRTC_LIBJINGLE_SESSION_TUNNEL_SECURETUNNELSESSIONCLIENT_H_ | |
| 36 | |
| 37 #include <string> | |
| 38 | |
| 39 #include "webrtc/libjingle/session/tunnel/tunnelsessionclient.h" | |
| 40 #include "webrtc/base/sslidentity.h" | |
| 41 #include "webrtc/base/sslstreamadapter.h" | |
| 42 | |
| 43 namespace cricket { | |
| 44 | |
| 45 class SecureTunnelSession; // below | |
| 46 | |
| 47 // SecureTunnelSessionClient | |
| 48 | |
| 49 // This TunnelSessionClient establishes secure tunnels protected by | |
| 50 // SSL/TLS. The PseudoTcpChannel stream is wrapped with an | |
| 51 // SSLStreamAdapter. An SSLIdentity must be set or generated. | |
| 52 // | |
| 53 // The TunnelContentDescription is extended to include the client and | |
| 54 // server certificates. The initiator acts as the client. The session | |
| 55 // initiate stanza carries a description that contains the client's | |
| 56 // certificate, and the session accept response's description has the | |
| 57 // server certificate added to it. | |
| 58 | |
| 59 class SecureTunnelSessionClient : public TunnelSessionClient { | |
| 60 public: | |
| 61 // The jid is used as the name for sessions for outgoing tunnels. | |
| 62 // manager is the SessionManager to which we register this client | |
| 63 // and its sessions. | |
| 64 SecureTunnelSessionClient(const buzz::Jid& jid, SessionManager* manager); | |
| 65 | |
| 66 // Configures this client to use a preexisting SSLIdentity. | |
| 67 // The client takes ownership of the identity object. | |
| 68 // Use either SetIdentity or GenerateIdentity, and only once. | |
| 69 void SetIdentity(rtc::SSLIdentity* identity); | |
| 70 | |
| 71 // Generates an identity from nothing. | |
| 72 // Returns true if generation was successful. | |
| 73 // Use either SetIdentity or GenerateIdentity, and only once. | |
| 74 bool GenerateIdentity(); | |
| 75 | |
| 76 // Returns our identity for SSL purposes, as either set by | |
| 77 // SetIdentity() or generated by GenerateIdentity(). Call this | |
| 78 // method only after our identity has been successfully established | |
| 79 // by one of those methods. | |
| 80 rtc::SSLIdentity& GetIdentity() const; | |
| 81 | |
| 82 // Inherited methods | |
| 83 virtual void OnIncomingTunnel(const buzz::Jid& jid, Session *session); | |
| 84 virtual bool ParseContent(SignalingProtocol protocol, | |
| 85 const buzz::XmlElement* elem, | |
| 86 ContentDescription** content, | |
| 87 ParseError* error); | |
| 88 virtual bool WriteContent(SignalingProtocol protocol, | |
| 89 const ContentDescription* content, | |
| 90 buzz::XmlElement** elem, | |
| 91 WriteError* error); | |
| 92 virtual SessionDescription* CreateOffer( | |
| 93 const buzz::Jid &jid, const std::string &description); | |
| 94 virtual SessionDescription* CreateAnswer( | |
| 95 const SessionDescription* offer); | |
| 96 | |
| 97 protected: | |
| 98 virtual TunnelSession* MakeTunnelSession( | |
| 99 Session* session, rtc::Thread* stream_thread, | |
| 100 TunnelSessionRole role); | |
| 101 | |
| 102 private: | |
| 103 // Our identity (key and certificate) for SSL purposes. The | |
| 104 // certificate part will be communicated within the session | |
| 105 // description. The identity will be passed to the SSLStreamAdapter | |
| 106 // and used for SSL authentication. | |
| 107 rtc::scoped_ptr<rtc::SSLIdentity> identity_; | |
| 108 | |
| 109 DISALLOW_COPY_AND_ASSIGN(SecureTunnelSessionClient); | |
| 110 }; | |
| 111 | |
| 112 // SecureTunnelSession: | |
| 113 // A TunnelSession represents one session for one client. It | |
| 114 // provides the actual tunnel stream and handles state changes. | |
| 115 // A SecureTunnelSession is a TunnelSession that wraps the underlying | |
| 116 // tunnel stream into an SSLStreamAdapter. | |
| 117 | |
| 118 class SecureTunnelSession : public TunnelSession { | |
| 119 public: | |
| 120 // This TunnelSession will tie together the given client and session. | |
| 121 // stream_thread is passed to the PseudoTCPChannel: it's the thread | |
| 122 // designated to interact with the tunnel stream. | |
| 123 // role is either INITIATOR or RESPONDER, depending on who is | |
| 124 // initiating the session. | |
| 125 SecureTunnelSession(SecureTunnelSessionClient* client, Session* session, | |
| 126 rtc::Thread* stream_thread, | |
| 127 TunnelSessionRole role); | |
| 128 | |
| 129 // Returns the stream that implements the actual P2P tunnel. | |
| 130 // This may be called only once. Caller is responsible for freeing | |
| 131 // the returned object. | |
| 132 virtual rtc::StreamInterface* GetStream(); | |
| 133 | |
| 134 protected: | |
| 135 // Inherited method: callback on accepting a session. | |
| 136 virtual void OnAccept(); | |
| 137 | |
| 138 // Helper method for GetStream() that Instantiates the | |
| 139 // SSLStreamAdapter to wrap the PseudoTcpChannel's stream, and | |
| 140 // configures it with our identity and role. | |
| 141 rtc::StreamInterface* MakeSecureStream( | |
| 142 rtc::StreamInterface* stream); | |
| 143 | |
| 144 // Our role in requesting the tunnel: INITIATOR or | |
| 145 // RESPONDER. Translates to our role in SSL negotiation: | |
| 146 // respectively client or server. Also indicates which slot of the | |
| 147 // SecureTunnelContentDescription our cert goes into: client-cert or | |
| 148 // server-cert respectively. | |
| 149 TunnelSessionRole role_; | |
| 150 | |
| 151 // This is the stream representing the usable tunnel endpoint. It's | |
| 152 // a StreamReference wrapping the SSLStreamAdapter instance, which | |
| 153 // further wraps a PseudoTcpChannel::InternalStream. The | |
| 154 // StreamReference is because in the case of CreateTunnel(), the | |
| 155 // stream endpoint is returned early, but we need to keep a handle | |
| 156 // on it so we can setup the peer certificate when we receive it | |
| 157 // later. | |
| 158 rtc::scoped_ptr<rtc::StreamReference> ssl_stream_reference_; | |
| 159 | |
| 160 DISALLOW_COPY_AND_ASSIGN(SecureTunnelSession); | |
| 161 }; | |
| 162 | |
| 163 } // namespace cricket | |
| 164 | |
| 165 #endif // WEBRTC_LIBJINGLE_SESSION_TUNNEL_SECURETUNNELSESSIONCLIENT_H_ | |
| OLD | NEW |