RTCCertificates added to RTCConfiguration, used by WebRtcSession/-DescriptionFactory

talk/app/webrtc/webrtcsession.cc

 /*
  * libjingle
  * Copyright 2012 Google Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  *  1. Redistributions of source code must retain the above copyright notice,
  *     this list of conditions and the following disclaimer.
  *  2. Redistributions in binary form must reproduce the above copyright notice,
@@ skipping 689 matching lines @@
   const cricket::VideoCodec default_codec(
       JsepSessionDescription::kDefaultVideoCodecId,
       JsepSessionDescription::kDefaultVideoCodecName,
       JsepSessionDescription::kMaxVideoCodecWidth,
       JsepSessionDescription::kMaxVideoCodecHeight,
       JsepSessionDescription::kDefaultVideoCodecFramerate,
       JsepSessionDescription::kDefaultVideoCodecPreference);
   channel_manager_->SetDefaultVideoEncoderConfig(
       cricket::VideoEncoderConfig(default_codec));
 
-  webrtc_session_desc_factory_.reset(new WebRtcSessionDescriptionFactory(
-      signaling_thread(),
-      channel_manager_,
-      mediastream_signaling_,
-      dtls_identity_store.Pass(),
-      this,
-      id(),
-      data_channel_type_,
-      dtls_enabled_));
+  if (!dtls_enabled_) {
+    // Construct with DTLS disabled.
+    webrtc_session_desc_factory_.reset(new WebRtcSessionDescriptionFactory(
+        signaling_thread(),
+        channel_manager_,
+        mediastream_signaling_,
+        this,
+        id(),
+        data_channel_type_));
+  } else {
+    // Construct with DTLS enabled.
+    rtc::scoped_refptr<rtc::RTCCertificate> certificate;
+    if (!rtc_configuration.certificates.empty())
+      certificate = rtc_configuration.certificates[0];
+    if (!certificate) {

[tommi, 2015/08/20 14:58:11]

I don't think you need this variable actually.
Here you could just do

if (rtc_configuration.certificates.empty()) {

[hbos, 2015/08/20 16:06:11]

You're right. In latest PS though certificate != nullptr became relevant in two
places and the variable more necessary so I still have it but it's moved.

+      // Use the |dtls_identity_store| to generate a certificate.
+      webrtc_session_desc_factory_.reset(new WebRtcSessionDescriptionFactory(
+          signaling_thread(),
+          channel_manager_,
+          mediastream_signaling_,
+          dtls_identity_store.Pass(),
+          this,
+          id(),
+          data_channel_type_));
+    } else {
+      // Use the already generated certificate.

[tommi, 2015/08/20 14:58:11]

is the intent to support multiple certificates eventually?

[hbos, 2015/08/20 16:06:11]

The specs say if multiple are provided it is up to us to choose which one to use
but it doesn't say how to pick one. Unless there are compatibility issues(?)
this is one way to do it ;)

But yeah, me and torbjorng talked about this briefly. If which one to use
matters compatibility/security/performance-wise we should have a function that
decides which one to pick... (although performance-wise: at this point the
certificates have already been generated).

I'll add a TODO, forgot to do that.

+      webrtc_session_desc_factory_.reset(new WebRtcSessionDescriptionFactory(
+          signaling_thread(),
+          channel_manager_,
+          mediastream_signaling_,
+          certificate,

[tommi, 2015/08/20 14:58:11]

...and here you could pass rtc_configuration.certificates[0]

+          this,
+          id(),
+          data_channel_type_));
+    }
+  }
 
   webrtc_session_desc_factory_->SignalIdentityReady.connect(
       this, &WebRtcSession::OnIdentityReady);
 
   if (options.disable_encryption) {
     webrtc_session_desc_factory_->SetSdesPolicy(cricket::SEC_DISABLED);
   }
   port_allocator()->set_candidate_filter(
       ConvertIceTransportTypeToCandidateFilter(rtc_configuration.type));
   return true;
@@ skipping 620 matching lines @@
 
 void WebRtcSession::ResetIceRestartLatch() {
   ice_restart_latch_->Reset();
 }
 
 void WebRtcSession::OnIdentityReady(rtc::SSLIdentity* identity) {
   SetIdentity(identity);
 }
 
 bool WebRtcSession::waiting_for_identity() const {
-  return webrtc_session_desc_factory_->waiting_for_identity();
+  return webrtc_session_desc_factory_->waiting_for_certificate();
 }
 
 void WebRtcSession::SetIceConnectionState(
       PeerConnectionInterface::IceConnectionState state) {
   if (ice_connection_state_ == state) {
     return;
   }
 
   // ASSERT that the requested transition is allowed.  Note that
   // WebRtcSession does not implement "kIceConnectionClosed" (that is handled
@@ skipping 674 matching lines @@
 
   if (!srtp_cipher.empty()) {
     metrics_observer_->AddHistogramSample(srtp_name, srtp_cipher);
   }
   if (!ssl_cipher.empty()) {
     metrics_observer_->AddHistogramSample(ssl_name, ssl_cipher);
   }
 }
 
 }  // namespace webrtc