Add disabled certificate check support to IceServer PeerConnection API.

webrtc/p2p/base/turnport.cc

 /*
  *  Copyright 2012 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 26 matching lines @@
 // Retry at most twice (i.e. three different ALLOCATE requests) on
 // STUN_ERROR_ALLOCATION_MISMATCH error per rfc5766.
 static const size_t MAX_ALLOCATE_MISMATCH_RETRIES = 2;
 
 static const int TURN_SUCCESS_RESULT_CODE = 0;
 
 inline bool IsTurnChannelData(uint16_t msg_type) {
   return ((msg_type & 0xC000) == 0x4000);  // MSB are 0b01
 }
 
-static int GetRelayPreference(cricket::ProtocolType proto, bool secure) {
-  int relay_preference = ICE_TYPE_PREFERENCE_RELAY;
-  if (proto == cricket::PROTO_TCP) {
-    relay_preference -= 1;
-    if (secure)
-      relay_preference -= 1;
+static int GetRelayPreference(cricket::ProtocolType proto) {
+  switch (proto) {
+    case cricket::PROTO_TCP:
+      return ICE_TYPE_PREFERENCE_RELAY_TCP;
+    case cricket::PROTO_TLS:
+      return ICE_TYPE_PREFERENCE_RELAY_TLS;
+    default:
+      return ICE_TYPE_PREFERENCE_RELAY_UDP;
   }
-
-  ASSERT(relay_preference >= 0);
-  return relay_preference;
 }
 
 class TurnAllocateRequest : public StunRequest {
  public:
   explicit TurnAllocateRequest(TurnPort* port);
   void Prepare(StunMessage* request) override;
   void OnSent() override;
   void OnResponse(StunMessage* response) override;
   void OnErrorResponse(StunMessage* response) override;
   void OnTimeout() override;
@@ skipping 248 matching lines @@
     }
   }
 }
 
 bool TurnPort::CreateTurnClientSocket() {
   ASSERT(!socket_ || SharedSocket());
 
   if (server_address_.proto == PROTO_UDP && !SharedSocket()) {
     socket_ = socket_factory()->CreateUdpSocket(
         rtc::SocketAddress(ip(), 0), min_port(), max_port());
-  } else if (server_address_.proto == PROTO_TCP) {
+  } else if (server_address_.proto == PROTO_TCP ||
+             server_address_.proto == PROTO_TLS) {
     ASSERT(!SharedSocket());
     int opts = rtc::PacketSocketFactory::OPT_STUN;
-    // If secure bit is enabled in server address, use TLS over TCP.
-    if (server_address_.secure) {
+
+    // Apply server address TLS and insecure bits to options.
+    if (server_address_.proto == PROTO_TLS) {
       opts |= rtc::PacketSocketFactory::OPT_TLS;
     }

[pthatcher1, 2016/12/07 21:29:36]

I like the cleanup/refactoring going on here (the addition of PROTO_TLS and
ICE_TYPE_PREFERENCE_RELAY_X).  I think it would be easier to make that into a
separate CL with no behavior change, and then a second CL that's the behavior
change.

[Taylor Brandstetter, 2016/12/08 01:36:40]

I agree, if it's not too hard to pull the two apart.

[hnsl1, 2016/12/12 16:08:13]

Okay, I'll prepare a new CL where I do the PROTO_TLS refactoring, which I will
land first.

+    if (server_address_.flags & PROTO_FLAG_INSECURE_CERT_CHECK) {
+      opts |= rtc::PacketSocketFactory::OPT_INSECURE_CERT_CHECK;
+    }
+
     socket_ = socket_factory()->CreateClientTcpSocket(
         rtc::SocketAddress(ip(), 0), server_address_.address,
         proxy(), user_agent(), opts);
   }
 
   if (!socket_) {
     error_ = SOCKET_ERROR;
     return false;
   }
 
   // Apply options if any.
   for (SocketOptionsMap::iterator iter = socket_options_.begin();
        iter != socket_options_.end(); ++iter) {
     socket_->SetOption(iter->first, iter->second);
   }
 
   if (!SharedSocket()) {
     // If socket is shared, AllocationSequence will receive the packet.
     socket_->SignalReadPacket.connect(this, &TurnPort::OnReadPacket);
   }
 
   socket_->SignalReadyToSend.connect(this, &TurnPort::OnReadyToSend);
 
   socket_->SignalSentPacket.connect(this, &TurnPort::OnSentPacket);
 
   // TCP port is ready to send stun requests after the socket is connected,
   // while UDP port is ready to do so once the socket is created.
-  if (server_address_.proto == PROTO_TCP) {
+  if (server_address_.proto == PROTO_TCP ||
+      server_address_.proto == PROTO_TLS) {
     socket_->SignalConnect.connect(this, &TurnPort::OnSocketConnect);
     socket_->SignalClose.connect(this, &TurnPort::OnSocketClose);
   } else {
     state_ = STATE_CONNECTED;
   }
   return true;
 }
 
 void TurnPort::OnSocketConnect(rtc::AsyncPacketSocket* socket) {
   ASSERT(server_address_.proto == PROTO_TCP);
@@ skipping 275 matching lines @@
     LOG_J(LS_WARNING, this)
         << "Blocking attempted redirect to loopback address.";
     return false;
   }
 
   LOG_J(LS_INFO, this) << "Redirecting from TURN server ["
                        << server_address_.address.ToSensitiveString()
                        << "] to TURN server ["
                        << address.ToSensitiveString()
                        << "]";
-  server_address_ = ProtocolAddress(address, server_address_.proto,
-                                    server_address_.secure);
+  server_address_ =
+      ProtocolAddress(address, server_address_.proto, server_address_.flags);
 
   // Insert the current address to prevent redirection pingpong.
   attempted_server_addresses_.insert(server_address_.address);
   return true;
 }
 
 void TurnPort::ResolveTurnAddress(const rtc::SocketAddress& address) {
   if (resolver_)
     return;
 
@@ skipping 62 matching lines @@
 
   rtc::SocketAddress related_address = stun_address;
 
   // For relayed candidate, Base is the candidate itself.
   AddAddress(address,          // Candidate address.
              address,          // Base address.
              related_address,  // Related address.
              UDP_PROTOCOL_NAME,
              ProtoToString(server_address_.proto),  // The first hop protocol.
              "",  // TCP canddiate type, empty for turn candidates.
-             RELAY_PORT_TYPE,
-             GetRelayPreference(server_address_.proto, server_address_.secure),
+             RELAY_PORT_TYPE, GetRelayPreference(server_address_.proto),
              server_priority_, true);
 }
 
 void TurnPort::OnAllocateError() {
   // We will send SignalPortError asynchronously as this can be sent during
   // port initialization. This way it will not be blocking other port
   // creation.
   thread()->Post(RTC_FROM_HERE, this, MSG_ALLOCATE_ERROR);
 }
 
@@ skipping 791 matching lines @@
   } else {
     state_ = STATE_UNBOUND;
     port_->FailAndPruneConnection(ext_addr_);
   }
 }
 void TurnEntry::OnChannelBindTimeout() {
   state_ = STATE_UNBOUND;
   port_->FailAndPruneConnection(ext_addr_);
 }
 }  // namespace cricket