admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change DTLS default from 1.0 to 1.2 for webrtc.

Browse Source 
This changes for standalone webrtc applications.

BUG=
R=pthatcher@webrtc.org

Review URL: https://codereview.webrtc.org/1548733002 .

Cr-Commit-Position: refs/heads/master@{#11211}
This commit is contained in:
Guo-wei Shieh 2016-01-11 15:27:03 -08:00
parent f6c318ebae
commit a7446d2a50
8 changed files with 139 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
talk/app/webrtc/peerconnectioninterface.h
View File

@ -502,13 +502,12 @@ class PeerConnectionFactoryInterface : public rtc::RefCountInterface {
public:
class Options {
public:
Options() :
disable_encryption(false),
disable_sctp_data_channels(false),
disable_network_monitor(false),
network_ignore_mask(rtc::kDefaultNetworkIgnoreMask),
ssl_max_version(rtc::SSL_PROTOCOL_DTLS_10) {
}
Options()
: disable_encryption(false),
disable_sctp_data_channels(false),
disable_network_monitor(false),
network_ignore_mask(rtc::kDefaultNetworkIgnoreMask),
ssl_max_version(rtc::SSL_PROTOCOL_DTLS_12) {}
bool disable_encryption;
bool disable_sctp_data_channels;
bool disable_network_monitor;

9
webrtc/base/opensslstreamadapter.cc
View File

@ -301,12 +301,13 @@ OpenSSLStreamAdapter::OpenSSLStreamAdapter(StreamInterface* stream)
: SSLStreamAdapter(stream),
state_(SSL_NONE),
role_(SSL_CLIENT),
ssl_read_needs_write_(false), ssl_write_needs_read_(false),
ssl_(NULL), ssl_ctx_(NULL),
ssl_read_needs_write_(false),
ssl_write_needs_read_(false),
ssl_(NULL),
ssl_ctx_(NULL),
custom_verification_succeeded_(false),
ssl_mode_(SSL_MODE_TLS),
ssl_max_version_(SSL_PROTOCOL_TLS_11) {
}
ssl_max_version_(SSL_PROTOCOL_TLS_12) {}
OpenSSLStreamAdapter::~OpenSSLStreamAdapter() {
Cleanup();

3
webrtc/base/sslstreamadapterhelper.cc
View File

@ -29,8 +29,7 @@ SSLStreamAdapterHelper::SSLStreamAdapterHelper(StreamInterface* stream)
role_(SSL_CLIENT),
ssl_error_code_(0), // Not meaningful yet
ssl_mode_(SSL_MODE_TLS),
ssl_max_version_(SSL_PROTOCOL_TLS_11) {
}
ssl_max_version_(SSL_PROTOCOL_TLS_12) {}
SSLStreamAdapterHelper::~SSLStreamAdapterHelper() = default;

2
webrtc/p2p/base/dtlstransport.h
View File

@ -35,7 +35,7 @@ class DtlsTransport : public Base {
: Base(name, allocator),
certificate_(certificate),
secure_role_(rtc::SSL_CLIENT),
ssl_max_version_(rtc::SSL_PROTOCOL_DTLS_10) {}
ssl_max_version_(rtc::SSL_PROTOCOL_DTLS_12) {}
~DtlsTransport() {
Base::DestroyAllChannels();

2
webrtc/p2p/base/dtlstransportchannel.cc
View File

@ -97,7 +97,7 @@ DtlsTransportChannelWrapper::DtlsTransportChannelWrapper(
channel_(channel),
downward_(NULL),
ssl_role_(rtc::SSL_CLIENT),
ssl_max_version_(rtc::SSL_PROTOCOL_DTLS_10) {
ssl_max_version_(rtc::SSL_PROTOCOL_DTLS_12) {
channel_->SignalWritableState.connect(this,
&DtlsTransportChannelWrapper::OnWritableState);
channel_->SignalReadPacket.connect(this,

138
webrtc/p2p/base/dtlstransportchannel_unittest.cc
View File

@ -48,7 +48,7 @@ class DtlsTestClient : public sigslot::has_slots<> {
: name_(name),
packet_size_(0),
use_dtls_srtp_(false),
ssl_max_version_(rtc::SSL_PROTOCOL_DTLS_10),
ssl_max_version_(rtc::SSL_PROTOCOL_DTLS_12),
negotiated_dtls_(false),
received_dtls_client_hello_(false),
received_dtls_server_hello_(false) {}
@ -400,7 +400,7 @@ class DtlsTransportChannelTest : public testing::Test {
channel_ct_(1),
use_dtls_(false),
use_dtls_srtp_(false),
ssl_expected_version_(rtc::SSL_PROTOCOL_DTLS_10) {}
ssl_expected_version_(rtc::SSL_PROTOCOL_DTLS_12) {}
void SetChannelCount(size_t channel_ct) {
channel_ct_ = static_cast<int>(channel_ct);
@ -600,16 +600,30 @@ TEST_F(DtlsTransportChannelTest, TestTransferSrtpTwoChannels) {
TestTransfer(1, 1000, 100, true);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtls DISABLED_TestTransferDtls
#else
#define MAYBE_TestTransferDtls TestTransferDtls
#endif
// Connect with DTLS, and transfer some data.
TEST_F(DtlsTransportChannelTest, TestTransferDtls) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtls) {
MAYBE_SKIP_TEST(HaveDtls);
PrepareDtls(true, true, rtc::KT_DEFAULT);
ASSERT_TRUE(Connect());
TestTransfer(0, 1000, 100, false);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtlsTwoChannels DISABLED_TestTransferDtlsTwoChannels
#else
#define MAYBE_TestTransferDtlsTwoChannels TestTransferDtlsTwoChannels
#endif
// Create two channels with DTLS, and transfer some data.
TEST_F(DtlsTransportChannelTest, TestTransferDtlsTwoChannels) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtlsTwoChannels) {
MAYBE_SKIP_TEST(HaveDtls);
SetChannelCount(2);
PrepareDtls(true, true, rtc::KT_DEFAULT);
@ -675,8 +689,15 @@ TEST_F(DtlsTransportChannelTest, TestDtls12Client2) {
ASSERT_TRUE(Connect());
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtlsSrtp DISABLED_TestTransferDtlsSrtp
#else
#define MAYBE_TestTransferDtlsSrtp TestTransferDtlsSrtp
#endif
// Connect with DTLS, negotiate DTLS-SRTP, and transfer SRTP using bypass.
TEST_F(DtlsTransportChannelTest, TestTransferDtlsSrtp) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtlsSrtp) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
PrepareDtls(true, true, rtc::KT_DEFAULT);
PrepareDtlsSrtp(true, true);
@ -684,9 +705,18 @@ TEST_F(DtlsTransportChannelTest, TestTransferDtlsSrtp) {
TestTransfer(0, 1000, 100, true);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtlsInvalidSrtpPacket \
DISABLED_TestTransferDtlsInvalidSrtpPacket
#else
#define MAYBE_TestTransferDtlsInvalidSrtpPacket \
TestTransferDtlsInvalidSrtpPacket
#endif
// Connect with DTLS-SRTP, transfer an invalid SRTP packet, and expects -1
// returned.
TEST_F(DtlsTransportChannelTest, TestTransferDtlsInvalidSrtpPacket) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtlsInvalidSrtpPacket) {
MAYBE_SKIP_TEST(HaveDtls);
PrepareDtls(true, true, rtc::KT_DEFAULT);
PrepareDtlsSrtp(true, true);
@ -695,24 +725,47 @@ TEST_F(DtlsTransportChannelTest, TestTransferDtlsInvalidSrtpPacket) {
ASSERT_EQ(-1, result);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtlsSrtpRejected DISABLED_TestTransferDtlsSrtpRejected
#else
#define MAYBE_TestTransferDtlsSrtpRejected TestTransferDtlsSrtpRejected
#endif
// Connect with DTLS. A does DTLS-SRTP but B does not.
TEST_F(DtlsTransportChannelTest, TestTransferDtlsSrtpRejected) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtlsSrtpRejected) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
PrepareDtls(true, true, rtc::KT_DEFAULT);
PrepareDtlsSrtp(true, false);
ASSERT_TRUE(Connect());
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtlsSrtpNotOffered \
DISABLED_TestTransferDtlsSrtpNotOffered
#else
#define MAYBE_TestTransferDtlsSrtpNotOffered TestTransferDtlsSrtpNotOffered
#endif
// Connect with DTLS. B does DTLS-SRTP but A does not.
TEST_F(DtlsTransportChannelTest, TestTransferDtlsSrtpNotOffered) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtlsSrtpNotOffered) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
PrepareDtls(true, true, rtc::KT_DEFAULT);
PrepareDtlsSrtp(false, true);
ASSERT_TRUE(Connect());
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtlsSrtpTwoChannels \
DISABLED_TestTransferDtlsSrtpTwoChannels
#else
#define MAYBE_TestTransferDtlsSrtpTwoChannels TestTransferDtlsSrtpTwoChannels
#endif
// Create two channels with DTLS, negotiate DTLS-SRTP, and transfer bypass SRTP.
TEST_F(DtlsTransportChannelTest, TestTransferDtlsSrtpTwoChannels) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtlsSrtpTwoChannels) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
SetChannelCount(2);
PrepareDtls(true, true, rtc::KT_DEFAULT);
@ -722,8 +775,15 @@ TEST_F(DtlsTransportChannelTest, TestTransferDtlsSrtpTwoChannels) {
TestTransfer(1, 1000, 100, true);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtlsSrtpDemux DISABLED_TestTransferDtlsSrtpDemux
#else
#define MAYBE_TestTransferDtlsSrtpDemux TestTransferDtlsSrtpDemux
#endif
// Create a single channel with DTLS, and send normal data and SRTP data on it.
TEST_F(DtlsTransportChannelTest, TestTransferDtlsSrtpDemux) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtlsSrtpDemux) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
PrepareDtls(true, true, rtc::KT_DEFAULT);
PrepareDtlsSrtp(true, true);
@ -732,8 +792,17 @@ TEST_F(DtlsTransportChannelTest, TestTransferDtlsSrtpDemux) {
TestTransfer(0, 1000, 100, true);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestTransferDtlsAnswererIsPassive \
DISABLED_TestTransferDtlsAnswererIsPassive
#else
#define MAYBE_TestTransferDtlsAnswererIsPassive \
TestTransferDtlsAnswererIsPassive
#endif
// Testing when the remote is passive.
TEST_F(DtlsTransportChannelTest, TestTransferDtlsAnswererIsPassive) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestTransferDtlsAnswererIsPassive) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
SetChannelCount(2);
PrepareDtls(true, true, rtc::KT_DEFAULT);
@ -758,9 +827,16 @@ TEST_F(DtlsTransportChannelTest, TestDtlsSetupWithLegacyAsAnswerer) {
EXPECT_EQ(rtc::SSL_CLIENT, channel2_role);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestDtlsReOfferFromOfferer DISABLED_TestDtlsReOfferFromOfferer
#else
#define MAYBE_TestDtlsReOfferFromOfferer TestDtlsReOfferFromOfferer
#endif
// Testing re offer/answer after the session is estbalished. Roles will be
// kept same as of the previous negotiation.
TEST_F(DtlsTransportChannelTest, TestDtlsReOfferFromOfferer) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestDtlsReOfferFromOfferer) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
SetChannelCount(2);
PrepareDtls(true, true, rtc::KT_DEFAULT);
@ -777,7 +853,14 @@ TEST_F(DtlsTransportChannelTest, TestDtlsReOfferFromOfferer) {
TestTransfer(1, 1000, 100, true);
}
TEST_F(DtlsTransportChannelTest, TestDtlsReOfferFromAnswerer) {
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestDtlsReOfferFromAnswerer DISABLED_TestDtlsReOfferFromAnswerer
#else
#define MAYBE_TestDtlsReOfferFromAnswerer TestDtlsReOfferFromAnswerer
#endif
TEST_F(DtlsTransportChannelTest, MAYBE_TestDtlsReOfferFromAnswerer) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
SetChannelCount(2);
PrepareDtls(true, true, rtc::KT_DEFAULT);
@ -794,8 +877,15 @@ TEST_F(DtlsTransportChannelTest, TestDtlsReOfferFromAnswerer) {
TestTransfer(1, 1000, 100, true);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestDtlsRoleReversal DISABLED_TestDtlsRoleReversal
#else
#define MAYBE_TestDtlsRoleReversal TestDtlsRoleReversal
#endif
// Test that any change in role after the intial setup will result in failure.
TEST_F(DtlsTransportChannelTest, TestDtlsRoleReversal) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestDtlsRoleReversal) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
SetChannelCount(2);
PrepareDtls(true, true, rtc::KT_DEFAULT);
@ -809,9 +899,18 @@ TEST_F(DtlsTransportChannelTest, TestDtlsRoleReversal) {
NF_REOFFER | NF_EXPECT_FAILURE);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestDtlsReOfferWithDifferentSetupAttr \
DISABLED_TestDtlsReOfferWithDifferentSetupAttr
#else
#define MAYBE_TestDtlsReOfferWithDifferentSetupAttr \
TestDtlsReOfferWithDifferentSetupAttr
#endif
// Test that using different setup attributes which results in similar ssl
// role as the initial negotiation will result in success.
TEST_F(DtlsTransportChannelTest, TestDtlsReOfferWithDifferentSetupAttr) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestDtlsReOfferWithDifferentSetupAttr) {
MAYBE_SKIP_TEST(HaveDtlsSrtp);
SetChannelCount(2);
PrepareDtls(true, true, rtc::KT_DEFAULT);
@ -871,8 +970,15 @@ TEST_F(DtlsTransportChannelTest, TestCertificatesBeforeConnect) {
ASSERT_FALSE(remote_cert2 != NULL);
}
#if defined(MEMORY_SANITIZER)
// Fails under MemorySanitizer:
// See https://code.google.com/p/webrtc/issues/detail?id=5381.
#define MAYBE_TestCertificatesAfterConnect DISABLED_TestCertificatesAfterConnect
#else
#define MAYBE_TestCertificatesAfterConnect TestCertificatesAfterConnect
#endif
// Test Certificates state after connection.
TEST_F(DtlsTransportChannelTest, TestCertificatesAfterConnect) {
TEST_F(DtlsTransportChannelTest, MAYBE_TestCertificatesAfterConnect) {
MAYBE_SKIP_TEST(HaveDtls);
PrepareDtls(true, true, rtc::KT_DEFAULT);
ASSERT_TRUE(Connect());

4
webrtc/p2p/base/faketransportcontroller.h
View File

@ -332,7 +332,7 @@ class FakeTransportChannel : public TransportChannelImpl,
std::string remote_ice_ufrag_;
std::string remote_ice_pwd_;
IceMode remote_ice_mode_ = ICEMODE_FULL;
rtc::SSLProtocolVersion ssl_max_version_ = rtc::SSL_PROTOCOL_DTLS_10;
rtc::SSLProtocolVersion ssl_max_version_ = rtc::SSL_PROTOCOL_DTLS_12;
rtc::SSLFingerprint dtls_fingerprint_;
rtc::SSLRole ssl_role_ = rtc::SSL_CLIENT;
size_t connection_count_ = 0;
@ -453,7 +453,7 @@ class FakeTransport : public Transport {
FakeTransport* dest_ = nullptr;
bool async_ = false;
rtc::scoped_refptr<rtc::RTCCertificate> certificate_;
rtc::SSLProtocolVersion ssl_max_version_ = rtc::SSL_PROTOCOL_DTLS_10;
rtc::SSLProtocolVersion ssl_max_version_ = rtc::SSL_PROTOCOL_DTLS_12;
};
// Fake TransportController class, which can be passed into a BaseChannel object

2
webrtc/p2p/base/transportcontroller.h
View File

@ -198,7 +198,7 @@ class TransportController : public sigslot::has_slots<>,
std::vector<RefCountedChannel> channels_;
PortAllocator* const port_allocator_ = nullptr;
rtc::SSLProtocolVersion ssl_max_version_ = rtc::SSL_PROTOCOL_DTLS_10;
rtc::SSLProtocolVersion ssl_max_version_ = rtc::SSL_PROTOCOL_DTLS_12;
// Aggregate state for TransportChannelImpls.
IceConnectionState connection_state_ = kIceConnectionConnecting;