From 5e594055bf03589b48c5aca816fe297186e68d6d Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Mon, 17 Aug 2026 12:03:44 -0400 Subject: [PATCH] MT#55283 combine DTLS= and DTLS-reverse= Forcing the DTLS role to passive only makes sense for the backwards (torwards the offerer) direction anyway, as towards the answerer (in an offer) it's not allowed by the RFC, and in an answer it's not possible as the active DTLS connection would already be in progress. Convert DTLS= processing into a list as multiple flags might be required. Change-Id: I54239280460e1bbce1966bc17a384489eb978618 Amends: 78ee0451 / Ib1d07831 Related: #2156 Related: #2145 (cherry picked from commit 032bd398b91b48418624ef314aa48083ba4127bc) (cherry picked from commit 24d4b8d0fd7fd5d467c5a02e35b293ca6dfffd4a) --- daemon/call.c | 4 +- daemon/call_flags.c | 76 +++++++++++++++---------------------- docs/ng_control_protocol.md | 18 --------- include/call_flags.h | 1 - 4 files changed, 32 insertions(+), 67 deletions(-) diff --git a/daemon/call.c b/daemon/call.c index 531d1d63a..5ffc62c66 100644 --- a/daemon/call.c +++ b/daemon/call.c @@ -1664,8 +1664,6 @@ static void __generate_crypto(const sdp_ng_flags *flags, struct call_media *this MEDIA_SET(this, SETUP_ACTIVE); } else { - if (flags->dtls_passive && MEDIA_ISSET(this, SETUP_PASSIVE)) - MEDIA_CLEAR(this, SETUP_ACTIVE); /* if we can be active, we will, otherwise we'll be passive */ if (MEDIA_ISSET(this, SETUP_ACTIVE)) MEDIA_CLEAR(this, SETUP_PASSIVE); @@ -2210,7 +2208,7 @@ static void __dtls_logic(const sdp_ng_flags *flags, && MEDIA_ARESET2(other_media, SETUP_ACTIVE, SETUP_PASSIVE)) { // if passive mode is requested, honour it - if (flags->dtls_reverse_passive) + if (flags->dtls_passive) MEDIA_CLEAR(other_media, SETUP_ACTIVE); // if we were previously passive, retain that role else if ((tmp & (MEDIA_FLAG_SETUP_ACTIVE | MEDIA_FLAG_SETUP_PASSIVE)) diff --git a/daemon/call_flags.c b/daemon/call_flags.c index 7826b92f5..e16e886c1 100644 --- a/daemon/call_flags.c +++ b/daemon/call_flags.c @@ -446,6 +446,34 @@ static const char *call_ng_flags_bundle(str *s, unsigned int idx, helper_arg arg return NULL; } +static const char *call_ng_flags_dtls(str *s, unsigned int idx, sdp_ng_flags *out) { + switch (__csh_lookup(s)) { + case CSH_LOOKUP("passive"): + if (out->opmode == OP_ANSWER) + ilog(LOG_NOTICE, "Ignoring DTLS=passive flag in answer as it is too late"); + else + out->dtls_passive = true; + break; + case CSH_LOOKUP("active"): + if (out->opmode == OP_ANSWER) + ilog(LOG_NOTICE, "Ignoring DTLS=active flag in answer as it is too late"); + else + out->dtls_passive = false; + break; + case CSH_LOOKUP("no"): + case CSH_LOOKUP("off"): + case CSH_LOOKUP("disabled"): + case CSH_LOOKUP("disable"): + out->dtls_off = true; + break; + default: + ilog(LOG_WARN, "Unknown 'DTLS' flag encountered: '" STR_FORMAT "'", + STR_FMT(s)); + } + + return NULL; +} + static const char *call_ng_flags_moh(const ng_parser_t *parser, str *key, parser_arg value, helper_arg arg) { sdp_ng_flags *out = arg.flags; switch (__csh_lookup(key)) { @@ -1079,7 +1107,6 @@ void call_ng_flags_init(sdp_ng_flags *out, enum ng_opmode opmode) { out->trust_address = trust_address_def; out->dtls_passive = dtls_passive_def; - out->dtls_reverse_passive = dtls_passive_def; out->el_option = rtpe_config.endpoint_learning; out->tos = 256; out->delay_buffer = -1; @@ -1548,56 +1575,15 @@ const char *call_ng_main_flags(const ng_parser_t *parser, str *key, parser_arg v break; case CSH_LOOKUP("DTLS"): case CSH_LOOKUP("dtls"): - switch (__csh_lookup_n(1, &s)) { - case CSH_LOOKUP_N(1, "passive"): - if (out->opmode == OP_ANSWER) - ilog(LOG_NOTICE, "Ignoring DTLS=passive flag in answer as it is too late"); - else - out->dtls_passive = true; - break; - case CSH_LOOKUP_N(1, "active"): - if (out->opmode == OP_ANSWER) - ilog(LOG_NOTICE, "Ignoring DTLS=active flag in answer as it is too late"); - else - out->dtls_passive = false; - break; - case CSH_LOOKUP_N(1, "no"): - case CSH_LOOKUP_N(1, "off"): - case CSH_LOOKUP_N(1, "disabled"): - case CSH_LOOKUP_N(1, "disable"): - out->dtls_off = true; - break; - default: - ilog(LOG_WARN, "Unknown 'DTLS' flag encountered: '" STR_FORMAT "'", - STR_FMT(&s)); - } - break; + case CSH_LOOKUP("DTLS-reverse"): + case CSH_LOOKUP("dtls-reverse"): + return call_ng_flags_str_list(parser, value, call_ng_flags_dtls, out); case CSH_LOOKUP("DTLS fingerprint"): case CSH_LOOKUP("DTLS-fingerprint"): case CSH_LOOKUP("dtls fingerprint"): case CSH_LOOKUP("dtls-fingerprint"): out->dtls_fingerprint = s; break; - case CSH_LOOKUP("DTLS-reverse"): - case CSH_LOOKUP("dtls-reverse"): - case CSH_LOOKUP("DTLS reverse"): - case CSH_LOOKUP("dtls reverse"): - if (out->opmode == OP_ANSWER) - ilog(LOG_NOTICE, "Ignoring DTLS-reverse option in answer as it is too late"); - else { - switch (__csh_lookup_n(1, &s)) { - case CSH_LOOKUP_N(1, "passive"): - out->dtls_reverse_passive = true; - break; - case CSH_LOOKUP_N(1, "active"): - out->dtls_reverse_passive = false; - break; - default: - ilog(LOG_WARN, "Unknown 'DTLS-reverse' flag encountered: '" STR_FORMAT "'", - STR_FMT(&s)); - } - } - break; case CSH_LOOKUP("DTMF-delay"): case CSH_LOOKUP("DTMF delay"): case CSH_LOOKUP("dtmf-delay"): diff --git a/docs/ng_control_protocol.md b/docs/ng_control_protocol.md index d7c2717b4..70e44c2b5 100644 --- a/docs/ng_control_protocol.md +++ b/docs/ng_control_protocol.md @@ -337,24 +337,6 @@ Optionally included keys are: Reverts the `passive` setting. Only useful if the `dtls-passive` config option is set. -* `DTLS-reverse` - - Contains a string and influences the behaviour of DTLS-SRTP. Unlike the regular `DTLS` flag, this one - is used to control behaviour towards DTLS that was offered to *rtpengine*. In particular, if `passive` - mode is used, it prevents *rtpengine* from prematurely sending active DTLS connection attempts. - Possible values are: - - - `passive` - - Instructs *rtpengine* to prefer the passive (i.e. server) role for the DTLS - handshake. The default is to take the active (client) role if possible. This is useful in cases - where the SRTP endpoint isn't able to receive or process the DTLS handshake packets, for example - when it's behind NAT or needs to finish ICE processing first. - - - `active` - - Reverts the `passive` setting. Only useful if the `dtls-passive` config option is set. - * `DTLS-fingerprint` Contains a string and is used to select the hashing function to generate the DTLS fingerprint diff --git a/include/call_flags.h b/include/call_flags.h index be9694bd8..99b8d154a 100644 --- a/include/call_flags.h +++ b/include/call_flags.h @@ -244,7 +244,6 @@ RTPE_NG_FLAGS_STR_CASE_HT_PARAMS strict_source:1, media_handover:1, dtls_passive:1, - dtls_reverse_passive:1, osrtp_accept_legacy:1, osrtp_accept_rfc:1, osrtp_offer:1,