From 9e9d669f80edd535413e5d5452425163c26f215b Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Mon, 17 Aug 2026 12:03:44 -0400 Subject: [PATCH] MT#55283 combine DTLS= and DTLS-reverse= Forcing the DTLS role to passive only makes sense for the backwards (torwards the offerer) direction anyway, as towards the answerer (in an offer) it's not allowed by the RFC, and in an answer it's not possible as the active DTLS connection would already be in progress. Convert DTLS= processing into a list as multiple flags might be required. Change-Id: I54239280460e1bbce1966bc17a384489eb978618 Amends: 78ee0451 / Ib1d07831 Related: #2156 Related: #2145 (cherry picked from commit 032bd398b91b48418624ef314aa48083ba4127bc) --- daemon/call.c | 4 +- daemon/call_interfaces.c | 74 +++++++++++++++---------------------- docs/ng_control_protocol.md | 18 --------- include/call_interfaces.h | 1 - 4 files changed, 30 insertions(+), 67 deletions(-) diff --git a/daemon/call.c b/daemon/call.c index 0ddd2fa98..95e25f374 100644 --- a/daemon/call.c +++ b/daemon/call.c @@ -1657,8 +1657,6 @@ static void __generate_crypto(const sdp_ng_flags *flags, struct call_media *this MEDIA_SET(this, SETUP_ACTIVE); } else { - if (flags->dtls_passive && MEDIA_ISSET(this, SETUP_PASSIVE)) - MEDIA_CLEAR(this, SETUP_ACTIVE); /* if we can be active, we will, otherwise we'll be passive */ if (MEDIA_ISSET(this, SETUP_ACTIVE)) MEDIA_CLEAR(this, SETUP_PASSIVE); @@ -2203,7 +2201,7 @@ static void __dtls_logic(const sdp_ng_flags *flags, && MEDIA_ARESET2(other_media, SETUP_ACTIVE, SETUP_PASSIVE)) { // if passive mode is requested, honour it - if (flags->dtls_reverse_passive) + if (flags->dtls_passive) MEDIA_CLEAR(other_media, SETUP_ACTIVE); // if we were previously passive, retain that role else if ((tmp & (MEDIA_FLAG_SETUP_ACTIVE | MEDIA_FLAG_SETUP_PASSIVE)) diff --git a/daemon/call_interfaces.c b/daemon/call_interfaces.c index 961c8bb70..24d8f59e0 100644 --- a/daemon/call_interfaces.c +++ b/daemon/call_interfaces.c @@ -870,6 +870,32 @@ static void call_ng_flags_bundle(str *s, unsigned int idx, helper_arg arg) { } } +static void call_ng_flags_dtls(str *s, unsigned int idx, sdp_ng_flags *out) { + switch (__csh_lookup(s)) { + case CSH_LOOKUP("passive"): + if (out->opmode == OP_ANSWER) + ilog(LOG_NOTICE, "Ignoring DTLS=passive flag in answer as it is too late"); + else + out->dtls_passive = true; + break; + case CSH_LOOKUP("active"): + if (out->opmode == OP_ANSWER) + ilog(LOG_NOTICE, "Ignoring DTLS=active flag in answer as it is too late"); + else + out->dtls_passive = false; + break; + case CSH_LOOKUP("no"): + case CSH_LOOKUP("off"): + case CSH_LOOKUP("disabled"): + case CSH_LOOKUP("disable"): + out->dtls_off = true; + break; + default: + ilog(LOG_WARN, "Unknown 'DTLS' flag encountered: '" STR_FORMAT "'", + STR_FMT(s)); + } +} + static void call_ng_flags_moh(const ng_parser_t *parser, str *key, parser_arg value, helper_arg arg) { sdp_ng_flags *out = arg.flags; switch (__csh_lookup(key)) { @@ -1483,7 +1509,6 @@ void call_ng_flags_init(sdp_ng_flags *out, enum ng_opmode opmode) { out->trust_address = trust_address_def; out->dtls_passive = dtls_passive_def; - out->dtls_reverse_passive = dtls_passive_def; out->el_option = rtpe_config.endpoint_learning; out->tos = 256; out->delay_buffer = -1; @@ -1919,56 +1944,15 @@ void call_ng_main_flags(const ng_parser_t *parser, str *key, parser_arg value, h break; case CSH_LOOKUP("DTLS"): case CSH_LOOKUP("dtls"): - switch (__csh_lookup_n(1, &s)) { - case CSH_LOOKUP_N(1, "passive"): - if (out->opmode == OP_ANSWER) - ilog(LOG_NOTICE, "Ignoring DTLS=passive flag in answer as it is too late"); - else - out->dtls_passive = true; - break; - case CSH_LOOKUP_N(1, "active"): - if (out->opmode == OP_ANSWER) - ilog(LOG_NOTICE, "Ignoring DTLS=active flag in answer as it is too late"); - else - out->dtls_passive = false; - break; - case CSH_LOOKUP_N(1, "no"): - case CSH_LOOKUP_N(1, "off"): - case CSH_LOOKUP_N(1, "disabled"): - case CSH_LOOKUP_N(1, "disable"): - out->dtls_off = true; - break; - default: - ilog(LOG_WARN, "Unknown 'DTLS' flag encountered: '" STR_FORMAT "'", - STR_FMT(&s)); - } - break; + case CSH_LOOKUP("DTLS-reverse"): + case CSH_LOOKUP("dtls-reverse"): + return call_ng_flags_str_list(parser, value, call_ng_flags_dtls, out); case CSH_LOOKUP("DTLS fingerprint"): case CSH_LOOKUP("DTLS-fingerprint"): case CSH_LOOKUP("dtls fingerprint"): case CSH_LOOKUP("dtls-fingerprint"): out->dtls_fingerprint = s; break; - case CSH_LOOKUP("DTLS-reverse"): - case CSH_LOOKUP("dtls-reverse"): - case CSH_LOOKUP("DTLS reverse"): - case CSH_LOOKUP("dtls reverse"): - if (out->opmode == OP_ANSWER) - ilog(LOG_NOTICE, "Ignoring DTLS-reverse option in answer as it is too late"); - else { - switch (__csh_lookup_n(1, &s)) { - case CSH_LOOKUP_N(1, "passive"): - out->dtls_reverse_passive = true; - break; - case CSH_LOOKUP_N(1, "active"): - out->dtls_reverse_passive = false; - break; - default: - ilog(LOG_WARN, "Unknown 'DTLS-reverse' flag encountered: '" STR_FORMAT "'", - STR_FMT(&s)); - } - } - break; case CSH_LOOKUP("DTMF-delay"): case CSH_LOOKUP("DTMF delay"): case CSH_LOOKUP("dtmf-delay"): diff --git a/docs/ng_control_protocol.md b/docs/ng_control_protocol.md index 1b527076c..7367cb785 100644 --- a/docs/ng_control_protocol.md +++ b/docs/ng_control_protocol.md @@ -336,24 +336,6 @@ Optionally included keys are: Reverts the `passive` setting. Only useful if the `dtls-passive` config option is set. -* `DTLS-reverse` - - Contains a string and influences the behaviour of DTLS-SRTP. Unlike the regular `DTLS` flag, this one - is used to control behaviour towards DTLS that was offered to *rtpengine*. In particular, if `passive` - mode is used, it prevents *rtpengine* from prematurely sending active DTLS connection attempts. - Possible values are: - - - `passive` - - Instructs *rtpengine* to prefer the passive (i.e. server) role for the DTLS - handshake. The default is to take the active (client) role if possible. This is useful in cases - where the SRTP endpoint isn't able to receive or process the DTLS handshake packets, for example - when it's behind NAT or needs to finish ICE processing first. - - - `active` - - Reverts the `passive` setting. Only useful if the `dtls-passive` config option is set. - * `DTLS-fingerprint` Contains a string and is used to select the hashing function to generate the DTLS fingerprint diff --git a/include/call_interfaces.h b/include/call_interfaces.h index 607db28ed..3ebb8595b 100644 --- a/include/call_interfaces.h +++ b/include/call_interfaces.h @@ -233,7 +233,6 @@ RTPE_NG_FLAGS_STR_CASE_HT_PARAMS strict_source:1, media_handover:1, dtls_passive:1, - dtls_reverse_passive:1, osrtp_accept_legacy:1, osrtp_accept_rfc:1, osrtp_offer:1,