Crate rtc_dtls 

DTLS 1.2 for the Sans-I/O WebRTC stack.

An implementation of Datagram Transport Layer Security (RFC 6347) with the extensions WebRTC requires: DTLS-SRTP key export (RFC 5764), extended master secret (RFC 7627), and elliptic-curve cipher suites (RFC 4492, RFC 5289). It secures the media and data-channel path: SRTP keying material comes out of the DTLS handshake, and SCTP data channels run over the DTLS association itself.

Structure

• endpoint — the Sans-I/O entry point: feed it datagrams, poll it for the datagrams it wants to send and the events it produces. No sockets, no timers of its own.
• config — certificates, cipher-suite and curve preferences, the client/server role, and the SRTP protection profiles to negotiate.
• handshake, flight, state — the handshake message types and the flight state machine that drives them, including retransmission.
• cipher_suite, crypto, curve, signature_hash_algorithm — the cryptographic primitives and the negotiated-suite abstraction.
• extension — the ClientHello/ServerHello extensions, including use_srtp and SNI.
• alert, content, record_layer — the record layer and its content types.

Example

A WebRTC handshake is configured with a self-signed certificate and the SRTP profiles to negotiate through use_srtp; the keys for those profiles are then exported from the completed handshake rather than signalled:

use rtc_dtls::config::{ConfigBuilder, ExtendedMasterSecretType};
use rtc_dtls::extension::extension_use_srtp::SrtpProtectionProfile;

let builder = ConfigBuilder::default()
    .with_srtp_protection_profiles(vec![
        SrtpProtectionProfile::Srtp_Aead_Aes_128_Gcm,
        SrtpProtectionProfile::Srtp_Aes128_Cm_Hmac_Sha1_80,
    ])
    .with_extended_master_secret(ExtendedMasterSecretType::Require);

Most applications do not depend on this crate directly — the rtc crate drives it as one layer of the peer-connection pipeline.

Modules

alert

Alert records: fatal errors and the orderly close_notify.

application_data

Application data records — the payload DTLS carries once the handshake completes.

change_cipher_spec

The ChangeCipherSpec record, which switches a side over to the negotiated keys.

cipher_suite

The negotiable cipher suites and the CipherSuite trait they implement.

client_certificate_type

Certificate types a server may request from a client.

compression_methods

The compression-methods field. DTLS in WebRTC always negotiates null compression.

config

Handshake configuration: certificates, roles, cipher-suite and SRTP profile preferences. Handshake configuration.

conn

Connection state shared across the handshake and record layers. The DTLS association.

content

Record content types: handshake, alert, change-cipher-spec and application data.

crypto

Cryptographic primitives: the AEAD and CBC ciphers, certificates and signatures. Cryptographic primitives for DTLS.

curve

Elliptic curves and the key-exchange values exchanged over them.

endpoint

The Sans-I/O entry point: feed it datagrams, poll it for output and events. The Sans-I/O DTLS endpoint.

extension

ClientHello and ServerHello extensions, including use_srtp and SNI.

flight

The flight state machine, which drives the handshake and its retransmissions.

fragment_buffer

Reassembly of handshake messages fragmented across datagrams.

handshake

The handshake message types and the cache that hashes them for Finished. DTLS handshake messages.

handshaker

Handshake orchestration: state, roles and the verification callbacks.

prf

The pseudo-random function that expands the master secret into keys.

record_layer

The record layer: framing, sequence numbers and epochs.

signature_hash_algorithm

Signature and hash algorithm pairs, as negotiated for certificate verification.

state

The negotiated connection state: keys, sequence numbers and peer identity.