Struct DtlsConnectorBuilder

pub struct DtlsConnectorBuilder { /* private fields */ }

A builder for DtlsConnectors.

With this builder you can configure the following DTLS properties:

• The identity to be used for client certificate authentication
• Adding and enabling the the DTLS extension ‘use_srtp’
• Configuring min/max supported DTLS versions
• Adding a certificate to the set of roots that the connector will trust
• Allowing invalid hostnames/certs for the connection
• Enabling Server Name Indication (SNI)

Implementations

impl DtlsConnectorBuilder

pub fn identity(&mut self, identity: Identity) -> &mut DtlsConnectorBuilder

Sets the identity to be used for client certificate authentication.

pub fn min_protocol_version( &mut self, protocol: Option<Protocol>, ) -> &mut DtlsConnectorBuilder

Sets the minimum supported protocol version.

A value of None enables support for the oldest protocols supported by the implementation.

Defaults to Some(Protocol::Dtlsv10).

Underlying SSL

This will be used for setting the ssl options witch corresponds to SSL_CTX_set_options.

pub fn max_protocol_version( &mut self, protocol: Option<Protocol>, ) -> &mut DtlsConnectorBuilder

Sets the maximum supported protocol version.

A value of None enables support for the newest protocols supported by the implementation.

Defaults to None.

Underlying SSL

This will be used for setting the ssl options witch corresponds to SSL_CTX_set_options.

pub fn add_srtp_profile( &mut self, profile: SrtpProfile, ) -> &mut DtlsConnectorBuilder

Enables the DTLS extension ‘use_srtp’ as defined in RFC5764.

Underlying SSL

This corresponds to SSL_CTX_set_tlsext_use_srtp.

Examples found in repository

examples/udp_socket.rs (line 21)

fn main() {
    let buffer = include_bytes!("../test/identity.p12");
    let identity = Identity::from_pkcs12(buffer, "mypass").unwrap();

    let root_ca = include_bytes!("../test/root-ca.der");
    let root_ca = Certificate::from_der(root_ca).unwrap();

    let acceptor = DtlsAcceptor::builder(identity).build().unwrap();
    let connector = DtlsConnector::builder()
        .add_srtp_profile(SrtpProfile::Aes128CmSha180)
        .add_srtp_profile(SrtpProfile::AeadAes256Gcm)
        .add_root_certificate(root_ca)
        .build()
        .unwrap();

    let server = UdpSocket::bind("127.0.0.1:0").unwrap();
    let client = UdpSocket::bind("127.0.0.1:0").unwrap();

    let server_addr = server.local_addr().unwrap();
    let client_addr = client.local_addr().unwrap();

    let server_channel = UdpChannel {
        socket: server,
        remote_addr: client_addr,
    };

    let client_channel = UdpChannel {
        socket: client,
        remote_addr: server_addr,
    };

    let guard = thread::spawn(move || {
        let mut dtls_server = acceptor.accept(server_channel).unwrap();

        let mut count = 0;

        while true {
            let mut received = [0; 5];

            dtls_server.read_exact(&mut received);

            println!(
                "{:?} {:?}",
                count,
                String::from_utf8_lossy(received.as_ref())
            );

            count = count + 1;
            thread::sleep(Duration::from_millis(2));
        }
    });

    let mut dtls_client = connector.connect("foobar.com", client_channel).unwrap();

    while true {
        let mut buf = [0; 5];

        let buf = b"hello";
        dtls_client.write_all(buf);

        thread::sleep(Duration::from_millis(30));
    }
}

pub fn add_root_certificate( &mut self, cert: Certificate, ) -> &mut DtlsConnectorBuilder

Adds a certificate to the set of roots that the connector will trust.

The connector will use the system’s trust root by default. This method can be used to add to that set when communicating with servers not trusted by the system.

Defaults to an empty set.

Underlying SSL

This will add a certificate to the certificate store. X509_STORE_add_cert.

Examples found in repository

examples/udp_socket.rs (line 23)

fn main() {
    let buffer = include_bytes!("../test/identity.p12");
    let identity = Identity::from_pkcs12(buffer, "mypass").unwrap();

    let root_ca = include_bytes!("../test/root-ca.der");
    let root_ca = Certificate::from_der(root_ca).unwrap();

    let acceptor = DtlsAcceptor::builder(identity).build().unwrap();
    let connector = DtlsConnector::builder()
        .add_srtp_profile(SrtpProfile::Aes128CmSha180)
        .add_srtp_profile(SrtpProfile::AeadAes256Gcm)
        .add_root_certificate(root_ca)
        .build()
        .unwrap();

    let server = UdpSocket::bind("127.0.0.1:0").unwrap();
    let client = UdpSocket::bind("127.0.0.1:0").unwrap();

    let server_addr = server.local_addr().unwrap();
    let client_addr = client.local_addr().unwrap();

    let server_channel = UdpChannel {
        socket: server,
        remote_addr: client_addr,
    };

    let client_channel = UdpChannel {
        socket: client,
        remote_addr: server_addr,
    };

    let guard = thread::spawn(move || {
        let mut dtls_server = acceptor.accept(server_channel).unwrap();

        let mut count = 0;

        while true {
            let mut received = [0; 5];

            dtls_server.read_exact(&mut received);

            println!(
                "{:?} {:?}",
                count,
                String::from_utf8_lossy(received.as_ref())
            );

            count = count + 1;
            thread::sleep(Duration::from_millis(2));
        }
    });

    let mut dtls_client = connector.connect("foobar.com", client_channel).unwrap();

    while true {
        let mut buf = [0; 5];

        let buf = b"hello";
        dtls_client.write_all(buf);

        thread::sleep(Duration::from_millis(30));
    }
}

pub fn danger_accept_invalid_certs( &mut self, accept_invalid_certs: bool, ) -> &mut DtlsConnectorBuilder

Controls the use of certificate validation.

Defaults to false.

Warning

You should think very carefully before using this method. If invalid certificates are trusted, any certificate for any site will be trusted for use. This includes expired certificates. This introduces significant vulnerabilities, and should only be used as a last resort.

pub fn use_sni(&mut self, use_sni: bool) -> &mut DtlsConnectorBuilder

Controls the use of Server Name Indication (SNI).

Defaults to true.

pub fn danger_accept_invalid_hostnames( &mut self, accept_invalid_hostnames: bool, ) -> &mut DtlsConnectorBuilder

Controls the use of hostname verification.

Defaults to false.

Warning

You should think very carefully before using this method. If invalid hostnames are trusted, any valid certificate for any site will be trusted for use. This introduces significant vulnerabilities, and should only be used as a last resort.

pub fn build(&self) -> Result<DtlsConnector>

Creates a new DtlsConnector with the settings from this builder.

Examples found in repository

examples/udp_socket.rs (line 24)

fn main() {
    let buffer = include_bytes!("../test/identity.p12");
    let identity = Identity::from_pkcs12(buffer, "mypass").unwrap();

    let root_ca = include_bytes!("../test/root-ca.der");
    let root_ca = Certificate::from_der(root_ca).unwrap();

    let acceptor = DtlsAcceptor::builder(identity).build().unwrap();
    let connector = DtlsConnector::builder()
        .add_srtp_profile(SrtpProfile::Aes128CmSha180)
        .add_srtp_profile(SrtpProfile::AeadAes256Gcm)
        .add_root_certificate(root_ca)
        .build()
        .unwrap();

    let server = UdpSocket::bind("127.0.0.1:0").unwrap();
    let client = UdpSocket::bind("127.0.0.1:0").unwrap();

    let server_addr = server.local_addr().unwrap();
    let client_addr = client.local_addr().unwrap();

    let server_channel = UdpChannel {
        socket: server,
        remote_addr: client_addr,
    };

    let client_channel = UdpChannel {
        socket: client,
        remote_addr: server_addr,
    };

    let guard = thread::spawn(move || {
        let mut dtls_server = acceptor.accept(server_channel).unwrap();

        let mut count = 0;

        while true {
            let mut received = [0; 5];

            dtls_server.read_exact(&mut received);

            println!(
                "{:?} {:?}",
                count,
                String::from_utf8_lossy(received.as_ref())
            );

            count = count + 1;
            thread::sleep(Duration::from_millis(2));
        }
    });

    let mut dtls_client = connector.connect("foobar.com", client_channel).unwrap();

    while true {
        let mut buf = [0; 5];

        let buf = b"hello";
        dtls_client.write_all(buf);

        thread::sleep(Duration::from_millis(30));
    }
}