Module dtls 

DTLS-SRTP: keying SRTP on the media path (RFC 5764).

SDES (sipx_sdp::crypto, RFC 4568) puts the master key in the SDP. That works and it means every element that reads the signalling — every proxy, every session border controller that terminates the TLS — has held the key. DTLS-SRTP does not: the two endpoints handshake on the media path, derive the SRTP keys from the DTLS master secret, and the signalling carries only a hash of the certificate that will appear (sipx_sdp::fingerprint, RFC 8122).

This module is the parts of RFC 5764 that are sipx’s own: telling a DTLS record from an RTP packet on one port (§5.1.2), the protection profiles and their key sizes (§4.1.2), and turning the exported keying material into the two SRTP contexts a session needs (§4.2). The handshake itself is a DTLS implementation’s job and is reached through Handshake.

Supported: sipx-call now selects this protocol, key-derivation and handshake surface for explicit DTLS-SRTP call policy (M-28), so an upper-layer caller has constrained its shape. The optional dtls::openssl implementation remains experimental; enabling that feature only makes the explicit selection available and never changes a call’s default.

Modules

openssl

The DTLS handshake itself, over the media socket.

Structs

Keys

The two SRTP contexts a session needs: one to protect with, one to unprotect with.

VerifiedKeys

DTLS-SRTP keys whose peer certificate and protection profile were verified.

Enums

Arriving

What a datagram arriving on a media port is (RFC 5764 §5.1.2).

Error

Why a keyed media path could not be established.

KeyError

Why keying material could not be turned into SRTP contexts.

Profile

An SRTP protection profile (RFC 5764 §4.1.2).

Role

Which end of the DTLS connection this endpoint is.

Constants

EXPORTER_LABEL

The TLS exporter label RFC 5764 §4.2 fixes for this use.

Traits

Handshake

A DTLS handshake on the media path, as much of one as RFC 5764 needs.

Functions

classify

Classify a datagram by its first byte (RFC 5764 §5.1.2).

establish

Handshake, verify the peer against the fingerprint from its SDP, and derive the SRTP keys.

establish_verified

Handshake, verify and return key material carrying proof that verification ran.

keys_from_exported

Split exported keying material into the two SRTP contexts (RFC 5764 §4.2).