@lakutata/webrtc 0.0.0-stage → 3.1.4

package/dist/esm/lib/peer/transport/dtls.js

@@ -0,0 +1,564 @@
+import { createPrivateKey, randomUUID, X509Certificate } from 'node:crypto';
+import { Event, runDetached } from '../imports/common.js';
+import { EventTarget as DomEventTarget } from '../helper.js';
+import { certificateDer, CipherContext, DtlsClient, DtlsServer, HashAlgorithm, NamedCurveAlgorithm, SignatureAlgorithm } from '../imports/dtls.js';
+import { RtcpPacketConverter, RtcpTransportLayerFeedback, RtpPacket, SrtcpSession, SrtpAuthenticationError, SrtpSession, TransportWideCC, debug, isMedia, isRtcp, keyLength, saltLength } from '../imports/rtp.js';
+import { generateStatsId, getStatsTimestamp } from '../media/stats.js';
+import { ReceiverTWCC } from '../media/receiver/receiverTwcc.js';
+import { SenderBandwidthEstimator } from '../media/sender/senderBWE.js';
+import { fingerprint, isDtls, normalizeFingerprintAlgorithm, normalizeFingerprintValue } from '../utils.js';
+const log = debug('webrtc/peer/transport/dtls');
+/**
+ * A packet not sent: lost as on the network (one function for all the packets)
+ */
+const ignoreSendFailure = () => undefined;
+function formatDtlsVersion(version) {
+    if (!version) {
+        return;
+    }
+    if (version.major === 0xfe && version.minor === 0xfd) {
+        return 'DTLS 1.2';
+    }
+    if (version.major === 0xfe && version.minor === 0xff) {
+        return 'DTLS 1.0';
+    }
+}
+function formatSrtpCipher(profile) {
+    switch (profile) {
+        case 0x0001:
+            return 'AES_CM_128_HMAC_SHA1_80';
+        case 0x0007:
+            return 'AEAD_AES_128_GCM';
+        default:
+            return;
+    }
+}
+export class RTCDtlsTransport {
+    //Takes the DTLS records from ICE from the start, so that none is lost before the handshake begins
+    #iceAdapter;
+    //The handshake, once started
+    #starting;
+    constructor(config, iceTransport, localCertificate, srtpProfiles = []) {
+        this.config = config;
+        this.iceTransport = iceTransport;
+        this.localCertificate = localCertificate;
+        this.srtpProfiles = srtpProfiles;
+        this.id = randomUUID().toString();
+        this.state = 'new';
+        this.role = 'auto';
+        this.srtpStarted = false;
+        this.transportSequenceNumber = 0;
+        /**The feedback of the packets received with a transport-wide sequence number (of all the streams)*/
+        this.receiverTWCC = new ReceiverTWCC(this);
+        /**The bandwidth estimated from the feedback of the packets sent with one*/
+        this.senderBWE = new SenderBandwidthEstimator();
+        // Statistics tracking
+        this.bytesSent = 0;
+        this.bytesReceived = 0;
+        this.packetsSent = 0;
+        this.packetsReceived = 0;
+        this.dataReceiver = () => { };
+        this.onStateChange = new Event();
+        this.onRtcp = new Event();
+        this.onRtp = new Event();
+        this.events = new DomEventTarget();
+        this.addEventListener = (type, listener, options) => {
+            this.events.addEventListener(type, listener, options);
+        };
+        this.removeEventListener = (type, listener) => {
+            this.events.removeEventListener(type, listener);
+        };
+        this.dispatchEvent = (event) => this.events.dispatchEvent(event);
+        this.sendData = async (data) => {
+            if (this.config.debug?.outboundPacketLoss &&
+                this.config.debug?.outboundPacketLoss / 100 < Math.random()) {
+                return;
+            }
+            if (!this.dtls) {
+                throw new Error('dtls not established');
+            }
+            await this.dtls.send(data);
+        };
+        this.localCertificate ??= RTCDtlsTransport.localCertificate;
+        this.#iceAdapter = createIceTransport(iceTransport.connection);
+    }
+    get localParameters() {
+        return new RTCDtlsParameters(this.localCertificate ? this.localCertificate.getFingerprints() : [], this.role);
+    }
+    static async SetupCertificate() {
+        if (this.localCertificate) {
+            return this.localCertificate;
+        }
+        if (this.localCertificatePromise) {
+            return this.localCertificatePromise;
+        }
+        this.localCertificatePromise = (async () => {
+            const { certPem, keyPem, signatureHash } = await CipherContext.createSelfSignedCertificateWithKey({
+                signature: SignatureAlgorithm.ecdsa_3,
+                hash: HashAlgorithm.sha256_4
+            }, NamedCurveAlgorithm.secp256r1_23);
+            this.localCertificate = new RTCCertificate(keyPem, certPem, signatureHash);
+            return this.localCertificate;
+        })();
+        return this.localCertificatePromise;
+    }
+    setRemoteParams(remoteParameters) {
+        const fingerprints = deduplicateFingerprints([
+            ...(this.remoteParameters?.fingerprints ?? []),
+            ...remoteParameters.fingerprints
+        ]);
+        const role = remoteParameters.role === 'auto' && this.remoteParameters?.role
+            ? this.remoteParameters.role
+            : remoteParameters.role;
+        this.remoteParameters = new RTCDtlsParameters(fingerprints, role);
+    }
+    async start() {
+        //Started already (a description applied again before DTLS connects): the same handshake
+        if (this.#starting) {
+            return await this.#starting;
+        }
+        if (this.state !== 'new') {
+            throw new Error('state must be new');
+        }
+        this.#starting = this.#start();
+        await this.#starting;
+    }
+    /**
+     * Run the handshake
+     */
+    async #start() {
+        if (!this.remoteParameters ||
+            this.remoteParameters.fingerprints.length === 0) {
+            throw new Error('remote fingerprint not exist');
+        }
+        if (this.role === 'auto') {
+            if (this.iceTransport.role === 'controlling') {
+                this.role = 'server';
+            }
+            else {
+                this.role = 'client';
+            }
+        }
+        this.setState('connecting');
+        await new Promise((r, f) => {
+            if (this.role === 'server') {
+                this.dtls = new DtlsServer({
+                    cert: this.localCertificate?.certPem,
+                    key: this.localCertificate?.privateKey,
+                    signatureHash: this.localCertificate?.signatureHash,
+                    transport: this.#iceAdapter,
+                    srtpProfiles: this.srtpProfiles,
+                    extendedMasterSecret: true,
+                    certificateRequest: true
+                });
+            }
+            else {
+                this.dtls = new DtlsClient({
+                    cert: this.localCertificate?.certPem,
+                    key: this.localCertificate?.privateKey,
+                    signatureHash: this.localCertificate?.signatureHash,
+                    transport: this.#iceAdapter,
+                    srtpProfiles: this.srtpProfiles,
+                    extendedMasterSecret: true
+                });
+            }
+            this.dtls.onData.subscribe((buf) => {
+                if (this.config.debug?.inboundPacketLoss &&
+                    this.config.debug?.inboundPacketLoss / 100 < Math.random()) {
+                    return;
+                }
+                this.dataReceiver(buf);
+            });
+            this.dtls.onClose.subscribe(() => {
+                if (this.state !== 'failed') {
+                    this.setState('closed');
+                }
+            });
+            this.dtls.onConnect.once(r);
+            this.dtls.onError.once((error) => {
+                this.setState('failed');
+                log('dtls failed', error);
+                f(error);
+            });
+            //The server keeps the records arriving early (IceTransport): the client starts at once
+            if (this.dtls instanceof DtlsClient) {
+                this.dtls.connect().catch((error) => {
+                    this.setState('failed');
+                    log('dtls connect failed', error);
+                    f(error);
+                });
+            }
+        });
+        try {
+            this.verifyRemoteCertificateFingerprint();
+        }
+        catch (error) {
+            this.setState('failed');
+            this.dtls?.close();
+            throw error;
+        }
+        if (this.srtpProfiles.length > 0) {
+            this.startSrtp();
+        }
+        this.setState('connected');
+        log('dtls connected');
+    }
+    verifyRemoteCertificateFingerprint() {
+        if (!this.remoteParameters ||
+            this.remoteParameters.fingerprints.length === 0) {
+            throw new Error('remote fingerprint not exist');
+        }
+        const remoteCertificate = this.dtls?.remoteCertificate;
+        if (!remoteCertificate) {
+            throw new Error('remote certificate not available');
+        }
+        const supportedFingerprints = this.remoteParameters.fingerprints.flatMap(({ algorithm, value }) => {
+            const normalizedAlgorithm = normalizeFingerprintAlgorithm(algorithm);
+            if (!normalizedAlgorithm) {
+                return [];
+            }
+            const normalizedValue = normalizeFingerprintValue(value);
+            if (!normalizedValue) {
+                throw new Error('remote fingerprint value is empty');
+            }
+            return [{ normalizedAlgorithm, normalizedValue }];
+        });
+        if (supportedFingerprints.length === 0) {
+            throw new Error('no supported remote fingerprint algorithms');
+        }
+        const preferredAlgorithm = selectPreferredFingerprintAlgorithm(supportedFingerprints);
+        const expectedFingerprints = supportedFingerprints.filter(({ normalizedAlgorithm }) => normalizedAlgorithm === preferredAlgorithm);
+        const actualFingerprints = expectedFingerprints.reduce((acc, { normalizedAlgorithm }) => {
+            if (!acc.has(normalizedAlgorithm)) {
+                acc.set(normalizedAlgorithm, normalizeFingerprintValue(fingerprint(remoteCertificate, normalizedAlgorithm)));
+            }
+            return acc;
+        }, new Map());
+        const matched = expectedFingerprints.some(({ normalizedAlgorithm, normalizedValue }) => actualFingerprints.get(normalizedAlgorithm) === normalizedValue);
+        if (!matched) {
+            throw new Error('remote certificate fingerprint mismatch');
+        }
+    }
+    updateSrtpSession() {
+        if (!this.dtls)
+            throw new Error();
+        const profile = this.dtls.srtp.srtpProfile;
+        if (!profile) {
+            throw new Error('need srtpProfile');
+        }
+        log('selected SRTP Profile', profile);
+        const { localKey, localSalt, remoteKey, remoteSalt } = this.dtls.extractSessionKeys(keyLength(profile), saltLength(profile));
+        const config = {
+            keys: {
+                localMasterKey: localKey,
+                localMasterSalt: localSalt,
+                remoteMasterKey: remoteKey,
+                remoteMasterSalt: remoteSalt
+            },
+            profile
+        };
+        this.srtp = new SrtpSession(config);
+        this.srtcp = new SrtcpSession(config);
+    }
+    startSrtp() {
+        if (this.srtpStarted)
+            return;
+        this.srtpStarted = true;
+        this.updateSrtpSession();
+        this.iceTransport.connection.onData.subscribe((data) => {
+            if (this.config.debug?.inboundPacketLoss &&
+                this.config.debug?.inboundPacketLoss / 100 < Math.random()) {
+                return;
+            }
+            if (!isMedia(data))
+                return;
+            // Track received data statistics
+            this.bytesReceived += data.length;
+            this.packetsReceived++;
+            if (isRtcp(data)) {
+                let dec;
+                try {
+                    dec = this.srtcp.decrypt(data);
+                }
+                catch (error) {
+                    if (error instanceof SrtpAuthenticationError) {
+                        log('dropping invalid SRTCP packet', error);
+                        return;
+                    }
+                    throw error;
+                }
+                let rtcpPackets;
+                try {
+                    rtcpPackets = RtcpPacketConverter.deSerialize(dec);
+                }
+                catch (error) {
+                    log('dropping malformed SRTCP packet', error);
+                    return;
+                }
+                for (const rtcp of rtcpPackets) {
+                    try {
+                        //The transport-wide feedback is the one of the packets of all the senders
+                        if (rtcp instanceof RtcpTransportLayerFeedback && rtcp.feedback instanceof TransportWideCC) {
+                            this.senderBWE.receiveTWCC(rtcp.feedback);
+                            continue;
+                        }
+                        this.onRtcp.execute(rtcp);
+                    }
+                    catch (error) {
+                        log('RTCP error', error);
+                    }
+                }
+            }
+            else {
+                let dec;
+                try {
+                    dec = this.srtp.decrypt(data);
+                }
+                catch (error) {
+                    if (error instanceof SrtpAuthenticationError) {
+                        log('dropping invalid SRTP packet', error);
+                        return;
+                    }
+                    throw error;
+                }
+                let rtp;
+                try {
+                    rtp = RtpPacket.deSerialize(dec);
+                }
+                catch (error) {
+                    log('dropping malformed SRTP packet', error);
+                    return;
+                }
+                try {
+                    this.onRtp.execute(rtp);
+                }
+                catch (error) {
+                    log('RTP error', error);
+                }
+            }
+        });
+    }
+    async sendRtp(payload, header) {
+        try {
+            const enc = this.srtp.encrypt(payload, header);
+            if (this.config.debug?.outboundPacketLoss &&
+                this.config.debug?.outboundPacketLoss / 100 < Math.random()) {
+                return enc.length;
+            }
+            // Track statistics
+            this.bytesSent += enc.length;
+            this.packetsSent++;
+            await this.iceTransport.connection.send(enc).catch(ignoreSendFailure);
+            return enc.length;
+        }
+        catch (error) {
+            log('failed to send', error);
+            return 0;
+        }
+    }
+    async sendRtcp(packets) {
+        //Before SRTP starts (a transport not connected yet, such as the one of a transceiver not bundled yet): as sendRtp
+        if (!this.srtcp) {
+            return;
+        }
+        const payload = Buffer.concat(packets.map((packet) => packet.serialize()));
+        const enc = this.srtcp.encrypt(payload);
+        if (this.config.debug?.outboundPacketLoss &&
+            this.config.debug?.outboundPacketLoss / 100 < Math.random()) {
+            return enc.length;
+        }
+        // Track statistics
+        this.bytesSent += enc.length;
+        this.packetsSent++;
+        await this.iceTransport.connection.send(enc).catch(() => { });
+    }
+    setState(state, emitEvent = true) {
+        if (state != this.state) {
+            this.state = state;
+            if (state === 'closed' || state === 'failed')
+                this.receiverTWCC.stop();
+            this.onStateChange.execute(state);
+            if (emitEvent) {
+                this.onstatechange?.();
+                this.events.emit('statechange');
+            }
+        }
+    }
+    async stop() {
+        this.setState('closed', false);
+        // todo impl send alert
+        //A handshake in progress stops sending its flights again
+        this.dtls?.close();
+        await this.iceTransport.stop();
+    }
+    async getStats(timestamp = getStatsTimestamp()) {
+        const stats = [];
+        const transportId = generateStatsId('transport', this.id);
+        // Transport stats
+        const transportStats = {
+            type: 'transport',
+            id: transportId,
+            timestamp,
+            bytesSent: this.bytesSent,
+            bytesReceived: this.bytesReceived,
+            packetsSent: this.packetsSent,
+            packetsReceived: this.packetsReceived,
+            dtlsState: this.state,
+            iceState: this.iceTransport.state,
+            iceRole: this.iceTransport.role === 'unknown'
+                ? undefined
+                : this.iceTransport.role,
+            iceLocalUsernameFragment: this.iceTransport.localParameters.usernameFragment,
+            selectedCandidatePairId: this.iceTransport.connection.nominated
+                ? generateStatsId('candidate-pair', this.iceTransport.connection.nominated.id)
+                : undefined,
+            localCertificateId: this.localCertificate
+                ? generateStatsId('certificate', this.id, 'local')
+                : undefined,
+            remoteCertificateId: this.dtls?.remoteCertificate
+                ? generateStatsId('certificate', this.id, 'remote')
+                : undefined,
+            dtlsRole: this.role === 'auto' ? undefined : this.role,
+            tlsVersion: formatDtlsVersion(this.dtls?.dtls.version),
+            dtlsCipher: this.dtls?.cipher.cipher?.name,
+            srtpCipher: formatSrtpCipher(this.dtls?.srtp.srtpProfile),
+            iceRestarts: this.iceTransport.iceRestarts
+        };
+        stats.push(transportStats);
+        // Certificate stats
+        if (this.localCertificate) {
+            const fingerprints = this.localCertificate.getFingerprints();
+            if (fingerprints.length > 0) {
+                const certStats = {
+                    type: 'certificate',
+                    id: generateStatsId('certificate', this.id, 'local'),
+                    timestamp,
+                    fingerprint: fingerprints[0].value,
+                    fingerprintAlgorithm: fingerprints[0].algorithm,
+                    base64Certificate: Buffer.from(this.localCertificate.certPem).toString('base64')
+                };
+                stats.push(certStats);
+            }
+        }
+        if (this.remoteParameters &&
+            this.remoteParameters.fingerprints.length > 0 &&
+            this.dtls?.remoteCertificate) {
+            const certStats = {
+                type: 'certificate',
+                id: generateStatsId('certificate', this.id, 'remote'),
+                timestamp,
+                fingerprint: this.remoteParameters.fingerprints[0].value,
+                fingerprintAlgorithm: this.remoteParameters.fingerprints[0].algorithm,
+                base64Certificate: Buffer.from(this.dtls.remoteCertificate).toString('base64')
+            };
+            stats.push(certStats);
+        }
+        // Get ICE stats
+        const iceStats = await this.iceTransport.getStats(timestamp, transportId);
+        stats.push(...iceStats);
+        return stats;
+    }
+}
+export const DtlsStates = [
+    'new',
+    'connecting',
+    'connected',
+    'closed',
+    'failed'
+];
+export class RTCCertificate {
+    constructor(privateKeyPem, certPem, signatureHash) {
+        this.certPem = certPem;
+        this.signatureHash = signatureHash;
+        this.publicKey = new X509Certificate(certPem).publicKey.export({ type: 'spki', format: 'pem' });
+        this.privateKey = createPrivateKey(privateKeyPem).export({ type: 'pkcs8', format: 'pem' });
+    }
+    getFingerprints() {
+        return [
+            new RTCDtlsFingerprint('sha-256', fingerprint(certificateDer(this.certPem), 'sha256'))
+        ];
+    }
+}
+export class RTCDtlsFingerprint {
+    constructor(algorithm, value) {
+        this.algorithm = algorithm;
+        this.value = value;
+    }
+}
+export class RTCDtlsParameters {
+    constructor(fingerprints = [], role) {
+        this.fingerprints = fingerprints;
+        this.role = role;
+    }
+}
+const deduplicateFingerprints = (fingerprints) => {
+    const seen = new Set();
+    return fingerprints.filter(({ algorithm, value }) => {
+        const key = `${normalizeFingerprintAlgorithm(algorithm) ?? algorithm.trim().toLowerCase()}:${normalizeFingerprintValue(value)}`;
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    });
+};
+const preferredFingerprintAlgorithms = [
+    'sha512',
+    'sha384',
+    'sha256',
+    'sha224',
+    'sha1'
+];
+const selectPreferredFingerprintAlgorithm = (fingerprints) => {
+    return (preferredFingerprintAlgorithms.find((algorithm) => fingerprints.some(({ normalizedAlgorithm }) => normalizedAlgorithm === algorithm)) ?? fingerprints[0].normalizedAlgorithm);
+};
+class IceTransport {
+    //The DTLS records arriving before the DTLS socket takes them (the peer's ClientHello, sent as soon as its ICE
+    //connected) wait here, a few at most, and go to the socket when it sets its handler
+    #early;
+    #onData;
+    constructor(ice) {
+        this.ice = ice;
+        this.closed = false;
+        //The DTLS records arriving before the DTLS socket takes them (the peer's ClientHello, sent as soon as its ICE
+        //connected) wait here, a few at most, and go to the socket when it sets its handler
+        this.#early = [];
+        this.type = 'ice';
+        this.send = (data) => {
+            return this.ice.send(data);
+        };
+        ice.onData.subscribe((buf) => {
+            if (!isDtls(buf))
+                return;
+            if (this.#onData)
+                this.#onData(buf);
+            else if (this.#early && this.#early.length < 16)
+                this.#early.push(buf);
+        });
+    }
+    get onData() {
+        return this.#onData ?? (() => undefined);
+    }
+    set onData(handler) {
+        const early = this.#early;
+        if (!early) {
+            this.#onData = handler;
+            return;
+        }
+        //The DTLS socket sets its handler in its constructor: the early records go to it once the construction ends
+        //(the records arriving meanwhile join them, in order)
+        queueMicrotask(() => {
+            this.#early = undefined;
+            this.#onData = handler;
+            early.forEach((buf) => handler(buf));
+        });
+    }
+    get address() {
+        return {};
+    }
+    async close() {
+        this.closed = true;
+        runDetached(() => this.ice.close(), (error) => log('close failed', error));
+    }
+}
+const createIceTransport = (ice) => new IceTransport(ice);