ddn.net.dtls.engine
DTLS engine for client and server roles.
Provides the main DtlsEngine class that manages DTLS connections over a datagram transport. Supports both client and server modes, multiple concurrent peers, and configurable timeouts.
The engine handles:
- DTLS handshake state machine
- Peer connection tracking
- Retransmission timers
- Idle peer pruning
- MTU configuration
class NativeDtlsEngine
Types 1
classNativeDtlsEngine : DtlsEngine
Main DTLS engine for client and server roles.
The engine manages DTLS connections over a single datagram socket. In server mode, it can handle multiple peers simultaneously. In client mode, it connects to a single server.
Thread safety: NOT thread-safe. All calls must be serialized.
Example (client):
auto engine = new NativeDtlsEngine(transport, timer, "example.com");
engine.setMinVersion(DtlsVersion.DTLS_1_2);
while (engine.handshake() != TlsProgress.DONE) {
// poll and handle I/O
}Example (server):
auto engine = new NativeDtlsEngine(transport, timer);
engine.setCertificateChain(certs);
engine.setPrivateKey(key);
// Process incoming datagrams in event loopFields
private ubyte[2] DTLS_RECORD_VERSIONprivate DtlsTransport transport_private DtlsTimerSink timer_private bool isServer_private string serverName_private DatagramEndpoint serverAddr_private Dtls12Client client12_private Dtls13Client client13_private bool handshakeStarted_private bool clientConnected_private bool useDtls13_private DtlsPeerState[DatagramEndpoint] peers_private size_t maxPeers_private size_t maxHandshakingPeers_private Duration handshakeTimeout_private Duration idleTimeout_private void delegate(DatagramEndpoint, DtlsEvictReason) @safe onPeerEvicted_private DtlsVersion minVersion_private DtlsVersion maxVersion_private size_t mtu_private string[] alpnProtocols_private const(ubyte)[][] certChainDer_private string privateKeyPem_private NativeTlsTrustStore trustStore_private TlsVerifyMode verifyMode_private DtlsVerifyCallback verifyCallback_private ubyte[] cookieSecret_private DtlsPmtudEngine pmtudEngine_private PmtudPeerState[DatagramEndpoint] pmtudStates_private DtlsMtuChangedCallback onMtuChanged_private DtlsCidManager cidManager_private ubyte cidLength_private DtlsPeerMigratedCallback onPeerMigrated_private SrtpProfile[] srtpProfiles_private bool sessionResumptionEnabled_private Duration sessionTicketLifetime_private size_t maxEarlyDataSize_private EarlyDataReplayProtection earlyDataReplayMode_private Duration earlyDataTimeWindow_private DtlsSessionCallback onSessionTicket_private DtlsEarlyDataCallback onEarlyData_private DtlsSessionInfo resumeSession_private bool hasResumeSession_private DtlsTicketKeyManager ticketKeyMgr_private DtlsReplayCache replayCache_Methods
DtlsCidManager cidManager() @safe pure nothrow @nogcReturns: The CID manager (package-internal access for NativeDtlsPeer).void setCertificateChain(const(ubyte[])[] derCerts) @safeSet the certificate chain for authentication.void setTrustStore(TlsTrustStore trustStore) @safeSets the trust store for certificate verification.void setVerifyCallback(DtlsVerifyCallback callback) @safe pure nothrowSets a custom certificate verification callback.void setVerifyMode(TlsVerifyMode mode) @safe pure nothrow @nogcSets the certificate verification mode.void setServerAddress(DatagramEndpoint addr) @safe pure nothrow @nogcSets the target server address for client mode.private
void completeClientHandshake(DatagramEndpoint peerAddr) @safeRegisters the connected peer state after the client handshake completes.TlsProgress processDatagram(const(ubyte)[] data, DatagramEndpoint from) @safeProcess an incoming datagram.private
bool authenticateCidDatagram(DtlsPeerState state,
const(ubyte)[] data) @safeAuthenticates a CID-bearing datagram under a peer's read keys.void enablePmtuDiscovery(bool enable) @safeEnables or disables path MTU discovery (RFC 8899 PLPMTUD).void setOnMtuChanged(DtlsMtuChangedCallback callback) @safeSets the callback fired when a peer's discovered MTU changes.void setOnPeerMigrated(DtlsPeerMigratedCallback callback) @safeSets the callback fired when a peer migrates to a new address.void enableSessionResumption(bool enable) @safeEnables or disables session resumption (and 0-RTT early data).void setMaxEarlyDataSize(size_t bytes) @safeSets the maximum 0-RTT early data size advertised to clients.void setEarlyDataReplayProtection(EarlyDataReplayProtection mode) @safeSets the anti-replay strategy for 0-RTT early data.void setEarlyDataTimeWindow(Duration window) @safeSets the replay window duration for TIME_WINDOWED protection.void setOnSessionTicket(DtlsSessionCallback callback) @safeSets the callback fired when a session ticket is issued.void setOnEarlyData(DtlsEarlyDataCallback callback) @safeSets the callback fired when early data is received.void resumeWithSession(scope ref const DtlsSessionInfo session) @safeConfigures resumption with a previously stored session.void setSrtpProfiles(const(SrtpProfile[]) profiles) @safeSets the DTLS-SRTP profiles to negotiate (RFC 5764).void setMaxHandshakingPeers(size_t limit) @safe pure nothrow @nogcSet the maximum number of peers in handshake state.void setOnPeerEvicted(DtlsEvictCallback callback) @safe pure nothrow @nogcSet the peer eviction callback.DtlsVersion negotiatedVersion(const DtlsPeerState state) const @safeGet the negotiated DTLS version for a peer.string cipherSuite(const DtlsPeerState state) const @safeGet the negotiated cipher suite for a peer.string alpnProtocol(const DtlsPeerState state) const @safeGet the negotiated ALPN protocol for a peer.string serverName() @property const @safe pure nothrow @nogcGet the server name (SNI) for client engines.private
ubyte[] encryptAppData(DtlsPeerState state, TlsAead aead,
const(ubyte)[] plaintext)Encrypt application data into a DTLS record.private
ubyte[] encryptAppData12(DtlsPeerState state, TlsAead aead,
const(ubyte)[] plaintext)Encrypt application data using DTLS 1.2 format (explicit nonce).private
ubyte[] encryptAppData13(DtlsPeerState state, TlsAead aead,
const(ubyte)[] plaintext)Encrypt application data using DTLS 1.3 format (XOR nonce).private
ubyte[] decryptAppDataRecord(DtlsPeerState state,
const(ubyte)[] payload, DtlsRecordHeader header)Decrypt an APPLICATION_DATA record payload.private
ubyte[] decryptAppData12(TlsAead aead, const(ubyte)[] payload,
DtlsRecordHeader header)Decrypt a DTLS 1.2 APPLICATION_DATA record (explicit nonce).private
ubyte[] decryptAppData13(TlsAead aead, const(ubyte)[] payload,
DtlsRecordHeader header)Decrypt a DTLS 1.3 APPLICATION_DATA record (XOR nonce).private
ubyte[] buildDtlsRecord(ContentType type, ushort epoch,
ulong seq, const(ubyte)[] payload) @safe pure nothrow Build a complete DTLS record with the given parameters. Params: type = Content type. epoch = Epoch number. seq = Sequence number. payload = Record payload. * Returns: Serialized...TlsProgress sendAlert(DtlsPeerState state, AlertLevel level,
AlertDescription description) @safeBuild and send a DTLS alert record to a peer.private
ubyte[] encryptAlertRecord(DtlsPeerState state, TlsAead aead,
const(ubyte)[] alertPayload)Encrypt an alert record payload using the peer's write AEAD.private
TlsProgress processAppDataDatagram(DtlsPeerState state,
DatagramEndpoint from, const(ubyte)[] data) @safeProcess a datagram containing APPLICATION_DATA for a connected peer.private
void handleAlertRecord(DtlsPeerState state,
ref DtlsRecord rec) @safeHandle a received ALERT record for a connected peer.private
string cipherSuiteName(CipherSuiteId id) static @safe pure nothrow Converts a CipherSuiteId to its IANA name string. Params: id = The cipher suite identifier. Returns: * The IANA cipher suite name.Constructors
this(DtlsTransport transport, DtlsTimerSink timer, string serverName)Create a client engine.this(DtlsTransport transport, DtlsTimerSink timer)Create a server engine.