ddn.net.dtls.server13

DTLS 1.3 server handshake state machine (RFC 9147).

Drives the DTLS 1.3 server handshake as a resumable state machine. The server handles handshakes from a single client, identified by their DatagramEndpoint. The server:

Receives ClientHello and optionally performs HelloRetryRequest
Sends ServerHello, EncryptedExtensions, Certificate, CertificateVerify, Finished
All messages after ServerHello are encrypted with handshake traffic keys
Receives client Finished and derives application traffic keys

Uses Tls13KeySchedule for cryptographic key derivation, DtlsTranscriptHash for transcript hashing, and Dtls13ServerKeySchedule for the "dtls13" HKDF label prefix.

var DTLS_1_3_RECORD_VERSION

class Dtls13Server Dtls13ServerKeySchedule

Types 2

classDtls13ServerKeySchedule : Tls13KeySchedule

DTLS 1.3 key schedule with "dtls13" HKDF label prefix.

Overrides hkdfExpandLabel to use "dtls13" instead of "tls13 " per RFC 9147 §5.

Fields

private HKDF hkdf13_

private size_t hashLen13_

Methods

void setCipherSuite(ushort cipherSuite)Reconfigures the hash algorithm based on the negotiated cipher suite.

ubyte[] hkdfExpandLabel(const(ubyte)[]  secret,  string label,
          const(ubyte)[]  context,  size_t length)

HKDF-Expand-Label with "dtls13" prefix for DTLS 1.3.

Constructors

this()Constructs a DTLS 1.3 key schedule.

classDtls13Server

DTLS 1.3 server handshake engine.

Drives the server side of a DTLS 1.3 handshake over a datagram transport for a single peer. Uses flight-based retransmission with exponential backoff and supports the HelloRetryRequest cookie exchange for DoS mitigation.

Call processDatagram() when data arrives from a client. The server will advance its state machine and send responses as needed.

Fields

private DtlsTransport transport_

private DtlsTimerSink timer_

private DatagramEndpoint clientAddr_

private Dtls13ServerPhase phase_

private ushort messageSeq_

private ushort epoch_

private ulong recordSeq_

private SecureRandom rng_

private DtlsFlight pendingFlight_

private int retryCount_

private ubyte[32] clientRandom_

private ubyte[32] serverRandom_

private ubyte[] sharedSecret_

private ubyte[] receivedCookie_

private X25519PrivateKey ecdhePrivate_

private NamedGroup selectedGroup_

private DtlsVersion minVersion_

private DtlsVersion maxVersion_

private string[] alpnProtocols_

private SrtpProfile[] srtpProfiles_

private string negotiatedAlpn_

private CipherSuiteId negotiatedCipher_

private DtlsVersion negotiatedVersion_

private SrtpProfile negotiatedSrtpProfile_

private bool cidEnabled_

private ubyte localCidLength_

private DtlsConnectionId localCid_

private DtlsConnectionId peerCid_

private bool cidNegotiated_

private const(ubyte)[][] certChainDer_

private string privateKeyPem_

private PrivateKey privateKey_

private SignatureScheme sigScheme_

private Dtls13ServerKeySchedule keySchedule_

private DtlsTranscriptHash transcript_

private ubyte[] appTrafficHash_Transcript hash through the server Finished (RFC 8446 §7.1: application traffic secrets bind here, before the client Finished enters the transcript).

private TlsAead writeAead_

private TlsAead readAead_

private ubyte[] cookieSecret_

private DtlsFragmentBuffer reassembly_

private ubyte[] pendingDatagram_

private bool sessionResumptionEnabled_

private uint ticketLifetimeSeconds_

private size_t maxEarlyDataSize_

private DtlsSessionCallback onSessionTicket_

private DtlsEarlyDataCallback onEarlyData_

private DtlsTicketKeyManager ticketKeyMgr_

private ubyte[] receivedPskTicket_

private ubyte[] receivedPskBinder_

private bool pskValid_

private ubyte[] pskFromTicket_

private TlsAead earlyDataAead_

private bool earlyDataReceived_

private size_t earlyDataBytesReceived_

private const(ubyte)[] chBody_

Methods

void setMinVersion(DtlsVersion ver) @safe pure nothrow @nogcSets the minimum DTLS version.

void setMaxVersion(DtlsVersion ver) @safe pure nothrow @nogcSets the maximum DTLS version.

void setAlpnProtocols(string[] protocols) @safe pure nothrowSets the ALPN protocols.

void setSrtpProfiles(SrtpProfile[] profiles) @safe pure nothrowSets the DTLS-SRTP profiles to negotiate (RFC 5764).

void setCidConfig(bool enabled, ubyte cidLength = DtlsCidConstants.DEFAULT_CID_LENGTH) @safe pure nothrow @nogcEnables Connection ID and sets the local CID length.

DtlsConnectionId localCid() @property @safe pure nothrow @nogcReturns: The local Connection ID.

DtlsConnectionId peerCid() @property @safe pure nothrow @nogcReturns: The peer's Connection ID.

bool cidNegotiated() @property const @safe pure nothrow @nogcReturns: true if CID was negotiated.

void setSessionResumption(bool enable) @safe pure nothrow @nogcEnables session resumption.

void setTicketLifetime(uint seconds) @safe pure nothrow @nogcSets the session ticket lifetime.

void setMaxEarlyDataSize(size_t bytes) @safe pure nothrow @nogcSets the maximum early data size.

void setOnSessionTicket(DtlsSessionCallback callback) @safe pure nothrowSets the callback for issued session tickets.

bool sessionResumptionEnabled() @property const @safe pure nothrow @nogcReturns: Whether session resumption is enabled.

TlsProgress processDatagram(const(ubyte)[] data) @trustedProcess a received datagram and advance the handshake.

bool processClientHello(const(ubyte)[] datagram)Process a ClientHello datagram.

bool parseClientHelloPayload(const(ubyte)[] payload)Parse a ClientHello handshake payload.

void selectCipherSuite(const(ubyte)[] cipherSuites)Select a cipher suite from the client's offered list.

void parseClientHelloExtensions(const(ubyte)[] extData)Parse extensions from a ClientHello.

void parsePskExtension(const(ubyte)[] data)Parses the pre_shared_key extension from ClientHello.

bool validatePskBinder(const(ubyte)[] clientHelloBody)Validates the PSK binder against the ClientHello transcript.

bool pskValid() @property const @safe pure nothrow @nogcReturns: Whether a valid PSK was received from the client.

void setTicketKeyManager(DtlsTicketKeyManager mgr) @safe pure nothrowSets the ticket key manager for session resumption.

void setOnEarlyData(DtlsEarlyDataCallback callback) @safe pure nothrowSets the early data callback.

void initEarlyDataKeys()Initializes early traffic keys from the validated PSK.

bool processEarlyDataRecord(const(ubyte)[] recordData, DtlsReplayCache replayCache = null)Attempts to decrypt an early data record.

bool earlyDataReceived() @property const @safe pure nothrow @nogcReturns: true if early data was received.

size_t earlyDataBytesReceived() @property const @safe pure nothrow @nogcReturns: total bytes of early data received.

void negotiateAlpn(const(ubyte)[] alpnData)Negotiate ALPN from the client's extension data.

void parseSupportedGroups(const(ubyte)[] groupsData)Parse supported groups extension to select ECDHE group.

void parseKeyShare(const(ubyte)[] ksData)Parse key_share extension to extract client's ephemeral public key.

void parseSupportedVersions(const(ubyte)[] svData)Parse supported_versions extension to confirm DTLS 1.3 support.

ubyte[] buildHelloRetryRequest(DtlsVersion dtlsVer,  ushort  msgSeq,
          const(ubyte)[]  cookie)

Build a HelloRetryRequest handshake message.

ubyte[] buildServerHello()Build a ServerHello handshake message.

ubyte[] buildEncryptedExtensions()Build an EncryptedExtensions handshake message.

ubyte[] buildCertificate()Build a Certificate handshake message.

ubyte[] buildCertificateVerify()Build a CertificateVerify handshake message.

ubyte[] signCertificateVerify(const(ubyte)[] message)Sign the CertificateVerify message content.

private void parsePrivateKey()Parses the PEM private key once and selects the signature scheme.

private ubyte[] computeSignature(const(ubyte)[] message)Signs a message with the configured private key.

ubyte[] buildFinished()Build a Finished handshake message.

ubyte[] buildNewSessionTicket(DtlsTicketKeyManager ticketKeyMgr)Builds a NewSessionTicket message for session resumption.

bool sendNewSessionTicket(DtlsTicketKeyManager ticketKeyMgr)Builds, encrypts, and sends a NewSessionTicket to the client.

bool processClientFinished(const(ubyte)[] datagram)Process a client Finished datagram.

ubyte[] decryptRecordPayload(const(ubyte)[] payload, DtlsRecordHeader header)Decrypt a record payload using the read AEAD.

bool processClientFinishedPayload(const(ubyte)[] payload)Process a decrypted client Finished payload.

void generateEphemeralKey(NamedGroup group, ref ubyte[] pubKeyBytes)Generate an ephemeral ECDHE key pair.

void performKeyExchange(NamedGroup group, const(ubyte)[] peerPubKey)Perform ECDHE key exchange with the client's public key.

void deriveHandshakeKeys()Derives handshake traffic keys from the shared secret.

void deriveAppKeys()Derives application traffic keys.

size_t cipherKeyLength(CipherSuiteId cs) static @safe pure nothrow @nogcReturns the AEAD key length for the given cipher suite.

ubyte[] wrapHandshakeMessage(HandshakeType msgType, const(ubyte)[] body)Wraps a handshake message body in a DTLS handshake header.

ubyte[] wrapInRecord(ContentType contentType, const(ubyte)[] payload)Wraps a handshake message in a DTLS record.

ubyte[] buildDtlsRecord(ContentType contentType, const(ubyte)[] payload)Builds a complete DTLS record with 13-byte header.

ubyte[] encryptRecord(ContentType contentType, const(ubyte)[] plaintext)Encrypts a record payload using the current write AEAD.

const(ubyte)[] receiveDatagram()Receive a datagram from pending buffer or transport.

void sendDatagram(const(ubyte)[] data)Send a datagram via the transport.

void sendFlight(ubyte[][] records)Send a flight of records as a single datagram.

void scheduleRetransmit()Schedule retransmission timer for the current flight.

void retransmitFlight()Retransmit the pending flight.

Dtls13ServerPhase phase() @property const @safe pure nothrow @nogcReturns: The current handshake phase.

CipherSuiteId negotiatedCipher() @property const @safe pure nothrow @nogcReturns: The negotiated cipher suite.

DtlsVersion negotiatedVersion() @property const @safe pure nothrow @nogcReturns: The negotiated DTLS version.

string alpnProtocol() @property const @safe pure nothrowReturns: The negotiated ALPN protocol.

ushort epoch() @property const @safe pure nothrow @nogcReturns: The current epoch.

SrtpProfile negotiatedSrtpProfile() @property const @safe pure nothrow @nogcReturns: The negotiated DTLS-SRTP profile (`SrtpProfile.init` when SRTP was not negotiated).

ubyte[] srtpMasterSecret() @property @trusted

ubyte[] srtpClientRandom() @property @safe pure nothrow @nogc

ubyte[] srtpServerRandom() @property @safe pure nothrow @nogc

TlsAead writeAead() @propertyReturns: The write AEAD cipher (after key derivation).

TlsAead readAead() @propertyReturns: The read AEAD cipher (after key derivation).

Constructors

this(DtlsTransport transport,  DtlsTimerSink timer,
          DatagramEndpoint clientAddr,  const(ubyte)[]  cookieSecret,
          const(ubyte)[][]  certChainDer,  string privateKeyPem)

Constructs a DTLS 1.3 server handshake engine.

Variables 1

enumvarDTLS_1_3_RECORD_VERSION = [0xFE, 0xFD]

DTLS 1.3 record version used on the wire.

DTLS 1.3 uses the same record layer version as DTLS 1.2 (0xFEFD) for backwards compatibility per RFC 9147.