From 148cf48d2b68354881066e2587e2673c91d2619a Mon Sep 17 00:00:00 2001
From: hrxi <hrrrxi@gmail.com>
Date: Sat, 28 Dec 2019 03:11:51 +0100
Subject: Add libnice and listen for direct connections in Jingle SOCKS5 (#608)

Add libnice as a plugin. If it is present, use libnice to enumerate
local IP addresses and listen on them to support direct connections for
Jingle SOCKS5.

Tested with Conversations and Gajim.

Created the nice.vapi file using
```
vapigen --library nice --pkg gio-2.0 --metadatadir metadata /usr/share/gir-1.0/Nice-0.1.gir
```
---
 plugins/ice/CMakeLists.txt | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 plugins/ice/CMakeLists.txt

(limited to 'plugins/ice/CMakeLists.txt')

diff --git a/plugins/ice/CMakeLists.txt b/plugins/ice/CMakeLists.txt
new file mode 100644
index 00000000..76dba28f
--- /dev/null
+++ b/plugins/ice/CMakeLists.txt
@@ -0,0 +1,30 @@
+find_packages(ICE_PACKAGES REQUIRED
+    Gee
+    GLib
+    GModule
+    GObject
+    GTK3
+    Nice
+)
+
+vala_precompile(ICE_VALA_C
+SOURCES
+    src/plugin.vala
+    src/register_plugin.vala
+CUSTOM_VAPIS
+    ${CMAKE_BINARY_DIR}/exports/xmpp-vala.vapi
+    ${CMAKE_BINARY_DIR}/exports/dino.vapi
+    ${CMAKE_BINARY_DIR}/exports/qlite.vapi
+PACKAGES
+    ${ICE_PACKAGES}
+OPTIONS
+    --vapidir=${CMAKE_CURRENT_SOURCE_DIR}/vapi
+)
+
+add_definitions(${VALA_CFLAGS})
+add_library(ice SHARED ${ICE_VALA_C})
+target_link_libraries(ice libdino ${ICE_PACKAGES})
+set_target_properties(ice PROPERTIES PREFIX "")
+set_target_properties(ice PROPERTIES LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/plugins/)
+
+install(TARGETS ice ${PLUGIN_INSTALL})
-- 
cgit v1.2.3-70-g09d2


From d703b7c09d5eea81ec383fd09c9d320199e6d577 Mon Sep 17 00:00:00 2001
From: Marvin W <git@larma.de>
Date: Sun, 21 Mar 2021 12:41:27 +0100
Subject: Add libnice-based ICE-UDP implementation as plugin

---
 plugins/ice/CMakeLists.txt                  |   5 +-
 plugins/ice/src/module.vala                 |  42 +++++
 plugins/ice/src/plugin.vala                 |  63 +++++--
 plugins/ice/src/transport_parameters.vala   | 261 ++++++++++++++++++++++++++++
 plugins/ice/src/util.vala                   |  18 ++
 plugins/ice/vapi/metadata/Nice-0.1.metadata |   4 +
 plugins/ice/vapi/nice.vapi                  |   9 +-
 7 files changed, 386 insertions(+), 16 deletions(-)
 create mode 100644 plugins/ice/src/module.vala
 create mode 100644 plugins/ice/src/transport_parameters.vala
 create mode 100644 plugins/ice/src/util.vala

(limited to 'plugins/ice/CMakeLists.txt')

diff --git a/plugins/ice/CMakeLists.txt b/plugins/ice/CMakeLists.txt
index 76dba28f..90fe5b7d 100644
--- a/plugins/ice/CMakeLists.txt
+++ b/plugins/ice/CMakeLists.txt
@@ -10,6 +10,9 @@ find_packages(ICE_PACKAGES REQUIRED
 vala_precompile(ICE_VALA_C
 SOURCES
     src/plugin.vala
+    src/module.vala
+    src/transport_parameters.vala
+    src/util.vala
     src/register_plugin.vala
 CUSTOM_VAPIS
     ${CMAKE_BINARY_DIR}/exports/xmpp-vala.vapi
@@ -21,7 +24,7 @@ OPTIONS
     --vapidir=${CMAKE_CURRENT_SOURCE_DIR}/vapi
 )
 
-add_definitions(${VALA_CFLAGS})
+add_definitions(${VALA_CFLAGS} -DG_LOG_DOMAIN="ice")
 add_library(ice SHARED ${ICE_VALA_C})
 target_link_libraries(ice libdino ${ICE_PACKAGES})
 set_target_properties(ice PROPERTIES PREFIX "")
diff --git a/plugins/ice/src/module.vala b/plugins/ice/src/module.vala
new file mode 100644
index 00000000..e961ffb6
--- /dev/null
+++ b/plugins/ice/src/module.vala
@@ -0,0 +1,42 @@
+using Gee;
+using Xmpp;
+using Xmpp.Xep;
+
+public class Dino.Plugins.Ice.Module : JingleIceUdp.Module {
+
+    public string? stun_ip = null;
+    public uint stun_port = 0;
+    public string? turn_ip = null;
+    public Xep.ExternalServiceDiscovery.Service? turn_service = null;
+
+    private weak Nice.Agent? agent;
+
+    private Nice.Agent get_agent() {
+        Nice.Agent? agent = this.agent;
+        if (agent == null) {
+            agent = new Nice.Agent(MainContext.@default(), Nice.Compatibility.RFC5245);
+            if (stun_ip != null) {
+                agent.stun_server = stun_ip;
+                agent.stun_server_port = stun_port;
+            }
+            agent.ice_tcp = false;
+            agent.set_software("Dino");
+            agent.weak_ref(agent_unweak);
+            this.agent = agent;
+            debug("STUN server for libnice %s %u", agent.stun_server, agent.stun_server_port);
+        }
+        return agent;
+    }
+
+    public override Jingle.TransportParameters create_transport_parameters(XmppStream stream, uint8 components, Jid local_full_jid, Jid peer_full_jid) {
+        return new TransportParameters(get_agent(), turn_service, turn_ip, components, local_full_jid, peer_full_jid);
+    }
+
+    public override Jingle.TransportParameters parse_transport_parameters(XmppStream stream, uint8 components, Jid local_full_jid, Jid peer_full_jid, StanzaNode transport) throws Jingle.IqError {
+        return new TransportParameters(get_agent(), turn_service, turn_ip, components, local_full_jid, peer_full_jid, transport);
+    }
+
+    private void agent_unweak() {
+        this.agent = null;
+    }
+}
\ No newline at end of file
diff --git a/plugins/ice/src/plugin.vala b/plugins/ice/src/plugin.vala
index f1c41a27..3ee8a72a 100644
--- a/plugins/ice/src/plugin.vala
+++ b/plugins/ice/src/plugin.vala
@@ -1,30 +1,71 @@
 using Gee;
-using Nice;
+using Dino.Entities;
 using Xmpp;
+using Xmpp.Xep;
 
-namespace Dino.Plugins.Ice {
+private extern const size_t NICE_ADDRESS_STRING_LEN;
 
-public class Plugin : RootInterface, Object {
+public class Dino.Plugins.Ice.Plugin : RootInterface, Object {
     public Dino.Application app;
 
     public void registered(Dino.Application app) {
+        Nice.debug_enable(true);
         this.app = app;
+        app.stream_interactor.module_manager.initialize_account_modules.connect((account, list) => {
+            list.add(new Module());
+        });
         app.stream_interactor.stream_attached_modules.connect((account, stream) => {
-            stream.get_module(Xmpp.Xep.Socks5Bytestreams.Module.IDENTITY).set_local_ip_address_handler(get_local_ip_addresses);
+            stream.get_module(Socks5Bytestreams.Module.IDENTITY).set_local_ip_address_handler(get_local_ip_addresses);
         });
+        app.stream_interactor.stream_negotiated.connect(on_stream_negotiated);
     }
 
-    private Gee.List<string> get_local_ip_addresses() {
-        Gee.List<string> result = new ArrayList<string>();
-        foreach (string ip_address in Nice.interfaces_get_local_ips(false)) {
-            result.add(ip_address);
+    private async void on_stream_negotiated(Account account, XmppStream stream) {
+        Module? ice_udp_module = stream.get_module(JingleIceUdp.Module.IDENTITY) as Module;
+        if (ice_udp_module == null) return;
+        Gee.List<Xep.ExternalServiceDiscovery.Service> services = yield ExternalServiceDiscovery.request_services(stream);
+        foreach (Xep.ExternalServiceDiscovery.Service service in services) {
+            if (service.transport == "udp" && (service.ty == "stun" || service.ty == "turn")) {
+                InetAddress ip = yield lookup_ipv4_addess(service.host);
+                if (ip == null) continue;
+
+                if (service.ty == "stun") {
+                    debug("Server offers STUN server: %s:%u, resolved to %s", service.host, service.port, ip.to_string());
+                    ice_udp_module.stun_ip = ip.to_string();
+                    ice_udp_module.stun_port = service.port;
+                } else if (service.ty == "turn") {
+                    debug("Server offers TURN server: %s:%u, resolved to %s", service.host, service.port, ip.to_string());
+                    ice_udp_module.turn_ip = ip.to_string();
+                    ice_udp_module.turn_service = service;
+                }
+            }
+        }
+        if (ice_udp_module.stun_ip == null) {
+            InetAddress ip = yield lookup_ipv4_addess("stun.l.google.com");
+            if (ip == null) return;
+
+            debug("Using fallback STUN server: stun.l.google.com:19302, resolved to %s", ip.to_string());
+
+            ice_udp_module.stun_ip = ip.to_string();
+            ice_udp_module.stun_port = 19302;
         }
-        return result;
     }
 
     public void shutdown() {
         // Nothing to do
     }
-}
 
-}
+    private async InetAddress? lookup_ipv4_addess(string host) {
+        try {
+            Resolver resolver = Resolver.get_default();
+            GLib.List<GLib.InetAddress>? ips = yield resolver.lookup_by_name_async(host);
+            foreach (GLib.InetAddress ina in ips) {
+                if (ina.get_family() != SocketFamily.IPV4) continue;
+                return ina;
+            }
+        } catch (Error e) {
+            warning("Failed looking up IP address of %s", host);
+        }
+        return null;
+    }
+}
\ No newline at end of file
diff --git a/plugins/ice/src/transport_parameters.vala b/plugins/ice/src/transport_parameters.vala
new file mode 100644
index 00000000..acb44852
--- /dev/null
+++ b/plugins/ice/src/transport_parameters.vala
@@ -0,0 +1,261 @@
+using Gee;
+using Xmpp;
+using Xmpp.Xep;
+
+
+public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransportParameters {
+    private Nice.Agent agent;
+    private uint stream_id;
+    private bool we_want_connection;
+    private bool remote_credentials_set;
+    private Map<uint8, DatagramConnection> connections = new HashMap<uint8, DatagramConnection>();
+
+    private class DatagramConnection : Jingle.DatagramConnection {
+        private Nice.Agent agent;
+        private uint stream_id;
+        private string? error;
+        private ulong sent;
+        private ulong sent_reported;
+        private ulong recv;
+        private ulong recv_reported;
+        private ulong datagram_received_id;
+
+        public DatagramConnection(Nice.Agent agent, uint stream_id, uint8 component_id) {
+            this.agent = agent;
+            this.stream_id = stream_id;
+            this.component_id = component_id;
+            this.datagram_received_id = this.datagram_received.connect((datagram) => {
+                recv += datagram.length;
+                if (recv > recv_reported + 100000) {
+                    debug("Received %lu bytes via stream %u component %u", recv, stream_id, component_id);
+                    recv_reported = recv;
+                }
+            });
+        }
+
+        public override async void terminate(bool we_terminated, string? reason_string = null, string? reason_text = null) {
+            yield base.terminate(we_terminated, reason_string, reason_text);
+            this.disconnect(datagram_received_id);
+            agent = null;
+        }
+
+        public override void send_datagram(Bytes datagram) {
+            if (this.agent != null && is_component_ready(agent, stream_id, component_id)) {
+                agent.send(stream_id, component_id, datagram.get_data());
+                sent += datagram.length;
+                if (sent > sent_reported + 100000) {
+                    debug("Sent %lu bytes via stream %u component %u", sent, stream_id, component_id);
+                    sent_reported = sent;
+                }
+            }
+        }
+    }
+
+    public TransportParameters(Nice.Agent agent, Xep.ExternalServiceDiscovery.Service? turn_service, string? turn_ip, uint8 components, Jid local_full_jid, Jid peer_full_jid, StanzaNode? node = null) {
+        base(components, local_full_jid, peer_full_jid, node);
+        this.we_want_connection = (node == null);
+        this.agent = agent;
+        agent.candidate_gathering_done.connect(on_candidate_gathering_done);
+        agent.initial_binding_request_received.connect(on_initial_binding_request_received);
+        agent.component_state_changed.connect(on_component_state_changed);
+        agent.new_selected_pair_full.connect(on_new_selected_pair_full);
+        agent.new_candidate_full.connect(on_new_candidate);
+
+        agent.controlling_mode = !incoming;
+        stream_id = agent.add_stream(components);
+
+        if (turn_ip != null) {
+            for (uint8 component_id = 1; component_id <= components; component_id++) {
+                agent.set_relay_info(stream_id, component_id, turn_ip, turn_service.port, turn_service.username, turn_service.password, Nice.RelayType.UDP);
+                debug("TURN info (component %i) %s:%u", component_id, turn_ip, turn_service.port);
+            }
+        }
+        string ufrag;
+        string pwd;
+        agent.get_local_credentials(stream_id, out ufrag, out pwd);
+        init(ufrag, pwd);
+
+        for (uint8 component_id = 1; component_id <= components; component_id++) {
+            // We don't properly get local candidates before this call
+            agent.attach_recv(stream_id, component_id, MainContext.@default(), on_recv);
+        }
+
+        agent.gather_candidates(stream_id);
+    }
+
+    private void on_candidate_gathering_done(uint stream_id) {
+        if (stream_id != this.stream_id) return;
+        debug("on_candidate_gathering_done in %u", stream_id);
+
+        for (uint8 i = 1; i <= components; i++) {
+            foreach (unowned Nice.Candidate nc in agent.get_local_candidates(stream_id, i)) {
+                if (nc.transport == Nice.CandidateTransport.UDP) {
+                    JingleIceUdp.Candidate? candidate = candidate_to_jingle(nc);
+                    if (candidate == null) continue;
+                    debug("Local candidate summary: %s", agent.generate_local_candidate_sdp(nc));
+                }
+            }
+        }
+    }
+
+    private void on_new_candidate(Nice.Candidate nc) {
+        if (nc.stream_id != stream_id) return;
+        JingleIceUdp.Candidate? candidate = candidate_to_jingle(nc);
+        if (candidate == null) return;
+
+        if (nc.transport == Nice.CandidateTransport.UDP) {
+            // Execution was in the agent thread before
+            add_local_candidate_threadsafe(candidate);
+        }
+    }
+
+    public override void handle_transport_accept(StanzaNode transport) throws Jingle.IqError {
+        debug("on_transport_accept from %s", peer_full_jid.to_string());
+        base.handle_transport_accept(transport);
+    }
+
+    public override void handle_transport_info(StanzaNode transport) throws Jingle.IqError {
+        debug("on_transport_info from %s", peer_full_jid.to_string());
+        base.handle_transport_info(transport);
+
+        if (!we_want_connection) return;
+
+        if (remote_ufrag != null && remote_pwd != null && !remote_credentials_set) {
+            agent.set_remote_credentials(stream_id, remote_ufrag, remote_pwd);
+            remote_credentials_set = true;
+        }
+        for (uint8 i = 1; i <= components; i++) {
+            SList<Nice.Candidate> candidates = new SList<Nice.Candidate>();
+            foreach (JingleIceUdp.Candidate candidate in remote_candidates) {
+                if (candidate.component == i) {
+                    Nice.Candidate nc = candidate_to_nice(candidate);
+                    candidates.append(nc);
+                }
+            }
+            int new_candidates = agent.set_remote_candidates(stream_id, i, candidates);
+            debug("Updated to %i remote candidates for candidate %u via transport info", new_candidates, i);
+        }
+    }
+
+    public override void create_transport_connection(XmppStream stream, Jingle.Content content) {
+        debug("create_transport_connection: %s", content.session.sid);
+        debug("local_credentials: %s %s", local_ufrag, local_pwd);
+        debug("remote_credentials: %s %s", remote_ufrag, remote_pwd);
+        debug("expected incoming credentials: %s %s", local_ufrag + ":" + remote_ufrag, local_pwd);
+        debug("expected outgoing credentials: %s %s", remote_ufrag + ":" + local_ufrag, remote_pwd);
+
+        we_want_connection = true;
+
+        if (remote_ufrag != null && remote_pwd != null && !remote_credentials_set) {
+            agent.set_remote_credentials(stream_id, remote_ufrag, remote_pwd);
+            remote_credentials_set = true;
+        }
+        for (uint8 i = 1; i <= components; i++) {
+            SList<Nice.Candidate> candidates = new SList<Nice.Candidate>();
+            foreach (JingleIceUdp.Candidate candidate in remote_candidates) {
+                if (candidate.ip.has_prefix("fe80::")) continue;
+                if (candidate.component == i) {
+                    Nice.Candidate nc = candidate_to_nice(candidate);
+                    candidates.append(nc);
+                    debug("remote candidate: %s", agent.generate_local_candidate_sdp(nc));
+                }
+            }
+            int new_candidates = agent.set_remote_candidates(stream_id, i, candidates);
+            debug("Initiated component %u with %i remote candidates", i, new_candidates);
+
+            connections[i] = new DatagramConnection(agent, stream_id, i);
+            content.set_transport_connection(connections[i], i);
+        }
+        base.create_transport_connection(stream, content);
+    }
+
+    private void on_component_state_changed(uint stream_id, uint component_id, uint state) {
+        if (stream_id != this.stream_id) return;
+        debug("stream %u component %u state changed to %s", stream_id, component_id, agent.get_component_state(stream_id, component_id).to_string());
+        if (is_component_ready(agent, stream_id, component_id) && connections.has_key((uint8) component_id) && !connections[(uint8)component_id].ready) {
+            connections[(uint8)component_id].ready = true;
+        }
+    }
+
+    private void on_initial_binding_request_received(uint stream_id) {
+        if (stream_id != this.stream_id) return;
+        debug("initial_binding_request_received");
+    }
+
+    private void on_new_selected_pair_full(uint stream_id, uint component_id, Nice.Candidate p1, Nice.Candidate p2) {
+        if (stream_id != this.stream_id) return;
+        debug("new_selected_pair_full %u [%s, %s]", component_id, agent.generate_local_candidate_sdp(p1), agent.generate_local_candidate_sdp(p2));
+    }
+
+    private void on_recv(Nice.Agent agent, uint stream_id, uint component_id, uint8[] data) {
+        if (stream_id != this.stream_id) return;
+        if (is_component_ready(agent, stream_id, component_id) && connections.has_key((uint8) component_id)) {
+            connections[(uint8) component_id].datagram_received(new Bytes(data));
+        } else {
+            debug("on_recv stream %u component %u length %u", stream_id, component_id, data.length);
+        }
+    }
+
+    private static Nice.Candidate candidate_to_nice(JingleIceUdp.Candidate c) {
+        Nice.CandidateType type;
+        switch (c.type_) {
+            case JingleIceUdp.Candidate.Type.HOST: type = Nice.CandidateType.HOST; break;
+            case JingleIceUdp.Candidate.Type.PRFLX: type = Nice.CandidateType.PEER_REFLEXIVE; break;
+            case JingleIceUdp.Candidate.Type.RELAY: type = Nice.CandidateType.RELAYED; break;
+            case JingleIceUdp.Candidate.Type.SRFLX: type = Nice.CandidateType.SERVER_REFLEXIVE; break;
+            default: assert_not_reached();
+        }
+
+        Nice.Candidate candidate = new Nice.Candidate(type);
+        candidate.component_id = c.component;
+        char[] foundation = new char[Nice.CANDIDATE_MAX_FOUNDATION];
+        string foundation_str = c.foundation.to_string();
+        Memory.copy(foundation, foundation_str.data, foundation_str.length);
+        candidate.foundation = foundation;
+        candidate.addr = Nice.Address();
+        candidate.addr.init();
+        candidate.addr.set_from_string(c.ip);
+        candidate.addr.set_port(c.port);
+        candidate.priority = c.priority;
+        if (c.rel_addr != null) {
+            candidate.base_addr = Nice.Address();
+            candidate.base_addr.init();
+            candidate.base_addr.set_from_string(c.rel_addr);
+            candidate.base_addr.set_port(c.rel_port);
+        }
+        candidate.transport = Nice.CandidateTransport.UDP;
+        return candidate;
+    }
+
+    private static JingleIceUdp.Candidate? candidate_to_jingle(Nice.Candidate nc) {
+        JingleIceUdp.Candidate candidate = new JingleIceUdp.Candidate();
+        switch (nc.type) {
+            case Nice.CandidateType.HOST: candidate.type_ = JingleIceUdp.Candidate.Type.HOST; break;
+            case Nice.CandidateType.PEER_REFLEXIVE: candidate.type_ = JingleIceUdp.Candidate.Type.PRFLX; break;
+            case Nice.CandidateType.RELAYED: candidate.type_ = JingleIceUdp.Candidate.Type.RELAY; break;
+            case Nice.CandidateType.SERVER_REFLEXIVE: candidate.type_ = JingleIceUdp.Candidate.Type.SRFLX; break;
+            default: assert_not_reached();
+        }
+        candidate.component = (uint8) nc.component_id;
+        candidate.foundation = (uint8) int.parse((string)nc.foundation);
+        candidate.generation = 0;
+        candidate.id = Random.next_int().to_string("%08x"); // TODO
+
+        char[] res = new char[NICE_ADDRESS_STRING_LEN];
+        nc.addr.to_string(res);
+        candidate.ip = (string) res;
+        candidate.network = 0; // TODO
+        candidate.port = (uint16) nc.addr.get_port();
+        candidate.priority = nc.priority;
+        candidate.protocol = "udp";
+        if (nc.base_addr.is_valid() && !nc.base_addr.equal(nc.addr)) {
+            res = new char[NICE_ADDRESS_STRING_LEN];
+            nc.base_addr.to_string(res);
+            candidate.rel_addr = (string) res;
+            candidate.rel_port = (uint16) nc.base_addr.get_port();
+        }
+        if (candidate.ip.has_prefix("fe80::")) return null;
+
+        return candidate;
+    }
+}
\ No newline at end of file
diff --git a/plugins/ice/src/util.vala b/plugins/ice/src/util.vala
new file mode 100644
index 00000000..dd89d2f4
--- /dev/null
+++ b/plugins/ice/src/util.vala
@@ -0,0 +1,18 @@
+using Gee;
+
+namespace Dino.Plugins.Ice {
+
+internal static bool is_component_ready(Nice.Agent agent, uint stream_id, uint component_id) {
+    var state = agent.get_component_state(stream_id, component_id);
+    return state == Nice.ComponentState.CONNECTED || state == Nice.ComponentState.READY;
+}
+
+internal Gee.List<string> get_local_ip_addresses() {
+    Gee.List<string> result = new ArrayList<string>();
+    foreach (string ip_address in Nice.interfaces_get_local_ips(false)) {
+        result.add(ip_address);
+    }
+    return result;
+}
+
+}
\ No newline at end of file
diff --git a/plugins/ice/vapi/metadata/Nice-0.1.metadata b/plugins/ice/vapi/metadata/Nice-0.1.metadata
index 437da816..d6899f87 100644
--- a/plugins/ice/vapi/metadata/Nice-0.1.metadata
+++ b/plugins/ice/vapi/metadata/Nice-0.1.metadata
@@ -1,4 +1,8 @@
 Nice cheader_filename="nice.h"
+Address.to_string.dst type="char[]"
 Agent.new_reliable#constructor name="create_reliable"
+Agent.attach_recv skip=false
+Agent.send.buf type="uint8[]" array_length_idx=2
+AgentRecvFunc.buf type="uint8[]" array_length_idx=3
 PseudoTcpCallbacks#record skip
 PseudoTcpSocket#class skip
diff --git a/plugins/ice/vapi/nice.vapi b/plugins/ice/vapi/nice.vapi
index aa45cf08..39768b9b 100644
--- a/plugins/ice/vapi/nice.vapi
+++ b/plugins/ice/vapi/nice.vapi
@@ -8,6 +8,7 @@ namespace Nice {
 		public Agent (GLib.MainContext ctx, Nice.Compatibility compat);
 		public bool add_local_address (Nice.Address addr);
 		public uint add_stream (uint n_components);
+		public bool attach_recv (uint stream_id, uint component_id, GLib.MainContext ctx, Nice.AgentRecvFunc func);
 		[Version (since = "0.1.16")]
 		public async void close_async ();
 		[CCode (cname = "nice_agent_new_reliable", has_construct_function = false)]
@@ -58,7 +59,7 @@ namespace Nice {
 		public bool restart ();
 		[Version (since = "0.1.6")]
 		public bool restart_stream (uint stream_id);
-		public int send (uint stream_id, uint component_id, uint len, string buf);
+		public int send (uint stream_id, uint component_id, [CCode (array_length_cname = "len", array_length_pos = 2.5, array_length_type = "guint", type = "const gchar*")] uint8[] buf);
 		[Version (since = "0.1.5")]
 		public int send_messages_nonblocking (uint stream_id, uint component_id, [CCode (array_length_cname = "n_messages", array_length_pos = 3.5, array_length_type = "guint")] Nice.OutputMessage[] messages, GLib.Cancellable? cancellable = null) throws GLib.Error;
 		public bool set_local_credentials (uint stream_id, string ufrag, string pwd);
@@ -209,7 +210,7 @@ namespace Nice {
 		public void set_ipv4 (uint32 addr_ipv4);
 		public void set_ipv6 (uint8 addr_ipv6);
 		public void set_port (uint port);
-		public void to_string (string dst);
+		public void to_string ([CCode (array_length = false, type = "gchar*")] char[] dst);
 	}
 	[CCode (cheader_filename = "nice.h", has_type_id = false)]
 	[Version (since = "0.1.5")]
@@ -343,8 +344,8 @@ namespace Nice {
 		TCP,
 		TLS
 	}
-	[CCode (cheader_filename = "nice.h", instance_pos = 5.9)]
-	public delegate void AgentRecvFunc (Nice.Agent agent, uint stream_id, uint component_id, uint len, string buf);
+	[CCode (cheader_filename = "nice.h", instance_pos = 4.9)]
+	public delegate void AgentRecvFunc (Nice.Agent agent, uint stream_id, uint component_id, [CCode (array_length_cname = "len", array_length_pos = 3.5, array_length_type = "guint", type = "gchar*")] uint8[] buf);
 	[CCode (cheader_filename = "nice.h", cname = "NICE_AGENT_MAX_REMOTE_CANDIDATES")]
 	public const int AGENT_MAX_REMOTE_CANDIDATES;
 	[CCode (cheader_filename = "nice.h", cname = "NICE_CANDIDATE_DIRECTION_MS_PREF_ACTIVE")]
-- 
cgit v1.2.3-70-g09d2


From ec35f95e13f4f2f756c81a35ded0980245acc5f4 Mon Sep 17 00:00:00 2001
From: fiaxh <git@lightrise.org>
Date: Wed, 24 Mar 2021 14:12:42 +0100
Subject: Add initial support for DTLS-SRTP

---
 cmake/FindGnuTLS.cmake                             |  13 +
 libdino/src/service/calls.vala                     |  22 +-
 plugins/ice/CMakeLists.txt                         |   7 +-
 plugins/ice/src/dtls_srtp.vala                     | 247 ++++++++++++
 plugins/ice/src/transport_parameters.vala          |  48 ++-
 plugins/ice/vapi/gnutls.vapi                       | 419 +++++++++++++++++++++
 plugins/rtp/CMakeLists.txt                         |   1 +
 .../src/module/xep/0166_jingle/reason_element.vala |   1 +
 xmpp-vala/src/module/xep/0166_jingle/session.vala  |  38 +-
 .../xep/0167_jingle_rtp/content_parameters.vala    |   5 +-
 .../xep/0167_jingle_rtp/jingle_rtp_module.vala     |   2 +-
 .../xep/0167_jingle_rtp/session_info_type.vala     |   2 +-
 .../0176_jingle_ice_udp/jingle_ice_udp_module.vala |   1 +
 .../0176_jingle_ice_udp/transport_parameters.vala  |  27 ++
 14 files changed, 791 insertions(+), 42 deletions(-)
 create mode 100644 cmake/FindGnuTLS.cmake
 create mode 100644 plugins/ice/src/dtls_srtp.vala
 create mode 100644 plugins/ice/vapi/gnutls.vapi

(limited to 'plugins/ice/CMakeLists.txt')

diff --git a/cmake/FindGnuTLS.cmake b/cmake/FindGnuTLS.cmake
new file mode 100644
index 00000000..6b27abd7
--- /dev/null
+++ b/cmake/FindGnuTLS.cmake
@@ -0,0 +1,13 @@
+include(PkgConfigWithFallback)
+find_pkg_config_with_fallback(GnuTLS
+    PKG_CONFIG_NAME gnutls
+    LIB_NAMES gnutls
+    INCLUDE_NAMES gnutls/gnutls.h
+    INCLUDE_DIR_SUFFIXES gnutls gnutls/include
+    DEPENDS GLib
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(GnuTLS
+    REQUIRED_VARS GnuTLS_LIBRARY
+    VERSION_VAR GnuTLS_VERSION)
\ No newline at end of file
diff --git a/libdino/src/service/calls.vala b/libdino/src/service/calls.vala
index 5224bdd1..54c353b0 100644
--- a/libdino/src/service/calls.vala
+++ b/libdino/src/service/calls.vala
@@ -125,7 +125,7 @@ namespace Dino {
             call.state = Call.State.ESTABLISHING;
 
             if (sessions.has_key(call)) {
-                foreach (Xep.Jingle.Content content in sessions[call].contents.values) {
+                foreach (Xep.Jingle.Content content in sessions[call].contents) {
                     content.accept();
                 }
             } else {
@@ -146,7 +146,7 @@ namespace Dino {
             call.state = Call.State.DECLINED;
 
             if (sessions.has_key(call)) {
-                foreach (Xep.Jingle.Content content in sessions[call].contents.values) {
+                foreach (Xep.Jingle.Content content in sessions[call].contents) {
                     content.reject();
                 }
                 remove_call_from_datastructures(call);
@@ -223,16 +223,6 @@ namespace Dino {
             foreach (Jid full_jid in full_jids) {
                 bool supports_rtc = yield stream.get_module(Xep.JingleRtp.Module.IDENTITY).is_available(stream, full_jid);
                 if (!supports_rtc) continue;
-
-                // dtls support indicates webRTC support. Clients tend to not do normal ice udp in that case. Except Dino.
-                bool supports_dtls = yield stream_interactor.get_module(EntityInfo.IDENTITY).has_feature(conversation.account, full_jid, "urn:xmpp:jingle:apps:dtls:0");
-                if (supports_dtls) {
-                    Xep.ServiceDiscovery.Identity? identity = yield stream_interactor.get_module(EntityInfo.IDENTITY).get_identity(conversation.account, full_jid);
-                    bool is_dino = identity != null && identity.name == "Dino";
-
-                    if (!is_dino) continue;
-                }
-
                 ret.add(full_jid);
             }
             return ret;
@@ -253,7 +243,7 @@ namespace Dino {
 
         private void on_incoming_call(Account account, Xep.Jingle.Session session) {
             bool counterpart_wants_video = false;
-            foreach (Xep.Jingle.Content content in session.contents.values) {
+            foreach (Xep.Jingle.Content content in session.contents) {
                 Xep.JingleRtp.Parameters? rtp_content_parameter = content.content_params as Xep.JingleRtp.Parameters;
                 if (rtp_content_parameter == null) continue;
                 if (rtp_content_parameter.media == "video" && session.senders_include_us(content.senders)) {
@@ -391,7 +381,7 @@ namespace Dino {
                 on_incoming_content_add(stream, call, session, content)
             );
 
-            foreach (Xep.Jingle.Content content in session.contents.values) {
+            foreach (Xep.Jingle.Content content in session.contents) {
                 Xep.JingleRtp.Parameters? rtp_content_parameter = content.content_params as Xep.JingleRtp.Parameters;
                 if (rtp_content_parameter == null) continue;
 
@@ -446,7 +436,7 @@ namespace Dino {
 
             Xep.Jingle.Module jingle_module = stream_interactor.module_manager.get_module(account, Xep.Jingle.Module.IDENTITY);
             jingle_module.session_initiate_received.connect((stream, session) => {
-                foreach (Xep.Jingle.Content content in session.contents.values) {
+                foreach (Xep.Jingle.Content content in session.contents) {
                     Xep.JingleRtp.Parameters? rtp_content_parameter = content.content_params as Xep.JingleRtp.Parameters;
                     if (rtp_content_parameter != null) {
                         on_incoming_call(account, session);
@@ -460,7 +450,7 @@ namespace Dino {
                 if (!call_by_sid[account].has_key(session.sid)) return;
                 Call call = call_by_sid[account][session.sid];
 
-                foreach (Xep.Jingle.Content content in session.contents.values) {
+                foreach (Xep.Jingle.Content content in session.contents) {
                     if (name == null || content.content_name == name) {
                         Xep.JingleRtp.Parameters? rtp_content_parameter = content.content_params as Xep.JingleRtp.Parameters;
                         if (rtp_content_parameter != null) {
diff --git a/plugins/ice/CMakeLists.txt b/plugins/ice/CMakeLists.txt
index 90fe5b7d..38025aa0 100644
--- a/plugins/ice/CMakeLists.txt
+++ b/plugins/ice/CMakeLists.txt
@@ -2,6 +2,7 @@ find_packages(ICE_PACKAGES REQUIRED
     Gee
     GLib
     GModule
+    GnuTLS
     GObject
     GTK3
     Nice
@@ -9,8 +10,9 @@ find_packages(ICE_PACKAGES REQUIRED
 
 vala_precompile(ICE_VALA_C
 SOURCES
-    src/plugin.vala
+    src/dtls_srtp.vala
     src/module.vala
+    src/plugin.vala
     src/transport_parameters.vala
     src/util.vala
     src/register_plugin.vala
@@ -18,6 +20,7 @@ CUSTOM_VAPIS
     ${CMAKE_BINARY_DIR}/exports/xmpp-vala.vapi
     ${CMAKE_BINARY_DIR}/exports/dino.vapi
     ${CMAKE_BINARY_DIR}/exports/qlite.vapi
+    ${CMAKE_BINARY_DIR}/exports/crypto.vapi
 PACKAGES
     ${ICE_PACKAGES}
 OPTIONS
@@ -26,7 +29,7 @@ OPTIONS
 
 add_definitions(${VALA_CFLAGS} -DG_LOG_DOMAIN="ice")
 add_library(ice SHARED ${ICE_VALA_C})
-target_link_libraries(ice libdino ${ICE_PACKAGES})
+target_link_libraries(ice libdino crypto-vala ${ICE_PACKAGES})
 set_target_properties(ice PROPERTIES PREFIX "")
 set_target_properties(ice PROPERTIES LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/plugins/)
 
diff --git a/plugins/ice/src/dtls_srtp.vala b/plugins/ice/src/dtls_srtp.vala
new file mode 100644
index 00000000..a21c242b
--- /dev/null
+++ b/plugins/ice/src/dtls_srtp.vala
@@ -0,0 +1,247 @@
+using GnuTLS;
+
+public class DtlsSrtp {
+
+    public signal void send_data(uint8[] data);
+
+    private X509.Certificate[] own_cert;
+    private X509.PrivateKey private_key;
+    private Cond buffer_cond = new Cond();
+    private Mutex buffer_mutex = new Mutex();
+    private Gee.LinkedList<Bytes> buffer_queue = new Gee.LinkedList<Bytes>();
+    private uint pull_timeout = uint.MAX;
+    private string peer_fingerprint;
+
+    private Crypto.Srtp.Session encrypt_session;
+    private Crypto.Srtp.Session decrypt_session;
+
+    public static DtlsSrtp setup() throws GLib.Error {
+        var obj = new DtlsSrtp();
+        obj.generate_credentials();
+        return obj;
+    }
+
+    internal string get_own_fingerprint(DigestAlgorithm digest_algo) {
+        return format_certificate(own_cert[0], digest_algo);
+    }
+
+    public void set_peer_fingerprint(string fingerprint) {
+        this.peer_fingerprint = fingerprint;
+    }
+
+    public uint8[] process_incoming_data(uint component_id, uint8[] data) {
+        if (decrypt_session != null) {
+            if (component_id == 1) return decrypt_session.decrypt_rtp(data);
+            if (component_id == 2) return decrypt_session.decrypt_rtcp(data);
+        } else if (component_id == 1) {
+            on_data_rec(data);
+        }
+        return null;
+    }
+
+    public uint8[] process_outgoing_data(uint component_id, uint8[] data) {
+        if (encrypt_session != null) {
+            if (component_id == 1) return encrypt_session.encrypt_rtp(data);
+            if (component_id == 2) return encrypt_session.encrypt_rtcp(data);
+        }
+        return null;
+    }
+
+    public void on_data_rec(owned uint8[] data) {
+        buffer_mutex.lock();
+        buffer_queue.add(new Bytes.take(data));
+        buffer_cond.signal();
+        buffer_mutex.unlock();
+    }
+
+    private void generate_credentials() throws GLib.Error {
+        int err = 0;
+
+        private_key = X509.PrivateKey.create();
+        err = private_key.generate(PKAlgorithm.RSA, 2048);
+        throw_if_error(err);
+
+        var start_time = new DateTime.now_local().add_days(1);
+        var end_time = start_time.add_days(2);
+
+        X509.Certificate cert = X509.Certificate.create();
+        cert.set_key(private_key);
+        cert.set_version(1);
+        cert.set_activation_time ((time_t) start_time.to_unix ());
+        cert.set_expiration_time ((time_t) end_time.to_unix ());
+
+        uint32 serial = 1;
+        cert.set_serial(&serial, sizeof(uint32));
+
+        cert.sign(cert, private_key);
+
+        own_cert = new X509.Certificate[] { (owned)cert };
+    }
+
+    public async void setup_dtls_connection(bool server) {
+        InitFlags server_or_client = server ? InitFlags.SERVER : InitFlags.CLIENT;
+        debug("Setting up DTLS connection. We're %s", server_or_client.to_string());
+
+        CertificateCredentials cert_cred = CertificateCredentials.create();
+        int err = cert_cred.set_x509_key(own_cert, private_key);
+        throw_if_error(err);
+
+        Session? session = Session.create(server_or_client | InitFlags.DATAGRAM);
+        session.enable_heartbeat(1);
+        session.set_srtp_profile_direct("SRTP_AES128_CM_HMAC_SHA1_80");
+        session.set_credentials(GnuTLS.CredentialsType.CERTIFICATE, cert_cred);
+        session.server_set_request(CertificateRequest.REQUEST);
+        session.set_priority_from_string("NORMAL:!VERS-TLS-ALL:+VERS-DTLS-ALL:+CTYPE-CLI-X509");
+
+        session.set_transport_pointer(this);
+        session.set_pull_function(pull_function);
+        session.set_pull_timeout_function(pull_timeout_function);
+        session.set_push_function(push_function);
+        session.set_verify_function(verify_function);
+
+        Thread<int> thread = new Thread<int> (null, () => {
+            DateTime maximum_time = new DateTime.now_utc().add_seconds(20);
+            do {
+                err = session.handshake();
+
+                DateTime current_time = new DateTime.now_utc();
+                if (maximum_time.compare(current_time) < 0) {
+                    warning("DTLS handshake timeouted");
+                    return -1;
+                }
+            } while (err < 0 && !((ErrorCode)err).is_fatal());
+            Idle.add(setup_dtls_connection.callback);
+            return err;
+        });
+        yield;
+        err = thread.join();
+
+        uint8[] km = new uint8[150];
+        Datum? client_key, client_salt, server_key, server_salt;
+        session.get_srtp_keys(km, km.length, out client_key, out client_salt, out server_key, out server_salt);
+        if (client_key == null || client_salt == null || server_key == null || server_salt == null) {
+            warning("SRTP client/server key/salt null");
+        }
+
+        Crypto.Srtp.Session encrypt_session = new Crypto.Srtp.Session(Crypto.Srtp.Encryption.AES_CM, Crypto.Srtp.Authentication.HMAC_SHA1, 10, Crypto.Srtp.Prf.AES_CM, 0);
+        Crypto.Srtp.Session decrypt_session = new Crypto.Srtp.Session(Crypto.Srtp.Encryption.AES_CM, Crypto.Srtp.Authentication.HMAC_SHA1, 10, Crypto.Srtp.Prf.AES_CM, 0);
+
+        if (server) {
+            encrypt_session.setkey(server_key.extract(), server_salt.extract());
+            decrypt_session.setkey(client_key.extract(), client_salt.extract());
+        } else {
+            encrypt_session.setkey(client_key.extract(), client_salt.extract());
+            decrypt_session.setkey(server_key.extract(), server_salt.extract());
+        }
+
+        this.encrypt_session = (owned)encrypt_session;
+        this.decrypt_session = (owned)decrypt_session;
+    }
+
+    private static ssize_t pull_function(void* transport_ptr, uint8[] buffer) {
+        DtlsSrtp self = transport_ptr as DtlsSrtp;
+
+        self.buffer_mutex.lock();
+        while (self.buffer_queue.size == 0) {
+            self.buffer_cond.wait(self.buffer_mutex);
+        }
+        owned Bytes data = self.buffer_queue.remove_at(0);
+        self.buffer_mutex.unlock();
+
+        uint8[] data_uint8 = Bytes.unref_to_data(data);
+        Memory.copy(buffer, data_uint8, data_uint8.length);
+
+        // The callback should return 0 on connection termination, a positive number indicating the number of bytes received, and -1 on error.
+        return (ssize_t)data.length;
+    }
+
+    private static int pull_timeout_function(void* transport_ptr, uint ms) {
+        DtlsSrtp self = transport_ptr as DtlsSrtp;
+
+        DateTime current_time = new DateTime.now_utc();
+        current_time.add_seconds(ms/1000);
+        int64 end_time = current_time.to_unix();
+
+        self.buffer_mutex.lock();
+        while (self.buffer_queue.size == 0) {
+            self.buffer_cond.wait_until(self.buffer_mutex, end_time);
+
+            DateTime new_current_time = new DateTime.now_utc();
+            if (new_current_time.compare(current_time) > 0) {
+                break;
+            }
+        }
+        self.buffer_mutex.unlock();
+
+        // The callback should return 0 on timeout, a positive number if data can be received, and -1 on error.
+        return 1;
+    }
+
+    private static ssize_t push_function(void* transport_ptr, uint8[] buffer) {
+        DtlsSrtp self = transport_ptr as DtlsSrtp;
+        self.send_data(buffer);
+
+        // The callback should return a positive number indicating the bytes sent, and -1 on error.
+        return (ssize_t)buffer.length;
+    }
+
+    private static int verify_function(Session session) {
+        DtlsSrtp self = session.get_transport_pointer() as DtlsSrtp;
+        try {
+            bool valid = self.verify_peer_cert(session);
+            if (!valid) {
+                warning("DTLS certificate invalid. Aborting handshake.");
+                return 1;
+            }
+        } catch (Error e) {
+            warning("Error during DTLS certificate validation: %s. Aborting handshake.", e.message);
+            return 1;
+        }
+
+        // The callback function should return 0 for the handshake to continue or non-zero to terminate.
+        return 0;
+    }
+
+    private bool verify_peer_cert(Session session) throws GLib.Error {
+        unowned Datum[] cert_datums = session.get_peer_certificates();
+        if (cert_datums.length == 0) {
+            warning("No peer certs");
+            return false;
+        }
+        if (cert_datums.length > 1) warning("More than one peer cert");
+
+        X509.Certificate peer_cert = X509.Certificate.create();
+        peer_cert.import(ref cert_datums[0], CertificateFormat.DER);
+
+        string peer_fp_str = format_certificate(peer_cert, DigestAlgorithm.SHA256);
+        if (peer_fp_str.down() != this.peer_fingerprint.down()) {
+            warning("First cert in peer cert list doesn't equal advertised one %s vs %s", peer_fp_str, this.peer_fingerprint);
+            return false;
+        }
+
+        return true;
+    }
+
+    private string format_certificate(X509.Certificate certificate, DigestAlgorithm digest_algo) {
+        uint8[] buf = new uint8[512];
+        size_t buf_out_size = 512;
+        certificate.get_fingerprint(digest_algo, buf, ref buf_out_size);
+
+        var sb = new StringBuilder();
+        for (int i = 0; i < buf_out_size; i++) {
+            sb.append("%02x".printf(buf[i]));
+            if (i < buf_out_size - 1) {
+                sb.append(":");
+            }
+        }
+        return sb.str;
+    }
+
+    private uint8[] uint8_pt_to_a(uint8* data, uint size) {
+        uint8[size] ret = new uint8[size];
+        for (int i = 0; i < size; i++) {
+            ret[i] = data[i];
+        }
+        return ret;
+    }
+}
\ No newline at end of file
diff --git a/plugins/ice/src/transport_parameters.vala b/plugins/ice/src/transport_parameters.vala
index a8172678..5b6431c2 100644
--- a/plugins/ice/src/transport_parameters.vala
+++ b/plugins/ice/src/transport_parameters.vala
@@ -9,9 +9,11 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
     private bool we_want_connection;
     private bool remote_credentials_set;
     private Map<uint8, DatagramConnection> connections = new HashMap<uint8, DatagramConnection>();
+    private DtlsSrtp? dtls_srtp;
 
     private class DatagramConnection : Jingle.DatagramConnection {
         private Nice.Agent agent;
+        private DtlsSrtp? dtls_srtp;
         private uint stream_id;
         private string? error;
         private ulong sent;
@@ -20,8 +22,9 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
         private ulong recv_reported;
         private ulong datagram_received_id;
 
-        public DatagramConnection(Nice.Agent agent, uint stream_id, uint8 component_id) {
+        public DatagramConnection(Nice.Agent agent, DtlsSrtp? dtls_srtp, uint stream_id, uint8 component_id) {
             this.agent = agent;
+            this.dtls_srtp = dtls_srtp;
             this.stream_id = stream_id;
             this.component_id = component_id;
             this.datagram_received_id = this.datagram_received.connect((datagram) => {
@@ -41,7 +44,12 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
 
         public override void send_datagram(Bytes datagram) {
             if (this.agent != null && is_component_ready(agent, stream_id, component_id)) {
-                agent.send(stream_id, component_id, datagram.get_data());
+                uint8[] encrypted_data = null;
+                if (dtls_srtp != null) {
+                    encrypted_data = dtls_srtp.process_outgoing_data(component_id, datagram.get_data());
+                    if (encrypted_data == null) return;
+                }
+                agent.send(stream_id, component_id, encrypted_data ?? datagram.get_data());
                 sent += datagram.length;
                 if (sent > sent_reported + 100000) {
                     debug("Sent %lu bytes via stream %u component %u", sent, stream_id, component_id);
@@ -55,6 +63,20 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
         base(components, local_full_jid, peer_full_jid, node);
         this.we_want_connection = (node == null);
         this.agent = agent;
+
+        if (this.peer_fingerprint != null || !incoming) {
+            dtls_srtp = DtlsSrtp.setup();
+            dtls_srtp.send_data.connect((data) => {
+                agent.send(stream_id, 1, data);
+            });
+            this.own_fingerprint = dtls_srtp.get_own_fingerprint(GnuTLS.DigestAlgorithm.SHA256);
+            if (incoming) {
+                dtls_srtp.set_peer_fingerprint(this.peer_fingerprint);
+            } else {
+                dtls_srtp.setup_dtls_connection(true);
+            }
+        }
+
         agent.candidate_gathering_done.connect(on_candidate_gathering_done);
         agent.initial_binding_request_received.connect(on_initial_binding_request_received);
         agent.component_state_changed.connect(on_component_state_changed);
@@ -112,6 +134,12 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
     public override void handle_transport_accept(StanzaNode transport) throws Jingle.IqError {
         debug("on_transport_accept from %s", peer_full_jid.to_string());
         base.handle_transport_accept(transport);
+
+        if (dtls_srtp != null && peer_fingerprint != null) {
+            dtls_srtp.set_peer_fingerprint(this.peer_fingerprint);
+        } else {
+            dtls_srtp = null;
+        }
     }
 
     public override void handle_transport_info(StanzaNode transport) throws Jingle.IqError {
@@ -163,9 +191,16 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
             int new_candidates = agent.set_remote_candidates(stream_id, i, candidates);
             debug("Initiated component %u with %i remote candidates", i, new_candidates);
 
-            connections[i] = new DatagramConnection(agent, stream_id, i);
+            connections[i] = new DatagramConnection(agent, dtls_srtp, stream_id, i);
             content.set_transport_connection(connections[i], i);
         }
+
+        if (incoming && dtls_srtp != null) {
+            Jingle.DatagramConnection rtp_datagram = (Jingle.DatagramConnection) content.get_transport_connection(1);
+            rtp_datagram.notify["ready"].connect(() => {
+                dtls_srtp.setup_dtls_connection(false);
+            });
+        }
         base.create_transport_connection(stream, content);
     }
 
@@ -194,12 +229,17 @@ public class Dino.Plugins.Ice.TransportParameters : JingleIceUdp.IceUdpTransport
 
     private void on_recv(Nice.Agent agent, uint stream_id, uint component_id, uint8[] data) {
         if (stream_id != this.stream_id) return;
+        uint8[] decrypt_data = null;
+        if (dtls_srtp != null) {
+            decrypt_data = dtls_srtp.process_incoming_data(component_id, data);
+            if (decrypt_data == null) return;
+        }
         may_consider_ready(stream_id, component_id);
         if (connections.has_key((uint8) component_id)) {
             if (!connections[(uint8) component_id].ready) {
                 debug("on_recv stream %u component %u when state %s", stream_id, component_id, agent.get_component_state(stream_id, component_id).to_string());
             }
-            connections[(uint8) component_id].datagram_received(new Bytes(data));
+            connections[(uint8) component_id].datagram_received(new Bytes(decrypt_data ?? data));
         } else {
             debug("on_recv stream %u component %u length %u", stream_id, component_id, data.length);
         }
diff --git a/plugins/ice/vapi/gnutls.vapi b/plugins/ice/vapi/gnutls.vapi
new file mode 100644
index 00000000..a8f75e14
--- /dev/null
+++ b/plugins/ice/vapi/gnutls.vapi
@@ -0,0 +1,419 @@
+[CCode (cprefix = "gnutls_", lower_case_cprefix = "gnutls_", cheader_filename = "gnutls/gnutls.h")]
+namespace GnuTLS {
+
+    public int global_init();
+
+    [CCode (cname = "gnutls_pull_func", has_target = false)]
+    public delegate ssize_t PullFunc(void* transport_ptr, [CCode (ctype = "void*", array_length_type="size_t")] uint8[] array);
+
+    [CCode (cname = "gnutls_pull_timeout_func", has_target = false)]
+    public delegate int PullTimeoutFunc(void* transport_ptr, uint ms);
+
+    [CCode (cname = "gnutls_push_func", has_target = false)]
+    public delegate ssize_t PushFunc(void* transport_ptr, [CCode (ctype = "void*", array_length_type="size_t")] uint8[] array);
+
+    [CCode (cname = "gnutls_certificate_verify_function", has_target = false)]
+    public delegate int VerifyFunc(Session session);
+
+    [Compact]
+    [CCode (cname = "struct gnutls_session_int", free_function = "gnutls_deinit")]
+    public class Session {
+
+        public static Session? create(int con_end) throws GLib.Error {
+            Session result;
+            var ret = init(out result, con_end);
+            throw_if_error(ret);
+            return result;
+        }
+
+        [CCode (cname = "gnutls_init")]
+        private static int init(out Session session, int con_end);
+
+        [CCode (cname = "gnutls_transport_set_push_function")]
+        public void set_push_function(PushFunc func);
+
+        [CCode (cname = "gnutls_transport_set_pull_function")]
+        public void set_pull_function(PullFunc func);
+
+        [CCode (cname = "gnutls_transport_set_pull_timeout_function")]
+        public void set_pull_timeout_function(PullTimeoutFunc func);
+
+        [CCode (cname = "gnutls_transport_set_ptr")]
+        public void set_transport_pointer(void* ptr);
+
+        [CCode (cname = "gnutls_transport_get_ptr")]
+        public void* get_transport_pointer();
+
+        [CCode (cname = "gnutls_heartbeat_enable")]
+        public int enable_heartbeat(uint type);
+
+        [CCode (cname = "gnutls_certificate_server_set_request")]
+        public void server_set_request(CertificateRequest req);
+
+        [CCode (cname = "gnutls_credentials_set")]
+        public int set_credentials_(CredentialsType type, void* cred);
+        [CCode (cname = "gnutls_credentials_set_")]
+        public void set_credentials(CredentialsType type, void* cred) throws GLib.Error {
+            int err = set_credentials_(type, cred);
+            throw_if_error(err);
+        }
+
+        [CCode (cname = "gnutls_priority_set_direct")]
+        public int set_priority_from_string_(string priority, out unowned string err_pos = null);
+        [CCode (cname = "gnutls_priority_set_direct_")]
+        public void set_priority_from_string(string priority, out unowned string err_pos = null) throws GLib.Error {
+            int err = set_priority_from_string_(priority, out err_pos);
+            throw_if_error(err);
+        }
+
+        [CCode (cname = "gnutls_srtp_set_profile_direct")]
+        public int set_srtp_profile_direct_(string profiles, out unowned string err_pos = null);
+        [CCode (cname = "gnutls_srtp_set_profile_direct_")]
+        public void set_srtp_profile_direct(string profiles, out unowned string err_pos = null) throws GLib.Error {
+            int err = set_srtp_profile_direct_(profiles, out err_pos);
+            throw_if_error(err);
+        }
+
+        [CCode (cname = "gnutls_transport_set_int")]
+        public void transport_set_int(int fd);
+
+        [CCode (cname = "gnutls_handshake")]
+        public int handshake();
+
+        [CCode (cname = "gnutls_srtp_get_keys")]
+        public int get_srtp_keys_(void *key_material, uint32 key_material_size, out Datum client_key, out Datum client_salt, out Datum server_key, out Datum server_salt);
+        [CCode (cname = "gnutls_srtp_get_keys_")]
+        public void get_srtp_keys(void *key_material, uint32 key_material_size, out Datum client_key, out Datum client_salt, out Datum server_key, out Datum server_salt) throws GLib.Error {
+            get_srtp_keys_(key_material, key_material_size, out client_key, out client_salt, out server_key, out server_salt);
+        }
+
+        [CCode (cname = "gnutls_certificate_get_peers", array_length_type = "unsigned int")]
+        public unowned Datum[]? get_peer_certificates();
+
+        [CCode (cname = "gnutls_session_set_verify_function")]
+        public void set_verify_function(VerifyFunc func);
+    }
+
+    [Compact]
+    [CCode (cname = "struct gnutls_certificate_credentials_st", free_function = "gnutls_certificate_free_credentials", cprefix = "gnutls_certificate_")]
+    public class CertificateCredentials {
+
+        [CCode (cname = "gnutls_certificate_allocate_credentials")]
+        private static int allocate(out CertificateCredentials credentials);
+
+        public static CertificateCredentials create() throws GLib.Error {
+            CertificateCredentials result;
+            var ret = allocate (out result);
+            throw_if_error(ret);
+            return result;
+        }
+
+        public void get_x509_crt(uint index, [CCode (array_length_type = "unsigned int")] out unowned X509.Certificate[] x509_ca_list);
+
+        public int set_x509_key(X509.Certificate[] cert_list, X509.PrivateKey key);
+    }
+
+    [CCode (cheader_filename = "gnutls/x509.h", cprefix = "GNUTLS_")]
+    namespace X509 {
+
+        [Compact]
+        [CCode (cname = "struct gnutls_x509_crt_int", cprefix = "gnutls_x509_crt_", free_function = "gnutls_x509_crt_deinit")]
+        public class Certificate {
+
+            [CCode (cname = "gnutls_x509_crt_init")]
+            private static int init (out Certificate cert);
+            public static Certificate create() throws GLib.Error {
+                Certificate result;
+                var ret = init (out result);
+                throw_if_error(ret);
+                return result;
+            }
+
+            [CCode (cname = "gnutls_x509_crt_import")]
+            public int import_(ref Datum data, CertificateFormat format);
+            [CCode (cname = "gnutls_x509_crt_import_")]
+            public void import(ref Datum data, CertificateFormat format) throws GLib.Error {
+                int err = import_(ref data, format);
+                throw_if_error(err);
+            }
+
+            [CCode (cname = "gnutls_x509_crt_set_version")]
+            public int set_version_(uint version);
+            [CCode (cname = "gnutls_x509_crt_set_version_")]
+            public void set_version(uint version) throws GLib.Error {
+                int err = set_version_(version);
+                throw_if_error(err);
+            }
+
+            [CCode (cname = "gnutls_x509_crt_set_key")]
+            public int set_key_(PrivateKey key);
+            [CCode (cname = "gnutls_x509_crt_set_key_")]
+            public void set_key(PrivateKey key) throws GLib.Error {
+                int err = set_key_(key);
+                throw_if_error(err);
+            }
+
+            [CCode (cname = "gnutls_x509_crt_set_activation_time")]
+            public int set_activation_time_(time_t act_time);
+            [CCode (cname = "gnutls_x509_crt_set_activation_time_")]
+            public void set_activation_time(time_t act_time) throws GLib.Error {
+                int err = set_activation_time_(act_time);
+                throw_if_error(err);
+            }
+
+            [CCode (cname = "gnutls_x509_crt_set_expiration_time")]
+            public int set_expiration_time_(time_t exp_time);
+            [CCode (cname = "gnutls_x509_crt_set_expiration_time_")]
+            public void set_expiration_time(time_t exp_time) throws GLib.Error {
+                int err = set_expiration_time_(exp_time);
+                throw_if_error(err);
+            }
+
+            [CCode (cname = "gnutls_x509_crt_set_serial")]
+            public int set_serial_(void* serial, size_t serial_size);
+            [CCode (cname = "gnutls_x509_crt_set_serial_")]
+            public void set_serial(void* serial, size_t serial_size) throws GLib.Error {
+                int err = set_serial_(serial, serial_size);
+                throw_if_error(err);
+            }
+
+            [CCode (cname = "gnutls_x509_crt_sign")]
+            public int sign_(Certificate issuer, PrivateKey issuer_key);
+            [CCode (cname = "gnutls_x509_crt_sign_")]
+            public void sign(Certificate issuer, PrivateKey issuer_key) throws GLib.Error {
+                int err = sign_(issuer, issuer_key);
+                throw_if_error(err);
+            }
+
+            [CCode (cname = "gnutls_x509_crt_get_fingerprint")]
+            public int get_fingerprint_(DigestAlgorithm algo, void* buf, ref size_t buf_size);
+            [CCode (cname = "gnutls_x509_crt_get_fingerprint_")]
+            public void get_fingerprint(DigestAlgorithm algo, void* buf, ref size_t buf_size) throws GLib.Error {
+                int err = get_fingerprint_(algo, buf, ref buf_size);
+                throw_if_error(err);
+            }
+        }
+
+        [Compact]
+        [CCode (cname = "struct gnutls_x509_privkey_int", cprefix = "gnutls_x509_privkey_", free_function = "gnutls_x509_privkey_deinit")]
+        public class PrivateKey {
+            private static int init (out PrivateKey key);
+            public static PrivateKey create () throws GLib.Error {
+                PrivateKey result;
+                var ret = init (out result);
+                throw_if_error(ret);
+                return result;
+            }
+
+            public int generate(PKAlgorithm algo, uint bits, uint flags = 0);
+        }
+
+    }
+
+    [CCode (cname = "gnutls_certificate_request_t", cprefix = "GNUTLS_CERT_", has_type_id = false)]
+    public enum CertificateRequest {
+        IGNORE,
+        REQUEST,
+        REQUIRE
+    }
+
+    [CCode (cname = "gnutls_pk_algorithm_t", cprefix = "GNUTLS_PK_", has_type_id = false)]
+    public enum PKAlgorithm {
+        UNKNOWN,
+        RSA,
+        DSA;
+    }
+
+    [CCode (cname = "gnutls_digest_algorithm_t", cprefix = "GNUTLS_DIG_", has_type_id = false)]
+    public enum DigestAlgorithm {
+        NULL,
+        MD5,
+        SHA1,
+        RMD160,
+        MD2,
+        SHA224,
+        SHA256,
+        SHA384,
+        SHA512;
+    }
+
+    [Flags]
+    [CCode (cname = "gnutls_init_flags_t", cprefix = "GNUTLS_", has_type_id = false)]
+    public enum InitFlags {
+        SERVER,
+        CLIENT,
+        DATAGRAM
+    }
+
+    [CCode (cname = "gnutls_credentials_type_t", cprefix = "GNUTLS_CRD_", has_type_id = false)]
+    public enum CredentialsType {
+        CERTIFICATE,
+        ANON,
+        SRP,
+        PSK,
+        IA
+    }
+
+    [CCode (cname = "gnutls_x509_crt_fmt_t", cprefix = "GNUTLS_X509_FMT_", has_type_id = false)]
+    public enum CertificateFormat {
+        DER,
+        PEM
+    }
+
+    [Flags]
+    [CCode (cname = "gnutls_certificate_status_t", cprefix = "GNUTLS_CERT_", has_type_id = false)]
+    public enum CertificateStatus {
+        INVALID,             // will be set if the certificate was not verified.
+		REVOKED,             // in X.509 this will be set only if CRLs are checked
+		SIGNER_NOT_FOUND,
+        SIGNER_NOT_CA,
+        INSECURE_ALGORITHM
+    }
+
+    [SimpleType]
+    [CCode (cname = "gnutls_datum_t", has_type_id = false)]
+    public struct Datum {
+        public uint8* data;
+        public uint size;
+
+        public uint8[] extract() {
+            uint8[size] ret = new uint8[size];
+            for (int i = 0; i < size; i++) {
+                ret[i] = data[i];
+            }
+            return ret;
+        }
+    }
+
+    // Gnutls error codes. The mapping to a TLS alert is also shown in comments.
+    [CCode (cname = "int", cprefix = "GNUTLS_E_", lower_case_cprefix = "gnutls_error_", has_type_id = false)]
+    public enum ErrorCode {
+        SUCCESS,
+        UNKNOWN_COMPRESSION_ALGORITHM,
+        UNKNOWN_CIPHER_TYPE,
+        LARGE_PACKET,
+        UNSUPPORTED_VERSION_PACKET, // GNUTLS_A_PROTOCOL_VERSION
+        UNEXPECTED_PACKET_LENGTH, // GNUTLS_A_RECORD_OVERFLOW
+        INVALID_SESSION,
+        FATAL_ALERT_RECEIVED,
+        UNEXPECTED_PACKET, // GNUTLS_A_UNEXPECTED_MESSAGE
+        WARNING_ALERT_RECEIVED,
+        ERROR_IN_FINISHED_PACKET,
+        UNEXPECTED_HANDSHAKE_PACKET,
+        UNKNOWN_CIPHER_SUITE, // GNUTLS_A_HANDSHAKE_FAILURE
+        UNWANTED_ALGORITHM,
+        MPI_SCAN_FAILED,
+        DECRYPTION_FAILED, // GNUTLS_A_DECRYPTION_FAILED, GNUTLS_A_BAD_RECORD_MAC
+        MEMORY_ERROR,
+        DECOMPRESSION_FAILED, // GNUTLS_A_DECOMPRESSION_FAILURE
+        COMPRESSION_FAILED,
+        AGAIN,
+        EXPIRED,
+        DB_ERROR,
+        SRP_PWD_ERROR,
+        INSUFFICIENT_CREDENTIALS,
+        HASH_FAILED,
+        BASE64_DECODING_ERROR,
+        MPI_PRINT_FAILED,
+        REHANDSHAKE, // GNUTLS_A_NO_RENEGOTIATION
+        GOT_APPLICATION_DATA,
+        RECORD_LIMIT_REACHED,
+        ENCRYPTION_FAILED,
+        PK_ENCRYPTION_FAILED,
+        PK_DECRYPTION_FAILED,
+        PK_SIGN_FAILED,
+        X509_UNSUPPORTED_CRITICAL_EXTENSION,
+        KEY_USAGE_VIOLATION,
+        NO_CERTIFICATE_FOUND, // GNUTLS_A_BAD_CERTIFICATE
+        INVALID_REQUEST,
+        SHORT_MEMORY_BUFFER,
+        INTERRUPTED,
+        PUSH_ERROR,
+        PULL_ERROR,
+        RECEIVED_ILLEGAL_PARAMETER, // GNUTLS_A_ILLEGAL_PARAMETER
+        REQUESTED_DATA_NOT_AVAILABLE,
+        PKCS1_WRONG_PAD,
+        RECEIVED_ILLEGAL_EXTENSION,
+        INTERNAL_ERROR,
+        DH_PRIME_UNACCEPTABLE,
+        FILE_ERROR,
+        TOO_MANY_EMPTY_PACKETS,
+        UNKNOWN_PK_ALGORITHM,
+        // returned if libextra functionality was requested but
+        // gnutls_global_init_extra() was not called.
+
+        INIT_LIBEXTRA,
+        LIBRARY_VERSION_MISMATCH,
+        // returned if you need to generate temporary RSA
+        // parameters. These are needed for export cipher suites.
+
+        NO_TEMPORARY_RSA_PARAMS,
+        LZO_INIT_FAILED,
+        NO_COMPRESSION_ALGORITHMS,
+        NO_CIPHER_SUITES,
+        OPENPGP_GETKEY_FAILED,
+        PK_SIG_VERIFY_FAILED,
+        ILLEGAL_SRP_USERNAME,
+        SRP_PWD_PARSING_ERROR,
+        NO_TEMPORARY_DH_PARAMS,
+        // For certificate and key stuff
+
+        ASN1_ELEMENT_NOT_FOUND,
+        ASN1_IDENTIFIER_NOT_FOUND,
+        ASN1_DER_ERROR,
+        ASN1_VALUE_NOT_FOUND,
+        ASN1_GENERIC_ERROR,
+        ASN1_VALUE_NOT_VALID,
+        ASN1_TAG_ERROR,
+        ASN1_TAG_IMPLICIT,
+        ASN1_TYPE_ANY_ERROR,
+        ASN1_SYNTAX_ERROR,
+        ASN1_DER_OVERFLOW,
+        OPENPGP_UID_REVOKED,
+        CERTIFICATE_ERROR,
+        CERTIFICATE_KEY_MISMATCH,
+        UNSUPPORTED_CERTIFICATE_TYPE, // GNUTLS_A_UNSUPPORTED_CERTIFICATE
+        X509_UNKNOWN_SAN,
+        OPENPGP_FINGERPRINT_UNSUPPORTED,
+        X509_UNSUPPORTED_ATTRIBUTE,
+        UNKNOWN_HASH_ALGORITHM,
+        UNKNOWN_PKCS_CONTENT_TYPE,
+        UNKNOWN_PKCS_BAG_TYPE,
+        INVALID_PASSWORD,
+        MAC_VERIFY_FAILED, // for PKCS #12 MAC
+        CONSTRAINT_ERROR,
+        WARNING_IA_IPHF_RECEIVED,
+        WARNING_IA_FPHF_RECEIVED,
+        IA_VERIFY_FAILED,
+        UNKNOWN_ALGORITHM,
+        BASE64_ENCODING_ERROR,
+        INCOMPATIBLE_CRYPTO_LIBRARY,
+        INCOMPATIBLE_LIBTASN1_LIBRARY,
+        OPENPGP_KEYRING_ERROR,
+        X509_UNSUPPORTED_OID,
+        RANDOM_FAILED,
+        BASE64_UNEXPECTED_HEADER_ERROR,
+        OPENPGP_SUBKEY_ERROR,
+        CRYPTO_ALREADY_REGISTERED,
+        HANDSHAKE_TOO_LARGE,
+        UNIMPLEMENTED_FEATURE,
+        APPLICATION_ERROR_MAX, // -65000
+        APPLICATION_ERROR_MIN; // -65500
+
+        [CCode (cname = "gnutls_error_is_fatal")]
+        public bool is_fatal();
+
+        [CCode (cname = "gnutls_perror")]
+        public void print();
+
+        [CCode (cname = "gnutls_strerror")]
+        public unowned string to_string();
+    }
+
+    public void throw_if_error(int err_int) throws GLib.Error {
+        ErrorCode error = (ErrorCode)err_int;
+        if (error != ErrorCode.SUCCESS) {
+            throw new GLib.Error(-1, error, "%s%s", error.to_string(), error.is_fatal() ? " fatal" : "");
+        }
+    }
+}
\ No newline at end of file
diff --git a/plugins/rtp/CMakeLists.txt b/plugins/rtp/CMakeLists.txt
index 5311fac3..8ce2a7c6 100644
--- a/plugins/rtp/CMakeLists.txt
+++ b/plugins/rtp/CMakeLists.txt
@@ -2,6 +2,7 @@ find_packages(RTP_PACKAGES REQUIRED
     Gee
     GLib
     GModule
+    GnuTLS
     GObject
     GTK3
     Gst
diff --git a/xmpp-vala/src/module/xep/0166_jingle/reason_element.vala b/xmpp-vala/src/module/xep/0166_jingle/reason_element.vala
index 1cbdf936..4d47d4cd 100644
--- a/xmpp-vala/src/module/xep/0166_jingle/reason_element.vala
+++ b/xmpp-vala/src/module/xep/0166_jingle/reason_element.vala
@@ -24,6 +24,7 @@ namespace  Xmpp.Xep.Jingle.ReasonElement {
         BUSY,
         CANCEL,
         DECLINE,
+        GONE,
         SUCCESS
     };
 }
\ No newline at end of file
diff --git a/xmpp-vala/src/module/xep/0166_jingle/session.vala b/xmpp-vala/src/module/xep/0166_jingle/session.vala
index e9ad9169..2d359f01 100644
--- a/xmpp-vala/src/module/xep/0166_jingle/session.vala
+++ b/xmpp-vala/src/module/xep/0166_jingle/session.vala
@@ -24,9 +24,10 @@ public class Xmpp.Xep.Jingle.Session : Object {
     public Jid peer_full_jid { get; private set; }
     public bool we_initiated { get; private set; }
 
-    public HashMap<string, Content> contents = new HashMap<string, Content>();
+    public HashMap<string, Content> contents_map = new HashMap<string, Content>();
+    public Gee.List<Content> contents = new ArrayList<Content>(); // Keep the order contents
 
-    public SecurityParameters? security { get { return contents.values.to_array()[0].security_params; } }
+    public SecurityParameters? security { get { return contents.to_array()[0].security_params; } }
 
     public Session.initiate_sent(XmppStream stream, string sid, Jid local_full_jid, Jid peer_full_jid) {
         this.stream = stream;
@@ -94,7 +95,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
 
         } else if (action.has_prefix("transport-")) {
             ContentNode content_node = get_single_content_node(jingle);
-            if (!contents.has_key(content_node.name)) {
+            if (!contents_map.has_key(content_node.name)) {
                 throw new IqError.BAD_REQUEST("unknown content");
             }
 
@@ -102,7 +103,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
                 throw new IqError.BAD_REQUEST("missing transport node");
             }
 
-            Content content = contents[content_node.name];
+            Content content = contents_map[content_node.name];
 
             if (content_node.creator != content.content_creator) {
                 throw new IqError.BAD_REQUEST("unknown content; creator");
@@ -128,11 +129,11 @@ public class Xmpp.Xep.Jingle.Session : Object {
 
         } else if (action == "description-info") {
             ContentNode content_node = get_single_content_node(jingle);
-            if (!contents.has_key(content_node.name)) {
+            if (!contents_map.has_key(content_node.name)) {
                 throw new IqError.BAD_REQUEST("unknown content");
             }
 
-            Content content = contents[content_node.name];
+            Content content = contents_map[content_node.name];
 
             if (content_node.creator != content.content_creator) {
                 throw new IqError.BAD_REQUEST("unknown content; creator");
@@ -149,7 +150,8 @@ public class Xmpp.Xep.Jingle.Session : Object {
     }
 
     internal void insert_content(Content content) {
-        this.contents[content.content_name] = content;
+        this.contents_map[content.content_name] = content;
+        this.contents.add(content);
         content.set_session(this);
     }
 
@@ -209,7 +211,8 @@ public class Xmpp.Xep.Jingle.Session : Object {
 
     public async void add_content(Content content) {
         content.session = this;
-        this.contents[content.content_name] = content;
+        this.contents_map[content.content_name] = content;
+        contents.add(content);
 
         StanzaNode content_add_node = new StanzaNode.build("jingle", NS_URI)
                 .add_self_xmlns()
@@ -228,9 +231,9 @@ public class Xmpp.Xep.Jingle.Session : Object {
 
     private void handle_content_accept(ContentNode content_node) throws IqError {
         if (content_node.description == null || content_node.transport == null) throw new IqError.BAD_REQUEST("missing description or transport node");
-        if (!contents.has_key(content_node.name)) throw new IqError.BAD_REQUEST("unknown content");
+        if (!contents_map.has_key(content_node.name)) throw new IqError.BAD_REQUEST("unknown content");
 
-        Content content = contents[content_node.name];
+        Content content = contents_map[content_node.name];
 
         if (content_node.creator != content.content_creator) warning("Counterpart accepts content with an unexpected `creator`");
         if (content_node.senders != content.senders) warning("Counterpart accepts content with an unexpected `senders`");
@@ -242,7 +245,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
     private void handle_content_modify(XmppStream stream, StanzaNode jingle_node, Iq.Stanza iq) throws IqError {
         ContentNode content_node = get_single_content_node(jingle_node);
 
-        Content? content = contents[content_node.name];
+        Content? content = contents_map[content_node.name];
 
         if (content == null) throw new IqError.BAD_REQUEST("no such content");
         if (content_node.creator != content.content_creator) throw new IqError.BAD_REQUEST("mismatching creator");
@@ -301,7 +304,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
             }
         }
 
-        foreach (Content content in contents.values) {
+        foreach (Content content in contents) {
             content.terminate(false, reason_name, reason_text);
         }
 
@@ -336,7 +339,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
                 .add_self_xmlns()
                 .put_attribute("action", "session-accept")
                 .put_attribute("sid", sid);
-        foreach (Content content in contents.values) {
+        foreach (Content content in contents) {
             StanzaNode content_node = new StanzaNode.build("content", NS_URI)
                     .put_attribute("creator", "initiator")
                     .put_attribute("name", content.content_name)
@@ -345,12 +348,13 @@ public class Xmpp.Xep.Jingle.Session : Object {
                     .put_node(content.transport_params.to_transport_stanza_node());
             jingle.put_node(content_node);
         }
+
         Iq.Stanza iq = new Iq.Stanza.set(jingle) { to=peer_full_jid };
         stream.get_module(Iq.Module.IDENTITY).send_iq(stream, iq);
 
 
-        foreach (Content content in contents.values) {
-            content.on_accept(stream);
+        foreach (Content content2 in contents) {
+            content2.on_accept(stream);
         }
 
         state = State.ACTIVE;
@@ -359,7 +363,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
     internal void accept_content(Content content) {
         if (state == State.INITIATE_RECEIVED) {
             bool all_accepted = true;
-            foreach (Content c in contents.values) {
+            foreach (Content c in contents) {
                 if (c.state != Content.State.WANTS_TO_BE_ACCEPTED) {
                     all_accepted = false;
                 }
@@ -413,7 +417,7 @@ public class Xmpp.Xep.Jingle.Session : Object {
             } else {
                 reason_str = "local session-terminate";
             }
-            foreach (Content content in contents.values) {
+            foreach (Content content in contents) {
                 content.terminate(true, reason_name, reason_text);
             }
         }
diff --git a/xmpp-vala/src/module/xep/0167_jingle_rtp/content_parameters.vala b/xmpp-vala/src/module/xep/0167_jingle_rtp/content_parameters.vala
index cca03543..32ea1df6 100644
--- a/xmpp-vala/src/module/xep/0167_jingle_rtp/content_parameters.vala
+++ b/xmpp-vala/src/module/xep/0167_jingle_rtp/content_parameters.vala
@@ -34,7 +34,7 @@ public class Xmpp.Xep.JingleRtp.Parameters : Jingle.ContentParameters, Object {
         this.parent = parent;
         this.media = media;
         this.ssrc = ssrc;
-        this.rtcp_mux = rtcp_mux;
+        this.rtcp_mux = true;
         this.bandwidth = bandwidth;
         this.bandwidth_type = bandwidth_type;
         this.encryption_required = encryption_required;
@@ -175,6 +175,9 @@ public class Xmpp.Xep.JingleRtp.Parameters : Jingle.ContentParameters, Object {
             ret.put_node(new StanzaNode.build("encryption", NS_URI)
                 .put_node(local_crypto.to_xml()));
         }
+        if (rtcp_mux) {
+            ret.put_node(new StanzaNode.build("rtcp-mux", NS_URI));
+        }
         return ret;
     }
 }
\ No newline at end of file
diff --git a/xmpp-vala/src/module/xep/0167_jingle_rtp/jingle_rtp_module.vala b/xmpp-vala/src/module/xep/0167_jingle_rtp/jingle_rtp_module.vala
index 23aee6c9..3a9ea09f 100644
--- a/xmpp-vala/src/module/xep/0167_jingle_rtp/jingle_rtp_module.vala
+++ b/xmpp-vala/src/module/xep/0167_jingle_rtp/jingle_rtp_module.vala
@@ -84,7 +84,7 @@ public abstract class Module : XmppStreamModule {
         Jid receiver_full_jid = session.peer_full_jid;
 
         Jingle.Content? content = null;
-        foreach (Jingle.Content c in session.contents.values) {
+        foreach (Jingle.Content c in session.contents) {
             Parameters? parameters = c.content_params as Parameters;
             if (parameters == null) continue;
 
diff --git a/xmpp-vala/src/module/xep/0167_jingle_rtp/session_info_type.vala b/xmpp-vala/src/module/xep/0167_jingle_rtp/session_info_type.vala
index d36255f0..32cd9016 100644
--- a/xmpp-vala/src/module/xep/0167_jingle_rtp/session_info_type.vala
+++ b/xmpp-vala/src/module/xep/0167_jingle_rtp/session_info_type.vala
@@ -50,7 +50,7 @@ namespace Xmpp.Xep.JingleRtp {
         public void send_mute(Jingle.Session session, bool mute, string media) {
             string node_name = mute ? "mute" : "unmute";
 
-            foreach (Jingle.Content content in session.contents.values) {
+            foreach (Jingle.Content content in session.contents) {
                 Parameters? parameters = content.content_params as Parameters;
                 if (parameters != null && parameters.media == media) {
                     StanzaNode session_info_content = new StanzaNode.build(node_name, NS_URI).add_self_xmlns().put_attribute("name", content.content_name);
diff --git a/xmpp-vala/src/module/xep/0176_jingle_ice_udp/jingle_ice_udp_module.vala b/xmpp-vala/src/module/xep/0176_jingle_ice_udp/jingle_ice_udp_module.vala
index 9ed494ff..4b7c7a36 100644
--- a/xmpp-vala/src/module/xep/0176_jingle_ice_udp/jingle_ice_udp_module.vala
+++ b/xmpp-vala/src/module/xep/0176_jingle_ice_udp/jingle_ice_udp_module.vala
@@ -12,6 +12,7 @@ public abstract class Module : XmppStreamModule, Jingle.Transport {
     public override void attach(XmppStream stream) {
         stream.get_module(Jingle.Module.IDENTITY).register_transport(this);
         stream.get_module(ServiceDiscovery.Module.IDENTITY).add_feature(stream, NS_URI);
+        stream.get_module(ServiceDiscovery.Module.IDENTITY).add_feature(stream, "urn:xmpp:jingle:apps:dtls:0");
     }
     public override void detach(XmppStream stream) {
         stream.get_module(ServiceDiscovery.Module.IDENTITY).remove_feature(stream, NS_URI);
diff --git a/xmpp-vala/src/module/xep/0176_jingle_ice_udp/transport_parameters.vala b/xmpp-vala/src/module/xep/0176_jingle_ice_udp/transport_parameters.vala
index 8b8aa07d..3c69d0af 100644
--- a/xmpp-vala/src/module/xep/0176_jingle_ice_udp/transport_parameters.vala
+++ b/xmpp-vala/src/module/xep/0176_jingle_ice_udp/transport_parameters.vala
@@ -13,6 +13,9 @@ public abstract class Xmpp.Xep.JingleIceUdp.IceUdpTransportParameters : Jingle.T
     public ConcurrentList<Candidate> unsent_local_candidates = new ConcurrentList<Candidate>(Candidate.equals_func);
     public Gee.List<Candidate> remote_candidates = new ArrayList<Candidate>(Candidate.equals_func);
 
+    public string? own_fingerprint = null;
+    public string? peer_fingerprint = null;
+
     public Jid local_full_jid { get; private set; }
     public Jid peer_full_jid { get; private set; }
     private uint8 components_;
@@ -34,6 +37,11 @@ public abstract class Xmpp.Xep.JingleIceUdp.IceUdpTransportParameters : Jingle.T
             foreach (StanzaNode candidateNode in node.get_subnodes("candidate")) {
                 remote_candidates.add(Candidate.parse(candidateNode));
             }
+
+            StanzaNode? fingerprint_node = node.get_subnode("fingerprint", "urn:xmpp:jingle:apps:dtls:0");
+            if (fingerprint_node != null) {
+                peer_fingerprint = fingerprint_node.get_deep_string_content();
+            }
         }
     }
 
@@ -57,6 +65,20 @@ public abstract class Xmpp.Xep.JingleIceUdp.IceUdpTransportParameters : Jingle.T
                 .add_self_xmlns()
                 .put_attribute("ufrag", local_ufrag)
                 .put_attribute("pwd", local_pwd);
+
+        if (own_fingerprint != null) {
+            var fingerprint_node = new StanzaNode.build("fingerprint", "urn:xmpp:jingle:apps:dtls:0")
+                    .add_self_xmlns()
+                    .put_attribute("hash", "sha-256")
+                    .put_node(new StanzaNode.text(own_fingerprint));
+            if (incoming) {
+                fingerprint_node.put_attribute("setup", "active");
+            } else {
+                fingerprint_node.put_attribute("setup", "actpass");
+            }
+            node.put_node(fingerprint_node);
+        }
+
         foreach (Candidate candidate in unsent_local_candidates) {
             node.put_node(candidate.to_xml());
         }
@@ -72,6 +94,11 @@ public abstract class Xmpp.Xep.JingleIceUdp.IceUdpTransportParameters : Jingle.T
         foreach (StanzaNode candidateNode in node.get_subnodes("candidate")) {
             remote_candidates.add(Candidate.parse(candidateNode));
         }
+
+        StanzaNode? fingerprint_node = node.get_subnode("fingerprint", "urn:xmpp:jingle:apps:dtls:0");
+        if (fingerprint_node != null) {
+            peer_fingerprint = fingerprint_node.get_deep_string_content();
+        }
     }
 
     public virtual void handle_transport_info(StanzaNode node) throws Jingle.IqError {
-- 
cgit v1.2.3-70-g09d2


From 5e58f2988382fffb70602cf308f6686b4731f0da Mon Sep 17 00:00:00 2001
From: Marvin W <git@larma.de>
Date: Mon, 29 Mar 2021 13:20:12 +0200
Subject: Migrate to libsrtp2

---
 cmake/FindSrtp2.cmake                  |  12 +
 plugins/crypto-vala/CMakeLists.txt     |  34 +-
 plugins/crypto-vala/src/error.vala     |   4 +-
 plugins/crypto-vala/src/srtp.c         | 836 ---------------------------------
 plugins/crypto-vala/src/srtp.h         |  82 ----
 plugins/crypto-vala/src/srtp.vala      | 122 +++++
 plugins/crypto-vala/src/srtp.vapi      | 107 -----
 plugins/crypto-vala/vapi/libsrtp2.vapi | 115 +++++
 plugins/ice/CMakeLists.txt             |   2 +-
 plugins/ice/src/dtls_srtp.vala         |  49 +-
 plugins/rtp/CMakeLists.txt             |   2 +-
 plugins/rtp/src/stream.vala            |  51 +-
 12 files changed, 314 insertions(+), 1102 deletions(-)
 create mode 100644 cmake/FindSrtp2.cmake
 delete mode 100644 plugins/crypto-vala/src/srtp.c
 delete mode 100644 plugins/crypto-vala/src/srtp.h
 create mode 100644 plugins/crypto-vala/src/srtp.vala
 delete mode 100644 plugins/crypto-vala/src/srtp.vapi
 create mode 100644 plugins/crypto-vala/vapi/libsrtp2.vapi

(limited to 'plugins/ice/CMakeLists.txt')

diff --git a/cmake/FindSrtp2.cmake b/cmake/FindSrtp2.cmake
new file mode 100644
index 00000000..40b0ed97
--- /dev/null
+++ b/cmake/FindSrtp2.cmake
@@ -0,0 +1,12 @@
+include(PkgConfigWithFallback)
+find_pkg_config_with_fallback(Srtp2
+    PKG_CONFIG_NAME libsrtp2
+    LIB_NAMES srtp2
+    INCLUDE_NAMES srtp2/srtp.h
+    INCLUDE_DIR_SUFFIXES srtp2 srtp2/include
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Srtp2
+    REQUIRED_VARS Srtp2_LIBRARY
+    VERSION_VAR Srtp2_VERSION)
\ No newline at end of file
diff --git a/plugins/crypto-vala/CMakeLists.txt b/plugins/crypto-vala/CMakeLists.txt
index f97b0d31..4a8da241 100644
--- a/plugins/crypto-vala/CMakeLists.txt
+++ b/plugins/crypto-vala/CMakeLists.txt
@@ -3,6 +3,7 @@ find_packages(CRYPTO_VALA_PACKAGES REQUIRED
     GLib
     GObject
     GIO
+    Srtp2
 )
 
 vala_precompile(CRYPTO_VALA_C
@@ -11,44 +12,23 @@ SOURCES
     "src/cipher_converter.vala"
     "src/error.vala"
     "src/random.vala"
-    "src/srtp.vapi"
+    "src/srtp.vala"
 CUSTOM_VAPIS
     "${CMAKE_CURRENT_SOURCE_DIR}/vapi/gcrypt.vapi"
+    "${CMAKE_CURRENT_SOURCE_DIR}/vapi/libsrtp2.vapi"
 PACKAGES
     ${CRYPTO_VALA_PACKAGES}
+OPTIONS
+    --vapidir=${CMAKE_CURRENT_SOURCE_DIR}/vapi
 GENERATE_VAPI
     crypto-vala
 GENERATE_HEADER
     crypto-vala
 )
 
-add_custom_command(OUTPUT "${CMAKE_BINARY_DIR}/exports/srtp.h"
-COMMAND
-    cp "${CMAKE_CURRENT_SOURCE_DIR}/src/srtp.h" "${CMAKE_BINARY_DIR}/exports/srtp.h"
-DEPENDS
-    "${CMAKE_CURRENT_SOURCE_DIR}/src/srtp.h"
-COMMENT
-    Copy header file srtp.h
-)
-
-add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/exports/crypto.vapi
-COMMAND
-    cat "${CMAKE_BINARY_DIR}/exports/crypto-vala.vapi" "${CMAKE_CURRENT_SOURCE_DIR}/src/srtp.vapi" > "${CMAKE_BINARY_DIR}/exports/crypto.vapi"
-DEPENDS
-    ${CMAKE_BINARY_DIR}/exports/crypto-vala.vapi
-    ${CMAKE_CURRENT_SOURCE_DIR}/src/srtp.vapi
-)
-
-add_custom_target(crypto-vapi
-DEPENDS
-    ${CMAKE_BINARY_DIR}/exports/crypto.vapi
-    ${CMAKE_BINARY_DIR}/exports/srtp.h
-)
-
-set(CFLAGS ${VALA_CFLAGS} -I${CMAKE_CURRENT_SOURCE_DIR}/src)
+set(CFLAGS ${VALA_CFLAGS})
 add_definitions(${CFLAGS})
-add_library(crypto-vala STATIC ${CRYPTO_VALA_C} src/srtp.c)
-add_dependencies(crypto-vala crypto-vapi)
+add_library(crypto-vala STATIC ${CRYPTO_VALA_C})
 target_link_libraries(crypto-vala ${CRYPTO_VALA_PACKAGES} gcrypt)
 set_property(TARGET crypto-vala PROPERTY POSITION_INDEPENDENT_CODE ON)
 
diff --git a/plugins/crypto-vala/src/error.vala b/plugins/crypto-vala/src/error.vala
index bae4ad08..5007d725 100644
--- a/plugins/crypto-vala/src/error.vala
+++ b/plugins/crypto-vala/src/error.vala
@@ -2,7 +2,9 @@ namespace Crypto {
 
 public errordomain Error {
     ILLEGAL_ARGUMENTS,
-    GCRYPT
+    GCRYPT,
+    AUTHENTICATION_FAILED,
+    UNKNOWN
 }
 
 internal void may_throw_gcrypt_error(GCrypt.Error e) throws Error {
diff --git a/plugins/crypto-vala/src/srtp.c b/plugins/crypto-vala/src/srtp.c
deleted file mode 100644
index 708244d9..00000000
--- a/plugins/crypto-vala/src/srtp.c
+++ /dev/null
@@ -1,836 +0,0 @@
-/*
- * Secure RTP with libgcrypt
- * Copyright (C) 2007  Rémi Denis-Courmont
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-/* TODO:
- * Useless stuff (because nothing depends on it):
- * - non-nul key derivation rate
- * - MKI payload
- */
-
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-#endif
-
-#include <stdint.h>
-#include <stddef.h>
-
-#include "srtp.h"
-
-#include <stdbool.h>
-#include <stdlib.h>
-#include <assert.h>
-#include <errno.h>
-
-#include <gcrypt.h>
-
-#ifdef _WIN32
-# include <winsock2.h>
-#else
-# include <netinet/in.h>
-#endif
-
-#define debug( ... ) (void)0
-
-typedef struct srtp_proto_t
-{
-    gcry_cipher_hd_t cipher;
-    gcry_md_hd_t     mac;
-    uint64_t         window;
-    uint32_t         salt[4];
-} srtp_proto_t;
-
-struct srtp_session_t
-{
-    srtp_proto_t rtp;
-    srtp_proto_t rtcp;
-    unsigned flags;
-    unsigned kdr;
-    uint32_t rtcp_index;
-    uint32_t rtp_roc;
-    uint16_t rtp_seq;
-    uint16_t rtp_rcc;
-    uint8_t  tag_len;
-};
-
-enum
-{
-    SRTP_CRYPT,
-    SRTP_AUTH,
-    SRTP_SALT,
-    SRTCP_CRYPT,
-    SRTCP_AUTH,
-    SRTCP_SALT
-};
-
-
-static inline unsigned rcc_mode (const srtp_session_t *s)
-{
-    return (s->flags >> 4) & 3;
-}
-
-
-static void proto_destroy (srtp_proto_t *p)
-{
-    gcry_md_close (p->mac);
-    gcry_cipher_close (p->cipher);
-}
-
-
-/**
- * Releases all resources associated with a Secure RTP session.
- */
-void srtp_destroy (srtp_session_t *s)
-{
-    assert (s != NULL);
-
-    proto_destroy (&s->rtcp);
-    proto_destroy (&s->rtp);
-    free (s);
-}
-
-
-static int proto_create (srtp_proto_t *p, int gcipher, int gmd)
-{
-    if (gcry_cipher_open (&p->cipher, gcipher, GCRY_CIPHER_MODE_CTR, 0) == 0)
-    {
-        if (gcry_md_open (&p->mac, gmd, GCRY_MD_FLAG_HMAC) == 0)
-            return 0;
-        gcry_cipher_close (p->cipher);
-    }
-    return -1;
-}
-
-
-/**
- * Allocates a Secure RTP one-way session.
- * The same session cannot be used both ways because this would confuse
- * internal cryptographic counters; it is however of course feasible to open
- * multiple simultaneous sessions with the same master key.
- *
- * @param encr encryption algorithm number
- * @param auth authentication algortihm number
- * @param tag_len authentication tag byte length (NOT including RCC)
- * @param flags OR'ed optional flags.
- *
- * @return NULL in case of error
- */
-srtp_session_t *
-srtp_create (int encr, int auth, unsigned tag_len, int prf, unsigned flags)
-{
-    if ((flags & ~SRTP_FLAGS_MASK))
-        return NULL;
-
-    int cipher, md;
-    switch (encr)
-    {
-        case SRTP_ENCR_NULL:
-            cipher = GCRY_CIPHER_NONE;
-            break;
-
-        case SRTP_ENCR_AES_CM:
-            cipher = GCRY_CIPHER_AES;
-            break;
-
-        default:
-            return NULL;
-    }
-
-    switch (auth)
-    {
-        case SRTP_AUTH_NULL:
-            md = GCRY_MD_NONE;
-            break;
-
-        case SRTP_AUTH_HMAC_SHA1:
-            md = GCRY_MD_SHA1;
-            break;
-
-        default:
-            return NULL;
-    }
-
-    if (tag_len > gcry_md_get_algo_dlen (md))
-        return NULL;
-
-    if (prf != SRTP_PRF_AES_CM)
-        return NULL;
-
-    srtp_session_t *s = malloc (sizeof (*s));
-    if (s == NULL)
-        return NULL;
-
-    memset (s, 0, sizeof (*s));
-    s->flags = flags;
-    s->tag_len = tag_len;
-    s->rtp_rcc = 1; /* Default RCC rate */
-    if (rcc_mode (s))
-    {
-        if (tag_len < 4)
-            goto error;
-    }
-
-    if (proto_create (&s->rtp, cipher, md) == 0)
-    {
-        if (proto_create (&s->rtcp, cipher, md) == 0)
-            return s;
-        proto_destroy (&s->rtp);
-    }
-
-    error:
-    free (s);
-    return NULL;
-}
-
-
-/**
- * Counter Mode encryption/decryption (ctr length = 16 bytes)
- * with non-padded (truncated) text
- */
-static int
-do_ctr_crypt (gcry_cipher_hd_t hd, const void *ctr, uint8_t *data, size_t len)
-{
-    const size_t ctrlen = 16;
-    div_t d = div (len, ctrlen);
-
-    if (gcry_cipher_setctr (hd, ctr, ctrlen)
-        || gcry_cipher_encrypt (hd, data, d.quot * ctrlen, NULL, 0))
-        return -1;
-
-    if (d.rem)
-    {
-        /* Truncated last block */
-        uint8_t dummy[ctrlen];
-        data += d.quot * ctrlen;
-        memcpy (dummy, data, d.rem);
-        memset (dummy + d.rem, 0, ctrlen - d.rem);
-
-        if (gcry_cipher_encrypt (hd, dummy, ctrlen, data, ctrlen))
-            return -1;
-        memcpy (data, dummy, d.rem);
-    }
-
-    return 0;
-}
-
-
-/**
- * AES-CM key derivation (saltlen = 14 bytes)
- */
-static int
-do_derive (gcry_cipher_hd_t prf, const void *salt,
-           const uint8_t *r, size_t rlen, uint8_t label,
-           void *out, size_t outlen)
-{
-    uint8_t iv[16];
-
-    memcpy (iv, salt, 14);
-    iv[14] = iv[15] = 0;
-
-    assert (rlen < 14);
-    iv[13 - rlen] ^= label;
-    for (size_t i = 0; i < rlen; i++)
-        iv[sizeof (iv) - rlen + i] ^= r[i];
-
-    memset (out, 0, outlen);
-    return do_ctr_crypt (prf, iv, out, outlen);
-}
-
-
-/**
- * Sets (or resets) the master key and master salt for a SRTP session.
- * This must be done at least once before using srtp_send(), srtp_recv(),
- * srtcp_send() or srtcp_recv(). Also, rekeying is required every
- * 2^48 RTP packets or 2^31 RTCP packets (whichever comes first),
- * otherwise the protocol security might be broken.
- *
- * @return 0 on success, in case of error:
- *  EINVAL  invalid or unsupported key/salt sizes combination
- */
-int
-srtp_setkey (srtp_session_t *s, const void *key, size_t keylen,
-             const void *salt, size_t saltlen)
-{
-    /* SRTP/SRTCP cipher/salt/MAC keys derivation */
-    gcry_cipher_hd_t prf;
-    uint8_t r[6], keybuf[20];
-
-    if (saltlen != 14)
-        return EINVAL;
-
-    if (gcry_cipher_open (&prf, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CTR, 0)
-        || gcry_cipher_setkey (prf, key, keylen))
-        return EINVAL;
-
-    /* SRTP key derivation */
-#if 0
-    if (s->kdr != 0)
-    {
-        uint64_t index = (((uint64_t)s->rtp_roc) << 16) | s->rtp_seq;
-        index /= s->kdr;
-
-        for (int i = sizeof (r) - 1; i >= 0; i--)
-        {
-            r[i] = index & 0xff;
-            index = index >> 8;
-        }
-    }
-    else
-#endif
-    memset (r, 0, sizeof (r));
-    if (do_derive (prf, salt, r, 6, SRTP_CRYPT, keybuf, 16)
-        || gcry_cipher_setkey (s->rtp.cipher, keybuf, 16)
-        || do_derive (prf, salt, r, 6, SRTP_AUTH, keybuf, 20)
-        || gcry_md_setkey (s->rtp.mac, keybuf, 20)
-        || do_derive (prf, salt, r, 6, SRTP_SALT, s->rtp.salt, 14))
-        return -1;
-
-    /* SRTCP key derivation */
-    memcpy (r, &(uint32_t){ htonl (s->rtcp_index) }, 4);
-    if (do_derive (prf, salt, r, 4, SRTCP_CRYPT, keybuf, 16)
-        || gcry_cipher_setkey (s->rtcp.cipher, keybuf, 16)
-        || do_derive (prf, salt, r, 4, SRTCP_AUTH, keybuf, 20)
-        || gcry_md_setkey (s->rtcp.mac, keybuf, 20)
-        || do_derive (prf, salt, r, 4, SRTCP_SALT, s->rtcp.salt, 14))
-        return -1;
-
-    (void)gcry_cipher_close (prf);
-    return 0;
-}
-
-static int hexdigit (char c)
-{
-    if ((c >= '0') && (c <= '9'))
-        return c - '0';
-    if ((c >= 'A') && (c <= 'F'))
-        return c - 'A' + 0xA;
-    if ((c >= 'a') && (c <= 'f'))
-        return c - 'a' + 0xa;
-    return -1;
-}
-
-static ssize_t hexstring (const char *in, uint8_t *out, size_t outlen)
-{
-    size_t inlen = strlen (in);
-
-    if ((inlen > (2 * outlen)) || (inlen & 1))
-        return -1;
-
-    for (size_t i = 0; i < inlen; i += 2)
-    {
-        int a = hexdigit (in[i]), b = hexdigit (in[i + 1]);
-        if ((a == -1) || (b == -1))
-            return -1;
-        out[i / 2] = (a << 4) | b;
-    }
-    return inlen / 2;
-}
-
-/**
- * Sets (or resets) the master key and master salt for a SRTP session
- * from hexadecimal strings. See also srtp_setkey().
- *
- * @return 0 on success, in case of error:
- *  EINVAL  invalid or unsupported key/salt sizes combination
- */
-int
-srtp_setkeystring (srtp_session_t *s, const char *key, const char *salt)
-{
-    uint8_t bkey[16]; /* TODO/NOTE: hard-coded for AES */
-    uint8_t bsalt[14]; /* TODO/NOTE: hard-coded for the PRF-AES-CM */
-    ssize_t bkeylen = hexstring (key, bkey, sizeof (bkey));
-    ssize_t bsaltlen = hexstring (salt, bsalt, sizeof (bsalt));
-
-    if ((bkeylen == -1) || (bsaltlen == -1))
-        return EINVAL;
-    return srtp_setkey (s, bkey, bkeylen, bsalt, bsaltlen) ? EINVAL : 0;
-}
-
-/**
- * Sets Roll-over-Counter Carry (RCC) rate for the SRTP session. If not
- * specified (through this function), the default rate of ONE is assumed
- * (i.e. every RTP packets will carry the RoC). RCC rate is ignored if none
- * of the RCC mode has been selected.
- *
- * The RCC mode is selected through one of these flags for srtp_create():
- *  SRTP_RCC_MODE1: integrity protection only for RoC carrying packets
- *  SRTP_RCC_MODE2: integrity protection for all packets
- *  SRTP_RCC_MODE3: no integrity protection
- *
- * RCC mode 3 is insecure. Compared to plain RTP, it provides confidentiality
- * (through encryption) but is much more prone to DoS. It can only be used if
- * anti-spoofing protection is provided by lower network layers (e.g. IPsec,
- * or trusted routers and proper source address filtering).
- *
- * If RCC rate is 1, RCC mode 1 and 2 are functionally identical.
- *
- * @param rate RoC Carry rate (MUST NOT be zero)
- */
-void srtp_setrcc_rate (srtp_session_t *s, uint16_t rate)
-{
-    assert (rate != 0);
-    s->rtp_rcc = rate;
-}
-
-
-/** AES-CM for RTP (salt = 14 bytes + 2 nul bytes) */
-static int
-rtp_crypt (gcry_cipher_hd_t hd, uint32_t ssrc, uint32_t roc, uint16_t seq,
-           const uint32_t *salt, uint8_t *data, size_t len)
-{
-    /* Determines cryptographic counter (IV) */
-    uint32_t counter[4];
-    counter[0] = salt[0];
-    counter[1] = salt[1] ^ ssrc;
-    counter[2] = salt[2] ^ htonl (roc);
-    counter[3] = salt[3] ^ htonl (seq << 16);
-
-    /* Encryption */
-    return do_ctr_crypt (hd, counter, data, len);
-}
-
-
-/** Determines SRTP Roll-Over-Counter (in host-byte order) */
-static uint32_t
-srtp_compute_roc (const srtp_session_t *s, uint16_t seq)
-{
-    uint32_t roc = s->rtp_roc;
-
-    if (((seq - s->rtp_seq) & 0xffff) < 0x8000)
-    {
-        /* Sequence is ahead, good */
-        if (seq < s->rtp_seq)
-            roc++; /* Sequence number wrap */
-    }
-    else
-    {
-        /* Sequence is late, bad */
-        if (seq > s->rtp_seq)
-            roc--; /* Wrap back */
-    }
-    return roc;
-}
-
-
-/** Returns RTP sequence (in host-byte order) */
-static inline uint16_t rtp_seq (const uint8_t *buf)
-{
-    return (buf[2] << 8) | buf[3];
-}
-
-
-/** Message Authentication and Integrity for RTP */
-static const uint8_t *
-rtp_digest (gcry_md_hd_t md, const uint8_t *data, size_t len,
-            uint32_t roc)
-{
-    gcry_md_reset (md);
-    gcry_md_write (md, data, len);
-    gcry_md_write (md, &(uint32_t){ htonl (roc) }, 4);
-    return gcry_md_read (md, 0);
-}
-
-
-/**
- * Encrypts/decrypts a RTP packet and updates SRTP context
- * (CTR block cypher mode of operation has identical encryption and
- * decryption function).
- *
- * @param buf RTP packet to be en-/decrypted
- * @param len RTP packet length
- *
- * @return 0 on success, in case of error:
- *  EINVAL  malformatted RTP packet
- *  EACCES  replayed packet or out-of-window or sync lost
- */
-static int srtp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
-{
-    assert (s != NULL);
-    assert (len >= 12u);
-
-    if ((buf[0] >> 6) != 2)
-        return EINVAL;
-
-    /* Computes encryption offset */
-    uint16_t offset = 12;
-    offset += (buf[0] & 0xf) * 4; // skips CSRC
-
-    if (buf[0] & 0x10)
-    {
-        uint16_t extlen;
-
-        offset += 4;
-        if (len < offset)
-            return EINVAL;
-
-        memcpy (&extlen, buf + offset - 2, 2);
-        offset += htons (extlen); // skips RTP extension header
-    }
-
-    if (len < offset)
-        return EINVAL;
-
-    /* Determines RTP 48-bits counter and SSRC */
-    uint16_t seq = rtp_seq (buf);
-    uint32_t roc = srtp_compute_roc (s, seq), ssrc;
-    memcpy (&ssrc, buf + 8, 4);
-
-    /* Updates ROC and sequence (it's safe now) */
-    int16_t diff = seq - s->rtp_seq;
-    if (diff > 0)
-    {
-        /* Sequence in the future, good */
-        s->rtp.window = s->rtp.window << diff;
-        s->rtp.window |= UINT64_C(1);
-        s->rtp_seq = seq, s->rtp_roc = roc;
-    }
-    else
-    {
-        /* Sequence in the past/present, bad */
-        diff = -diff;
-        if ((diff >= 64) || ((s->rtp.window >> diff) & 1))
-            return EACCES; /* Replay attack */
-        s->rtp.window |= UINT64_C(1) << diff;
-    }
-
-    /* Encrypt/Decrypt */
-    if (s->flags & SRTP_UNENCRYPTED)
-        return 0;
-
-    if (rtp_crypt (s->rtp.cipher, ssrc, roc, seq, s->rtp.salt,
-                   buf + offset, len - offset))
-        return EINVAL;
-
-    return 0;
-}
-
-
-/**
- * Turns a RTP packet into a SRTP packet: encrypt it, then computes
- * the authentication tag and appends it.
- * Note that you can encrypt packet in disorder.
- *
- * @param buf RTP packet to be encrypted/digested
- * @param lenp pointer to the RTP packet length on entry,
- *             set to the SRTP length on exit (undefined on non-ENOSPC error)
- * @param bufsize size (bytes) of the packet buffer
- *
- * @return 0 on success, in case of error:
- *  EINVAL  malformatted RTP packet or internal error
- *  ENOSPC  bufsize is too small to add authentication tag
- *          (<lenp> will hold the required byte size)
- *  EACCES  packet would trigger a replay error on receiver
- */
-int
-srtp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t bufsize)
-{
-    size_t len = *lenp;
-    size_t tag_len;
-    size_t roc_len = 0;
-
-    /* Compute required buffer size */
-    if (len < 12u)
-        return EINVAL;
-
-    if (!(s->flags & SRTP_UNAUTHENTICATED))
-    {
-        tag_len = s->tag_len;
-
-        if (rcc_mode (s))
-        {
-            assert (tag_len >= 4);
-            assert (s->rtp_rcc != 0);
-            if ((rtp_seq (buf) % s->rtp_rcc) == 0)
-            {
-                roc_len = 4;
-                if (rcc_mode (s) == 3)
-                    tag_len = 0; /* RCC mode 3 -> no auth*/
-                else
-                    tag_len -= 4; /* RCC mode 1 or 2 -> auth*/
-            }
-            else
-            {
-                if (rcc_mode (s) & 1)
-                    tag_len = 0; /* RCC mode 1 or 3 -> no auth */
-            }
-        }
-
-        *lenp = len + roc_len + tag_len;
-    }
-    else
-        tag_len = 0;
-
-    if (bufsize < *lenp)
-        return ENOSPC;
-
-    /* Encrypt payload */
-    int val = srtp_crypt (s, buf, len);
-    if (val)
-        return val;
-
-    /* Authenticate payload */
-    if (!(s->flags & SRTP_UNAUTHENTICATED))
-    {
-        uint32_t roc = srtp_compute_roc (s, rtp_seq (buf));
-        const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, roc);
-
-        if (roc_len)
-        {
-            memcpy (buf + len, &(uint32_t){ htonl (s->rtp_roc) }, 4);
-            len += 4;
-        }
-        memcpy (buf + len, tag, tag_len);
-#if 0
-        printf ("Sent    : 0x");
-        for (unsigned i = 0; i < tag_len; i++)
-            printf ("%02x", tag[i]);
-        puts ("");
-#endif
-    }
-
-    return 0;
-}
-
-
-/**
- * Turns a SRTP packet into a RTP packet: authenticates the packet,
- * then decrypts it.
- *
- * @param buf RTP packet to be digested/decrypted
- * @param lenp pointer to the SRTP packet length on entry,
- *             set to the RTP length on exit (undefined in case of error)
- *
- * @return 0 on success, in case of error:
- *  EINVAL  malformatted SRTP packet
- *  EACCES  authentication failed (spoofed packet or out-of-sync)
- */
-int
-srtp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
-{
-    size_t len = *lenp;
-    if (len < 12u)
-        return EINVAL;
-
-    if (!(s->flags & SRTP_UNAUTHENTICATED))
-    {
-        size_t tag_len = s->tag_len, roc_len = 0;
-        if (rcc_mode (s))
-        {
-            if ((rtp_seq (buf) % s->rtp_rcc) == 0)
-            {
-                roc_len = 4;
-                if (rcc_mode (s) == 3)
-                    tag_len = 0;
-                else
-                    tag_len -= 4;
-            }
-            else
-            {
-                if (rcc_mode (s) & 1)
-                    tag_len = 0; // RCC mode 1 or 3: no auth
-            }
-        }
-
-        if (len < (12u + roc_len + tag_len))
-            return EINVAL;
-        len -= roc_len + tag_len;
-
-        uint32_t roc = srtp_compute_roc (s, rtp_seq (buf)), rcc;
-        if (roc_len)
-        {
-            assert (roc_len == 4);
-            memcpy (&rcc, buf + len, 4);
-            rcc = ntohl (rcc);
-        }
-        else
-            rcc = roc;
-
-        const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, rcc);
-#if 0
-        printf ("Computed: 0x");
-        for (unsigned i = 0; i < tag_len; i++)
-            printf ("%02x", tag[i]);
-        printf ("\nReceived: 0x");
-        for (unsigned i = 0; i < tag_len; i++)
-            printf ("%02x", buf[len + roc_len + i]);
-        puts ("");
-#endif
-        if (memcmp (buf + len + roc_len, tag, tag_len))
-            return EACCES;
-
-        if (roc_len)
-        {
-            /* Authenticated packet carried a Roll-Over-Counter */
-            s->rtp_roc += rcc - roc;
-            assert (srtp_compute_roc (s, rtp_seq (buf)) == rcc);
-        }
-        *lenp = len;
-    }
-
-    return srtp_crypt (s, buf, len);
-}
-
-
-/** AES-CM for RTCP (salt = 14 bytes + 2 nul bytes) */
-static int
-rtcp_crypt (gcry_cipher_hd_t hd, uint32_t ssrc, uint32_t index,
-            const uint32_t *salt, uint8_t *data, size_t len)
-{
-    return rtp_crypt (hd, ssrc, index >> 16, index & 0xffff, salt, data, len);
-}
-
-
-/** Message Authentication and Integrity for RTCP */
-static const uint8_t *
-rtcp_digest (gcry_md_hd_t md, const void *data, size_t len)
-{
-    gcry_md_reset (md);
-    gcry_md_write (md, data, len);
-    return gcry_md_read (md, 0);
-}
-
-
-/**
- * Encrypts/decrypts a RTCP packet and updates SRTCP context
- * (CTR block cypher mode of operation has identical encryption and
- * decryption function).
- *
- * @param buf RTCP packet to be en-/decrypted
- * @param len RTCP packet length
- *
- * @return 0 on success, in case of error:
- *  EINVAL  malformatted RTCP packet
- */
-static int srtcp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
-{
-    assert (s != NULL);
-
-    /* 8-bytes unencrypted header, and 4-bytes unencrypted footer */
-    if ((len < 12) || ((buf[0] >> 6) != 2))
-        return EINVAL;
-
-    uint32_t index;
-    memcpy (&index, buf + len, 4);
-    index = ntohl (index);
-    if (((index >> 31) != 0) != ((s->flags & SRTCP_UNENCRYPTED) == 0))
-        return EINVAL; // E-bit mismatch
-
-    index &= ~(1 << 31); // clear E-bit for counter
-
-    /* Updates SRTCP index (safe here) */
-    int32_t diff = index - s->rtcp_index;
-    if (diff > 0)
-    {
-        /* Packet in the future, good */
-        s->rtcp.window = s->rtcp.window << diff;
-        s->rtcp.window |= UINT64_C(1);
-        s->rtcp_index = index;
-    }
-    else
-    {
-        /* Packet in the past/present, bad */
-        diff = -diff;
-        if ((diff >= 64) || ((s->rtcp.window >> diff) & 1))
-            return EACCES; // replay attack!
-        s->rtp.window |= UINT64_C(1) << diff;
-    }
-
-    /* Crypts SRTCP */
-    if (s->flags & SRTCP_UNENCRYPTED)
-        return 0;
-
-    uint32_t ssrc;
-    memcpy (&ssrc, buf + 4, 4);
-
-    if (rtcp_crypt (s->rtcp.cipher, ssrc, index, s->rtp.salt,
-                    buf + 8, len - 8))
-        return EINVAL;
-    return 0;
-}
-
-
-/**
- * Turns a RTCP packet into a SRTCP packet: encrypt it, then computes
- * the authentication tag and appends it.
- *
- * @param buf RTCP packet to be encrypted/digested
- * @param lenp pointer to the RTCP packet length on entry,
- *             set to the SRTCP length on exit (undefined in case of error)
- * @param bufsize size (bytes) of the packet buffer
- *
- * @return 0 on success, in case of error:
- *  EINVAL  malformatted RTCP packet or internal error
- *  ENOSPC  bufsize is too small (to add index and authentication tag)
- */
-int
-srtcp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t bufsize)
-{
-    size_t len = *lenp;
-    if (bufsize < (len + 4 + s->tag_len))
-        return ENOSPC;
-
-    uint32_t index = ++s->rtcp_index;
-    if (index >> 31)
-        s->rtcp_index = index = 0; /* 31-bit wrap */
-
-    if ((s->flags & SRTCP_UNENCRYPTED) == 0)
-        index |= 0x80000000; /* Set Encrypted bit */
-    memcpy (buf + len, &(uint32_t){ htonl (index) }, 4);
-
-    int val = srtcp_crypt (s, buf, len);
-    if (val)
-        return val;
-
-    len += 4; /* Digests SRTCP index too */
-
-    const uint8_t *tag = rtcp_digest (s->rtcp.mac, buf, len);
-    memcpy (buf + len, tag, s->tag_len);
-    *lenp = len + s->tag_len;
-    return 0;
-}
-
-
-/**
- * Turns a SRTCP packet into a RTCP packet: authenticates the packet,
- * then decrypts it.
- *
- * @param buf RTCP packet to be digested/decrypted
- * @param lenp pointer to the SRTCP packet length on entry,
- *             set to the RTCP length on exit (undefined in case of error)
- *
- * @return 0 on success, in case of error:
- *  EINVAL  malformatted SRTCP packet
- *  EACCES  authentication failed (spoofed packet or out-of-sync)
- */
-int
-srtcp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
-{
-    size_t len = *lenp;
-
-    if (len < (4u + s->tag_len))
-        return EINVAL;
-    len -= s->tag_len;
-
-    const uint8_t *tag = rtcp_digest (s->rtcp.mac, buf, len);
-    if (memcmp (buf + len, tag, s->tag_len))
-        return EACCES;
-
-    len -= 4; /* Remove SRTCP index before decryption */
-    *lenp = len;
-    return srtcp_crypt (s, buf, len);
-}
\ No newline at end of file
diff --git a/plugins/crypto-vala/src/srtp.h b/plugins/crypto-vala/src/srtp.h
deleted file mode 100644
index abca6988..00000000
--- a/plugins/crypto-vala/src/srtp.h
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Secure RTP with libgcrypt
- * Copyright (C) 2007  Rémi Denis-Courmont
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public License
- * as published by the Free Software Foundation; either version 2.1
- * of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- ****************************************************************************/
-
-#ifndef LIBVLC_SRTP_H
-# define LIBVLC_SRTP_H 1
-#include <stdint.h>
-
-typedef struct srtp_session_t srtp_session_t;
-
-enum
-{
-    SRTP_UNENCRYPTED=0x1,   //< do not encrypt SRTP packets
-    SRTCP_UNENCRYPTED=0x2,  //< do not encrypt SRTCP packets
-    SRTP_UNAUTHENTICATED=0x4, //< authenticate only SRTCP packets
-
-    SRTP_RCC_MODE1=0x10,    //< use Roll-over-Counter Carry mode 1
-    SRTP_RCC_MODE2=0x20,    //< use Roll-over-Counter Carry mode 2
-    SRTP_RCC_MODE3=0x30,    //< use Roll-over-Counter Carry mode 3 (insecure)
-
-    SRTP_FLAGS_MASK=0x37    //< mask for valid flags
-};
-
-/** SRTP encryption algorithms (ciphers); same values as MIKEY */
-enum
-{
-    SRTP_ENCR_NULL=0,   //< no encryption
-    SRTP_ENCR_AES_CM=1, //< AES counter mode
-    SRTP_ENCR_AES_F8=2, //< AES F8 mode (not implemented)
-};
-
-/** SRTP authenticaton algorithms; same values as MIKEY */
-enum
-{
-    SRTP_AUTH_NULL=0,      //< no authentication code
-    SRTP_AUTH_HMAC_SHA1=1, //< HMAC-SHA1
-};
-
-/** SRTP pseudo random function; same values as MIKEY */
-enum
-{
-    SRTP_PRF_AES_CM=0, //< AES counter mode
-};
-
-# ifdef __cplusplus
-extern "C" {
-# endif
-
-srtp_session_t *srtp_create (int encr, int auth, unsigned tag_len, int prf,
-                             unsigned flags);
-void srtp_destroy (srtp_session_t *s);
-
-int srtp_setkey (srtp_session_t *s, const void *key, size_t keylen,
-                 const void *salt, size_t saltlen);
-int srtp_setkeystring (srtp_session_t *s, const char *key, const char *salt);
-
-void srtp_setrcc_rate (srtp_session_t *s, uint16_t rate);
-
-int srtp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t maxsize);
-int srtp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp);
-int srtcp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t maxsiz);
-int srtcp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp);
-
-# ifdef __cplusplus
-}
-# endif
-#endif
\ No newline at end of file
diff --git a/plugins/crypto-vala/src/srtp.vala b/plugins/crypto-vala/src/srtp.vala
new file mode 100644
index 00000000..77b5acde
--- /dev/null
+++ b/plugins/crypto-vala/src/srtp.vala
@@ -0,0 +1,122 @@
+using Srtp;
+
+public class Crypto.Srtp {
+    public const string AES_CM_128_HMAC_SHA1_80 = "AES_CM_128_HMAC_SHA1_80";
+    public const string AES_CM_128_HMAC_SHA1_32 = "AES_CM_128_HMAC_SHA1_32";
+    public const string F8_128_HMAC_SHA1_80 = "F8_128_HMAC_SHA1_80";
+
+    public class Session {
+        public bool has_encrypt { get; private set; }
+        public bool has_decrypt { get; private set; }
+
+        private Context encrypt_context;
+        private Context decrypt_context;
+
+        static construct {
+            init();
+            install_log_handler(log);
+        }
+
+        private static void log(LogLevel level, string msg) {
+            print(@"SRTP[$level]: $msg\n");
+        }
+
+        public Session() {
+            Context.create(out encrypt_context, null);
+            Context.create(out decrypt_context, null);
+        }
+
+        public uint8[] encrypt_rtp(uint8[] data) throws Error {
+            uint8[] buf = new uint8[data.length + MAX_TRAILER_LEN];
+            Memory.copy(buf, data, data.length);
+            int buf_use = data.length;
+            ErrorStatus res = encrypt_context.protect(buf, ref buf_use);
+            if (res != ErrorStatus.ok) {
+                throw new Error.UNKNOWN(@"SRTP encrypt failed: $res");
+            }
+            uint8[] ret = new uint8[buf_use];
+            GLib.Memory.copy(ret, buf, buf_use);
+            return ret;
+        }
+
+        public uint8[] decrypt_rtp(uint8[] data) throws Error {
+            uint8[] buf = new uint8[data.length];
+            Memory.copy(buf, data, data.length);
+            int buf_use = data.length;
+            ErrorStatus res = decrypt_context.unprotect(buf, ref buf_use);
+            switch (res) {
+                case ErrorStatus.auth_fail:
+                    throw new Error.AUTHENTICATION_FAILED("SRTP packet failed the message authentication check");
+                case ErrorStatus.ok:
+                    break;
+                default:
+                    throw new Error.UNKNOWN(@"SRTP decrypt failed: $res");
+            }
+            uint8[] ret = new uint8[buf_use];
+            GLib.Memory.copy(ret, buf, buf_use);
+            return ret;
+        }
+
+        public uint8[] encrypt_rtcp(uint8[] data) throws Error {
+            uint8[] buf = new uint8[data.length + MAX_TRAILER_LEN + 4];
+            Memory.copy(buf, data, data.length);
+            int buf_use = data.length;
+            ErrorStatus res = encrypt_context.protect_rtcp(buf, ref buf_use);
+            if (res != ErrorStatus.ok) {
+                throw new Error.UNKNOWN(@"SRTCP encrypt failed: $res");
+            }
+            uint8[] ret = new uint8[buf_use];
+            GLib.Memory.copy(ret, buf, buf_use);
+            return ret;
+        }
+
+        public uint8[] decrypt_rtcp(uint8[] data) throws Error {
+            uint8[] buf = new uint8[data.length];
+            Memory.copy(buf, data, data.length);
+            int buf_use = data.length;
+            ErrorStatus res = decrypt_context.unprotect_rtcp(buf, ref buf_use);
+            switch (res) {
+                case ErrorStatus.auth_fail:
+                    throw new Error.AUTHENTICATION_FAILED("SRTCP packet failed the message authentication check");
+                case ErrorStatus.ok:
+                    break;
+                default:
+                    throw new Error.UNKNOWN(@"SRTP decrypt failed: $res");
+            }
+            uint8[] ret = new uint8[buf_use];
+            GLib.Memory.copy(ret, buf, buf_use);
+            return ret;
+        }
+
+        private Policy create_policy(string profile) {
+            Policy policy = Policy();
+            switch (profile) {
+                case AES_CM_128_HMAC_SHA1_80:
+                    policy.rtp.set_aes_cm_128_hmac_sha1_80();
+                    policy.rtcp.set_aes_cm_128_hmac_sha1_80();
+                    break;
+            }
+            return policy;
+        }
+
+        public void set_encryption_key(string profile, uint8[] key, uint8[] salt) {
+            Policy policy = create_policy(profile);
+            policy.ssrc.type = SsrcType.any_outbound;
+            policy.key = new uint8[key.length + salt.length];
+            Memory.copy(policy.key, key, key.length);
+            Memory.copy(((uint8*)policy.key) + key.length, salt, salt.length);
+            encrypt_context.add_stream(ref policy);
+            has_encrypt = true;
+        }
+
+        public void set_decryption_key(string profile, uint8[] key, uint8[] salt) {
+            Policy policy = create_policy(profile);
+            policy.ssrc.type = SsrcType.any_inbound;
+            policy.key = new uint8[key.length + salt.length];
+            Memory.copy(policy.key, key, key.length);
+            Memory.copy(((uint8*)policy.key) + key.length, salt, salt.length);
+            decrypt_context.add_stream(ref policy);
+            has_decrypt = true;
+        }
+    }
+}
\ No newline at end of file
diff --git a/plugins/crypto-vala/src/srtp.vapi b/plugins/crypto-vala/src/srtp.vapi
deleted file mode 100644
index 0fe825c3..00000000
--- a/plugins/crypto-vala/src/srtp.vapi
+++ /dev/null
@@ -1,107 +0,0 @@
-[CCode (cheader_filename="srtp.h")]
-namespace Crypto.Srtp {
-
-[Compact]
-[CCode (cname = "srtp_session_t", free_function = "srtp_destroy")]
-public class Session {
-    [CCode (cname = "srtp_create")]
-    public Session(Encryption encr, Authentication auth, uint tag_len, Prf prf, Flags flags);
-    [CCode (cname = "srtp_setkey")]
-    public int setkey(uint8[] key, uint8[] salt);
-    [CCode (cname = "srtp_setkeystring")]
-    public int setkeystring(string key, string salt);
-    [CCode (cname = "srtp_setrcc_rate")]
-    public void setrcc_rate(uint16 rate);
-
-    [CCode (cname = "srtp_send")]
-    private int rtp_send([CCode (array_length = false)] uint8[] buf, ref size_t len, size_t maxsize);
-    [CCode (cname = "srtcp_send")]
-    private int rtcp_send([CCode (array_length = false)] uint8[] buf, ref size_t len, size_t maxsize);
-    [CCode (cname = "srtp_recv")]
-    private int rtp_recv([CCode (array_length = false)] uint8[] buf, ref size_t len);
-    [CCode (cname = "srtcp_recv")]
-    private int rtcp_recv([CCode (array_length = false)] uint8[] buf, ref size_t len);
-
-    public uint8[] encrypt_rtp(uint8[] input, uint tag_len = 10) throws GLib.Error {
-        uint8[] buf = new uint8[input.length + tag_len];
-        GLib.Memory.copy(buf, input, input.length);
-        size_t buf_use = input.length;
-        int res = rtp_send(buf, ref buf_use, buf.length);
-        if (res != 0) {
-            throw new GLib.Error(-1, res, "RTP encrypt failed");
-        }
-        uint8[] ret = new uint8[buf_use];
-        GLib.Memory.copy(ret, buf, buf_use);
-        return ret;
-    }
-
-    public uint8[] encrypt_rtcp(uint8[] input, uint tag_len = 10) throws GLib.Error {
-        uint8[] buf = new uint8[input.length + tag_len + 4];
-        GLib.Memory.copy(buf, input, input.length);
-        size_t buf_use = input.length;
-        int res = rtcp_send(buf, ref buf_use, buf.length);
-        if (res != 0) {
-            throw new GLib.Error(-1, res, "RTCP encrypt failed");
-        }
-        uint8[] ret = new uint8[buf_use];
-        GLib.Memory.copy(ret, buf, buf_use);
-        return ret;
-    }
-
-    public uint8[] decrypt_rtp(uint8[] input) throws GLib.Error {
-        uint8[] buf = new uint8[input.length];
-        GLib.Memory.copy(buf, input, input.length);
-        size_t buf_use = input.length;
-        int res = rtp_recv(buf, ref buf_use);
-        if (res != 0) {
-            throw new GLib.Error(-1, res, "RTP decrypt failed");
-        }
-        uint8[] ret = new uint8[buf_use];
-        GLib.Memory.copy(ret, buf, buf_use);
-        return ret;
-    }
-
-    public uint8[] decrypt_rtcp(uint8[] input) throws GLib.Error {
-        uint8[] buf = new uint8[input.length];
-        GLib.Memory.copy(buf, input, input.length);
-        size_t buf_use = input.length;
-        int res = rtcp_recv(buf, ref buf_use);
-        if (res != 0) {
-            throw new GLib.Error(-1, res, "RTCP decrypt failed");
-        }
-        uint8[] ret = new uint8[buf_use];
-        GLib.Memory.copy(ret, buf, buf_use);
-        return ret;
-    }
-}
-
-[Flags]
-[CCode (cname = "unsigned", cprefix = "", has_type_id = false)]
-public enum Flags {
-    SRTP_UNENCRYPTED,
-    SRTCP_UNENCRYPTED,
-    SRTP_UNAUTHENTICATED,
-    SRTP_RCC_MODE1,
-    SRTP_RCC_MODE2,
-    SRTP_RCC_MODE3
-}
-
-[CCode (cname = "int", cprefix = "SRTP_ENCR_", has_type_id = false)]
-public enum Encryption {
-    NULL,
-    AES_CM,
-    AES_F8
-}
-
-[CCode (cname = "int", cprefix = "SRTP_AUTH_", has_type_id = false)]
-public enum Authentication {
-    NULL,
-    HMAC_SHA1
-}
-
-[CCode (cname = "int", cprefix = "SRTP_PRF_", has_type_id = false)]
-public enum Prf {
-    AES_CM
-}
-
-}
\ No newline at end of file
diff --git a/plugins/crypto-vala/vapi/libsrtp2.vapi b/plugins/crypto-vala/vapi/libsrtp2.vapi
new file mode 100644
index 00000000..5ceedced
--- /dev/null
+++ b/plugins/crypto-vala/vapi/libsrtp2.vapi
@@ -0,0 +1,115 @@
+[CCode (cheader_filename = "srtp2/srtp.h")]
+namespace Srtp {
+public const uint MAX_TRAILER_LEN;
+
+public static ErrorStatus init();
+public static ErrorStatus shutdown();
+
+[Compact]
+[CCode (cname = "srtp_ctx_t", cprefix = "srtp_", free_function = "srtp_dealloc")]
+public class Context {
+    public static ErrorStatus create(out Context session, Policy? policy);
+
+    public ErrorStatus protect([CCode (type = "void*", array_length = false)] uint8[] rtp, ref int len);
+    public ErrorStatus unprotect([CCode (type = "void*", array_length = false)] uint8[] rtp, ref int len);
+
+    public ErrorStatus protect_rtcp([CCode (type = "void*", array_length = false)] uint8[] rtcp, ref int len);
+    public ErrorStatus unprotect_rtcp([CCode (type = "void*", array_length = false)] uint8[] rtcp, ref int len);
+
+    public ErrorStatus add_stream(ref Policy policy);
+    public ErrorStatus update_stream(ref Policy policy);
+    public ErrorStatus remove_stream(uint ssrc);
+    public ErrorStatus update(ref Policy policy);
+}
+
+[CCode (cname = "srtp_ssrc_t")]
+public struct Ssrc {
+    public SsrcType type;
+    public uint value;
+}
+
+[CCode (cname = "srtp_ssrc_type_t", cprefix = "ssrc_")]
+public enum SsrcType {
+    undefined, specific, any_inbound, any_outbound
+}
+
+[CCode (cname = "srtp_policy_t", destroy_function = "")]
+public struct Policy {
+    public Ssrc ssrc;
+    public CryptoPolicy rtp;
+    public CryptoPolicy rtcp;
+    [CCode (array_length = false)]
+    public uint8[] key;
+    public ulong num_master_keys;
+    public ulong window_size;
+    public int allow_repeat_tx;
+    [CCode (array_length_cname = "enc_xtn_hdr_count")]
+    public int[] enc_xtn_hdr;
+}
+
+[CCode (cname = "srtp_crypto_policy_t")]
+public struct CryptoPolicy {
+    public CipherType cipher_type;
+    public int cipher_key_len;
+    public AuthType auth_type;
+    public int auth_key_len;
+    public int auth_tag_len;
+    public SecurityServices sec_serv;
+
+    public void set_aes_cm_128_hmac_sha1_80();
+    public void set_aes_cm_128_hmac_sha1_32();
+    public void set_aes_cm_128_null_auth();
+    public void set_aes_cm_192_hmac_sha1_32();
+    public void set_aes_cm_192_hmac_sha1_80();
+    public void set_aes_cm_192_null_auth();
+    public void set_aes_cm_256_hmac_sha1_32();
+    public void set_aes_cm_256_hmac_sha1_80();
+    public void set_aes_cm_256_null_auth();
+    public void set_aes_gcm_128_16_auth();
+    public void set_aes_gcm_128_8_auth();
+    public void set_aes_gcm_128_8_only_auth();
+    public void set_aes_gcm_256_16_auth();
+    public void set_aes_gcm_256_8_auth();
+    public void set_aes_gcm_256_8_only_auth();
+    public void set_null_cipher_hmac_null();
+    public void set_null_cipher_hmac_sha1_80();
+
+    public void set_rtp_default();
+    public void set_rtcp_default();
+
+    public void set_from_profile_for_rtp(Profile profile);
+    public void set_from_profile_for_rtcp(Profile profile);
+}
+
+[CCode (cname = "srtp_profile_t", cprefix = "srtp_profile_")]
+public enum Profile {
+    reserved, aes128_cm_sha1_80, aes128_cm_sha1_32, null_sha1_80, null_sha1_32, aead_aes_128_gcm, aead_aes_256_gcm
+}
+
+[CCode (cname = "srtp_cipher_type_id_t")]
+public struct CipherType : uint32 {}
+
+[CCode (cname = "srtp_auth_type_id_t")]
+public struct AuthType : uint32 {}
+
+[CCode (cname = "srtp_sec_serv_t", cprefix = "sec_serv_")]
+public enum SecurityServices {
+    none, conf, auth, conf_and_auth;
+}
+
+[CCode (cname = "srtp_err_status_t", cprefix = "srtp_err_status_", has_type_id = false)]
+public enum ErrorStatus {
+    ok, fail, bad_param, alloc_fail, dealloc_fail, init_fail, terminus, auth_fail, cipher_fail, replay_fail, algo_fail, no_such_op, no_ctx, cant_check, key_expired, socket_err, signal_err, nonce_bad, encode_err, semaphore_err, pfkey_err, bad_mki, pkt_idx_old, pkt_idx_adv
+}
+
+[CCode (cname = "srtp_log_level_t", cprefix = "srtp_log_level_", has_type_id = false)]
+public enum LogLevel {
+    error, warning, info, debug
+}
+
+[CCode (cname = "srtp_log_handler_func_t")]
+public delegate void LogHandler(LogLevel level, string msg);
+
+public static ErrorStatus install_log_handler(LogHandler func);
+
+}
\ No newline at end of file
diff --git a/plugins/ice/CMakeLists.txt b/plugins/ice/CMakeLists.txt
index 38025aa0..392a202f 100644
--- a/plugins/ice/CMakeLists.txt
+++ b/plugins/ice/CMakeLists.txt
@@ -20,7 +20,7 @@ CUSTOM_VAPIS
     ${CMAKE_BINARY_DIR}/exports/xmpp-vala.vapi
     ${CMAKE_BINARY_DIR}/exports/dino.vapi
     ${CMAKE_BINARY_DIR}/exports/qlite.vapi
-    ${CMAKE_BINARY_DIR}/exports/crypto.vapi
+    ${CMAKE_BINARY_DIR}/exports/crypto-vala.vapi
 PACKAGES
     ${ICE_PACKAGES}
 OPTIONS
diff --git a/plugins/ice/src/dtls_srtp.vala b/plugins/ice/src/dtls_srtp.vala
index a21c242b..b742ccab 100644
--- a/plugins/ice/src/dtls_srtp.vala
+++ b/plugins/ice/src/dtls_srtp.vala
@@ -12,8 +12,7 @@ public class DtlsSrtp {
     private uint pull_timeout = uint.MAX;
     private string peer_fingerprint;
 
-    private Crypto.Srtp.Session encrypt_session;
-    private Crypto.Srtp.Session decrypt_session;
+    private Crypto.Srtp.Session srtp_session = new Crypto.Srtp.Session();
 
     public static DtlsSrtp setup() throws GLib.Error {
         var obj = new DtlsSrtp();
@@ -30,9 +29,19 @@ public class DtlsSrtp {
     }
 
     public uint8[] process_incoming_data(uint component_id, uint8[] data) {
-        if (decrypt_session != null) {
-            if (component_id == 1) return decrypt_session.decrypt_rtp(data);
-            if (component_id == 2) return decrypt_session.decrypt_rtcp(data);
+        if (srtp_session.has_decrypt) {
+            try {
+                if (component_id == 1) {
+                    if (data.length >= 2 && data[1] >= 192 && data[1] < 224) {
+                        return srtp_session.decrypt_rtcp(data);
+                    }
+                    return srtp_session.decrypt_rtp(data);
+                }
+                if (component_id == 2) return srtp_session.decrypt_rtcp(data);
+            } catch (Error e) {
+                warning("%s (%d)", e.message, e.code);
+                return null;
+            }
         } else if (component_id == 1) {
             on_data_rec(data);
         }
@@ -40,9 +49,19 @@ public class DtlsSrtp {
     }
 
     public uint8[] process_outgoing_data(uint component_id, uint8[] data) {
-        if (encrypt_session != null) {
-            if (component_id == 1) return encrypt_session.encrypt_rtp(data);
-            if (component_id == 2) return encrypt_session.encrypt_rtcp(data);
+        if (srtp_session.has_encrypt) {
+            try {
+                if (component_id == 1) {
+                    if (data.length >= 2 && data[1] >= 192 && data[1] < 224) {
+                        return srtp_session.encrypt_rtcp(data);
+                    }
+                    return srtp_session.encrypt_rtp(data);
+                }
+                if (component_id == 2) return srtp_session.encrypt_rtcp(data);
+            } catch (Error e) {
+                warning("%s (%d)", e.message, e.code);
+                return null;
+            }
         }
         return null;
     }
@@ -123,19 +142,13 @@ public class DtlsSrtp {
             warning("SRTP client/server key/salt null");
         }
 
-        Crypto.Srtp.Session encrypt_session = new Crypto.Srtp.Session(Crypto.Srtp.Encryption.AES_CM, Crypto.Srtp.Authentication.HMAC_SHA1, 10, Crypto.Srtp.Prf.AES_CM, 0);
-        Crypto.Srtp.Session decrypt_session = new Crypto.Srtp.Session(Crypto.Srtp.Encryption.AES_CM, Crypto.Srtp.Authentication.HMAC_SHA1, 10, Crypto.Srtp.Prf.AES_CM, 0);
-
         if (server) {
-            encrypt_session.setkey(server_key.extract(), server_salt.extract());
-            decrypt_session.setkey(client_key.extract(), client_salt.extract());
+            srtp_session.set_encryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key.extract(), server_salt.extract());
+            srtp_session.set_decryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key.extract(), client_salt.extract());
         } else {
-            encrypt_session.setkey(client_key.extract(), client_salt.extract());
-            decrypt_session.setkey(server_key.extract(), server_salt.extract());
+            srtp_session.set_encryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key.extract(), client_salt.extract());
+            srtp_session.set_decryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key.extract(), server_salt.extract());
         }
-
-        this.encrypt_session = (owned)encrypt_session;
-        this.decrypt_session = (owned)decrypt_session;
     }
 
     private static ssize_t pull_function(void* transport_ptr, uint8[] buffer) {
diff --git a/plugins/rtp/CMakeLists.txt b/plugins/rtp/CMakeLists.txt
index 8ce2a7c6..c6888459 100644
--- a/plugins/rtp/CMakeLists.txt
+++ b/plugins/rtp/CMakeLists.txt
@@ -19,7 +19,7 @@ SOURCES
     src/video_widget.vala
     src/register_plugin.vala
 CUSTOM_VAPIS
-    ${CMAKE_BINARY_DIR}/exports/crypto.vapi
+    ${CMAKE_BINARY_DIR}/exports/crypto-vala.vapi
     ${CMAKE_BINARY_DIR}/exports/xmpp-vala.vapi
     ${CMAKE_BINARY_DIR}/exports/dino.vapi
     ${CMAKE_BINARY_DIR}/exports/qlite.vapi
diff --git a/plugins/rtp/src/stream.vala b/plugins/rtp/src/stream.vala
index 77080a09..bedd6f8a 100644
--- a/plugins/rtp/src/stream.vala
+++ b/plugins/rtp/src/stream.vala
@@ -53,8 +53,7 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
     private Gst.Pad send_rtp_sink_pad;
     private Gst.Pad send_rtp_src_pad;
 
-    private Crypto.Srtp.Session? local_crypto_session;
-    private Crypto.Srtp.Session? remote_crypto_session;
+    private Crypto.Srtp.Session? crypto_session = new Crypto.Srtp.Session();
 
     public Stream(Plugin plugin, Xmpp.Xep.Jingle.Content content) {
         base(content);
@@ -148,15 +147,8 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
     }
 
     private void prepare_local_crypto() {
-        if (local_crypto != null && local_crypto_session == null) {
-            local_crypto_session = new Crypto.Srtp.Session(
-                    local_crypto.crypto_suite == Xep.JingleRtp.Crypto.F8_128_HMAC_SHA1_80 ? Crypto.Srtp.Encryption.AES_F8 : Crypto.Srtp.Encryption.AES_CM,
-                    Crypto.Srtp.Authentication.HMAC_SHA1,
-                    local_crypto.crypto_suite == Xep.JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_32 ? 4 : 10,
-                    Crypto.Srtp.Prf.AES_CM,
-                    0
-            );
-            local_crypto_session.setkey(local_crypto.key, local_crypto.salt);
+        if (local_crypto != null && !crypto_session.has_encrypt) {
+            crypto_session.set_encryption_key(local_crypto.crypto_suite, local_crypto.key, local_crypto.salt);
             debug("Setting up encryption with key params %s", local_crypto.key_params);
         }
     }
@@ -172,15 +164,19 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
         buffer.extract_dup(0, buffer.get_size(), out data);
         prepare_local_crypto();
         if (sink == send_rtp) {
-            if (local_crypto_session != null) {
-                data = local_crypto_session.encrypt_rtp(data, local_crypto.crypto_suite == Xep.JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_32 ? 4 : 10);
+            if (crypto_session.has_encrypt) {
+                data = crypto_session.encrypt_rtp(data);
             }
             on_send_rtp_data(new Bytes.take(data));
         } else if (sink == send_rtcp) {
-            if (local_crypto_session != null) {
-                data = local_crypto_session.encrypt_rtcp(data, local_crypto.crypto_suite == Xep.JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_32 ? 4 : 10);
+            if (crypto_session.has_encrypt) {
+                data = crypto_session.encrypt_rtcp(data);
+            }
+            if (rtcp_mux) {
+                on_send_rtp_data(new Bytes.take(data));
+            } else {
+                on_send_rtcp_data(new Bytes.take(data));
             }
-            on_send_rtcp_data(new Bytes.take(data));
         } else {
             warning("unknown sample");
         }
@@ -283,25 +279,22 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
     }
 
     private void prepare_remote_crypto() {
-        if (remote_crypto != null && remote_crypto_session == null) {
-            remote_crypto_session = new Crypto.Srtp.Session(
-                    remote_crypto.crypto_suite == Xep.JingleRtp.Crypto.F8_128_HMAC_SHA1_80 ? Crypto.Srtp.Encryption.AES_F8 : Crypto.Srtp.Encryption.AES_CM,
-                    Crypto.Srtp.Authentication.HMAC_SHA1,
-                    remote_crypto.crypto_suite == Xep.JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_32 ? 4 : 10,
-                    Crypto.Srtp.Prf.AES_CM,
-                    0
-            );
-            remote_crypto_session.setkey(remote_crypto.key, remote_crypto.salt);
+        if (remote_crypto != null && crypto_session.has_decrypt) {
+            crypto_session.set_decryption_key(remote_crypto.crypto_suite, remote_crypto.key, remote_crypto.salt);
             debug("Setting up decryption with key params %s", remote_crypto.key_params);
         }
     }
 
     public override void on_recv_rtp_data(Bytes bytes) {
+        if (rtcp_mux && bytes.length >= 2 && bytes.get(1) >= 192 && bytes.get(1) < 224) {
+            on_recv_rtcp_data(bytes);
+            return;
+        }
         prepare_remote_crypto();
         uint8[] data = bytes.get_data();
-        if (remote_crypto_session != null) {
+        if (crypto_session.has_decrypt) {
             try {
-                data = remote_crypto_session.decrypt_rtp(data);
+                data = crypto_session.decrypt_rtp(data);
             } catch (Error e) {
                 warning("%s (%d)", e.message, e.code);
             }
@@ -314,9 +307,9 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
     public override void on_recv_rtcp_data(Bytes bytes) {
         prepare_remote_crypto();
         uint8[] data = bytes.get_data();
-        if (remote_crypto_session != null) {
+        if (crypto_session.has_decrypt) {
             try {
-                data = remote_crypto_session.decrypt_rtcp(data);
+                data = crypto_session.decrypt_rtcp(data);
             } catch (Error e) {
                 warning("%s (%d)", e.message, e.code);
             }
-- 
cgit v1.2.3-70-g09d2


From 4edab3c8d63b327dcb48799e174a3e00192721ec Mon Sep 17 00:00:00 2001
From: Marvin W <git@larma.de>
Date: Sun, 11 Apr 2021 15:12:53 +0200
Subject: Fix custom vapi integration

---
 plugins/crypto-vala/CMakeLists.txt |  6 ++----
 plugins/ice/CMakeLists.txt         | 10 +++++-----
 plugins/omemo/CMakeLists.txt       |  7 +++----
 plugins/rtp/CMakeLists.txt         |  2 --
 4 files changed, 10 insertions(+), 15 deletions(-)

(limited to 'plugins/ice/CMakeLists.txt')

diff --git a/plugins/crypto-vala/CMakeLists.txt b/plugins/crypto-vala/CMakeLists.txt
index 4a8da241..f615854c 100644
--- a/plugins/crypto-vala/CMakeLists.txt
+++ b/plugins/crypto-vala/CMakeLists.txt
@@ -1,9 +1,9 @@
 find_package(GCrypt REQUIRED)
+find_package(Srtp2 REQUIRED)
 find_packages(CRYPTO_VALA_PACKAGES REQUIRED
     GLib
     GObject
     GIO
-    Srtp2
 )
 
 vala_precompile(CRYPTO_VALA_C
@@ -18,8 +18,6 @@ CUSTOM_VAPIS
     "${CMAKE_CURRENT_SOURCE_DIR}/vapi/libsrtp2.vapi"
 PACKAGES
     ${CRYPTO_VALA_PACKAGES}
-OPTIONS
-    --vapidir=${CMAKE_CURRENT_SOURCE_DIR}/vapi
 GENERATE_VAPI
     crypto-vala
 GENERATE_HEADER
@@ -29,6 +27,6 @@ GENERATE_HEADER
 set(CFLAGS ${VALA_CFLAGS})
 add_definitions(${CFLAGS})
 add_library(crypto-vala STATIC ${CRYPTO_VALA_C})
-target_link_libraries(crypto-vala ${CRYPTO_VALA_PACKAGES} gcrypt)
+target_link_libraries(crypto-vala ${CRYPTO_VALA_PACKAGES} gcrypt libsrtp2)
 set_property(TARGET crypto-vala PROPERTY POSITION_INDEPENDENT_CODE ON)
 
diff --git a/plugins/ice/CMakeLists.txt b/plugins/ice/CMakeLists.txt
index 392a202f..b18bfcc5 100644
--- a/plugins/ice/CMakeLists.txt
+++ b/plugins/ice/CMakeLists.txt
@@ -1,11 +1,11 @@
+find_package(Nice REQUIRED)
+find_package(GnuTLS REQUIRED)
 find_packages(ICE_PACKAGES REQUIRED
     Gee
     GLib
     GModule
-    GnuTLS
     GObject
     GTK3
-    Nice
 )
 
 vala_precompile(ICE_VALA_C
@@ -21,15 +21,15 @@ CUSTOM_VAPIS
     ${CMAKE_BINARY_DIR}/exports/dino.vapi
     ${CMAKE_BINARY_DIR}/exports/qlite.vapi
     ${CMAKE_BINARY_DIR}/exports/crypto-vala.vapi
+    ${CMAKE_CURRENT_SOURCE_DIR}/vapi/nice.vapi
+    ${CMAKE_CURRENT_SOURCE_DIR}/vapi/gnutls.vapi
 PACKAGES
     ${ICE_PACKAGES}
-OPTIONS
-    --vapidir=${CMAKE_CURRENT_SOURCE_DIR}/vapi
 )
 
 add_definitions(${VALA_CFLAGS} -DG_LOG_DOMAIN="ice")
 add_library(ice SHARED ${ICE_VALA_C})
-target_link_libraries(ice libdino crypto-vala ${ICE_PACKAGES})
+target_link_libraries(ice libdino crypto-vala ${ICE_PACKAGES} nice gnutls)
 set_target_properties(ice PROPERTIES PREFIX "")
 set_target_properties(ice PROPERTIES LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/plugins/)
 
diff --git a/plugins/omemo/CMakeLists.txt b/plugins/omemo/CMakeLists.txt
index 0f5a1521..c7a45069 100644
--- a/plugins/omemo/CMakeLists.txt
+++ b/plugins/omemo/CMakeLists.txt
@@ -3,13 +3,13 @@ find_package(Gettext)
 include(${GETTEXT_USE_FILE})
 gettext_compile(${GETTEXT_PACKAGE} SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/po TARGET_NAME ${GETTEXT_PACKAGE}-translations)
 
+find_package(Qrencode REQUIRED)
 find_packages(OMEMO_PACKAGES REQUIRED
     Gee
     GLib
     GModule
     GObject
     GTK3
-    Qrencode
 )
 
 set(RESOURCE_LIST
@@ -66,18 +66,17 @@ CUSTOM_VAPIS
     ${CMAKE_BINARY_DIR}/exports/xmpp-vala.vapi
     ${CMAKE_BINARY_DIR}/exports/qlite.vapi
     ${CMAKE_BINARY_DIR}/exports/dino.vapi
+    ${CMAKE_CURRENT_SOURCE_DIR}/vapi/libqrencode.vapi
 PACKAGES
     ${OMEMO_PACKAGES}
 GRESOURCES
     ${OMEMO_GRESOURCES_XML}
-OPTIONS
-    --vapidir=${CMAKE_CURRENT_SOURCE_DIR}/vapi
 )
 
 add_definitions(${VALA_CFLAGS} -DGETTEXT_PACKAGE=\"${GETTEXT_PACKAGE}\" -DLOCALE_INSTALL_DIR=\"${LOCALE_INSTALL_DIR}\"  -DG_LOG_DOMAIN="OMEMO")
 add_library(omemo SHARED ${OMEMO_VALA_C} ${OMEMO_GRESOURCES_TARGET})
 add_dependencies(omemo ${GETTEXT_PACKAGE}-translations)
-target_link_libraries(omemo libdino signal-protocol-vala crypto-vala ${OMEMO_PACKAGES})
+target_link_libraries(omemo libdino signal-protocol-vala crypto-vala ${OMEMO_PACKAGES} libqrencode)
 set_target_properties(omemo PROPERTIES PREFIX "")
 set_target_properties(omemo PROPERTIES LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/plugins/)
 
diff --git a/plugins/rtp/CMakeLists.txt b/plugins/rtp/CMakeLists.txt
index 0925ff0c..76d6e66d 100644
--- a/plugins/rtp/CMakeLists.txt
+++ b/plugins/rtp/CMakeLists.txt
@@ -31,8 +31,6 @@ PACKAGES
     ${RTP_PACKAGES}
 DEFINITIONS
     ${RTP_DEFINITIONS}
-OPTIONS
-    --vapidir=${CMAKE_CURRENT_SOURCE_DIR}/vapi
 )
 
 add_definitions(${VALA_CFLAGS} -DG_LOG_DOMAIN="rtp" -I${CMAKE_CURRENT_SOURCE_DIR}/src)
-- 
cgit v1.2.3-70-g09d2


From 2bee82f0b6b1d7fb64c7c446257037ba17129baa Mon Sep 17 00:00:00 2001
From: Marvin W <git@larma.de>
Date: Mon, 12 Apr 2021 18:05:55 +0200
Subject: ICE: Require libnice 0.1.15 or newer

---
 plugins/ice/CMakeLists.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'plugins/ice/CMakeLists.txt')

diff --git a/plugins/ice/CMakeLists.txt b/plugins/ice/CMakeLists.txt
index b18bfcc5..4783cea6 100644
--- a/plugins/ice/CMakeLists.txt
+++ b/plugins/ice/CMakeLists.txt
@@ -1,4 +1,4 @@
-find_package(Nice REQUIRED)
+find_package(Nice 0.1.15 REQUIRED)
 find_package(GnuTLS REQUIRED)
 find_packages(ICE_PACKAGES REQUIRED
     Gee
-- 
cgit v1.2.3-70-g09d2