Merge pull request #317 from mofeng-git/dev

Dev

.github/workflows/build.yml

@@ -0,0 +1,189 @@
+name: Build
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      publish_release:
+        description: Publish GitHub Release
+        required: false
+        default: false
+        type: boolean
+      release_tag:
+        description: Release tag name when publishing
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  frontend:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Build frontend
+        working-directory: web
+        run: |
+          npm install
+          npm run build
+
+      - name: Upload frontend dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: web-dist
+          path: web/dist
+          if-no-files-found: error
+          retention-days: 7
+
+  deb:
+    runs-on: ubuntu-22.04
+    needs: frontend
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download frontend dist
+        uses: actions/download-artifact@v4
+        with:
+          name: web-dist
+          path: web/dist
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          # The Docker workflow builds the same targets with the same Cross images.
+          shared-key: linux-cross-release
+          key: ${{ hashFiles('Cross.toml', 'build/cross/Dockerfile.*') }}
+          cache-all-crates: true
+
+      - name: Install cross
+        run: cargo install cross --version 0.2.5 --locked
+
+      - name: Build linux binary
+        run: bash build/build-images.sh
+
+      - name: Package deb
+        run: bash build/package-deb.sh
+
+      - name: Upload deb
+        uses: actions/upload-artifact@v4
+        with:
+          name: one-kvm-deb
+          path: target/debian/*.deb
+          if-no-files-found: error
+          retention-days: 7
+
+  windows:
+    runs-on: windows-2022
+    needs: frontend
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download frontend dist
+        uses: actions/download-artifact@v4
+        with:
+          name: web-dist
+          path: web/dist
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Set up MSVC
+        uses: ilammy/msvc-dev-cmd@v1
+
+      - name: Prepare vcpkg and dependencies
+        shell: pwsh
+        run: |
+          $env:VCPKG_ROOT = "C:\vcpkg"
+          $env:VCPKG_DEFAULT_TRIPLET = "x64-windows-static"
+          $env:VCPKG_INSTALLED_DIR = Join-Path $pwd "vcpkg_installed"
+
+          if (-not (Test-Path $env:VCPKG_ROOT)) {
+            git clone https://github.com/microsoft/vcpkg $env:VCPKG_ROOT
+          }
+
+          & "$env:VCPKG_ROOT\bootstrap-vcpkg.bat" -disableMetrics
+          & "$env:VCPKG_ROOT\vcpkg.exe" install --triplet $env:VCPKG_DEFAULT_TRIPLET --x-install-root="$env:VCPKG_INSTALLED_DIR"
+
+          $tripletRoot = Join-Path $env:VCPKG_INSTALLED_DIR $env:VCPKG_DEFAULT_TRIPLET
+          $env:TURBOJPEG_SOURCE = "explicit"
+          $env:TURBOJPEG_LIB_DIR = Join-Path $tripletRoot "lib"
+          $env:TURBOJPEG_INCLUDE_DIR = Join-Path $tripletRoot "include"
+
+          "VCPKG_ROOT=$env:VCPKG_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "VCPKG_DEFAULT_TRIPLET=$env:VCPKG_DEFAULT_TRIPLET" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "VCPKG_INSTALLED_DIR=$env:VCPKG_INSTALLED_DIR" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "TURBOJPEG_SOURCE=$env:TURBOJPEG_SOURCE" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "TURBOJPEG_LIB_DIR=$env:TURBOJPEG_LIB_DIR" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "TURBOJPEG_INCLUDE_DIR=$env:TURBOJPEG_INCLUDE_DIR" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: windows-msvc-release
+          key: ${{ hashFiles('vcpkg.json', 'vcpkg-configuration.json') }}
+
+      - name: Build Windows exe
+        shell: pwsh
+        run: .\build\windows\build.ps1 -Configuration release -Package
+
+      - name: Upload exe
+        uses: actions/upload-artifact@v4
+        with:
+          name: one-kvm-windows-exe
+          path: target/x86_64-pc-windows-msvc/release/one-kvm_*.exe
+          if-no-files-found: error
+          retention-days: 7
+
+  release:
+    runs-on: ubuntu-22.04
+    needs: [deb, windows]
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_release }}
+    timeout-minutes: 30
+    permissions:
+      contents: write
+    steps:
+      - name: Validate release tag
+        run: |
+          if [ -z "${{ inputs.release_tag }}" ]; then
+            echo "release_tag is required when publish_release is true"
+            exit 1
+          fi
+
+      - name: Download deb artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: one-kvm-deb
+          path: release-artifacts/deb
+
+      - name: Download exe artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: one-kvm-windows-exe
+          path: release-artifacts/windows
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.release_tag }}
+          prerelease: true
+          generate_release_notes: true
+          files: |
+            release-artifacts/deb/*.deb
+            release-artifacts/windows/*.exe

.github/workflows/docker.yml

@@ -0,0 +1,91 @@
+name: Docker
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Docker image tag
+        required: false
+        default: latest
+      platforms:
+        description: Docker platforms
+        required: false
+        default: linux/amd64,linux/arm64,linux/arm/v7
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+  DOCKER_PLATFORMS: ${{ github.event_name == 'workflow_dispatch' && inputs.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
+  DOCKER_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+
+jobs:
+  docker:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 360
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          # Reuse dependency artifacts produced by the deb job and vice versa.
+          shared-key: linux-cross-release
+          key: ${{ hashFiles('Cross.toml', 'build/cross/Dockerfile.*') }}
+          cache-all-crates: true
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y unzip xz-utils
+          cargo install cross --version 0.2.5 --locked
+
+      - name: Build frontend
+        working-directory: web
+        run: |
+          npm install
+          npm run build
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build linux binaries
+        run: bash build/build-images.sh
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log in to Aliyun Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: registry.cn-hangzhou.aliyuncs.com
+          username: ${{ secrets.ALIYUN_USERNAME }}
+          password: ${{ secrets.ALIYUN_PASSWORD }}
+
+      - name: Publish Docker images
+        run: |
+          ./build/package-docker.sh --platform "$DOCKER_PLATFORMS" --registry docker.io/silentwind0 --tag "$DOCKER_TAG" --push
+          ./build/package-docker.sh --platform "$DOCKER_PLATFORMS" --registry registry.cn-hangzhou.aliyuncs.com/silentwind --tag "$DOCKER_TAG" --push
+          ./build/package-docker.sh --platform "$DOCKER_PLATFORMS" --registry docker.io/silentwind0 --variant full --tag "$DOCKER_TAG" --push
+          ./build/package-docker.sh --platform "$DOCKER_PLATFORMS" --registry registry.cn-hangzhou.aliyuncs.com/silentwind --variant full --tag "$DOCKER_TAG" --push

.gitignore

@@ -1,6 +1,5 @@
 # Rust
-/target/
-Cargo.lock
+target/
 
 # IDE
 .idea/
@@ -30,6 +29,8 @@ Thumbs.db
 
 # Build artifacts
 /dist/
+/build-staging
+/.tmp/
 
 # Frontend (built files)
 /web/node_modules/
@@ -41,3 +42,4 @@ CLAUDE.md
 secrets.toml
 .env
 /docs/
+web/package-lock.json

Cargo.toml

@@ -1,137 +1,212 @@
 [package]
 name = "one-kvm"
-version = "0.1.8"
+version = "0.2.8"
 edition = "2021"
 authors = ["SilentWind"]
 description = "A open and lightweight IP-KVM solution written in Rust"
-license = "GPL-2.0"
+license = "AGPL-3.0-only"
 repository = "https://github.com/mofeng-git/One-KVM"
 keywords = ["kvm", "ipkvm", "remote-management", "embedded"]
 categories = ["embedded", "network-programming"]
 
+[features]
+default = ["desktop"]
+desktop = [
+    "dep:tokio",
+    "dep:tokio-util",
+    "dep:axum",
+    "dep:axum-extra",
+    "dep:tower-http",
+    "dep:sqlx",
+    "dep:serde",
+    "dep:serde_json",
+    "dep:toml_edit",
+    "dep:tracing",
+    "dep:tracing-subscriber",
+    "dep:thiserror",
+    "dep:anyhow",
+    "dep:argon2",
+    "dep:rand",
+    "dep:totp-rs",
+    "dep:uuid",
+    "dep:base64",
+    "dep:nix",
+    "dep:reqwest",
+    "dep:urlencoding",
+    "dep:rust-embed",
+    "dep:mime_guess",
+    "dep:openssl",
+    "dep:rcgen",
+    "dep:axum-server",
+    "dep:clap",
+    "dep:time",
+    "dep:tempfile",
+    "dep:bytes",
+    "dep:bytemuck",
+    "dep:xxhash-rust",
+    "dep:async-stream",
+    "dep:futures",
+    "dep:tokio-tungstenite",
+    "dep:parking_lot",
+    "dep:arc-swap",
+    "dep:webrtc",
+    "dep:rtp",
+    "dep:rtsp-types",
+    "dep:sdp-types",
+    "dep:serialport",
+    "dep:async-trait",
+    "dep:libc",
+    "dep:ventoy-img",
+    "dep:protobuf",
+    "dep:sodiumoxide",
+    "dep:des",
+    "dep:sha2",
+    "dep:typeshare",
+    "dep:hwcodec",
+    "dep:libyuv",
+    "dep:turbojpeg",
+    "dep:audiopus",
+    "dep:v4l2r",
+    "dep:alsa",
+    "dep:gpio-cdev",
+    "dep:one-kvm-bluetooth-hid",
+    "dep:cpal",
+    "dep:windows-sys",
+]
 [dependencies]
 # Async runtime
-tokio = { version = "1", features = ["full"] }
-tokio-util = { version = "0.7", features = ["rt"] }
+tokio = { version = "1", features = ["fs", "io-util", "macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"], optional = true }
+tokio-util = { version = "0.7", features = ["rt"], optional = true }
 
 # Web framework
-axum = { version = "0.8", features = ["ws", "multipart", "tokio"] }
-axum-extra = { version = "0.12", features = ["typed-header", "cookie"] }
-tower-http = { version = "0.6", features = ["fs", "cors", "trace", "compression-gzip"] }
+axum = { version = "0.8", features = ["ws", "multipart", "tokio"], optional = true }
+axum-extra = { version = "0.12", features = ["cookie"], optional = true }
+tower-http = { version = "0.6", features = ["cors", "trace", "set-header"], optional = true }
 
 # Database - Use bundled SQLite for static linking
-sqlx = { version = "0.8", features = ["runtime-tokio", "sqlite"] }
+sqlx = { version = "0.9", default-features = false, features = ["runtime-tokio", "sqlite-bundled"], optional = true }
 
 # Serialization
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
+serde = { version = "1", features = ["derive"], optional = true }
+serde_json = { version = "1", optional = true }
+toml_edit = { version = "0.25", optional = true }
 
 # Logging
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter", "json", "tracing-log"] }
-tracing-log = "0.2"
+tracing = { version = "0.1", optional = true }
+tracing-subscriber = { version = "0.3", features = ["env-filter", "json", "tracing-log"], optional = true }
 
 # Error handling
-thiserror = "2"
-anyhow = "1"
+thiserror = { version = "2", optional = true }
+anyhow = { version = "1", optional = true }
 
 # Authentication
-argon2 = "0.5"
-rand = "0.9"
+argon2 = { version = "0.5", optional = true }
+rand = { version = "0.10", optional = true }
+totp-rs = { version = "5.7", features = ["gen_secret", "otpauth", "zeroize"], optional = true }
 
 # Utilities
-uuid = { version = "1", features = ["v4", "serde"] }
-chrono = { version = "0.4", features = ["serde"] }
-base64 = "0.22"
-nix = { version = "0.30", features = ["fs", "net", "hostname", "poll"] }
+uuid = { version = "1", features = ["v4", "serde"], optional = true }
+base64 = { version = "0.22", optional = true }
+tempfile = { version = "3", optional = true }
 
 # HTTP client (for URL downloads)
-# Use rustls by default, but allow native-tls for systems with older GLIBC
-reqwest = { version = "0.13", features = ["stream", "rustls", "json"], default-features = false }
-urlencoding = "2"
+reqwest = { version = "0.13", features = ["stream", "native-tls-vendored", "json"], default-features = false, optional = true }
+urlencoding = { version = "2", optional = true }
 
 # Static file embedding
-rust-embed = { version = "8", features = ["compression"] }
-mime_guess = "2"
+rust-embed = { version = "8", features = ["compression", "debug-embed"], optional = true }
+mime_guess = { version = "2", optional = true }
 
 # TLS/HTTPS
-rustls = { version = "0.23", features = ["ring"] }
-rcgen = "0.14"
-axum-server = { version = "0.8", features = ["tls-rustls"] }
+openssl = { version = "0.10", features = ["vendored"], optional = true }
+rcgen = { version = "0.14", optional = true }
+axum-server = { version = "0.8", features = ["tls-openssl"], optional = true }
 
 # CLI argument parsing
-clap = { version = "4", features = ["derive"] }
+clap = { version = "4", features = ["derive"], optional = true }
 
-# Time
-time = "0.3"
-
-# Video capture (V4L2)
-v4l2r = "0.0.7"
-
-# JPEG encoding (libjpeg-turbo, SIMD accelerated)
-turbojpeg = "1.3"
+# Time (cookie max_age + RFC3339 timestamps)
+time = { version = "0.3", features = ["serde", "formatting", "parsing"], optional = true }
 
 # Bytes handling
-bytes = "1"
-bytemuck = { version = "1.24", features = ["derive"] }
+bytes = { version = "1", optional = true }
+bytemuck = { version = "1.24", features = ["derive"], optional = true }
 
 # Frame deduplication (hash-based comparison)
-xxhash-rust = { version = "0.8", features = ["xxh64"] }
+xxhash-rust = { version = "0.8", features = ["xxh64"], optional = true }
 
 # Async channels
-async-stream = "0.3"
-futures = "0.3"
+async-stream = { version = "0.3", optional = true }
+futures = { version = "0.3", optional = true }
 
 # WebSocket client (for ttyd proxy)
-tokio-tungstenite = "0.28"
+tokio-tungstenite = { version = "0.29", optional = true }
 
 # High-performance synchronization
-parking_lot = "0.12"
-arc-swap = "1.8"
+parking_lot = { version = "0.12", optional = true }
+arc-swap = { version = "1.8", optional = true }
 
 # WebRTC
-webrtc = "0.14"
-rtp = "0.14"
-rtsp-types = "0.1"
-sdp-types = "0.1"
-
-# Audio (ALSA capture + Opus encoding)
-# Note: audiopus links to libopus.so (unavoidable for audio support)
-alsa = "0.11"
-audiopus = "0.2"
+webrtc = { version = "0.17", features = ["vendored-openssl"], optional = true }
+rtp = { version = "0.17", optional = true }
+rtsp-types = { version = "0.1", optional = true }
+sdp-types = { version = "0.1", optional = true }
 
 # HID (serial port for CH9329)
-serialport = "4"
-async-trait = "0.1"
-libc = "0.2"
+serialport = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+libc = { version = "0.2", optional = true }
 
 # Ventoy bootable image support
-ventoy-img = { path = "libs/ventoy-img-rs" }
-
-# ATX (GPIO control)
-gpio-cdev = "0.6"
-
-# H264 hardware/software encoding (hwcodec from rustdesk)
-hwcodec = { path = "libs/hwcodec" }
+ventoy-img = { path = "libs/ventoy-img-rs", optional = true }
 
 # RustDesk protocol support
-protobuf = { version = "3.7", features = ["with-bytes"] }
-sodiumoxide = "0.2"
-sha2 = "0.10"
-# High-performance pixel format conversion (libyuv)
-libyuv = { path = "res/vcpkg/libyuv" }
-
+protobuf = { version = "3.7", features = ["with-bytes"], optional = true }
+sodiumoxide = { version = "0.2", optional = true }
+des = { version = "0.9", optional = true }
+sha2 = { version = "0.11", optional = true }
 # TypeScript type generation
-typeshare = "1.0"
+typeshare = { version = "1.0", optional = true }
 
-[dev-dependencies]
-tokio-test = "0.4"
-tempfile = "3"
+[target.'cfg(any(target_os = "linux", windows))'.dependencies]
+# Video encoding/decoding (FFmpeg/libjpeg-turbo/libyuv; available on Windows and Linux)
+hwcodec = { path = "libs/hwcodec", features = ["bytes"], optional = true }
+libyuv = { path = "res/vcpkg/libyuv", optional = true }
+turbojpeg = { version = "1.3", optional = true }
+# Note: audiopus links to libopus.so (unavoidable for audio support)
+audiopus = { version = "0.2", optional = true }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+one-kvm-bluetooth-hid = { path = "libs/bluetooth-hid", optional = true }
+
+# Utilities
+nix = { version = "0.31", default-features = false, features = ["fs", "socket", "net", "hostname", "poll"], optional = true }
+
+# Video capture (V4L2)
+v4l2r = { path = "libs/v4l2r", optional = true }
+
+# Audio (ALSA capture)
+alsa = { version = "0.11", optional = true }
+
+# ATX (GPIO control)
+gpio-cdev = { version = "0.6", optional = true }
+
+[target.'cfg(windows)'.dependencies]
+cpal = { version = "0.18", default-features = false, optional = true }
+windows-sys = { version = "0.61", features = [
+    "Win32_Foundation",
+    "Win32_NetworkManagement_IpHelper",
+    "Win32_NetworkManagement_Ndis",
+    "Win32_Networking_WinSock",
+    "Win32_System_SystemInformation",
+    "Win32_System_Threading",
+], optional = true }
 
 [build-dependencies]
 protobuf-codegen = "3.7"
-toml = "0.9"
-cc = "1"
+
+[patch.crates-io]
+dtls = { path = "libs/dtls" }
 
 [profile.release]
 opt-level = 3

Cross.toml

@@ -1,5 +1,5 @@
 # Cross-compilation configuration for One-KVM
-# Uses pre-built custom Debian 11 based images for consistent build/runtime environment
+# Uses pre-built custom Debian 12 based images for consistent build/runtime environment
 # See: https://github.com/cross-rs/cross
 
 [build]

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.en.md

@@ -0,0 +1,251 @@
+<div align="center">
+  <h1>One-KVM</h1>
+  <p><strong>An open, lightweight IP-KVM stack in Rust — remote management down to BIOS level</strong></p>
+
+  <p><a href="README.md">简体中文</a> · <a href="README.en.md">English</a></p>
+
+  [![GitHub Release](https://img.shields.io/github/v/release/mofeng-git/One-KVM)](https://github.com/mofeng-git/One-KVM/releases)
+  [![GitHub stars](https://img.shields.io/github/stars/mofeng-git/One-KVM?style=social)](https://github.com/mofeng-git/One-KVM/stargazers)
+  [![GitHub forks](https://img.shields.io/github/forks/mofeng-git/One-KVM?style=social)](https://github.com/mofeng-git/One-KVM/network/members)
+  [![GitHub issues](https://img.shields.io/github/issues/mofeng-git/One-KVM)](https://github.com/mofeng-git/One-KVM/issues)
+</div>
+
+---
+
+## Overview
+
+**One-KVM (Rust)** is a lightweight IP-KVM solution written in Rust. It lets you manage servers and workstations over the network, including at BIOS level.
+
+Goals: an open, lightweight, easy-to-use IP-KVM stack.
+
+- **Open**: not tied to one hardware recipe; runs across many setups.
+- **Lightweight**: shipped as a binary with minimal moving parts for deployment.
+- **Easy to use**: no hand-edited config files required; settings are done in the web UI.
+
+For more information, see the [One-KVM Rust documentation](https://docs.one-kvm.cn/).
+
+> **One-KVM (Python)** is no longer maintained. If you still need it, see <https://github.com/mofeng-git/One-KVM/tree/python>.
+
+<div align="center">
+
+![One-KVM web console](https://one-kvm.cn/hero-app-effect.png)
+
+</div>
+
+## Features
+
+**Core**
+
+| Area | Capabilities |
+|------|----------------|
+| Video capture | HDMI USB / MIPI CSI / RK3588 HDMI IN; MJPEG and WebRTC (H.264 / H.265 / VP8 / VP9) |
+| Video encoding | VAAPI / QSV / RKMPP / V4L2 M2M hardware paths, with software fallback |
+| Keyboard & mouse | USB OTG HID or CH340 + CH9329 HID; absolute / relative mouse |
+| Virtual media | USB mass storage; ISO/IMG mount and Ventoy-style virtual USB |
+| ATX power | GPIO or USB relay; power control |
+| Audio | ALSA capture + Opus (HTTP / WebRTC) |
+
+## Installation
+
+Release artifacts are on [GitHub Releases](https://github.com/mofeng-git/One-KVM/releases). Below are short paths for common setups. For **system requirements, hardware, Docker env vars, USB OTG**, and full troubleshooting, see the [One-KVM documentation](https://docs.one-kvm.cn/) (Chinese; use a translator if needed).
+
+### Debian / Ubuntu (.deb)
+
+Download a `one-kvm_*.deb` matching your CPU architecture from Releases, then from the directory containing the package:
+
+```bash
+sudo apt update
+sudo apt install ./one-kvm_0.x.x_<arch>.deb
+```
+
+Replace the version and architecture in the filename with your actual file name.
+
+### Docker
+
+Images:
+
+- **one-kvm** — main app + ttyd  
+- **one-kvm-full** — same plus optional extras (e.g. gostc, easytier-core)
+
+Example:
+
+```bash
+docker run --name one-kvm -itd \
+  --privileged=true --restart unless-stopped \
+  -v /dev:/dev -v /sys:/sys \
+  --net=host \
+  silentwind0/one-kvm-full
+```
+
+If pulls are slow, use the Aliyun mirror, e.g. `registry.cn-hangzhou.aliyuncs.com/silentwind/one-kvm-full` (and `registry.cn-hangzhou.aliyuncs.com/silentwind/one-kvm` for the slim image).
+
+### fnOS NAS (Feiniu / 飞牛)
+
+One-KVM is listed in the fnOS **app store**; search and install on your NAS.
+
+### Web UI and first run
+
+Open `http://<device-ip>:8080` in a browser (**8420** after fnOS install). The first visit runs initial setup.
+
+## Reporting issues
+
+If something breaks:
+
+1. Open [GitHub Issues](https://github.com/mofeng-git/One-KVM/issues) or report in the project QQ group.  
+2. Include **useful** error messages and steps to reproduce.  
+3. Mention software version, hardware, and OS details.
+
+## Sponsorship
+
+One-KVM builds on many great open-source projects; a lot of time goes into testing and maintenance. If you find it useful, you can support development on **[Afdian (为爱发电)](https://afdian.com/a/silentwind)**.
+
+### Thanks
+
+<details>
+<summary><strong>Supporter list</strong></summary>
+
+- 浩龙的电子嵌入式之路
+
+- Tsuki
+
+- H_xiaoming
+
+- 0蓝蓝0
+
+- fairybl
+
+- Will
+
+- 自.知
+
+- 观棋不语٩ ི۶
+
+- 爱发电用户_a57a4
+
+- 爱发电用户_2c769
+
+- 霜序
+
+- 远方（闲鱼用户名：小远技术店铺）
+
+- 爱发电用户_399fc
+
+- 斐斐の
+
+- 爱发电用户_09451
+
+- 超高校级的錆鱼
+
+- 爱发电用户_08cff
+
+- guoke
+
+- mgt
+
+- 姜沢掵
+
+- ui_beam
+
+- 爱发电用户_c0dd7
+
+- 爱发电用户_dnjK
+
+- 忍者胖猪
+
+- 永遠の願い
+
+- 爱发电用户_GBrF
+
+- 爱发电用户_fd65c
+
+- 爱发电用户_vhNa
+
+- 爱发电用户_Xu6S
+
+- moss
+
+- woshididi
+
+- 爱发电用户_a0fd1
+
+- 爱发电用户_f6bH
+
+- 码农
+
+- 爱发电用户_6639f
+
+- jeron
+
+- 爱发电用户_CN7y
+
+- 爱发电用户_Up6w
+
+- 爱发电用户_e3202
+
+- 一语念白
+
+- 云边
+
+- 爱发电用户_5a711
+
+- 爱发电用户_9a706
+
+- T0m9ir1SUKI
+
+- 爱发电用户_56d52
+
+- 爱发电用户_3N6F
+
+- DUSK
+
+- 飘零
+
+- .
+
+- 饭太稀
+
+- 葱
+
+- MaxZ
+
+- 爱发电用户_c5f33
+
+- 爱发电用户_09386
+
+- 爱发电用户_JT6c
+
+- 爱发电用户_d3d9c
+
+- 爱发电用户_97b41
+
+- 偶然
+
+- 爱发电用户_dba45
+
+- 爱发电用户_d4f8b
+
+- 故人。
+
+- ......
+
+</details>
+
+### Sponsors
+
+**File hosting**
+
+- **[Huang1111 public-interest program](https://pan.huang1111.cn/s/mxkx3T1)** — login-free downloads
+
+**Cloud**
+
+- **[林枫云](https://www.dkdun.cn)** — project server sponsorship
+
+![林枫云](https://docs.one-kvm.cn/img/36076FEFF0898A80EBD5756D28F4076C.png)
+
+林枫云 offers premium network routes, high-frequency game servers, and high-bandwidth servers in China and abroad.
+
+- **[Beta Network](https://my.beita.cc/?ref=github_onekvm)** — project server sponsorship
+
+![BTBT](https://github.com/user-attachments/assets/c442d5f5-d72f-4a07-b9f4-400a6a0c3f1e)
+
+Remote computers, consumer GPU servers, and dedicated physical machines with fully automated online delivery.

README.md

@@ -2,8 +2,9 @@
   <h1>One-KVM</h1>
   <p><strong>Rust 编写的开放轻量 IP-KVM 解决方案，实现 BIOS 级远程管理</strong></p>
 
-  <p><a href="README.md">简体中文</a></p>
+  <p><a href="README.md">简体中文</a> · <a href="README.en.md">English</a></p>
 
+  [![GitHub Release](https://img.shields.io/github/v/release/mofeng-git/One-KVM)](https://github.com/mofeng-git/One-KVM/releases)
   [![GitHub stars](https://img.shields.io/github/stars/mofeng-git/One-KVM?style=social)](https://github.com/mofeng-git/One-KVM/stargazers)
   [![GitHub forks](https://img.shields.io/github/forks/mofeng-git/One-KVM?style=social)](https://github.com/mofeng-git/One-KVM/network/members)
   [![GitHub issues](https://img.shields.io/github/issues/mofeng-git/One-KVM)](https://github.com/mofeng-git/One-KVM/issues)
@@ -11,61 +12,82 @@
 
 ---
 
-## 📖 项目概述
+## 项目概述
 
 **One-KVM Rust** 是一个用 Rust 编写的轻量级 IP-KVM 解决方案，可通过网络远程管理服务器和工作站，实现 BIOS 级远程控制。
 
-项目目标：
+项目目标：提供一个开放、轻量、易用的 IPKVM 解决方案。
 
-- **开放**：不绑定特定硬件配置，尽量适配常见 Linux 设备
-- **轻量**：单二进制分发，部署过程更简单
-- **易用**：网页界面完成设备与参数配置，无需手动改配置文件
+- **开放**：不绑定特定硬件配置，可在各类硬件环境中稳定运行。
+- **轻量**：以二进制文件形式分发，无繁杂的依赖项，部署过程简单。
+- **易用**：无需手动编辑配置文件，参数设置均可通过网页界面完成。
 
-> **注意：** One-KVM Rust 目前仍处于开发早期阶段，功能与细节会快速迭代，欢迎体验与反馈。
+更多内容可访问 [One-KVM Rust 文档站点](https://docs.one-kvm.cn/)。
 
-## 🔁 迁移说明
+> **One-KVM Python** 已停止开发，如有需要可访问 <https://github.com/mofeng-git/One-KVM/tree/python>。
 
-开发重心正在从 **One-KVM Python** 逐步转向 **One-KVM Rust**。
+<div align="center">
 
-- 如果你在使用 **One-KVM Python（基于 PiKVM）**，请查看 [One-KVM Python 文档](https://docs.one-kvm.cn/python/)
-- One-KVM Rust 相较于 One-KVM Python：**尚未完全适配 CSI HDMI 采集卡**、**不支持 VNC 访问**，仍处于开发早期阶段
+![One-KVM Web 控制台界面](https://one-kvm.cn/hero-app-effect.png)
 
-## 📊 功能介绍
+</div>
 
-### 核心功能
+## 功能介绍
 
-| 功能 | 说明 |
+**核心功能**
+
+| 功能 | 能力说明 |
 |------|------|
-| 视频采集 | HDMI USB 采集卡支持，提供 MJPEG / WebRTC（H.264/H.265/VP8/VP9） |
+| 视频采集 | HDMI USB /MIPI CSI/RK3588 HDMI IN 采集支持，提供 MJPEG / WebRTC（H.264/H.265/VP8/VP9） 视频流|
+| 视频编码 | VAAPI/QSV/RKMPP/V4L2M2M 硬件编码支持，以及软件编码兜底 |
 | 键鼠控制 | USB OTG HID 或 CH340 + CH9329 HID，支持绝对/相对鼠标模式 |
 | 虚拟媒体 | USB Mass Storage，支持 ISO/IMG 镜像挂载和 Ventoy 虚拟U盘模式 |
-| ATX 电源控制 | GPIO 控制电源/重启按钮 |
+| ATX 电源控制 | GPIO/USB 继电器，支持电源控制 |
 | 音频传输 | ALSA 采集 + Opus 编码（HTTP/WebRTC） |
 
-### 硬件编码
+## 安装使用
 
-支持自动检测和选择硬件加速：
+构建产物见 [GitHub Releases](https://github.com/mofeng-git/One-KVM/releases)。以下为常见安装方式的简要步骤；**系统要求、硬件准备、Docker 环境变量与 USB OTG 等完整说明**请查阅 [One-KVM Rust 文档站点](https://docs.one-kvm.cn/)。
 
-- **VAAPI**：Intel/AMD GPU
-- **RKMPP**：Rockchip SoC
-- **V4L2 M2M**：通用硬件编码器
-- **软件编码**：CPU 编码
+### 使用 deb 安装（Debian / Ubuntu）
 
-### 扩展能力
+从 Releases 下载与本机架构匹配的 `one-kvm_*.deb`，在包所在目录执行：
 
-- Web UI 配置，多语言支持（中文/英文）
-- 内置 Web 终端（ttyd）、内网穿透支持（gostc）、P2P 组网支持（EasyTier）、RustDesk 协议集成（用于跨平台远程访问能力扩展）和 RTSP 视频流（用于视频推流）
+```bash
+sudo apt update
+sudo apt install ./one-kvm_0.x.x_<arch>.deb
+```
 
-## ⚡ 安装使用
+将文件名中的版本号与架构替换为实际下载的包名。
 
-可以访问 [One-KVM Rust 文档站点](https://docs.one-kvm.cn/) 获取详细信息。
+### 使用 Docker
+
+镜像分为 **one-kvm**（One-KVM 主程序 + ttyd）与 **one-kvm-full**（另含 gostc、easytier-core 等可选扩展），按需选用。
+
+```bash
+docker run --name one-kvm -itd \
+  --privileged=true --restart unless-stopped \
+  -v /dev:/dev -v /sys:/sys \
+  --net=host \
+  silentwind0/one-kvm-full
+```
+
+拉取较慢时，可将镜像名替换为阿里云加速，例如 `registry.cn-hangzhou.aliyuncs.com/silentwind/one-kvm-full`（`one-kvm` 镜像同理，将 `silentwind0/one-kvm` 换为 `registry.cn-hangzhou.aliyuncs.com/silentwind/one-kvm`）。
+
+### 飞牛 NAS
+
+One-KVM 已上架飞牛 **应用市场**，在 NAS 上直接搜索安装即可。
+
+### 访问 Web 与首次配置
+
+浏览器访问 `http://<设备 IP>:8080`（飞牛 NAS 安装后为 8420 端口）。首次访问将引导完成初始配置。
 
 ## 报告问题
 
 如果您发现了问题，请：
 1. 使用 [GitHub Issues](https://github.com/mofeng-git/One-KVM/issues) 报告，或加入 QQ 群聊反馈。
-2. 提供详细的错误信息和复现步骤
-3. 包含您的硬件配置和系统信息
+2. 提供有帮助的错误信息和复现步骤
+3. 包含您使用的软件版本、硬件配置和系统信息
 
 ## 赞助支持
 
@@ -88,8 +110,6 @@
 
 - Will
 
-- 浩龙的电子嵌入式之路
-
 - 自.知
 
 - 观棋不语٩ ི۶
@@ -188,10 +208,18 @@
 
 - 爱发电用户_JT6c
 
-- MaxZ
-
 - 爱发电用户_d3d9c
 
+- 爱发电用户_97b41
+
+- 偶然
+
+- 爱发电用户_dba45
+
+- 爱发电用户_d4f8b
+
+- 故人。
+
 - ......
 
 </details>
@@ -205,8 +233,14 @@
 
 **云服务商**
 
-- **[林枫云](https://www.dkdun.cn)** - 赞助了本项目宁波大带宽服务器
+- **[林枫云](https://www.dkdun.cn)** - 赞助了本项目服务器
 
-![林枫云](https://docs.one-kvm.cn/img/36076FEFF0898A80EBD5756D28F4076C.png)
+  <img  height="128" alt="林枫云" src="https://docs.one-kvm.cn/img/36076FEFF0898A80EBD5756D28F4076C.png" />
 
-林枫云主营国内外地域的精品线路业务服务器、高主频游戏服务器和大带宽服务器。
+  林枫云主营国内外地域的精品线路业务服务器、高主频游戏服务器和大带宽服务器。
+
+- **[贝塔网络](https://my.beita.cc/?ref=github_onekvm)** - 赞助了本项目服务器
+
+  <img height="128" alt="BTBT" src="https://github.com/user-attachments/assets/c442d5f5-d72f-4a07-b9f4-400a6a0c3f1e" />
+
+  远程电脑、消费级GPU服务器、独服物理机，全自动在线交付。

build.rs

@@ -2,21 +2,6 @@ use std::fs;
 use std::path::Path;
 
 fn main() {
-    // Set BUILD_DATE environment variable for compile-time access
-    // Use system time to avoid adding chrono as a build dependency
-    let now = std::time::SystemTime::now();
-    let duration = now.duration_since(std::time::UNIX_EPOCH).unwrap();
-    let secs = duration.as_secs();
-
-    // Convert Unix timestamp to date (simplified calculation)
-    // Days since epoch
-    let days = secs / 86400;
-    // Calculate year, month, day from days since 1970-01-01
-    let (year, month, day) = days_to_ymd(days as i64);
-    let build_date = format!("{:04}-{:02}-{:02}", year, month, day);
-
-    println!("cargo:rustc-env=BUILD_DATE={}", build_date);
-
     // Compile protobuf files for RustDesk protocol
     compile_protos();
 
@@ -64,25 +49,6 @@ fn generate_secrets() {
 pub mod ice {
     /// Google public STUN server URL (hardcoded)
     pub const STUN_SERVER: &str = "stun:stun.l.google.com:19302";
-
-    /// TURN server URLs - not provided, users must configure their own
-    pub const TURN_URLS: &str = "";
-
-    /// TURN authentication username
-    pub const TURN_USERNAME: &str = "";
-
-    /// TURN authentication password
-    pub const TURN_PASSWORD: &str = "";
-
-    /// Always returns true since we have STUN
-    pub const fn is_configured() -> bool {
-        true
-    }
-
-    /// Always returns false since TURN is not provided
-    pub const fn has_turn() -> bool {
-        false
-    }
 }
 
 /// RustDesk public server configuration - NOT PROVIDED
@@ -105,19 +71,3 @@ pub mod rustdesk {
 
     fs::write(&dest_path, code).expect("Failed to write secrets_generated.rs");
 }
-
-/// Convert days since Unix epoch to year-month-day
-fn days_to_ymd(days: i64) -> (i32, u32, u32) {
-    // Algorithm from http://howardhinnant.github.io/date_algorithms.html
-    let z = days + 719468;
-    let era = if z >= 0 { z } else { z - 146096 } / 146097;
-    let doe = (z - era * 146097) as u32;
-    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
-    let y = yoe as i64 + era * 400;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let year = if m <= 2 { y + 1 } else { y };
-    (year as i32, m, d)
-}

build/Dockerfile.runtime

@@ -1,24 +1,35 @@
 # One-KVM Runtime Image
 # This Dockerfile only packages pre-compiled binaries (no compilation)
 # Used after cross-compiling with `cross build`
-# Using Debian 11 for maximum compatibility (GLIBC 2.31)
+# Using Debian 12 to match the build images (GLIBC 2.36)
 
 ARG TARGETPLATFORM=linux/amd64
 
-FROM debian:11-slim
+FROM debian:12-slim
 
 ARG TARGETPLATFORM
+ARG APT_MIRROR=
 
 # Install runtime dependencies in a single layer
 # All codec libraries (libx264, libx265, libopus) are now statically linked
 # Only hardware acceleration drivers and core system libraries remain dynamic
-RUN sed -i 's/ main$/ main contrib non-free/' /etc/apt/sources.list && \
+# Set APT_MIRROR=mirrors.tuna.tsinghua.edu.cn to speed up builds in China
+RUN if [ -n "$APT_MIRROR" ]; then \
+        sed -i "s@deb.debian.org@${APT_MIRROR}@g" /etc/apt/sources.list.d/debian.sources; \
+    fi \
+    && sed -i 's/^Components: main$/Components: main contrib non-free non-free-firmware/' /etc/apt/sources.list.d/debian.sources && \
     apt-get update && \
     apt-get install -y --no-install-recommends \
         # Core runtime (all platforms) - no codec libs needed
         ca-certificates \
+        # Bluetooth HID uses the host BlueZ system bus; btmgmt manages a dedicated adapter.
+        bluez \
         libudev1 \
         libasound2 \
+        # OTG Ethernet bridge control (nmcli talks to the host NetworkManager over D-Bus)
+        network-manager \
+        iproute2 \
+        iputils-ping \
         # v4l2 is handled by kernel, minimal userspace needed
         libv4l-0 \
         && \

build/Dockerfile.runtime-full

@@ -1,24 +1,35 @@
 # One-KVM Runtime Image (full)
 # This Dockerfile only packages pre-compiled binaries (no compilation)
 # Used after cross-compiling with `cross build`
-# Using Debian 11 for maximum compatibility (GLIBC 2.31)
+# Using Debian 12 to match the build images (GLIBC 2.36)
 
 ARG TARGETPLATFORM=linux/amd64
 
-FROM debian:11-slim
+FROM debian:12-slim
 
 ARG TARGETPLATFORM
+ARG APT_MIRROR=
 
 # Install runtime dependencies in a single layer
 # All codec libraries (libx264, libx265, libopus) are now statically linked
 # Only hardware acceleration drivers and core system libraries remain dynamic
-RUN sed -i 's/ main$/ main contrib non-free/' /etc/apt/sources.list && \
+# Set APT_MIRROR=mirrors.tuna.tsinghua.edu.cn to speed up builds in China
+RUN if [ -n "$APT_MIRROR" ]; then \
+        sed -i "s@deb.debian.org@${APT_MIRROR}@g" /etc/apt/sources.list.d/debian.sources; \
+    fi \
+    && sed -i 's/^Components: main$/Components: main contrib non-free non-free-firmware/' /etc/apt/sources.list.d/debian.sources && \
     apt-get update && \
     apt-get install -y --no-install-recommends \
         # Core runtime (all platforms) - no codec libs needed
         ca-certificates \
+        # Bluetooth HID uses the host BlueZ system bus; btmgmt manages a dedicated adapter.
+        bluez \
         libudev1 \
         libasound2 \
+        # OTG Ethernet bridge control (nmcli talks to the host NetworkManager over D-Bus)
+        network-manager \
+        iproute2 \
+        iputils-ping \
         # v4l2 is handled by kernel, minimal userspace needed
         libv4l-0 \
         && \

build/build-images.sh

@@ -19,6 +19,32 @@ ARCH_MAP=(
 build_arch() {
     local rust_target="$1"
 
+    case "${CHINAMIRRO:-}" in
+        1|true|TRUE|yes|YES|on|ON)
+            # Default Rust toolchain mirror is USTC (rsproxy.cn is unreachable via the
+            # Docker bridge on some networks because its CDN blocks the SNAT source IP).
+            local rust_dist="${RUSTUP_DIST_SERVER_MIRROR:-https://mirrors.ustc.edu.cn/rust-static}"
+            local rust_root="${RUSTUP_UPDATE_ROOT_MIRROR:-https://mirrors.ustc.edu.cn/rust-static/rustup}"
+            local crates_sparse="${CARGO_SPARSE_MIRROR:-sparse+https://mirrors.ustc.edu.cn/crates.io-index/}"
+            local crates_git="${CARGO_GIT_MIRROR:-https://mirrors.ustc.edu.cn/crates.io-index}"
+            local cross_build_opts="${CROSS_BUILD_OPTS:+$CROSS_BUILD_OPTS }--progress=plain --build-arg CHINAMIRRO=1 --build-arg GH_PROXY=${GH_PROXY:-https://ghfast.top/} --build-arg DEBIAN_IMAGE=${DEBIAN_IMAGE:-dockerproxy.net/library/debian:12}"
+            cross_build_opts="$cross_build_opts --build-arg HTTP_PROXY= --build-arg HTTPS_PROXY= --build-arg ALL_PROXY= --build-arg NO_PROXY="
+            cross_build_opts="$cross_build_opts --build-arg http_proxy= --build-arg https_proxy= --build-arg all_proxy= --build-arg no_proxy="
+            echo "=== China mirror acceleration: enabled ==="
+            echo "=== Building: $rust_target (via cross with custom Dockerfile) ==="
+            env \
+                CROSS_BUILD_OPTS="$cross_build_opts" \
+                CARGO_SOURCE_CRATES_IO_REPLACE_WITH=cn-mirror \
+                CARGO_SOURCE_CN-MIRROR_REGISTRY="$crates_sparse" \
+                CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse \
+                CARGO_NET_GIT_FETCH_WITH_CLI=true \
+                RUSTUP_DIST_SERVER="$rust_dist" \
+                RUSTUP_UPDATE_ROOT="$rust_root" \
+                cross build --release --target "$rust_target"
+            return
+            ;;
+    esac
+
     echo "=== Building: $rust_target (via cross with custom Dockerfile) ==="
     cross build --release --target "$rust_target"
 }
@@ -49,6 +75,7 @@ case "${1:-all}" in
         echo "Examples:"
         echo "  $0              # Build all"
         echo "  $0 x86_64       # Build x86_64 only"
+        echo "  CHINAMIRRO=1 $0 arm64  # Build with China mirrors"
         exit 0
         ;;
     *)
@@ -65,16 +92,4 @@ for target in "${ARCH_MAP[@]}"; do
     fi
 done
 echo ""
-echo "Static libraries:"
-for target in "${ARCH_MAP[@]}"; do
-    case "$target" in
-        x86_64-unknown-linux-gnu) gnu_target="x86_64-linux-gnu" ;;
-        aarch64-unknown-linux-gnu) gnu_target="aarch64-linux-gnu" ;;
-        armv7-unknown-linux-gnueabihf) gnu_target="armv7-linux-gnueabihf" ;;
-    esac
-    if [ -d "$PROJECT_DIR/target/one-kvm-libs/$gnu_target/lib" ]; then
-        echo "  $gnu_target: OK"
-    fi
-done
-echo ""
 echo "Next step: ./build/package-docker.sh or ./build/package-deb.sh"

build/cross/Dockerfile.arm64

@@ -1,21 +1,55 @@
-# Cross-compilation image for ARM64 based on Debian 11
-# Build on Debian 11 (GLIBC 2.31) for maximum runtime compatibility
+# Cross-compilation image for ARM64 based on Debian 12
+# Build on Debian 12 (GLIBC 2.36) to match the runtime images
 
-FROM debian:11
+ARG DEBIAN_IMAGE=debian:12
+FROM ${DEBIAN_IMAGE}
 
-# Linux headers used by v4l2r bindgen
-ARG LINUX_HEADERS_VERSION=6.6
-ARG LINUX_HEADERS_SHA256=
+ARG CHINAMIRRO=0
+ARG GH_PROXY=https://gh-proxy.com/
+ARG RUSTUP_DIST_SERVER_CN=https://mirrors.ustc.edu.cn/rust-static
+ARG RUSTUP_UPDATE_ROOT_CN=https://mirrors.ustc.edu.cn/rust-static/rustup
+ARG CARGO_INDEX_CN=https://mirrors.ustc.edu.cn/crates.io-index
+ARG CARGO_REGISTRY_CN=sparse+https://mirrors.ustc.edu.cn/crates.io-index/
+ARG LIBJPEG_TURBO_VERSION=3.1.4.1
+ARG LIBYUV_REV=957f295ea946cbbd13fcfc46e7066f2efa801233
+ARG LIBVPX_VERSION=1.16.0
+ARG X265_VERSION=3.4
+ARG OPUS_VERSION=1.5.2
+ARG RKMPP_BRANCH=jellyfin-mpp
+ARG RKRGA_BRANCH=jellyfin-rga
+ARG FFMPEG_ROCKCHIP_REV=40c412daccf08164493da0de990eb99a8948116b
 
-# Set Rustup mirrors (Aliyun)
-#ENV RUSTUP_UPDATE_ROOT=https://mirrors.aliyun.com/rustup/rustup \
-#    RUSTUP_DIST_SERVER=https://mirrors.aliyun.com/rustup
+# Optionally use China mirrors for builds in China.
+RUN if [ "$CHINAMIRRO" = "1" ]; then \
+        sed -i -E \
+            -e 's@http://deb.debian.org/debian([[:space:]]|$)@http://mirrors.tuna.tsinghua.edu.cn/debian\1@g' \
+            /etc/apt/sources.list.d/debian.sources; \
+    fi
 
 # Install Rust toolchain
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
+    && if [ "$CHINAMIRRO" = "1" ]; then \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
+    fi \
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable \
+    && if [ "$CHINAMIRRO" = "1" ]; then \
+        mkdir -p /root/.cargo; \
+        printf '%s\n' \
+            '[source.crates-io]' \
+            "replace-with = 'cn-mirror-sparse'" \
+            '[source.cn-mirror]' \
+            "registry = '${CARGO_INDEX_CN}'" \
+            '[source.cn-mirror-sparse]' \
+            "registry = '${CARGO_REGISTRY_CN}'" \
+            '[registries.cn-mirror]' \
+            "index = '${CARGO_INDEX_CN}'" \
+            '[net]' \
+            'git-fetch-with-cli = true' \
+            > /root/.cargo/config.toml; \
+    fi \
     && rm -rf /var/lib/apt/lists/*
 
 ENV PATH="/root/.cargo/bin:${PATH}"
@@ -26,6 +60,7 @@ RUN dpkg --add-architecture arm64
 # Install cross-compiler and native build tools
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
+    patch \
     pkg-config \
     cmake \
     nasm \
@@ -49,6 +84,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # Install ARM64 development libraries (without VAAPI/X11 for ARM)
 RUN apt-get update && apt-get install -y --no-install-recommends \
+    libssl3 \
+    libssl3:arm64 \
     libasound2-dev:arm64 \
     libv4l-dev:arm64 \
     libudev-dev:arm64 \
@@ -58,23 +95,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libdrm-dev:arm64 \
     && rm -rf /var/lib/apt/lists/*
 
-# Install newer V4L2 headers for v4l2r bindgen
-RUN mkdir -p /opt/v4l2-headers \
-    && wget -q https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${LINUX_HEADERS_VERSION}.tar.xz -O /tmp/linux-headers.tar.xz \
-    && if [ -n "$LINUX_HEADERS_SHA256" ]; then echo "$LINUX_HEADERS_SHA256  /tmp/linux-headers.tar.xz" | sha256sum -c -; fi \
-    && tar -xf /tmp/linux-headers.tar.xz -C /tmp \
-    && cd /tmp/linux-${LINUX_HEADERS_VERSION} \
-    && make ARCH=arm64 headers_install INSTALL_HDR_PATH=/opt/v4l2-headers \
-    && rm -rf /tmp/linux-${LINUX_HEADERS_VERSION} /tmp/linux-headers.tar.xz
-
-ENV V4L2R_VIDEODEV2_H_PATH=/opt/v4l2-headers/include
-
 # Build static libjpeg-turbo from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libjpeg-turbo \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libjpeg-turbo \
     && cd /tmp/libjpeg-turbo \
+    && git remote add origin "${github_prefix}https://github.com/libjpeg-turbo/libjpeg-turbo.git" \
+    && git fetch --depth 1 origin "refs/tags/${LIBJPEG_TURBO_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/aarch64-linux-gnu \
+        -DCMAKE_INSTALL_LIBDIR=lib \
         -DCMAKE_SYSTEM_NAME=Linux \
         -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
         -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc \
@@ -84,8 +116,13 @@ RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libj
     && rm -rf /tmp/libjpeg-turbo
 
 # Build static libyuv from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
+RUN git init /tmp/libyuv \
     && cd /tmp/libyuv \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git remote add origin "${github_prefix}https://github.com/lemenkov/libyuv" \
+    && git fetch --depth 1 origin ${LIBYUV_REV} \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/aarch64-linux-gnu \
@@ -93,14 +130,24 @@ RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
         -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
         -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc \
         -DCMAKE_CXX_COMPILER=aarch64-linux-gnu-g++ \
+        -DJPEG_FOUND=TRUE \
+        -DJPEG_INCLUDE_DIR=/usr/aarch64-linux-gnu/include \
+        -DJPEG_LIBRARY=/usr/aarch64-linux-gnu/lib/libjpeg.a \
+        -DCMAKE_C_FLAGS="-DHAVE_JPEG -I/usr/aarch64-linux-gnu/include" \
+        -DCMAKE_CXX_FLAGS="-DHAVE_JPEG -I/usr/aarch64-linux-gnu/include" \
     && make -j$(nproc) \
     && make install \
     && rm -rf /tmp/libyuv
 
 # Build static libvpx from source (cross-compile for ARM64)
 # CC/CXX/LD/AR must be environment variables, not configure arguments
-RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libvpx \
     && cd /tmp/libvpx \
+    && git remote add origin "${github_prefix}https://github.com/webmproject/libvpx.git" \
+    && git fetch --depth 1 origin "refs/tags/v${LIBVPX_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && echo "=== libvpx: Configuring for ARM64 ===" \
     && export CC=aarch64-linux-gnu-gcc \
     && export CXX=aarch64-linux-gnu-g++ \
@@ -123,7 +170,9 @@ RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
     && rm -rf /tmp/libvpx
 
 # Build static libx264 from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 "${github_prefix}https://github.com/mirror/x264.git" /tmp/x264 \
     && cd /tmp/x264 \
     && export CC=aarch64-linux-gnu-gcc \
     && export AR=aarch64-linux-gnu-ar \
@@ -139,12 +188,18 @@ RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
     && rm -rf /tmp/x264
 
 # Build static libx265 from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://bitbucket.org/multicoreware/x265_git /tmp/x265 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/x265 \
     && cd /tmp/x265 \
+    && git remote add origin "${github_prefix}https://github.com/videolan/x265.git" \
+    && git fetch --depth 1 origin "refs/tags/${X265_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && cd source \
     && mkdir -p build \
     && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_NASM_FLAGS="-w-macro-params-legacy" \
         -DCMAKE_INSTALL_PREFIX=/usr/aarch64-linux-gnu \
         -DCMAKE_SYSTEM_NAME=Linux \
         -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
@@ -178,12 +233,15 @@ Cflags: -I\${includedir}
 EOF
 
 # Build static libopus from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && wget -O /tmp/opus.tar.gz "${github_prefix}https://github.com/xiph/opus/releases/download/v${OPUS_VERSION}/opus-${OPUS_VERSION}.tar.gz" \
+    && tar -xzf /tmp/opus.tar.gz -C /tmp \
+    && mv "/tmp/opus-${OPUS_VERSION}" /tmp/opus \
     && cd /tmp/opus \
     && export CC=aarch64-linux-gnu-gcc \
     && export AR=aarch64-linux-gnu-ar \
     && export RANLIB=aarch64-linux-gnu-ranlib \
-    && ./autogen.sh \
     && ./configure \
         --prefix=/usr/aarch64-linux-gnu \
         --host=aarch64-linux-gnu \
@@ -191,13 +249,24 @@ RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
         --disable-doc \
     && make -j$(nproc) \
     && make install \
-    && rm -rf /tmp/opus
+    && rm -rf /tmp/opus /tmp/opus.tar.gz
+
+# Reject raw formats smaller than the requested frame before any V4L2 upload.
+COPY build/cross/patches/0001-v4l2-m2m-reject-undersized-encoder-format.patch /tmp/ffmpeg-v4l2-size.patch
 
 # Download and build FFmpeg with RKMPP support
 RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
-    && wget -q https://files.mofeng.run/src/image/other/ffmpeg.tar.gz \
-    && tar -xzf ffmpeg.tar.gz \
-    && cd ffmpeg \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 --branch ${RKMPP_BRANCH} "${github_prefix}https://github.com/nyanmisaka/mpp.git" rkmpp \
+    && git clone --depth 1 --branch ${RKRGA_BRANCH} "${github_prefix}https://github.com/nyanmisaka/rk-mirrors.git" rkrga \
+    && git init ffmpeg-rockchip \
+    && cd ffmpeg-rockchip \
+    && git remote add origin "${github_prefix}https://github.com/nyanmisaka/ffmpeg-rockchip.git" \
+    && git fetch --depth 1 origin ${FFMPEG_ROCKCHIP_REV} \
+    && git checkout --detach FETCH_HEAD \
+    && patch -p1 < /tmp/ffmpeg-v4l2-size.patch \
+    && cd .. \
     # Build RKMPP
     && mkdir -p rkmpp/build && cd rkmpp/build \
     && cmake .. \
@@ -212,6 +281,7 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
     && make -j$(nproc) \
     && make install \
     && sed -i 's/^Libs:.*$/& -lstdc++ -lm -lpthread/' /usr/aarch64-linux-gnu/lib/pkgconfig/rockchip_mpp.pc \
+    && rm -f /usr/aarch64-linux-gnu/lib/librockchip_mpp.so* \
     && cd ../.. \
     # Build RKRGA - create cross file for meson
     && echo '[binaries]' > /tmp/aarch64-cross.txt \
@@ -239,6 +309,7 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
     && ar rcs /usr/aarch64-linux-gnu/lib/librga.a $(find build -name '*.o') \
     && ranlib /usr/aarch64-linux-gnu/lib/librga.a \
     && sed -i 's/^Libs:.*$/& -lstdc++ -lm -lpthread/' /usr/aarch64-linux-gnu/lib/pkgconfig/librga.pc \
+    && rm -f /usr/aarch64-linux-gnu/lib/librga.so* \
     && cd .. \
     # Create pkg-config wrapper for cross-compilation
     && echo '#!/bin/sh' > /tmp/aarch64-pkg-config \
@@ -327,7 +398,11 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
     && rm -rf /tmp/ffmpeg-build /tmp/aarch64-cross.txt /tmp/aarch64-pkg-config
 
 # Add Rust target
-RUN rustup target add aarch64-unknown-linux-gnu
+RUN if [ "$CHINAMIRRO" = "1" ]; then \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
+    fi \
+    && rustup target add aarch64-unknown-linux-gnu
 
 # Configure environment for cross-compilation
 ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
@@ -341,4 +416,4 @@ ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
     LIBYUV_STATIC=1 \
     OPUS_STATIC=1 \
     PKG_CONFIG_ALL_STATIC=1 \
-    RUSTFLAGS="-C linker=aarch64-linux-gnu-gcc"
+    RUSTFLAGS="-C linker=aarch64-linux-gnu-gcc -C link-arg=-Wl,--allow-multiple-definition"

build/cross/Dockerfile.armv7

@@ -1,21 +1,55 @@
-# Cross-compilation image for ARMv7 based on Debian 11
-# Build on Debian 11 (GLIBC 2.31) for maximum runtime compatibility
+# Cross-compilation image for ARMv7 based on Debian 12
+# Build on Debian 12 (GLIBC 2.36) to match the runtime images
 
-FROM debian:11
+ARG DEBIAN_IMAGE=debian:12
+FROM ${DEBIAN_IMAGE}
 
-# Linux headers used by v4l2r bindgen
-ARG LINUX_HEADERS_VERSION=6.6
-ARG LINUX_HEADERS_SHA256=
+ARG CHINAMIRRO=0
+ARG GH_PROXY=https://gh-proxy.com/
+ARG RUSTUP_DIST_SERVER_CN=https://mirrors.ustc.edu.cn/rust-static
+ARG RUSTUP_UPDATE_ROOT_CN=https://mirrors.ustc.edu.cn/rust-static/rustup
+ARG CARGO_INDEX_CN=https://mirrors.ustc.edu.cn/crates.io-index
+ARG CARGO_REGISTRY_CN=sparse+https://mirrors.ustc.edu.cn/crates.io-index/
+ARG LIBJPEG_TURBO_VERSION=3.1.4.1
+ARG LIBYUV_REV=957f295ea946cbbd13fcfc46e7066f2efa801233
+ARG LIBVPX_VERSION=1.16.0
+ARG X265_VERSION=3.4
+ARG OPUS_VERSION=1.5.2
+ARG RKMPP_BRANCH=jellyfin-mpp
+ARG RKRGA_BRANCH=jellyfin-rga
+ARG FFMPEG_ROCKCHIP_REV=40c412daccf08164493da0de990eb99a8948116b
 
-# Set Rustup mirrors (Aliyun)
-#ENV RUSTUP_UPDATE_ROOT=https://mirrors.aliyun.com/rustup/rustup \
-#    RUSTUP_DIST_SERVER=https://mirrors.aliyun.com/rustup
+# Optionally use China mirrors for builds in China.
+RUN if [ "$CHINAMIRRO" = "1" ]; then \
+        sed -i -E \
+            -e 's@http://deb.debian.org/debian([[:space:]]|$)@http://mirrors.tuna.tsinghua.edu.cn/debian\1@g' \
+            /etc/apt/sources.list.d/debian.sources; \
+    fi
 
 # Install Rust toolchain
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
+    && if [ "$CHINAMIRRO" = "1" ]; then \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
+    fi \
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable \
+    && if [ "$CHINAMIRRO" = "1" ]; then \
+        mkdir -p /root/.cargo; \
+        printf '%s\n' \
+            '[source.crates-io]' \
+            "replace-with = 'cn-mirror-sparse'" \
+            '[source.cn-mirror]' \
+            "registry = '${CARGO_INDEX_CN}'" \
+            '[source.cn-mirror-sparse]' \
+            "registry = '${CARGO_REGISTRY_CN}'" \
+            '[registries.cn-mirror]' \
+            "index = '${CARGO_INDEX_CN}'" \
+            '[net]' \
+            'git-fetch-with-cli = true' \
+            > /root/.cargo/config.toml; \
+    fi \
     && rm -rf /var/lib/apt/lists/*
 
 ENV PATH="/root/.cargo/bin:${PATH}"
@@ -26,6 +60,7 @@ RUN dpkg --add-architecture armhf
 # Install cross-compiler and native build tools
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
+    patch \
     pkg-config \
     cmake \
     nasm \
@@ -49,6 +84,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # Install ARMv7 development libraries (without VAAPI/X11 for ARM)
 RUN apt-get update && apt-get install -y --no-install-recommends \
+    libssl3 \
+    libssl3:armhf \
     libasound2-dev:armhf \
     libv4l-dev:armhf \
     libudev-dev:armhf \
@@ -57,23 +94,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libdrm-dev:armhf \
     && rm -rf /var/lib/apt/lists/*
 
-# Install newer V4L2 headers for v4l2r bindgen
-RUN mkdir -p /opt/v4l2-headers \
-    && wget -q https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${LINUX_HEADERS_VERSION}.tar.xz -O /tmp/linux-headers.tar.xz \
-    && if [ -n "$LINUX_HEADERS_SHA256" ]; then echo "$LINUX_HEADERS_SHA256  /tmp/linux-headers.tar.xz" | sha256sum -c -; fi \
-    && tar -xf /tmp/linux-headers.tar.xz -C /tmp \
-    && cd /tmp/linux-${LINUX_HEADERS_VERSION} \
-    && make ARCH=arm headers_install INSTALL_HDR_PATH=/opt/v4l2-headers \
-    && rm -rf /tmp/linux-${LINUX_HEADERS_VERSION} /tmp/linux-headers.tar.xz
-
-ENV V4L2R_VIDEODEV2_H_PATH=/opt/v4l2-headers/include
-
 # Build static libjpeg-turbo from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libjpeg-turbo \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libjpeg-turbo \
     && cd /tmp/libjpeg-turbo \
+    && git remote add origin "${github_prefix}https://github.com/libjpeg-turbo/libjpeg-turbo.git" \
+    && git fetch --depth 1 origin "refs/tags/${LIBJPEG_TURBO_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/arm-linux-gnueabihf \
+        -DCMAKE_INSTALL_LIBDIR=lib \
         -DCMAKE_SYSTEM_NAME=Linux \
         -DCMAKE_SYSTEM_PROCESSOR=arm \
         -DCMAKE_C_COMPILER=arm-linux-gnueabihf-gcc \
@@ -83,8 +115,13 @@ RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libj
     && rm -rf /tmp/libjpeg-turbo
 
 # Build static libyuv from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
+RUN git init /tmp/libyuv \
     && cd /tmp/libyuv \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git remote add origin "${github_prefix}https://github.com/lemenkov/libyuv" \
+    && git fetch --depth 1 origin ${LIBYUV_REV} \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/arm-linux-gnueabihf \
@@ -92,13 +129,23 @@ RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
         -DCMAKE_SYSTEM_PROCESSOR=arm \
         -DCMAKE_C_COMPILER=arm-linux-gnueabihf-gcc \
         -DCMAKE_CXX_COMPILER=arm-linux-gnueabihf-g++ \
+        -DJPEG_FOUND=TRUE \
+        -DJPEG_INCLUDE_DIR=/usr/arm-linux-gnueabihf/include \
+        -DJPEG_LIBRARY=/usr/arm-linux-gnueabihf/lib/libjpeg.a \
+        -DCMAKE_C_FLAGS="-DHAVE_JPEG -I/usr/arm-linux-gnueabihf/include" \
+        -DCMAKE_CXX_FLAGS="-DHAVE_JPEG -I/usr/arm-linux-gnueabihf/include" \
     && make -j$(nproc) \
     && make install \
     && rm -rf /tmp/libyuv
 
 # Build static libvpx from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libvpx \
     && cd /tmp/libvpx \
+    && git remote add origin "${github_prefix}https://github.com/webmproject/libvpx.git" \
+    && git fetch --depth 1 origin "refs/tags/v${LIBVPX_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && export CC=arm-linux-gnueabihf-gcc \
     && export CXX=arm-linux-gnueabihf-g++ \
     && export LD=arm-linux-gnueabihf-ld \
@@ -115,7 +162,9 @@ RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
     && rm -rf /tmp/libvpx
 
 # Build static libx264 from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 "${github_prefix}https://github.com/mirror/x264.git" /tmp/x264 \
     && cd /tmp/x264 \
     && export CC=arm-linux-gnueabihf-gcc \
     && export AR=arm-linux-gnueabihf-ar \
@@ -132,12 +181,18 @@ RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
     && rm -rf /tmp/x264
 
 # Build static libx265 from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://bitbucket.org/multicoreware/x265_git /tmp/x265 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/x265 \
     && cd /tmp/x265 \
+    && git remote add origin "${github_prefix}https://github.com/videolan/x265.git" \
+    && git fetch --depth 1 origin "refs/tags/${X265_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && cd source \
     && mkdir -p build \
     && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_NASM_FLAGS="-w-macro-params-legacy" \
         -DCMAKE_INSTALL_PREFIX=/usr/arm-linux-gnueabihf \
         -DCMAKE_SYSTEM_NAME=Linux \
         -DCMAKE_SYSTEM_PROCESSOR=arm \
@@ -167,12 +222,15 @@ Cflags: -I\${includedir}
 EOF
 
 # Build static libopus from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && wget -O /tmp/opus.tar.gz "${github_prefix}https://github.com/xiph/opus/releases/download/v${OPUS_VERSION}/opus-${OPUS_VERSION}.tar.gz" \
+    && tar -xzf /tmp/opus.tar.gz -C /tmp \
+    && mv "/tmp/opus-${OPUS_VERSION}" /tmp/opus \
     && cd /tmp/opus \
     && export CC=arm-linux-gnueabihf-gcc \
     && export AR=arm-linux-gnueabihf-ar \
     && export RANLIB=arm-linux-gnueabihf-ranlib \
-    && ./autogen.sh \
     && ./configure \
         --prefix=/usr/arm-linux-gnueabihf \
         --host=arm-linux-gnueabihf \
@@ -180,13 +238,24 @@ RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
         --disable-doc \
     && make -j$(nproc) \
     && make install \
-    && rm -rf /tmp/opus
+    && rm -rf /tmp/opus /tmp/opus.tar.gz
+
+# Reject raw formats smaller than the requested frame before any V4L2 upload.
+COPY build/cross/patches/0001-v4l2-m2m-reject-undersized-encoder-format.patch /tmp/ffmpeg-v4l2-size.patch
 
 # Download and build FFmpeg with RKMPP support
 RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
-    && wget -q https://files.mofeng.run/src/image/other/ffmpeg.tar.gz \
-    && tar -xzf ffmpeg.tar.gz \
-    && cd ffmpeg \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 --branch ${RKMPP_BRANCH} "${github_prefix}https://github.com/nyanmisaka/mpp.git" rkmpp \
+    && git clone --depth 1 --branch ${RKRGA_BRANCH} "${github_prefix}https://github.com/nyanmisaka/rk-mirrors.git" rkrga \
+    && git init ffmpeg-rockchip \
+    && cd ffmpeg-rockchip \
+    && git remote add origin "${github_prefix}https://github.com/nyanmisaka/ffmpeg-rockchip.git" \
+    && git fetch --depth 1 origin ${FFMPEG_ROCKCHIP_REV} \
+    && git checkout --detach FETCH_HEAD \
+    && patch -p1 < /tmp/ffmpeg-v4l2-size.patch \
+    && cd .. \
     # Build RKMPP
     && mkdir -p rkmpp/build && cd rkmpp/build \
     && cmake .. \
@@ -201,6 +270,7 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
     && make -j$(nproc) \
     && make install \
     && sed -i 's/^Libs:.*$/& -lstdc++ -lm -lpthread/' /usr/arm-linux-gnueabihf/lib/pkgconfig/rockchip_mpp.pc \
+    && rm -f /usr/arm-linux-gnueabihf/lib/librockchip_mpp.so* \
     && cd ../.. \
     # Build RKRGA - create cross file for meson
     && echo '[binaries]' > /tmp/armhf-cross.txt \
@@ -228,6 +298,7 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
     && ar rcs /usr/arm-linux-gnueabihf/lib/librga.a $(find build -name '*.o') \
     && ranlib /usr/arm-linux-gnueabihf/lib/librga.a \
     && sed -i 's/^Libs:.*$/& -lstdc++ -lm -lpthread/' /usr/arm-linux-gnueabihf/lib/pkgconfig/librga.pc \
+    && rm -f /usr/arm-linux-gnueabihf/lib/librga.so* \
     && cd .. \
     # Create pkg-config wrapper for cross-compilation
     && echo '#!/bin/sh' > /tmp/armhf-pkg-config \
@@ -316,7 +387,11 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
     && rm -rf /tmp/ffmpeg-build /tmp/armhf-cross.txt /tmp/armhf-pkg-config
 
 # Add Rust target
-RUN rustup target add armv7-unknown-linux-gnueabihf
+RUN if [ "$CHINAMIRRO" = "1" ]; then \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
+    fi \
+    && rustup target add armv7-unknown-linux-gnueabihf
 
 # Configure environment for cross-compilation
 ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER=arm-linux-gnueabihf-gcc \
@@ -330,7 +405,7 @@ ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER=arm-linux-gnueabihf-gcc \
     LIBYUV_STATIC=1 \
     OPUS_STATIC=1 \
     PKG_CONFIG_ALL_STATIC=1 \
-    RUSTFLAGS="-C linker=arm-linux-gnueabihf-gcc"
+    RUSTFLAGS="-C linker=arm-linux-gnueabihf-gcc -C link-arg=-Wl,--allow-multiple-definition"
 
 # Default command
 CMD ["bash"]

build/cross/Dockerfile.x86_64

@@ -1,21 +1,53 @@
-# Cross-compilation image for x86_64 based on Debian 11
-# Build on Debian 11 (GLIBC 2.31) for maximum runtime compatibility
+# Cross-compilation image for x86_64 based on Debian 12
+# Build on Debian 12 (GLIBC 2.36) to match the runtime images
 
-FROM debian:11
+ARG DEBIAN_IMAGE=debian:12
+FROM ${DEBIAN_IMAGE}
 
-# Linux headers used by v4l2r bindgen
-ARG LINUX_HEADERS_VERSION=6.6
-ARG LINUX_HEADERS_SHA256=
+ARG CHINAMIRRO=0
+ARG GH_PROXY=https://gh-proxy.com/
+ARG RUSTUP_DIST_SERVER_CN=https://mirrors.ustc.edu.cn/rust-static
+ARG RUSTUP_UPDATE_ROOT_CN=https://mirrors.ustc.edu.cn/rust-static/rustup
+ARG CARGO_INDEX_CN=https://mirrors.ustc.edu.cn/crates.io-index
+ARG CARGO_REGISTRY_CN=sparse+https://mirrors.ustc.edu.cn/crates.io-index/
+ARG LIBJPEG_TURBO_VERSION=3.1.4.1
+ARG LIBYUV_REV=957f295ea946cbbd13fcfc46e7066f2efa801233
+ARG LIBVPX_VERSION=1.16.0
+ARG X265_VERSION=3.4
+ARG OPUS_VERSION=1.5.2
+ARG FFMPEG_ROCKCHIP_REV=40c412daccf08164493da0de990eb99a8948116b
 
-# Set Rustup mirrors (Aliyun)
-#ENV RUSTUP_UPDATE_ROOT=https://mirrors.aliyun.com/rustup/rustup \
-#    RUSTUP_DIST_SERVER=https://mirrors.aliyun.com/rustup
+# Optionally use China mirrors for builds in China.
+RUN if [ "$CHINAMIRRO" = "1" ]; then \
+        sed -i -E \
+            -e 's@http://deb.debian.org/debian([[:space:]]|$)@http://mirrors.tuna.tsinghua.edu.cn/debian\1@g' \
+            /etc/apt/sources.list.d/debian.sources; \
+    fi
 
 # Install Rust toolchain
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
+    && if [ "$CHINAMIRRO" = "1" ]; then \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
+    fi \
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable \
+    && if [ "$CHINAMIRRO" = "1" ]; then \
+        mkdir -p /root/.cargo; \
+        printf '%s\n' \
+            '[source.crates-io]' \
+            "replace-with = 'cn-mirror-sparse'" \
+            '[source.cn-mirror]' \
+            "registry = '${CARGO_INDEX_CN}'" \
+            '[source.cn-mirror-sparse]' \
+            "registry = '${CARGO_REGISTRY_CN}'" \
+            '[registries.cn-mirror]' \
+            "index = '${CARGO_INDEX_CN}'" \
+            '[net]' \
+            'git-fetch-with-cli = true' \
+            > /root/.cargo/config.toml; \
+    fi \
     && rm -rf /var/lib/apt/lists/*
 
 ENV PATH="/root/.cargo/bin:${PATH}"
@@ -56,48 +88,62 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libxdmcp-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Install newer V4L2 headers for v4l2r bindgen
-RUN mkdir -p /opt/v4l2-headers \
-    && wget -q https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${LINUX_HEADERS_VERSION}.tar.xz -O /tmp/linux-headers.tar.xz \
-    && if [ -n "$LINUX_HEADERS_SHA256" ]; then echo "$LINUX_HEADERS_SHA256  /tmp/linux-headers.tar.xz" | sha256sum -c -; fi \
-    && tar -xf /tmp/linux-headers.tar.xz -C /tmp \
-    && cd /tmp/linux-${LINUX_HEADERS_VERSION} \
-    && make ARCH=x86 headers_install INSTALL_HDR_PATH=/opt/v4l2-headers \
-    && rm -rf /tmp/linux-${LINUX_HEADERS_VERSION} /tmp/linux-headers.tar.xz
-
-ENV V4L2R_VIDEODEV2_H_PATH=/opt/v4l2-headers/include
-
 # Build static libjpeg-turbo from source (needed by libyuv)
-RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libjpeg-turbo \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libjpeg-turbo \
     && cd /tmp/libjpeg-turbo \
+    && git remote add origin "${github_prefix}https://github.com/libjpeg-turbo/libjpeg-turbo.git" \
+    && git fetch --depth 1 origin "refs/tags/${LIBJPEG_TURBO_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DCMAKE_INSTALL_PREFIX=/usr/local \
+        -DCMAKE_INSTALL_LIBDIR=lib \
         -DENABLE_SHARED=OFF -DENABLE_STATIC=ON \
     && make -j$(nproc) \
     && make install \
     && rm -rf /tmp/libjpeg-turbo
 
 # Build static libyuv from source (uses libjpeg-turbo headers)
-RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
+RUN git init /tmp/libyuv \
     && cd /tmp/libyuv \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git remote add origin "${github_prefix}https://github.com/lemenkov/libyuv" \
+    && git fetch --depth 1 origin ${LIBYUV_REV} \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DJPEG_FOUND=TRUE \
+        -DJPEG_INCLUDE_DIR=/usr/local/include \
+        -DJPEG_LIBRARY=/usr/local/lib/libjpeg.a \
+        -DCMAKE_C_FLAGS="-DHAVE_JPEG -I/usr/local/include" \
+        -DCMAKE_CXX_FLAGS="-DHAVE_JPEG -I/usr/local/include" \
     && make -j$(nproc) \
     && make install \
     && rm -rf /tmp/libyuv
 
 # Build static libvpx from source
-RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libvpx \
     && cd /tmp/libvpx \
+    && git remote add origin "${github_prefix}https://github.com/webmproject/libvpx.git" \
+    && git fetch --depth 1 origin "refs/tags/v${LIBVPX_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && ./configure \
         --enable-static --disable-shared --enable-pic \
         --disable-examples --disable-tools --disable-docs \
+        --disable-unit-tests \
     && make -j$(nproc) \
     && make install \
     && rm -rf /tmp/libvpx
 
 # Build static libx264 from source
-RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 "${github_prefix}https://github.com/mirror/x264.git" /tmp/x264 \
     && cd /tmp/x264 \
     && ./configure --enable-static --disable-cli \
     && make -j$(nproc) \
@@ -105,12 +151,18 @@ RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
     && rm -rf /tmp/x264
 
 # Build static libx265 from source
-RUN git clone --depth 1 https://bitbucket.org/multicoreware/x265_git /tmp/x265 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/x265 \
     && cd /tmp/x265 \
+    && git remote add origin "${github_prefix}https://github.com/videolan/x265.git" \
+    && git fetch --depth 1 origin "refs/tags/${X265_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && cd source \
     && mkdir -p build \
     && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_NASM_FLAGS="-w-macro-params-legacy" \
         -DENABLE_SHARED=OFF \
         -DENABLE_CLI=OFF \
         -DBUILD_SHARED_LIBS=OFF \
@@ -135,21 +187,28 @@ Cflags: -I\${includedir}
 EOF
 
 # Build static libopus from source
-RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && wget -O /tmp/opus.tar.gz "${github_prefix}https://github.com/xiph/opus/releases/download/v${OPUS_VERSION}/opus-${OPUS_VERSION}.tar.gz" \
+    && tar -xzf /tmp/opus.tar.gz -C /tmp \
+    && mv "/tmp/opus-${OPUS_VERSION}" /tmp/opus \
     && cd /tmp/opus \
-    && ./autogen.sh \
     && ./configure \
         --enable-static --disable-shared \
         --disable-doc \
     && make -j$(nproc) \
     && make install \
-    && rm -rf /tmp/opus
+    && rm -rf /tmp/opus /tmp/opus.tar.gz
 
 # Download and build FFmpeg with minimal configuration for encoding only
 RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
-    && wget -q https://files.mofeng.run/src/image/other/ffmpeg.tar.gz \
-    && tar -xzf ffmpeg.tar.gz \
-    && cd ffmpeg/ffmpeg-rockchip \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init ffmpeg-rockchip \
+    && cd ffmpeg-rockchip \
+    && git remote add origin "${github_prefix}https://github.com/nyanmisaka/ffmpeg-rockchip.git" \
+    && git fetch --depth 1 origin ${FFMPEG_ROCKCHIP_REV} \
+    && git checkout --detach FETCH_HEAD \
     && ./configure \
         --enable-gpl \
         --enable-version3 \
@@ -221,7 +280,11 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
     && rm -rf /tmp/ffmpeg-build
 
 # Add Rust target
-RUN rustup target add x86_64-unknown-linux-gnu
+RUN if [ "$CHINAMIRRO" = "1" ]; then \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
+    fi \
+    && rustup target add x86_64-unknown-linux-gnu
 
 # Configure environment for static linking
 ENV PKG_CONFIG_ALLOW_CROSS=1\

build/cross/patches/0001-v4l2-m2m-reject-undersized-encoder-format.patch

@@ -0,0 +1,36 @@
+--- a/libavcodec/v4l2_m2m_enc.c
++++ b/libavcodec/v4l2_m2m_enc.c
+@@ -338,6 +338,7 @@
+     V4L2m2mPriv *priv = avctx->priv_data;
+     enum AVPixelFormat pix_fmt_output;
+     uint32_t v4l2_fmt_output;
++    unsigned int output_width, output_height;
+     int ret;
+ 
+     ret = ff_v4l2_m2m_create_context(priv, &s);
+@@ -370,6 +371,25 @@
+         v4l2_fmt_output = output->format.fmt.pix_mp.pixelformat;
+     else
+         v4l2_fmt_output = output->format.fmt.pix.pixelformat;
++
++    /* Drivers may clamp the requested raw format to their supported size.
++     * The software-frame upload still uses avctx/frame dimensions, so a
++     * smaller negotiated format would overrun the mapped output buffers.
++     * Allow upward alignment, but reject frames that do not fit.
++     */
++    if (V4L2_TYPE_IS_MULTIPLANAR(output->type)) {
++        output_width  = output->format.fmt.pix_mp.width;
++        output_height = output->format.fmt.pix_mp.height;
++    } else {
++        output_width  = output->format.fmt.pix.width;
++        output_height = output->format.fmt.pix.height;
++    }
++    if (output_width < avctx->width || output_height < avctx->height) {
++        av_log(avctx, AV_LOG_ERROR,
++               "Encoder cannot fit requested %dx%d frame in negotiated %ux%u format\n",
++               avctx->width, avctx->height, output_width, output_height);
++        return AVERROR(EINVAL);
++    }
+ 
+     pix_fmt_output = ff_v4l2_format_v4l2_to_avfmt(v4l2_fmt_output, AV_CODEC_ID_RAWVIDEO);
+     if (pix_fmt_output != avctx->pix_fmt) {

build/debian/control.tpl

@@ -6,6 +6,7 @@ Maintainer: SilentWind <admin@mofeng.run>
 Package: one-kvm
 Architecture: {arch}
 Depends: ${{auto}}, ca-certificates{distsuffix}
+Recommends: bluez
 Description: A open and lightweight IP-KVM solution written in Rust
  Enables BIOS-level remote management of servers and workstations.
  .
@@ -17,6 +18,7 @@ Description: A open and lightweight IP-KVM solution written in Rust
   * Hardware-accelerated video encoding (VAAPI, QSV, RKMPP)
   * WebRTC and MJPEG streaming with low latency
   * USB HID emulation via OTG gadget
+  * Classic Bluetooth keyboard and mouse via BlueZ
   * Mass storage device for ISO/IMG mounting
   * ATX power control via GPIO or USB relay
 Homepage: https://github.com/mofeng-git/One-KVM

build/debian/copyright

@@ -1,16 +1,130 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: one-kvm
-Source: https://github.com/mofeng-git/one-KVM
+Upstream-Contact: https://github.com/mofeng-git/One-KVM/issues
+Source: https://github.com/mofeng-git/One-KVM
 
 Files: *
 Copyright: 2025 One-KVM contributors
-License: GPL-2.0
+License: AGPL-3.0-only
+
+Files: protos/*
+Copyright: the RustDesk contributors
+           2025 One-KVM contributors
+License: AGPL-3.0-only
+Comment:
+ Protocol definition files derived from RustDesk
+ (https://github.com/rustdesk/rustdesk). Modified for One-KVM.
+ See protos/NOTICE for the full attribution.
+
+Files: src/rustdesk/*
+Copyright: the RustDesk contributors
+           2025 One-KVM contributors
+License: AGPL-3.0-only
+Comment:
+ Code derived from the RustDesk project, modified for One-KVM.
+ See src/rustdesk/NOTICE for the full attribution.
+
+Files: libs/hwcodec/*
+Copyright: the RustDesk contributors
+           2025 One-KVM contributors
+License: AGPL-3.0-only
+Comment:
+ Derived from the RustDesk hwcodec component. See libs/hwcodec/NOTICE.
+
+Files: libs/v4l2r/*
+Copyright: 2023-2024 Andrei Lytkin, Daniel Almeida, Collabora Ltd. and other v4l2r contributors
+License: Expat
 
 Files: libs/ventoy-img-rs/resources/*
 Copyright: Ventoy contributors
-License: GPL-2.0
+License: GPL-3.0+
+Comment:
+ Pre-built Ventoy boot files (boot.img, core.img.xz, ventoy.disk.img.xz).
+ Ventoy upstream: https://github.com/ventoy/Ventoy, licensed GPL-3.0-or-later.
 
-License: GPL-2.0
+Files: res/vcpkg/libyuv/*
+Copyright: The LibYuv Project Authors
+License: BSD-3-Clause
+
+Files: third-party/ffmpeg
+Copyright: FFmpeg developers and contributors
+License: GPL-2.0+
+Comment:
+ FFmpeg is built with --enable-gpl --enable-version3 and linked against
+ x264/x265; the resulting build is GPL-compatible with the AGPL-3.0 main
+ program. Upstream: https://ffmpeg.org/
+ The Linux builds use nyanmisaka/ffmpeg-rockchip at the commit pinned by
+ FFMPEG_ROCKCHIP_REV in build/cross/Dockerfile.*.
+
+Files: third-party/x264
+Copyright: x264 LLC and x264 contributors
+License: GPL-2.0+
+Comment: Upstream: https://www.videolan.org/developers/x264.html
+
+Files: third-party/x265
+Copyright: MulticoreWare, Inc. and x265 contributors
+License: GPL-2.0+
+Comment: Upstream: https://www.x265.org/
+
+Files: third-party/libvpx
+Copyright: The WebM Project authors
+License: BSD-3-Clause
+Comment: Upstream: https://www.webmproject.org/code/
+
+Files: third-party/libopus
+Copyright: Opus contributors
+License: BSD-3-Clause
+Comment: Upstream: https://opus-codec.org/
+
+Files: third-party/libjpeg-turbo
+Copyright: D. R. Commander and other libjpeg-turbo contributors
+License: BSD-3-Clause
+Comment: Upstream: https://libjpeg-turbo.org/
+
+Files: third-party/libsodium
+Copyright: 2013-2025 Frank Denis
+License: Expat
+Comment: Upstream: https://libsodium.gitbook.io/
+
+Files: third-party/sqlite
+Copyright: 1994-2010 Hipp, Wyrick & Company, Inc.
+License: SQLite-public-domain
+Comment: Upstream: https://www.sqlite.org/
+
+License: AGPL-3.0-only
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+ .
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ .
+ On Debian systems, the full text of the GNU Affero General Public License
+ version 3 can be found in the file `/usr/share/common-licenses/AGPL-3'.
+
+License: GPL-3.0+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ .
+ On Debian systems, the full text of the GNU General Public License
+ version 3 can be found in the file `/usr/share/common-licenses/GPL-3'.
+
+License: GPL-2.0+
  This program is free software: you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation, either version 2 of the License, or
@@ -22,8 +136,61 @@ License: GPL-2.0
  GNU General Public License for more details.
  .
  You should have received a copy of the GNU General Public License
- along with this program.  If not, write to the Free Software
- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ .
+ On Debian systems, the full text of the GNU General Public License
+ version 2 can be found in the file `/usr/share/common-licenses/GPL-2'.
 
-On Debian systems, the full text of the GNU General Public License
-version 2 can be found in the file `/usr/share/common-licenses/GPL-2'.
+License: Expat
+ Permission is hereby granted, free of charge, to any person obtaining a
+ copy of this software and associated documentation files (the "Software"),
+ to deal in the Software without restriction, including without limitation
+ the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ and/or sell copies of the Software, and to permit persons to whom the
+ Software is furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ DEALINGS IN THE SOFTWARE.
+
+License: BSD-3-Clause
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+ .
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+ .
+ 2. Redistributions in binary form must reproduce the above copyright notice,
+ this list of conditions and the following disclaimer in the documentation
+ and/or other materials provided with the distribution.
+ .
+ 3. Neither the name of the copyright holder nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+License: SQLite-public-domain
+ The author disclaims copyright to this source code.  In place of a legal
+ notice, here is a blessing:
+ .
+ May you do good and not evil.
+ May you find forgiveness for yourself and understand yourself.
+ May you share freely, never taking more than you give.

build/one-kvm.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=One-KVM IP-KVM Service
 Documentation=https://github.com/mofeng-git/One-KVM
-After=network.target
+After=network-online.target bluetooth.service
 Wants=network-online.target
 
 [Service]

build/package-deb.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 # Build deb packages from pre-compiled binaries
-# Binaries are compiled once on Debian 11 (GLIBC 2.31) via build-images.sh
+# Binaries are compiled once on Debian 12 (GLIBC 2.36) via build-images.sh
 # This script packages them directly on the host using dpkg-deb
 # Usage: ./build/build-deb.sh [arch]
 # Example: ./build/build-deb.sh aarch64
@@ -125,8 +125,8 @@ EOF
     chmod 755 "$PKG_DIR/DEBIAN/prerm"
 
     # Create control file
-    BASE_DEPS="libc6 (>= 2.31), libgcc-s1, libstdc++6, libasound2 (>= 1.1), libdrm2 (>= 2.4)"
-    AMD64_DEPS="libva2 (>= 2.0), libva-drm2 (>= 2.10), libva-x11-2 (>= 2.10), libmfx1 (>= 21.1), libx11-6 (>= 1.6), libxcb1 (>= 1.14), i965-va-driver-shaders (>= 2.4), intel-media-va-driver-non-free (>= 21.1)"
+    BASE_DEPS="libc6 (>= 2.36), libgcc-s1, libstdc++6, libasound2t64 (>= 1.1) | libasound2 (>= 1.1), libdrm2 (>= 2.4)"
+    AMD64_DEPS="libva2 (>= 2.0), libva-drm2 (>= 2.10), libva-x11-2 (>= 2.10), libmfx-gen1.2 (>= 22.0) | libmfx1 (>= 21.1), libx11-6 (>= 1.6), libxcb1 (>= 1.14), i965-va-driver-shaders (>= 2.4), intel-media-va-driver-non-free (>= 21.1)"
     DEPS="$BASE_DEPS"
     if [ "$DEB_ARCH" = "amd64" ]; then
         DEPS="$DEPS, $AMD64_DEPS"
@@ -139,10 +139,11 @@ Section: admin
 Priority: optional
 Architecture: $DEB_ARCH
 Depends: $DEPS
+Recommends: bluez
 Maintainer: SilentWind <admin@mofeng.run>
 Description: A open and lightweight IP-KVM solution
  Enables BIOS-level remote management of servers and workstations.
- Built on Debian 11, compatible with Debian 11+, Ubuntu 20.04+.
+ Built on Debian 12, compatible with Debian 12+, Ubuntu 24.04+.
 EOF
 
     # Build deb directly on host

build/package-docker.sh

@@ -204,9 +204,21 @@ get_tool_urls() {
 }
 
 # Download tools for a platform
+# Set CURL_PROXY=http://host:port to route GitHub downloads through an HTTP proxy
+# Set GHPROXY_PREFIX=https://ghfast.top/ to prefix GitHub URLs instead
 download_tools() {
     local platform="$1"
     local staging="$2"
+    local curl_proxy=()
+    if [ -n "${CURL_PROXY:-}" ]; then
+        curl_proxy=(-x "$CURL_PROXY")
+    fi
+    dl() {
+        # dl <url> <output>
+        local url="$1"
+        [ -n "${GHPROXY_PREFIX:-}" ] && url="${GHPROXY_PREFIX%/}/$url"
+        curl -fsSL "${curl_proxy[@]}" "$url" -o "$2"
+    }
 
     get_tool_urls "$platform"
 
@@ -214,14 +226,14 @@ download_tools() {
 
     # ttyd
     if [ ! -f "$staging/ttyd" ]; then
-        curl -fsSL "$TTYD_URL" -o "$staging/ttyd"
+        dl "$TTYD_URL" "$staging/ttyd"
         chmod +x "$staging/ttyd"
     fi
 
     if [ "$INCLUDE_THIRD_PARTY" = true ]; then
         # gostc
         if [ ! -f "$staging/gostc" ]; then
-            curl -fsSL "$GOSTC_URL" -o /tmp/gostc.tar.gz
+            dl "$GOSTC_URL" /tmp/gostc.tar.gz
             tar -xzf /tmp/gostc.tar.gz -C "$staging"
             chmod +x "$staging/gostc"
             rm /tmp/gostc.tar.gz
@@ -229,7 +241,7 @@ download_tools() {
 
         # easytier
         if [ ! -f "$staging/easytier-core" ]; then
-            curl -fsSL "$EASYTIER_URL" -o /tmp/easytier.zip
+            dl "$EASYTIER_URL" /tmp/easytier.zip
             unzip -o /tmp/easytier.zip -d /tmp/easytier
             cp "/tmp/easytier/$EASYTIER_DIR/easytier-core" "$staging/easytier-core"
             chmod +x "$staging/easytier-core"
@@ -311,9 +323,16 @@ build_for_platform() {
 
     local build_cmd="docker buildx build --platform $platform"
     build_cmd="$build_cmd --build-arg TARGETPLATFORM=$platform"
+    if [ -n "${APT_MIRROR:-}" ]; then
+        build_cmd="$build_cmd --build-arg APT_MIRROR=$APT_MIRROR"
+    fi
 
     if [ "$PUSH" = true ]; then
         build_cmd="$build_cmd --push"
+        # Aliyun ACR rejects the OCI artifact manifests used by BuildKit attestations.
+        if [[ "$REGISTRY" == registry.cn-*.aliyuncs.com/* ]]; then
+            build_cmd="$build_cmd --provenance=false --sbom=false"
+        fi
     elif [ "$LOAD" = true ]; then
         build_cmd="$build_cmd --load"
     fi

build/windows/build.ps1

@@ -0,0 +1,87 @@
+param(
+    [string]$Configuration = "debug",
+    [string]$Target = "x86_64-pc-windows-msvc",
+    [string]$Triplet = "x64-windows-static",
+    [string]$VcpkgRoot = $env:VCPKG_ROOT,
+    [string]$VcpkgInstalledRoot = $env:VCPKG_INSTALLED_DIR,
+    [switch]$NoDefaultFeatures,
+    [string[]]$Features = @(),
+    [switch]$Package,
+    [Parameter(ValueFromRemainingArguments = $true)]
+    [string[]]$CargoArgs = @()
+)
+
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..\..")
+Set-Location $repoRoot
+
+if ([string]::IsNullOrWhiteSpace($VcpkgRoot)) {
+    $VcpkgRoot = Join-Path (Split-Path $repoRoot -Parent) "vcpkg"
+}
+
+$VcpkgRoot = [System.IO.Path]::GetFullPath($VcpkgRoot)
+if ([string]::IsNullOrWhiteSpace($VcpkgInstalledRoot)) {
+    $VcpkgInstalledRoot = Join-Path $VcpkgRoot "installed"
+}
+
+$VcpkgInstalledRoot = [System.IO.Path]::GetFullPath($VcpkgInstalledRoot)
+$vcpkgTripletRoot = Join-Path $VcpkgInstalledRoot $Triplet
+$turbojpegLibDir = Join-Path $vcpkgTripletRoot "lib"
+$turbojpegIncludeDir = Join-Path $vcpkgTripletRoot "include"
+
+if (-not (Test-Path $VcpkgRoot)) {
+    throw "VCPKG_ROOT does not exist: $VcpkgRoot. Run build/windows/bootstrap-vcpkg.ps1 first."
+}
+
+if (-not (Test-Path $turbojpegLibDir) -or -not (Test-Path $turbojpegIncludeDir)) {
+    throw "vcpkg triplet is not installed at $vcpkgTripletRoot. Run build/windows/bootstrap-vcpkg.ps1 first."
+}
+
+$env:VCPKG_ROOT = $VcpkgRoot
+$env:VCPKG_DEFAULT_TRIPLET = $Triplet
+$env:VCPKG_INSTALLED_DIR = $VcpkgInstalledRoot
+$env:TURBOJPEG_SOURCE = "explicit"
+$env:TURBOJPEG_LIB_DIR = $turbojpegLibDir
+$env:TURBOJPEG_INCLUDE_DIR = $turbojpegIncludeDir
+
+$cargoCommand = @("build", "--target", $Target)
+
+if ($Configuration -eq "release") {
+    $cargoCommand += "--release"
+} elseif ($Configuration -ne "debug") {
+    throw "Unsupported configuration '$Configuration'. Use 'debug' or 'release'."
+}
+
+if ($NoDefaultFeatures) {
+    $cargoCommand += "--no-default-features"
+}
+
+if ($Features.Count -gt 0) {
+    $cargoCommand += "--features"
+    $cargoCommand += ($Features -join ",")
+}
+
+$cargoCommand += $CargoArgs
+
+cargo @cargoCommand
+
+if ($Package) {
+    $metadata = cargo metadata --no-deps --format-version 1 | ConvertFrom-Json
+    $packageInfo = $metadata.packages | Where-Object { $_.name -eq "one-kvm" } | Select-Object -First 1
+
+    if ($null -eq $packageInfo -or [string]::IsNullOrWhiteSpace($packageInfo.version)) {
+        throw "Failed to resolve version from Cargo metadata"
+    }
+
+    $sourcePath = Join-Path $repoRoot "target/$Target/release/one-kvm.exe"
+    $targetName = "one-kvm_{0}_amd64.exe" -f $packageInfo.version
+    $targetPath = Join-Path $repoRoot "target/$Target/release/$targetName"
+
+    if (-not (Test-Path $sourcePath)) {
+        throw "Windows binary not found: $sourcePath"
+    }
+
+    Copy-Item $sourcePath $targetPath
+    Write-Host $targetPath
+}

docs/macos-drag-compatibility.md

@@ -0,0 +1,24 @@
+# macOS 拖拽兼容模式（实验性）
+
+适用于 OTG 和 CH9329 后端的绝对鼠标输入。遇到目标 Mac 上拖拽只能移动一小段便停止时，可在设置页的 HID 配置中开启「macOS 拖拽兼容模式」。默认关闭。
+
+配置字段为 `hid.mouse_macos_drag`，旧 PR 的 `ch9329_macos_drag` 字段仍可作为读取别名。OTG 必须同时启用相对鼠标和绝对鼠标接口，否则配置保存会被拒绝。CH9329 同时启用 Linux 兼容开关时，此模式优先。
+
+## 报告行为
+
+- 未按键时仍使用绝对坐标定位。
+- 从绝对输入开始的拖拽：按下使用绝对报告，移动和滚轮使用相对报告，释放时先更新相对按钮状态，再发送绝对按钮释放。
+- 按键报告的通道保持到所有按钮释放，不随拖拽期间的输入模式切换而改变。
+- 从相对输入开始的点击、拖拽继续使用相对按钮报告；此选项不修复原生相对模式的点击兼容问题。
+- 位移从原始 15 位输入坐标换算，累计小数余量，大位移按单包范围分包并保留总量及方向。
+- 运行时使用当前视频采集尺寸，并在 HID 重载后恢复尺寸；视频尚未提供尺寸时使用配置尺寸。
+
+## 验证范围与限制
+
+本次 OTG 扩展及位移换算修改没有 macOS 实机验证。原 PR 作者对旧 CH9329 实现的实机反馈不能视为本版本已经验证。
+
+本地自动化覆盖位移累计/分包、1080p/4K 换算、往返移动、滚轮、输入模式切换、复位、CH9329 命令队列、OTG 临时文件模拟端点及配置校验。临时文件测试仅验证写出的字节，不验证 USB 枚举或目标系统的事件解释。
+
+相对位移受 macOS 鼠标速度、加速、显示缩放及多屏布局影响，无法保证与绝对定位逐像素一致。松手报告携带最后的客户端绝对坐标，仍可能出现落点偏移或光标跳位；大位移分包也可能增加低波特率串口延迟。
+
+后续实机验证应分别覆盖两个后端：窗口/文件/文本拖拽，快速及慢速移动，滚轮和多按钮组合，1080p/4K 与缩放显示，输入模式切换、断开重连、精确落点。异常时关闭此选项恢复默认行为。

libs/bluetooth-hid/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "one-kvm-bluetooth-hid"
+version = "0.1.0"
+edition = "2021"
+license = "AGPL-3.0-only"
+
+[dependencies]
+bluer = { version = "0.17", features = ["bluetoothd", "l2cap"] }
+dbus = { version = "0.9", features = ["vendored"] }
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "time", "process"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+dbus-crossroads = "0.5"
+dbus-tokio = "0.7"
+libc = "0.2"
+tracing = "0.1"

libs/bluetooth-hid/examples/pairing_probe.rs

@@ -0,0 +1,49 @@
+//! Explicit hardware regression: opens a 10-second pairing window without
+//! removing existing bonds or sending input. Stop the production HID first.
+use one_kvm_bluetooth_hid::{Action, Config, Peripheral};
+use std::time::Duration;
+
+#[tokio::main]
+async fn main() -> Result<(), String> {
+    let peripheral = Peripheral::start(Config {
+        adapter: "hci0".into(),
+        name: "One-KVM HID".into(),
+        peer: None,
+    })?;
+    let result = async {
+        for _ in 0..50 {
+            if peripheral.status().initialized {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(100)).await;
+        }
+        let before = peripheral.status();
+        if !before.initialized {
+            return Err(format!("Initialization failed: {:?}", before.error));
+        }
+        if !before
+            .devices
+            .iter()
+            .any(|d| Some(&d.address) == before.peer.as_ref() && d.paired)
+        {
+            return Err("This regression needs an existing bonded computer".into());
+        }
+        peripheral.action(Action::Pair(10)).await?;
+        tokio::time::sleep(Duration::from_secs(1)).await;
+        let open = peripheral.status();
+        println!("open: {}", serde_json::to_string(&open).unwrap());
+        if open.pairing_seconds == 0 {
+            return Err("Existing bond prematurely closed pairing".into());
+        }
+        tokio::time::sleep(Duration::from_secs(10)).await;
+        let expired = peripheral.status();
+        println!("expired: {}", serde_json::to_string(&expired).unwrap());
+        if expired.pairing_seconds != 0 || expired.peer != before.peer {
+            return Err("Window did not expire while preserving the bonded peer".into());
+        }
+        Ok(())
+    }
+    .await;
+    let cleanup = peripheral.shutdown().await;
+    result.and(cleanup)
+}

libs/bluetooth-hid/examples/probe.rs

@@ -0,0 +1,24 @@
+//! Native hardware smoke check. Registers for 12 seconds, sends no input,
+//! opens no pairing window, then restores the adapter configuration.
+use one_kvm_bluetooth_hid::{Config, Peripheral};
+use std::time::Duration;
+#[tokio::main]
+async fn main() -> Result<(), String> {
+    let peripheral = Peripheral::start(Config {
+        adapter: "hci0".into(),
+        name: "One-KVM HID".into(),
+        peer: None,
+    })?;
+    let mut initialized = false;
+    for _ in 0..12 {
+        tokio::time::sleep(Duration::from_secs(1)).await;
+        let status = peripheral.status();
+        initialized |= status.initialized;
+        println!("{}", serde_json::to_string(&status).unwrap());
+    }
+    peripheral.shutdown().await?;
+    if !initialized {
+        return Err("Native BlueZ peripheral never initialized".into());
+    }
+    Ok(())
+}

libs/bluetooth-hid/src/agent.rs

@@ -0,0 +1,236 @@
+use crate::Shared;
+use dbus::{channel::MatchingReceiver, message::MatchRule, nonblock::Proxy, Path};
+use dbus_crossroads::Crossroads;
+use std::{
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+const PATH: &str = "/org/onekvm/bluetooth/agent";
+pub struct Agent {
+    connection: Arc<dbus::nonblock::SyncConnection>,
+    task: tokio::task::JoinHandle<()>,
+}
+impl Agent {
+    pub async fn register(shared: Arc<Shared>, adapter: String) -> Result<Self, String> {
+        let (resource, connection) =
+            dbus_tokio::connection::new_system_sync().map_err(|e| e.to_string())?;
+        let task = tokio::spawn(async move {
+            let _ = resource.await;
+        });
+        let mut cr = Crossroads::new();
+        let iface = cr.register("org.bluez.Agent1", |b| {
+            b.method("Release", (), (), |_, _: &mut (), ()| Ok(()));
+            b.method("Cancel", (), (), |_, _: &mut (), ()| Ok(()));
+            let state = shared.clone();
+            let name = adapter.clone();
+            b.method(
+                "RequestAuthorization",
+                ("device",),
+                (),
+                move |_, _: &mut (), (path,): (Path<'static>,)| {
+                    authorize(&state, &name, &path, true)
+                },
+            );
+            let state = shared.clone();
+            let name = adapter.clone();
+            b.method(
+                "RequestConfirmation",
+                ("device", "passkey"),
+                (),
+                move |_, _: &mut (), (path, _): (Path<'static>, u32)| {
+                    authorize(&state, &name, &path, true)
+                },
+            );
+            b.method(
+                "AuthorizeService",
+                ("device", "uuid"),
+                (),
+                move |_, _: &mut (), (path, uuid): (Path<'static>, String)| {
+                    if !matches!(uuid.as_str(), "00001124-0000-1000-8000-00805f9b34fb") {
+                        return Err(dbus::MethodErr::from((
+                            "org.bluez.Error.Rejected",
+                            "Not an HID service",
+                        )));
+                    }
+                    authorize(&shared, &adapter, &path, false)
+                },
+            );
+        });
+        cr.insert(PATH, &[iface], ());
+        let profile = cr.register("org.bluez.Profile1", |b| {
+            b.method("Release", (), (), |_, _: &mut (), ()| Ok(()));
+            b.method(
+                "RequestDisconnection",
+                ("device",),
+                (),
+                |_, _: &mut (), (_device,): (Path<'static>,)| Ok(()),
+            );
+            b.method(
+                "NewConnection",
+                ("device", "fd", "properties"),
+                (),
+                |_,
+                 _: &mut (),
+                 (_device, _fd, _props): (
+                    Path<'static>,
+                    dbus::arg::OwnedFd,
+                    dbus::arg::PropMap,
+                )| {
+                    // This profile only publishes SDP. Our L2CAP sockets own both HID channels.
+                    Err::<(), _>(dbus::MethodErr::from((
+                        "org.bluez.Error.Rejected",
+                        "Unexpected profile connection",
+                    )))
+                },
+            );
+        });
+        cr.insert("/org/onekvm/bluetooth/profile", &[profile], ());
+        connection.start_receive(
+            MatchRule::new_method_call(),
+            Box::new(move |msg, conn| {
+                let _ = cr.handle_message(msg, conn);
+                true
+            }),
+        );
+        let agent = Self { connection, task };
+        let proxy = Proxy::new(
+            "org.bluez",
+            "/org/bluez",
+            Duration::from_secs(5),
+            agent.connection.clone(),
+        );
+        let result: Result<(), dbus::Error> = proxy
+            .method_call(
+                "org.bluez.AgentManager1",
+                "RegisterAgent",
+                (Path::from(PATH), "NoInputNoOutput"),
+            )
+            .await;
+        if let Err(error) = result {
+            return Err(error.to_string());
+        }
+        let result: Result<(), dbus::Error> = proxy
+            .method_call(
+                "org.bluez.AgentManager1",
+                "RequestDefaultAgent",
+                (Path::from(PATH),),
+            )
+            .await;
+        result.map_err(|e| e.to_string())?;
+        let mut options: dbus::arg::PropMap = std::collections::HashMap::new();
+        options.insert(
+            "ServiceRecord".into(),
+            dbus::arg::Variant(Box::new(crate::protocol::sdp())),
+        );
+        options.insert(
+            "Role".into(),
+            dbus::arg::Variant(Box::new("server".to_string())),
+        );
+        options.insert(
+            "RequireAuthentication".into(),
+            dbus::arg::Variant(Box::new(true)),
+        );
+        options.insert(
+            "RequireAuthorization".into(),
+            dbus::arg::Variant(Box::new(false)),
+        );
+        let result: Result<(), dbus::Error> = proxy
+            .method_call(
+                "org.bluez.ProfileManager1",
+                "RegisterProfile",
+                (
+                    Path::from("/org/onekvm/bluetooth/profile"),
+                    crate::protocol::HID_UUID,
+                    options,
+                ),
+            )
+            .await;
+        result.map_err(|e| format!("Register HID SDP: {e}"))?;
+        Ok(agent)
+    }
+}
+impl Drop for Agent {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
+fn authorize(
+    shared: &Shared,
+    adapter: &str,
+    path: &str,
+    pairing: bool,
+) -> Result<(), dbus::MethodErr> {
+    let rejected = || {
+        dbus::MethodErr::from((
+            "org.bluez.Error.Rejected",
+            "Open pairing in One-KVM or select the paired computer",
+        ))
+    };
+    let prefix = format!("/org/bluez/{adapter}/dev_");
+    let address = path
+        .strip_prefix(&prefix)
+        .ok_or_else(rejected)?
+        .replace('_', ":");
+    let mut state = shared.state.lock().unwrap();
+    if pairing
+        && !state
+            .pairing_until
+            .is_some_and(|until| until > Instant::now())
+    {
+        return Err(rejected());
+    }
+    if state.peer.as_ref().is_some_and(|peer| peer != &address) {
+        return Err(rejected());
+    }
+    if state.peer.is_none() {
+        if !pairing || state.bonded_before_pairing.contains(&address) {
+            return Err(rejected());
+        }
+        state.peer = Some(address);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn existing_unrelated_bond_cannot_be_adopted_by_agent_callback() {
+        let shared = Shared::new(None);
+        {
+            let mut state = shared.state.lock().unwrap();
+            state.pairing_until = Some(Instant::now() + Duration::from_secs(120));
+            state
+                .bonded_before_pairing
+                .insert("10:6F:D9:66:97:88".into());
+        }
+        assert!(authorize(
+            &shared,
+            "hci0",
+            "/org/bluez/hci0/dev_10_6F_D9_66_97_88",
+            true
+        )
+        .is_err());
+        assert!(shared.state.lock().unwrap().peer.is_none());
+    }
+    #[test]
+    fn only_pair_during_window_and_pin_first_peer() {
+        let state = Shared::new(None);
+        let first = "/org/bluez/hci0/dev_10_6F_D9_66_97_88";
+        assert!(authorize(&state, "hci0", first, true).is_err());
+        state.state.lock().unwrap().pairing_until = Some(Instant::now() + Duration::from_secs(60));
+        assert!(authorize(&state, "hci0", first, true).is_ok());
+        assert!(authorize(
+            &state,
+            "hci0",
+            "/org/bluez/hci0/dev_10_6F_D9_66_97_89",
+            true
+        )
+        .is_err());
+        assert!(authorize(&state, "hci1", first, true).is_err());
+        state.state.lock().unwrap().pairing_until = None;
+        assert!(authorize(&state, "hci0", first, false).is_ok());
+        assert!(authorize(&state, "hci0", first, true).is_err());
+    }
+}

libs/bluetooth-hid/src/bonds.rs

@@ -0,0 +1,145 @@
+//! Only bonds explicitly owned by this HID peripheral may be removed.
+use bluer::{Adapter, Session};
+use std::{future::Future, pin::Pin};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Bond {
+    pub adapter: String,
+    pub peer: String,
+    pub pending: bool,
+}
+pub type Operation<'a, T> = Pin<Box<dyn Future<Output = Result<T, String>> + Send + 'a>>;
+pub trait BondStore: Send + Sync {
+    fn list(&self) -> Operation<'_, Vec<Bond>>;
+    fn save(&self, bond: Bond) -> Operation<'_, ()>;
+    fn remove(&self, bond: Bond) -> Operation<'_, ()>;
+}
+
+pub async fn clean_adapter(store: &dyn BondStore, adapter: &Adapter) -> Result<(), String> {
+    let address = adapter
+        .address()
+        .await
+        .map_err(|e| e.to_string())?
+        .to_string();
+    clean_owned(store, &address, |peer| async move {
+        let peer = peer.parse().map_err(|_| "Invalid stored HID peer")?;
+        if adapter
+            .device_addresses()
+            .await
+            .map_err(|e| e.to_string())?
+            .contains(&peer)
+        {
+            adapter
+                .remove_device(peer)
+                .await
+                .map_err(|e| e.to_string())?;
+        }
+        Ok(())
+    })
+    .await
+}
+
+async fn clean_owned<F, Fut>(
+    store: &dyn BondStore,
+    address: &str,
+    mut remove: F,
+) -> Result<(), String>
+where
+    F: FnMut(String) -> Fut,
+    Fut: Future<Output = Result<(), String>>,
+{
+    for bond in store
+        .list()
+        .await?
+        .into_iter()
+        .filter(|b| b.pending && b.adapter == address)
+    {
+        remove(bond.peer.clone()).await?;
+        // Keep the tombstone until BlueZ confirms removal; retry safely after interruption.
+        store.remove(bond).await?;
+    }
+    Ok(())
+}
+
+pub async fn reset(store: &dyn BondStore, explicit: Vec<Bond>) -> Result<(), String> {
+    let session = Session::new().await.map_err(|e| e.to_string())?;
+    let mut owned = store.list().await?;
+    owned.extend(explicit);
+    for mut bond in owned {
+        bond.pending = true;
+        store.save(bond).await?;
+    }
+    for name in session.adapter_names().await.map_err(|e| e.to_string())? {
+        clean_adapter(store, &session.adapter(&name).map_err(|e| e.to_string())?).await?;
+    }
+    // Records for absent adapters remain pending and are cleaned before their next use.
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex;
+    #[derive(Default)]
+    struct Memory(Mutex<Vec<Bond>>);
+    impl BondStore for Memory {
+        fn list(&self) -> Operation<'_, Vec<Bond>> {
+            Box::pin(async { Ok(self.0.lock().unwrap().clone()) })
+        }
+        fn save(&self, bond: Bond) -> Operation<'_, ()> {
+            Box::pin(async move {
+                let mut rows = self.0.lock().unwrap();
+                rows.retain(|b| b.adapter != bond.adapter || b.peer != bond.peer);
+                rows.push(bond);
+                Ok(())
+            })
+        }
+        fn remove(&self, bond: Bond) -> Operation<'_, ()> {
+            Box::pin(async move {
+                self.0.lock().unwrap().retain(|b| b != &bond);
+                Ok(())
+            })
+        }
+    }
+    fn bond(adapter: &str, peer: &str, pending: bool) -> Bond {
+        Bond {
+            adapter: adapter.into(),
+            peer: peer.into(),
+            pending,
+        }
+    }
+    #[tokio::test]
+    async fn cleanup_only_removes_owned_pending_bonds_on_the_selected_hardware() {
+        let current = bond("adapter-A", "host-1", true);
+        let absent = bond("adapter-B", "host-2", true);
+        let retained = bond("adapter-A", "host-3", false);
+        let store = Memory(Mutex::new(vec![current, absent.clone(), retained.clone()]));
+        let removed = Mutex::new(Vec::new());
+        clean_owned(&store, "adapter-A", |peer| {
+            removed.lock().unwrap().push(peer);
+            async { Ok(()) }
+        })
+        .await
+        .unwrap();
+        assert_eq!(*removed.lock().unwrap(), vec!["host-1"]);
+        assert_eq!(store.list().await.unwrap(), vec![absent, retained]);
+    }
+    #[tokio::test]
+    async fn cleanup_failure_keeps_tombstone_and_is_reported() {
+        let record = bond("adapter-A", "host-1", true);
+        let store = Memory(Mutex::new(vec![record.clone()]));
+        assert_eq!(
+            clean_owned(&store, "adapter-A", |_| async {
+                Err("BlueZ denied removal".into())
+            })
+            .await
+            .unwrap_err(),
+            "BlueZ denied removal"
+        );
+        assert_eq!(store.list().await.unwrap(), vec![record]);
+        clean_owned(&store, "adapter-A", |_| async { Ok(()) })
+            .await
+            .unwrap();
+        assert!(store.list().await.unwrap().is_empty());
+    }
+}

libs/bluetooth-hid/src/controller.rs

@@ -0,0 +1,135 @@
+//! Exclusive controller ownership. No BLE switching or power cycling.
+use std::{
+    fs::{File, OpenOptions},
+    os::{fd::AsRawFd, unix::fs::OpenOptionsExt},
+    process::Stdio,
+    time::Duration,
+};
+use tokio::process::Command;
+pub struct Controller {
+    _lock: File,
+    adapter: String,
+    old_class: (u8, u8),
+    old_connectable: bool,
+}
+async fn run_once(adapter: &str, args: &[&str]) -> Result<String, String> {
+    let mut cmd = Command::new("btmgmt");
+    cmd.arg("--index")
+        .arg(adapter.trim_start_matches("hci"))
+        .args(args)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .kill_on_drop(true);
+    let mut child = cmd
+        .spawn()
+        .map_err(|e| format!("Install bluez/btmgmt: {e}"))?;
+    // BlueZ 5.55's btmgmt exits on stdin EOF, even with a command argument.
+    // Keep a pipe open until it finishes; systemd normally supplies /dev/null.
+    let stdin = child.stdin.take();
+    let result = tokio::time::timeout(Duration::from_secs(5), child.wait_with_output())
+        .await
+        .map_err(|_| "btmgmt timeout")?
+        .map_err(|e| format!("Install bluez/btmgmt: {e}"))?;
+    drop(stdin);
+    let text = String::from_utf8_lossy(&result.stdout).into_owned();
+    if !result.status.success()
+        || !result.stderr.is_empty()
+        || text.to_lowercase().contains("failed")
+    {
+        return Err(format!(
+            "btmgmt {}: {text} {}",
+            args.join(" "),
+            String::from_utf8_lossy(&result.stderr)
+        ));
+    }
+    Ok(text)
+}
+async fn run(adapter: &str, args: &[&str]) -> Result<String, String> {
+    // BlueZ updates the EIR/class asynchronously after registering SDP.
+    // Kernel management rejects a simultaneous class change with Busy.
+    for attempt in 0..5 {
+        match run_once(adapter, args).await {
+            Err(error) if error.contains("(Busy)") && attempt < 4 => {
+                tokio::time::sleep(Duration::from_millis(200)).await;
+            }
+            result => return result,
+        }
+    }
+    unreachable!()
+}
+impl Controller {
+    pub async fn acquire(adapter: &str) -> Result<Self, String> {
+        let lock = OpenOptions::new()
+            .read(true)
+            .write(true)
+            .create(true)
+            .truncate(false)
+            .mode(0o600)
+            .custom_flags(libc::O_NOFOLLOW)
+            .open(format!("/run/one-kvm-bluetooth-{adapter}.lock"))
+            .map_err(|e| e.to_string())?;
+        if unsafe { libc::flock(lock.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) } != 0 {
+            return Err("Bluetooth adapter already owned by One-KVM".into());
+        }
+        let info = run(adapter, &["info"]).await?;
+        let settings = info
+            .lines()
+            .find_map(|l| l.trim().strip_prefix("current settings:"))
+            .ok_or("Cannot read Bluetooth settings")?;
+        if !settings.split_whitespace().any(|s| s == "br/edr") {
+            return Err(
+                "Classic Bluetooth disabled; enable BR/EDR with btmgmt before using HID".into(),
+            );
+        }
+        let class = info
+            .split_whitespace()
+            .skip_while(|s| *s != "class")
+            .nth(1)
+            .ok_or("Missing Bluetooth class")?;
+        let class =
+            u32::from_str_radix(class.trim_start_matches("0x"), 16).map_err(|e| e.to_string())?;
+        Ok(Self {
+            _lock: lock,
+            adapter: adapter.into(),
+            old_class: (((class >> 8) & 0x1f) as u8, (class & 0xfc) as u8),
+            old_connectable: settings.split_whitespace().any(|s| s == "connectable"),
+        })
+    }
+    pub async fn configure(&self) -> Result<(), String> {
+        run(&self.adapter, &["class", "5", "192"]).await?;
+        run(&self.adapter, &["connectable", "on"]).await?;
+        Ok(())
+    }
+    pub async fn restore(&self) -> Result<(), String> {
+        let mut errors = vec![];
+        if let Err(e) = run(
+            &self.adapter,
+            &[
+                "class",
+                &self.old_class.0.to_string(),
+                &self.old_class.1.to_string(),
+            ],
+        )
+        .await
+        {
+            errors.push(e);
+        }
+        if let Err(e) = run(
+            &self.adapter,
+            &[
+                "connectable",
+                if self.old_connectable { "on" } else { "off" },
+            ],
+        )
+        .await
+        {
+            errors.push(e);
+        }
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(errors.join("; "))
+        }
+    }
+}

libs/bluetooth-hid/src/lib.rs

@@ -0,0 +1,964 @@
+//! Classic Bluetooth HID peripheral: SDP + L2CAP. Linux/BlueZ only.
+mod agent;
+pub mod bonds;
+mod controller;
+mod protocol;
+
+use bluer::{
+    l2cap::{Security, SecurityLevel, SeqPacket, SeqPacketListener, Socket, SocketAddr},
+    Adapter, Address, AddressType, Session,
+};
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::HashSet,
+    sync::{Arc, Mutex},
+    time::{Duration, Instant},
+};
+use tokio::sync::{mpsc, oneshot, watch, Mutex as AsyncMutex};
+
+#[derive(Debug, Clone)]
+pub struct Config {
+    pub adapter: String,
+    pub name: String,
+    pub peer: Option<String>,
+}
+impl Config {
+    pub fn validate(&self) -> Result<(), String> {
+        if !self
+            .adapter
+            .strip_prefix("hci")
+            .is_some_and(|n| !n.is_empty() && n.bytes().all(|c| c.is_ascii_digit()))
+        {
+            return Err("Bluetooth adapter must be hci followed by an index".into());
+        }
+        if self.name.is_empty() || self.name.len() > 64 || self.name.chars().any(char::is_control) {
+            return Err(
+                "Bluetooth name must contain 1–64 UTF-8 bytes without control characters".into(),
+            );
+        }
+        if let Some(peer) = &self.peer {
+            peer.parse::<Address>()
+                .map_err(|_| "Invalid Bluetooth peer address")?;
+        }
+        Ok(())
+    }
+}
+#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Status {
+    pub initialized: bool,
+    pub connected: bool,
+    pub ready: bool,
+    pub adapter: String,
+    pub adapter_address: String,
+    pub peer: Option<String>,
+    pub pairing_seconds: u32,
+    pub control_connected: bool,
+    pub interrupt_connected: bool,
+    pub leds: u8,
+    pub generation: u64,
+    pub error: Option<String>,
+    pub devices: Vec<Device>,
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Device {
+    pub address: String,
+    pub name: String,
+    pub paired: bool,
+    pub connected: bool,
+}
+#[derive(Debug, Clone, Copy)]
+pub enum Report {
+    Keyboard,
+    Mouse,
+    Consumer,
+}
+impl Report {
+    fn len(self) -> usize {
+        match self {
+            Self::Keyboard => 8,
+            Self::Mouse => 4,
+            Self::Consumer => 2,
+        }
+    }
+    fn id(self) -> u8 {
+        match self {
+            Self::Keyboard => 1,
+            Self::Mouse => 2,
+            Self::Consumer => 3,
+        }
+    }
+}
+struct State {
+    peer: Option<String>,
+    pairing_until: Option<Instant>,
+    bonded_before_pairing: HashSet<String>,
+}
+impl State {
+    fn observe_bond(&mut self, address: &str, paired: bool) {
+        // Just Works may complete without an Agent1 authorization callback.
+        // Adopt only a new bond from our explicit window, respecting a pinned peer.
+        if paired
+            && self.peer.is_none()
+            && self
+                .pairing_until
+                .is_some_and(|until| until > Instant::now())
+            && !self.bonded_before_pairing.contains(address)
+        {
+            self.peer = Some(address.to_owned());
+            tracing::info!(
+                peer = address,
+                "Bluetooth HID selected newly bonded computer"
+            );
+        }
+    }
+    fn close_pairing(&mut self, paired: bool, fallback: Option<String>) {
+        self.pairing_until = None;
+        if !paired {
+            self.peer = fallback;
+        }
+    }
+    fn pairing_completed(&self, selected_paired: bool) -> bool {
+        selected_paired
+            && self
+                .peer
+                .as_ref()
+                .is_some_and(|peer| !self.bonded_before_pairing.contains(peer))
+    }
+}
+struct Shared {
+    state: Mutex<State>,
+}
+impl Shared {
+    fn new(peer: Option<String>) -> Self {
+        Self {
+            state: Mutex::new(State {
+                peer,
+                pairing_until: None,
+                bonded_before_pairing: HashSet::new(),
+            }),
+        }
+    }
+    fn allowed(&self, address: Address) -> bool {
+        self.state.lock().unwrap().peer.as_deref() == Some(address.to_string().as_str())
+    }
+}
+pub enum Action {
+    Pair(u32),
+    ClosePairing,
+    Forget,
+    Disconnect,
+    Reset,
+}
+enum Command {
+    Report(Report, Vec<u8>),
+    Action(Action),
+    Stop,
+}
+struct Request {
+    command: Command,
+    result: oneshot::Sender<Result<(), String>>,
+    expires: Instant,
+}
+pub struct Peripheral {
+    tx: mpsc::Sender<Request>,
+    status: watch::Receiver<Status>,
+    task: AsyncMutex<Option<tokio::task::JoinHandle<()>>>,
+}
+impl Peripheral {
+    pub fn start(config: Config) -> Result<Self, String> {
+        Self::start_with_store(config, None)
+    }
+    pub fn start_with_store(
+        config: Config,
+        bonds: Option<Arc<dyn bonds::BondStore>>,
+    ) -> Result<Self, String> {
+        config.validate()?;
+        let (tx, rx) = mpsc::channel(64);
+        let (state_tx, status) = watch::channel(Status {
+            adapter: config.adapter.clone(),
+            ..Default::default()
+        });
+        let task = tokio::spawn(supervise(config, bonds, rx, state_tx));
+        Ok(Self {
+            tx,
+            status,
+            task: AsyncMutex::new(Some(task)),
+        })
+    }
+    pub fn status(&self) -> Status {
+        self.status.borrow().clone()
+    }
+    pub fn subscribe(&self) -> watch::Receiver<Status> {
+        self.status.clone()
+    }
+    async fn request(&self, command: Command, duration: Duration) -> Result<(), String> {
+        let (result, rx) = oneshot::channel();
+        let request = Request {
+            command,
+            result,
+            expires: Instant::now() + duration,
+        };
+        self.tx
+            .try_send(request)
+            .map_err(|_| "Bluetooth input queue unavailable or full".to_string())?;
+        tokio::time::timeout(duration, rx)
+            .await
+            .map_err(|_| "Bluetooth operation timed out".to_string())?
+            .map_err(|_| "Bluetooth worker stopped".to_string())?
+    }
+    pub async fn send(&self, report: Report, value: Vec<u8>) -> Result<(), String> {
+        if value.len() != report.len() {
+            return Err("Invalid HID report size".into());
+        }
+        self.request(Command::Report(report, value), Duration::from_millis(500))
+            .await
+    }
+    pub async fn action(&self, action: Action) -> Result<(), String> {
+        self.request(Command::Action(action), Duration::from_secs(15))
+            .await
+    }
+    pub async fn shutdown(&self) -> Result<(), String> {
+        if let Some(task) = self.task.lock().await.take() {
+            let result = self.request(Command::Stop, Duration::from_secs(45)).await;
+            // Do not abort: the worker must restore the radio before a backend switch.
+            task.await.map_err(|e| e.to_string())?;
+            result
+        } else {
+            Ok(())
+        }
+    }
+}
+
+fn listen(address: Address, psm: u16) -> Result<SeqPacketListener, String> {
+    let socket = Socket::<SeqPacket>::new_seq_packet().map_err(|e| e.to_string())?;
+    socket
+        .set_security(Security {
+            level: SecurityLevel::Medium,
+            key_size: 0,
+        })
+        .map_err(|e| e.to_string())?;
+    socket.bind(SocketAddr::new(address,AddressType::BrEdr,psm))
+        .map_err(|e|format!("Cannot bind classic HID PSM 0x{psm:02x}: {e}. Disable BlueZ input plugin; see Bluetooth HID setup."))?;
+    socket.listen(2).map_err(|e| e.to_string())
+}
+struct Runtime {
+    adapter: Adapter,
+    _session: Session,
+    shared: Arc<Shared>,
+    agent: Option<agent::Agent>,
+    controller: controller::Controller,
+    listeners: [SeqPacketListener; 2],
+    channels: [Option<Arc<SeqPacket>>; 2],
+    channel_peer: Option<Address>,
+    partial_since: Option<Instant>,
+    hid: protocol::HidProtocol,
+    generation: u64,
+    old_pairable: bool,
+    old_powered: bool,
+    old_alias: String,
+    old_discoverable: bool,
+    old_discoverable_timeout: u32,
+    old_pairable_timeout: u32,
+    config: Config,
+    bonds: Option<Arc<dyn bonds::BondStore>>,
+    recorded_peer: Option<String>,
+}
+impl Runtime {
+    async fn open(
+        config: &Config,
+        bonds: Option<Arc<dyn bonds::BondStore>>,
+    ) -> Result<Self, String> {
+        let controller = controller::Controller::acquire(&config.adapter).await?;
+        let session = Session::new().await.map_err(|e| e.to_string())?;
+        let adapter = session
+            .adapter(&config.adapter)
+            .map_err(|e| e.to_string())?;
+        let address = adapter.address().await.map_err(|e| e.to_string())?;
+        let mut config = config.clone();
+        if let Some(store) = &bonds {
+            bonds::clean_adapter(store.as_ref(), &adapter).await?;
+            if config.peer.is_none() {
+                config.peer = store
+                    .list()
+                    .await?
+                    .into_iter()
+                    .find(|bond| bond.adapter == address.to_string() && !bond.pending)
+                    .map(|bond| bond.peer);
+            }
+        }
+        // Acquire BOTH channels before changing adapter state. Conflict is a startup error.
+        let listeners = [listen(address, 0x11)?, listen(address, 0x13)?];
+        let old_powered = adapter.is_powered().await.map_err(|e| e.to_string())?;
+        let old_pairable = adapter.is_pairable().await.map_err(|e| e.to_string())?;
+        let old_alias = adapter.alias().await.map_err(|e| e.to_string())?;
+        let old_discoverable = adapter.is_discoverable().await.map_err(|e| e.to_string())?;
+        let old_discoverable_timeout = adapter
+            .discoverable_timeout()
+            .await
+            .map_err(|e| e.to_string())?;
+        let old_pairable_timeout = adapter
+            .pairable_timeout()
+            .await
+            .map_err(|e| e.to_string())?;
+        let shared = Arc::new(Shared::new(
+            config.peer.as_ref().map(|p| p.to_ascii_uppercase()),
+        ));
+        let mut runtime = Self {
+            adapter,
+            _session: session,
+            shared,
+            agent: None,
+            controller,
+            listeners,
+            channels: [None, None],
+            channel_peer: None,
+            partial_since: None,
+            hid: Default::default(),
+            generation: 0,
+            old_pairable,
+            old_powered,
+            old_alias,
+            old_discoverable,
+            old_discoverable_timeout,
+            old_pairable_timeout,
+            config: config.clone(),
+            bonds,
+            recorded_peer: None,
+        };
+        if let Err(e) = runtime.setup().await {
+            let restore = runtime.close().await;
+            return Err(format!("{e}; cleanup: {restore:?}"));
+        }
+        Ok(runtime)
+    }
+    async fn setup(&mut self) -> Result<(), String> {
+        self.adapter
+            .set_powered(true)
+            .await
+            .map_err(|e| e.to_string())?;
+        self.adapter
+            .set_discoverable(false)
+            .await
+            .map_err(|e| e.to_string())?;
+        self.adapter
+            .set_pairable(false)
+            .await
+            .map_err(|e| e.to_string())?;
+        self.adapter
+            .set_alias(self.config.name.clone())
+            .await
+            .map_err(|e| e.to_string())?;
+        self.agent =
+            Some(agent::Agent::register(self.shared.clone(), self.config.adapter.clone()).await?);
+        self.controller.configure().await?;
+        self.public(None).await?;
+        Ok(())
+    }
+    async fn public(&self, seconds: Option<u32>) -> Result<(), String> {
+        if let Some(seconds) = seconds {
+            self.adapter
+                .set_pairable_timeout(seconds)
+                .await
+                .map_err(|e| e.to_string())?;
+            self.adapter
+                .set_discoverable_timeout(seconds)
+                .await
+                .map_err(|e| e.to_string())?;
+            self.adapter
+                .set_pairable(true)
+                .await
+                .map_err(|e| e.to_string())?;
+            if let Err(e) = self.adapter.set_discoverable(true).await {
+                let _ = self.adapter.set_pairable(false).await;
+                return Err(e.to_string());
+            }
+        } else {
+            self.adapter
+                .set_discoverable(false)
+                .await
+                .map_err(|e| e.to_string())?;
+            self.adapter
+                .set_pairable(false)
+                .await
+                .map_err(|e| e.to_string())?;
+        }
+        Ok(())
+    }
+    fn drop_channels(&mut self) {
+        for socket in self.channels.iter_mut().filter_map(Option::take) {
+            let _ = socket.shutdown(std::net::Shutdown::Both);
+        }
+        self.channel_peer = None;
+        self.partial_since = None;
+        self.hid = Default::default();
+        self.generation = self.generation.wrapping_add(1);
+    }
+    async fn packet(&self, index: usize, data: &[u8]) -> Result<(), String> {
+        let socket = self.channels[index]
+            .as_ref()
+            .ok_or("Classic HID channel not connected")?;
+        let sent = tokio::time::timeout(Duration::from_millis(250), socket.send(data))
+            .await
+            .map_err(|_| "HID send timeout")?
+            .map_err(|e| e.to_string())?;
+        if sent != data.len() {
+            return Err("Short HID packet write".into());
+        }
+        Ok(())
+    }
+    async fn release(&mut self) {
+        for packet in self.hid.release() {
+            if self.channels[1].is_some() && self.packet(1, &packet).await.is_err() {
+                self.drop_channels();
+                break;
+            }
+        }
+        self.generation = self.generation.wrapping_add(1);
+    }
+    async fn accept(
+        &mut self,
+        index: usize,
+        socket: SeqPacket,
+        peer: SocketAddr,
+    ) -> Result<(), String> {
+        if peer.addr_type != AddressType::BrEdr {
+            return Ok(());
+        }
+        // A host can open HID channels before the next status poll.
+        let paired = self
+            .adapter
+            .device(peer.addr)
+            .map_err(|e| e.to_string())?
+            .is_paired()
+            .await
+            .map_err(|e| e.to_string())?;
+        self.shared
+            .state
+            .lock()
+            .unwrap()
+            .observe_bond(&peer.addr.to_string(), paired);
+        if !self.shared.allowed(peer.addr) {
+            return Ok(());
+        }
+        if self.channel_peer.is_some_and(|p| p != peer.addr) || self.channels[index].is_some() {
+            return Ok(());
+        }
+        // Kernel BT_SECURITY_MEDIUM negotiates encryption before accept completes.
+        if socket
+            .as_ref()
+            .security()
+            .map_err(|e| e.to_string())?
+            .key_size
+            < 7
+        {
+            return Ok(());
+        }
+        self.channel_peer = Some(peer.addr);
+        self.channels[index] = Some(Arc::new(socket));
+        if self.channels.iter().all(Option::is_some) {
+            self.partial_since = None;
+            self.release().await;
+        } else {
+            self.partial_since = Some(Instant::now());
+        }
+        Ok(())
+    }
+    async fn status(&mut self) -> Result<Status, String> {
+        if !self.adapter.is_powered().await.map_err(|e| e.to_string())? {
+            return Err("Bluetooth adapter powered off".into());
+        }
+        // A daemon restart loses the SDP registration even if the adapter comes back powered.
+        if !self
+            .adapter
+            .uuids()
+            .await
+            .map_err(|e| e.to_string())?
+            .unwrap_or_default()
+            .iter()
+            .any(|id| id.to_string() == protocol::HID_UUID)
+        {
+            return Err("Classic HID SDP registration lost; restarting Bluetooth backend".into());
+        }
+        let mut status = Status {
+            initialized: true,
+            adapter: self.config.adapter.clone(),
+            adapter_address: self
+                .adapter
+                .address()
+                .await
+                .map_err(|e| e.to_string())?
+                .to_string(),
+            ..Default::default()
+        };
+        for address in self
+            .adapter
+            .device_addresses()
+            .await
+            .map_err(|e| e.to_string())?
+        {
+            let device = self.adapter.device(address).map_err(|e| e.to_string())?;
+            let connected = device.is_connected().await.unwrap_or(false);
+            let paired = device.is_paired().await.unwrap_or(false);
+            self.shared
+                .state
+                .lock()
+                .unwrap()
+                .observe_bond(&address.to_string(), paired);
+            if paired || connected {
+                status.devices.push(Device {
+                    address: address.to_string(),
+                    name: device.alias().await.unwrap_or_default(),
+                    paired,
+                    connected,
+                });
+            }
+        }
+        status.devices.sort_by(|a, b| a.address.cmp(&b.address));
+        let (peer, until) = {
+            let state = self.shared.state.lock().unwrap();
+            (state.peer.clone(), state.pairing_until)
+        };
+        status.peer = peer.clone();
+        let selected = status
+            .devices
+            .iter()
+            .find(|device| Some(&device.address) == peer.as_ref());
+        let selected_paired = selected.is_some_and(|device| device.paired);
+        if selected_paired && self.recorded_peer != peer {
+            if let (Some(store), Some(peer)) = (&self.bonds, &peer) {
+                store
+                    .save(bonds::Bond {
+                        adapter: status.adapter_address.clone(),
+                        peer: peer.clone(),
+                        pending: false,
+                    })
+                    .await?;
+                self.recorded_peer = Some(peer.clone());
+            }
+        }
+        status.connected = selected.is_some_and(|device| device.paired && device.connected);
+        if self.channels.iter().any(Option::is_some)
+            && (!status.connected
+                || self
+                    .partial_since
+                    .is_some_and(|time| time.elapsed() > Duration::from_secs(10)))
+        {
+            self.drop_channels();
+        }
+        if let Some(until) = until {
+            let completed = self
+                .shared
+                .state
+                .lock()
+                .unwrap()
+                .pairing_completed(selected_paired);
+            if until <= Instant::now() || completed {
+                {
+                    let mut state = self.shared.state.lock().unwrap();
+                    state.close_pairing(
+                        selected_paired,
+                        self.config.peer.as_ref().map(|p| p.to_ascii_uppercase()),
+                    );
+                    status.peer = state.peer.clone();
+                }
+                self.public(None).await?;
+                tracing::info!(reason = if completed { "bonded" } else { "expired" }, peer = ?status.peer, "Bluetooth HID pairing window closed");
+            } else {
+                status.pairing_seconds =
+                    until.saturating_duration_since(Instant::now()).as_secs() as u32 + 1;
+            }
+        }
+        status.control_connected = self.channels[0].is_some();
+        status.interrupt_connected = self.channels[1].is_some();
+        status.ready = status.connected
+            && status.control_connected
+            && status.interrupt_connected
+            && !self.hid.suspended;
+        status.leds = self.hid.leds;
+        status.generation = self.generation;
+        Ok(status)
+    }
+    async fn forget(&mut self) -> Result<(), String> {
+        self.release().await;
+        self.drop_channels();
+        let peer = self.shared.state.lock().unwrap().peer.clone();
+        if let Some(peer) = &peer {
+            let address = peer.parse().map_err(|_| "Invalid peer")?;
+            if self
+                .adapter
+                .device_addresses()
+                .await
+                .map_err(|e| e.to_string())?
+                .contains(&address)
+            {
+                self.adapter
+                    .remove_device(address)
+                    .await
+                    .map_err(|e| e.to_string())?;
+            }
+            self.shared
+                .state
+                .lock()
+                .unwrap()
+                .bonded_before_pairing
+                .remove(peer);
+            tracing::info!(%peer, "Bluetooth HID forgot computer");
+        }
+        if let Some(store) = &self.bonds {
+            let address = self
+                .adapter
+                .address()
+                .await
+                .map_err(|e| e.to_string())?
+                .to_string();
+            for bond in store
+                .list()
+                .await?
+                .into_iter()
+                .filter(|b| b.adapter == address && Some(&b.peer) == peer.as_ref())
+            {
+                store.remove(bond).await?;
+            }
+        }
+        self.recorded_peer = None;
+        self.config.peer = None;
+        self.shared.state.lock().unwrap().peer = None;
+        Ok(())
+    }
+    async fn incoming(&mut self, index: usize, data: &[u8]) -> Result<(), String> {
+        if index == 1 {
+            self.hid.output(data);
+            return Ok(());
+        }
+        let result = self.hid.control(data);
+        if let Some(reply) = result.reply {
+            self.packet(0, &reply).await?;
+        }
+        if result.reset {
+            self.release().await;
+        }
+        if result.unplug {
+            self.forget().await?;
+        }
+        Ok(())
+    }
+    async fn execute(&mut self, command: Command) -> Result<(), String> {
+        match command {
+            Command::Report(kind, value) => {
+                let peer = self.channel_peer.ok_or("Classic HID is not connected")?;
+                if !self.shared.allowed(peer) || self.channels.iter().any(Option::is_none) {
+                    return Err("Classic HID channels are not ready".into());
+                }
+                let device = self.adapter.device(peer).map_err(|e| e.to_string())?;
+                if !device.is_paired().await.unwrap_or(false)
+                    || !device.is_connected().await.unwrap_or(false)
+                {
+                    self.drop_channels();
+                    return Err("Selected Bluetooth computer disconnected".into());
+                }
+                let packet = self.hid.input(kind, &value)?;
+                if let Err(e) = self.packet(1, &packet).await {
+                    self.drop_channels();
+                    return Err(e);
+                }
+            }
+            Command::Action(Action::Pair(seconds)) => {
+                if !(10..=300).contains(&seconds) {
+                    return Err("Pairing window must be 10–300 seconds".into());
+                }
+                let mut bonded = HashSet::new();
+                for address in self
+                    .adapter
+                    .device_addresses()
+                    .await
+                    .map_err(|e| e.to_string())?
+                {
+                    if self
+                        .adapter
+                        .device(address)
+                        .map_err(|e| e.to_string())?
+                        .is_paired()
+                        .await
+                        .map_err(|e| e.to_string())?
+                    {
+                        bonded.insert(address.to_string());
+                    }
+                }
+                {
+                    let mut state = self.shared.state.lock().unwrap();
+                    // Preserve the original baseline when extending an open window.
+                    if !state
+                        .pairing_until
+                        .is_some_and(|until| until > Instant::now())
+                    {
+                        state.bonded_before_pairing = bonded;
+                    }
+                    state.pairing_until =
+                        Some(Instant::now() + Duration::from_secs(seconds.into()));
+                }
+                if let Err(e) = self.public(Some(seconds)).await {
+                    self.shared.state.lock().unwrap().pairing_until = None;
+                    return Err(e);
+                }
+                tracing::info!(seconds, "Bluetooth HID pairing window opened");
+            }
+            Command::Action(Action::ClosePairing) => {
+                self.public(None).await?;
+                let peer = self.shared.state.lock().unwrap().peer.clone();
+                let paired = if let Some(peer) = peer {
+                    self.adapter
+                        .device(peer.parse().map_err(|_| "Invalid HID peer")?)
+                        .map_err(|e| e.to_string())?
+                        .is_paired()
+                        .await
+                        .map_err(|e| e.to_string())?
+                } else {
+                    false
+                };
+                self.shared
+                    .state
+                    .lock()
+                    .unwrap()
+                    .close_pairing(paired, self.config.peer.clone());
+                tracing::info!(reason = "manual", "Bluetooth HID pairing window closed");
+            }
+            Command::Action(Action::Forget) => self.forget().await?,
+            Command::Action(Action::Disconnect) => {
+                self.release().await;
+                self.drop_channels();
+                let peer = self.shared.state.lock().unwrap().peer.clone();
+                if let Some(peer) = peer {
+                    self.adapter
+                        .device(peer.parse().map_err(|_| "Invalid peer")?)
+                        .map_err(|e| e.to_string())?
+                        .disconnect()
+                        .await
+                        .map_err(|e| e.to_string())?;
+                }
+            }
+            Command::Action(Action::Reset) => self.release().await,
+            Command::Stop => {}
+        }
+        Ok(())
+    }
+    async fn close(&mut self) -> Result<(), String> {
+        self.release().await;
+        self.drop_channels();
+        self.agent.take();
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let mut errors = vec![];
+        if let Err(e) = self.adapter.set_discoverable(false).await {
+            errors.push(e.to_string());
+        }
+        if let Err(e) = self.controller.restore().await {
+            errors.push(e);
+        }
+        if let Err(e) = self.adapter.set_alias(self.old_alias.clone()).await {
+            errors.push(e.to_string());
+        }
+        if let Err(e) = self
+            .adapter
+            .set_discoverable_timeout(self.old_discoverable_timeout)
+            .await
+        {
+            errors.push(e.to_string());
+        }
+        if let Err(e) = self
+            .adapter
+            .set_pairable_timeout(self.old_pairable_timeout)
+            .await
+        {
+            errors.push(e.to_string());
+        }
+        if let Err(e) = self.adapter.set_pairable(self.old_pairable).await {
+            errors.push(e.to_string());
+        }
+        if let Err(e) = self.adapter.set_discoverable(self.old_discoverable).await {
+            errors.push(e.to_string());
+        }
+        if let Err(e) = self.adapter.set_powered(self.old_powered).await {
+            errors.push(e.to_string());
+        }
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(errors.join("; "))
+        }
+    }
+}
+async fn receive(socket: Option<Arc<SeqPacket>>, buffer: &mut [u8]) -> std::io::Result<usize> {
+    match socket {
+        Some(socket) => socket.recv(buffer).await,
+        None => std::future::pending().await,
+    }
+}
+async fn supervise(
+    config: Config,
+    bonds: Option<Arc<dyn bonds::BondStore>>,
+    mut rx: mpsc::Receiver<Request>,
+    tx: watch::Sender<Status>,
+) {
+    let mut generation = 0;
+    loop {
+        let mut runtime = match Runtime::open(&config, bonds.clone()).await {
+            Ok(runtime) => runtime,
+            Err(error) => {
+                tx.send_replace(Status {
+                    adapter: config.adapter.clone(),
+                    error: Some(error.clone()),
+                    generation,
+                    ..Default::default()
+                });
+                let delay = tokio::time::sleep(Duration::from_secs(5));
+                tokio::pin!(delay);
+                loop {
+                    tokio::select! {_=&mut delay=>break,request=rx.recv()=>{
+                        let Some(request)=request else{return;};
+                        if matches!(request.command,Command::Stop){let _=request.result.send(Ok(()));return;}
+                        let _=request.result.send(Err(error.clone()));
+                    }}
+                }
+                continue;
+            }
+        };
+        runtime.generation = generation;
+        let mut timer = tokio::time::interval(Duration::from_millis(500));
+        let failure = loop {
+            let ctl = runtime.channels[0].clone();
+            let intr = runtime.channels[1].clone();
+            let mut ctl_buffer = [0; 1024];
+            let mut intr_buffer = [0; 1024];
+            tokio::select! {
+                accepted=runtime.listeners[0].accept()=>{match accepted{Ok((socket,peer))=>{if let Err(e)=runtime.accept(0,socket,peer).await{break e;}},Err(e)=>break e.to_string()}}
+                accepted=runtime.listeners[1].accept()=>{match accepted{Ok((socket,peer))=>{if let Err(e)=runtime.accept(1,socket,peer).await{break e;}},Err(e)=>break e.to_string()}}
+                read=receive(ctl,&mut ctl_buffer)=>{match read{Ok(n)if n>0=>{if runtime.incoming(0,&ctl_buffer[..n]).await.is_err(){runtime.drop_channels();}},_=>runtime.drop_channels()}}
+                read=receive(intr,&mut intr_buffer)=>{match read{Ok(n)if n>0=>{if runtime.incoming(1,&intr_buffer[..n]).await.is_err(){runtime.drop_channels();}},_=>runtime.drop_channels()}}
+                _=timer.tick()=>{match runtime.status().await{Ok(status)=>{tx.send_if_modified(|old|{if *old!=status{*old=status;true}else{false}});},Err(e)=>break e}}
+                request=rx.recv()=>{
+                    let Some(request)=request else{let _=runtime.close().await;return;};
+                    if matches!(request.command,Command::Stop){let result=runtime.close().await;tx.send_replace(Status{adapter:config.adapter.clone(),..Default::default()});let _=request.result.send(result);return;}
+                    if request.expires<=Instant::now()||request.result.is_closed(){runtime.release().await;continue;}
+                    let action = matches!(&request.command, Command::Action(_));
+                    let result=runtime.execute(request.command).await;
+                    if result.is_err(){runtime.release().await;}
+                    if action {
+                        if let Ok(status) = runtime.status().await { tx.send_replace(status); }
+                    }
+                    let _=request.result.send(result);
+                }
+            }
+        };
+        let restore = runtime.close().await;
+        generation = runtime.generation.wrapping_add(1);
+        tx.send_replace(Status {
+            adapter: config.adapter.clone(),
+            error: Some(format!("{failure}; cleanup: {restore:?}")),
+            generation,
+            ..Default::default()
+        });
+        drop(runtime);
+        tokio::time::sleep(Duration::from_secs(2)).await;
+    }
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn closing_pairing_preserves_completed_bonds_but_releases_unpaired_targets() {
+        let shared = Shared::new(Some("10:6F:D9:66:97:88".into()));
+        let mut state = shared.state.lock().unwrap();
+        state.pairing_until = Some(Instant::now() + Duration::from_secs(120));
+        state.close_pairing(true, None);
+        assert_eq!(state.peer.as_deref(), Some("10:6F:D9:66:97:88"));
+        assert!(state.pairing_until.is_none());
+        state.close_pairing(false, None);
+        assert!(state.peer.is_none());
+    }
+    #[test]
+    fn configuration_validation() {
+        let mut c = Config {
+            adapter: "hci0".into(),
+            name: "One-KVM".into(),
+            peer: None,
+        };
+        assert!(c.validate().is_ok());
+        c.adapter = "hci0;reboot".into();
+        assert!(c.validate().is_err());
+        c.adapter = "hci1".into();
+        c.peer = Some("bogus".into());
+        assert!(c.validate().is_err());
+    }
+    #[test]
+    fn peer_isolation() {
+        let state = Shared::new(Some("10:6F:D9:66:97:88".into()));
+        assert!(state.allowed("10:6F:D9:66:97:88".parse().unwrap()));
+        assert!(!state.allowed("10:6F:D9:66:97:89".parse().unwrap()));
+    }
+    #[test]
+    fn new_bond_without_agent_callback_completes_pairing() {
+        let shared = Shared::new(None);
+        let mut state = shared.state.lock().unwrap();
+        state.pairing_until = Some(Instant::now() + Duration::from_secs(120));
+        let peer = "10:6F:D9:66:97:88";
+        state.observe_bond(peer, false);
+        assert_eq!(state.peer, None);
+        state.observe_bond(peer, true);
+        assert_eq!(state.peer.as_deref(), Some(peer));
+        assert!(state.pairing_completed(true));
+        // A second computer cannot replace the one selected in this window.
+        state.observe_bond("10:6F:D9:66:97:89", true);
+        assert_eq!(state.peer.as_deref(), Some(peer));
+    }
+    #[test]
+    fn old_bond_does_not_finish_a_new_window() {
+        let peer = "10:6F:D9:66:97:88";
+        let shared = Shared::new(Some(peer.into()));
+        let mut state = shared.state.lock().unwrap();
+        state.pairing_until = Some(Instant::now() + Duration::from_secs(120));
+        state.bonded_before_pairing.insert(peer.into());
+        state.observe_bond(peer, true);
+        assert!(!state.pairing_completed(true));
+        state.peer = None;
+        state.observe_bond(peer, true);
+        assert_eq!(state.peer, None);
+    }
+    #[test]
+    fn bond_observation_respects_closed_window_and_pinned_peer() {
+        let peer = "10:6F:D9:66:97:88";
+        let shared = Shared::new(None);
+        let mut state = shared.state.lock().unwrap();
+        state.observe_bond(peer, true);
+        assert_eq!(state.peer, None);
+        state.pairing_until = Some(Instant::now() - Duration::from_secs(1));
+        state.observe_bond(peer, true);
+        assert_eq!(state.peer, None);
+        state.pairing_until = Some(Instant::now() + Duration::from_secs(120));
+        state.peer = Some("10:6F:D9:66:97:89".into());
+        state.observe_bond(peer, true);
+        assert_eq!(state.peer.as_deref(), Some("10:6F:D9:66:97:89"));
+    }
+}
+
+#[derive(Serialize)]
+pub struct AdapterInfo {
+    pub name: String,
+    pub address: String,
+    pub powered: bool,
+}
+pub async fn adapters() -> Result<Vec<AdapterInfo>, String> {
+    let session = Session::new().await.map_err(|e| e.to_string())?;
+    let mut output = vec![];
+    for name in session.adapter_names().await.map_err(|e| e.to_string())? {
+        let adapter = session.adapter(&name).map_err(|e| e.to_string())?;
+        output.push(AdapterInfo {
+            name,
+            address: adapter
+                .address()
+                .await
+                .map_err(|e| e.to_string())?
+                .to_string(),
+            powered: adapter.is_powered().await.map_err(|e| e.to_string())?,
+        });
+    }
+    Ok(output)
+}

libs/bluetooth-hid/src/protocol.rs

@@ -0,0 +1,267 @@
+//! Classic HIDP framing and report descriptor.
+use crate::Report;
+pub const MAP: &[u8] = &[
+    0x05, 0x01, 0x09, 0x06, 0xa1, 0x01, 0x85, 0x01, 0x05, 0x07, 0x19, 0xe0, 0x29, 0xe7, 0x15, 0x00,
+    0x25, 0x01, 0x75, 0x01, 0x95, 0x08, 0x81, 0x02, 0x95, 0x01, 0x75, 0x08, 0x81, 0x01, 0x95, 0x05,
+    0x75, 0x01, 0x05, 0x08, 0x19, 0x01, 0x29, 0x05, 0x91, 0x02, 0x95, 0x01, 0x75, 0x03, 0x91, 0x01,
+    0x95, 0x06, 0x75, 0x08, 0x15, 0x00, 0x25, 0x65, 0x05, 0x07, 0x19, 0x00, 0x29, 0x65, 0x81, 0x00,
+    0xc0, 0x05, 0x01, 0x09, 0x02, 0xa1, 0x01, 0x85, 0x02, 0x09, 0x01, 0xa1, 0x00, 0x05, 0x09, 0x19,
+    0x01, 0x29, 0x05, 0x15, 0x00, 0x25, 0x01, 0x95, 0x05, 0x75, 0x01, 0x81, 0x02, 0x95, 0x01, 0x75,
+    0x03, 0x81, 0x01, 0x05, 0x01, 0x09, 0x30, 0x09, 0x31, 0x09, 0x38, 0x15, 0x81, 0x25, 0x7f, 0x75,
+    0x08, 0x95, 0x03, 0x81, 0x06, 0xc0, 0xc0, 0x05, 0x0c, 0x09, 0x01, 0xa1, 0x01, 0x85, 0x03, 0x15,
+    0x00, 0x26, 0xff, 0x03, 0x19, 0x00, 0x2a, 0xff, 0x03, 0x75, 0x10, 0x95, 0x01, 0x81, 0x00, 0xc0,
+];
+
+pub const HID_UUID: &str = "00001124-0000-1000-8000-00805f9b34fb";
+pub fn sdp() -> String {
+    let hex: String = MAP.iter().map(|byte| format!("{byte:02x}")).collect();
+    format!(
+        r#"<?xml version="1.0"?>
+<record>
+  <attribute id="0x0001"><sequence><uuid value="0x1124"/></sequence></attribute>
+  <attribute id="0x0004"><sequence><sequence><uuid value="0x0100"/><uint16 value="0x0011"/></sequence><sequence><uuid value="0x0011"/></sequence></sequence></attribute>
+  <attribute id="0x0005"><sequence><uuid value="0x1002"/></sequence></attribute>
+  <attribute id="0x0006"><sequence><uint16 value="0x656e"/><uint16 value="0x006a"/><uint16 value="0x0100"/></sequence></attribute>
+  <attribute id="0x0009"><sequence><sequence><uuid value="0x1124"/><uint16 value="0x0100"/></sequence></sequence></attribute>
+  <attribute id="0x000d"><sequence><sequence><sequence><uuid value="0x0100"/><uint16 value="0x0013"/></sequence><sequence><uuid value="0x0011"/></sequence></sequence></sequence></attribute>
+  <attribute id="0x0100"><text value="One-KVM Keyboard and Mouse"/></attribute>
+  <attribute id="0x0101"><text value="Classic Bluetooth HID"/></attribute>
+  <attribute id="0x0102"><text value="One-KVM"/></attribute>
+  <attribute id="0x0200"><uint16 value="0x0100"/></attribute>
+  <attribute id="0x0201"><uint16 value="0x0111"/></attribute>
+  <attribute id="0x0202"><uint8 value="0xc0"/></attribute>
+  <attribute id="0x0203"><uint8 value="0x00"/></attribute>
+  <attribute id="0x0204"><boolean value="false"/></attribute>
+  <attribute id="0x0205"><boolean value="false"/></attribute>
+  <attribute id="0x0206"><sequence><sequence><uint8 value="0x22"/><text encoding="hex" value="{hex}"/></sequence></sequence></attribute>
+  <attribute id="0x0207"><sequence><sequence><uint16 value="0x0409"/><uint16 value="0x0100"/></sequence></sequence></attribute>
+  <attribute id="0x0209"><boolean value="false"/></attribute>
+  <attribute id="0x020a"><boolean value="false"/></attribute>
+  <attribute id="0x020b"><uint16 value="0x0100"/></attribute>
+  <attribute id="0x020c"><uint16 value="0x0c80"/></attribute>
+  <attribute id="0x020d"><boolean value="true"/></attribute>
+  <attribute id="0x020e"><boolean value="true"/></attribute>
+</record>"#
+    )
+}
+#[derive(Debug, Default)]
+pub struct HidProtocol {
+    pub boot: bool,
+    pub suspended: bool,
+    pub leds: u8,
+    pub keyboard: [u8; 8],
+    pub buttons: u8,
+    pub consumer: [u8; 2],
+}
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct ControlResult {
+    pub reply: Option<Vec<u8>>,
+    pub unplug: bool,
+    pub reset: bool,
+}
+impl HidProtocol {
+    pub fn input(&mut self, kind: Report, value: &[u8]) -> Result<Vec<u8>, String> {
+        if value.len() != kind.len() {
+            return Err("Invalid HID report length".into());
+        }
+        if self.suspended {
+            return Err("Bluetooth HID is suspended".into());
+        }
+        let mut packet = vec![0xa1, kind.id()];
+        match kind {
+            Report::Keyboard => {
+                self.keyboard.copy_from_slice(value);
+                packet.extend_from_slice(value);
+            }
+            Report::Mouse => {
+                self.buttons = value[0];
+                packet.extend_from_slice(&value[..if self.boot { 3 } else { 4 }]);
+                if self.boot {
+                    packet[2] &= 7;
+                }
+            }
+            Report::Consumer if !self.boot => {
+                self.consumer.copy_from_slice(value);
+                packet.extend_from_slice(value);
+            }
+            Report::Consumer => return Err("Consumer keys unavailable in boot protocol".into()),
+        }
+        Ok(packet)
+    }
+    pub fn release(&mut self) -> Vec<Vec<u8>> {
+        self.keyboard = [0; 8];
+        self.buttons = 0;
+        self.consumer = [0; 2];
+        let mut packets = vec![
+            vec![0xa1, 1, 0, 0, 0, 0, 0, 0, 0, 0],
+            if self.boot {
+                vec![0xa1, 2, 0, 0, 0]
+            } else {
+                vec![0xa1, 2, 0, 0, 0, 0]
+            },
+        ];
+        if !self.boot {
+            packets.push(vec![0xa1, 3, 0, 0]);
+        }
+        packets
+    }
+    pub fn output(&mut self, data: &[u8]) -> bool {
+        if data.len() == 3 && data[0] == 0xa2 && data[1] == 1 {
+            self.leds = data[2] & 0x1f;
+            true
+        } else {
+            false
+        }
+    }
+    pub fn control(&mut self, data: &[u8]) -> ControlResult {
+        let mut result = ControlResult::default();
+        let handshake = |code| ControlResult {
+            reply: Some(vec![code]),
+            ..Default::default()
+        };
+        let Some(&header) = data.first() else {
+            return handshake(4);
+        };
+        match header {
+            0x13 if data.len() == 1 => {
+                self.suspended = true;
+                result.reset = true;
+            }
+            0x14 if data.len() == 1 => {
+                self.suspended = false;
+                result.reset = true;
+            }
+            0x15 if data.len() == 1 => {
+                result.unplug = true;
+            }
+            0x11 | 0x12 if data.len() == 1 => {
+                self.suspended = false;
+                result.reset = true;
+            }
+            0x60 if data.len() == 1 => {
+                result.reply = Some(vec![0xa0, if self.boot { 0 } else { 1 }]);
+            }
+            0x70 | 0x71 if data.len() == 1 => {
+                self.boot = header == 0x70;
+                result.reply = Some(vec![0]);
+                result.reset = true;
+            }
+            0x52 if data.len() == 3 && data[1] == 1 => {
+                self.leds = data[2] & 0x1f;
+                return handshake(0);
+            }
+            0x41 | 0x49 | 0x42 | 0x4a => {
+                let sized = header & 8 != 0;
+                if data.len() != if sized { 4 } else { 2 } {
+                    return handshake(4);
+                }
+                let mut report = vec![0xa0 | (header & 3), data[1]];
+                match (header & 3, data[1]) {
+                    (1, 1) => report.extend(self.keyboard),
+                    (1, 2) => report.extend(if self.boot {
+                        vec![self.buttons & 7, 0, 0]
+                    } else {
+                        vec![self.buttons, 0, 0, 0]
+                    }),
+                    (1, 3) if !self.boot => report.extend(self.consumer),
+                    (2, 1) => report.push(self.leds),
+                    _ => return handshake(2),
+                }
+                if sized {
+                    report.truncate(1 + u16::from_le_bytes([data[2], data[3]]) as usize);
+                }
+                result.reply = Some(report);
+            }
+            _ => return handshake(3), // ERR_UNSUPPORTED_REQUEST
+        }
+        result
+    }
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn classic_frames_and_boot_protocol() {
+        let mut hid = HidProtocol::default();
+        assert_eq!(
+            hid.input(Report::Keyboard, &[2, 0, 4, 0, 0, 0, 0, 0])
+                .unwrap(),
+            [0xa1, 1, 2, 0, 4, 0, 0, 0, 0, 0]
+        );
+        assert_eq!(hid.control(&[0x60]).reply.unwrap(), [0xa0, 1]);
+        assert_eq!(hid.control(&[0x70]).reply.unwrap(), [0]);
+        assert_eq!(
+            hid.input(Report::Mouse, &[0x1f, 127, 128, 1]).unwrap(),
+            [0xa1, 2, 7, 127, 128]
+        );
+        assert!(hid.input(Report::Consumer, &[0, 0]).is_err());
+        assert!(hid.input(Report::Keyboard, &[0]).is_err());
+    }
+    #[test]
+    fn led_read_write_and_errors() {
+        let mut hid = HidProtocol::default();
+        assert!(hid.output(&[0xa2, 1, 3]));
+        assert_eq!(hid.leds, 3);
+        assert_eq!(hid.control(&[0x42, 1]).reply.unwrap(), [0xa2, 1, 3]);
+        assert_eq!(hid.control(&[0x52, 1, 2]).reply.unwrap(), [0]);
+        assert_eq!(hid.leds, 2);
+        assert_eq!(hid.control(&[0x41, 99]).reply.unwrap(), [2]);
+        assert_eq!(hid.control(&[0x41]).reply.unwrap(), [4]);
+        assert_eq!(hid.control(&[0x90, 0]).reply.unwrap(), [3]);
+        assert_eq!(
+            hid.control(&[0x49, 1, 3, 0]).reply.unwrap(),
+            [0xa1, 1, 0, 0]
+        );
+    }
+    #[test]
+    fn suspend_reset_and_virtual_unplug() {
+        let mut hid = HidProtocol::default();
+        assert!(hid.control(&[0x13]).reset);
+        assert!(hid.input(Report::Mouse, &[0; 4]).is_err());
+        assert!(hid.control(&[0x14]).reset);
+        assert!(hid.input(Report::Mouse, &[0; 4]).is_ok());
+        assert!(hid.control(&[0x15]).unplug);
+        hid.keyboard[2] = 4;
+        hid.buttons = 1;
+        assert_eq!(hid.release().len(), 3);
+        assert_eq!(hid.keyboard, [0; 8]);
+        assert_eq!(hid.buttons, 0);
+    }
+    #[test]
+    fn sdp_describes_both_classic_channels() {
+        let record = sdp();
+        assert!(record.contains("uuid value=\"0x1124\""));
+        assert!(record.contains("uint16 value=\"0x0011\""));
+        assert!(record.contains("uint16 value=\"0x0013\""));
+        assert!(!record.contains("0x1812"));
+    }
+    #[test]
+    fn descriptor_report_sizes() {
+        let (mut pos, mut size, mut count, mut id, mut depth) = (0, 0, 0, 0, 0);
+        let mut input = [0; 4];
+        let mut output = [0; 4];
+        while pos < MAP.len() {
+            let prefix = MAP[pos];
+            pos += 1;
+            let length = [0, 1, 2, 4][(prefix & 3) as usize];
+            let mut value = 0;
+            for i in 0..length {
+                value |= (MAP[pos + i] as usize) << (8 * i);
+            }
+            pos += length;
+            match ((prefix >> 2) & 3, prefix >> 4) {
+                (1, 7) => size = value,
+                (1, 8) => id = value,
+                (1, 9) => count = value,
+                (0, 8) => input[id] += size * count,
+                (0, 9) => output[id] += size * count,
+                (0, 10) => depth += 1,
+                (0, 12) => depth -= 1,
+                _ => {}
+            }
+        }
+        assert_eq!(depth, 0);
+        assert_eq!(input, [0, 64, 32, 16]);
+        assert_eq!(output, [0, 8, 0, 0]);
+    }
+}

libs/dtls/Cargo.toml

@@ -0,0 +1,155 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2021"
+name = "dtls"
+version = "0.17.2"
+authors = ["Rain Liu <yliu@webrtc.rs>"]
+build = false
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "A pure Rust implementation of DTLS"
+homepage = "https://webrtc.rs"
+documentation = "https://docs.rs/dtls"
+readme = "README.md"
+license = "MIT/Apache-2.0"
+repository = "https://github.com/webrtc-rs/webrtc/tree/master/dtls"
+
+[features]
+pem = ["dep:pem"]
+
+[lib]
+name = "dtls"
+path = "src/lib.rs"
+
+[dependencies.aes]
+version = "0.8"
+
+[dependencies.aes-gcm]
+version = "0.10"
+
+[dependencies.async-trait]
+version = "0.1"
+
+[dependencies.bytecheck]
+version = "0.8"
+
+[dependencies.byteorder]
+version = "1"
+
+[dependencies.cbc]
+version = "0.1"
+features = [
+    "block-padding",
+    "alloc",
+]
+
+[dependencies.ccm]
+version = "0.5"
+
+[dependencies.chacha20poly1305]
+version = "0.10.1"
+
+[dependencies.der-parser]
+version = "9.0"
+
+[dependencies.hmac]
+version = "0.12"
+
+[dependencies.log]
+version = "0.4"
+
+[dependencies.p256]
+version = "0.13"
+features = [
+    "default",
+    "ecdh",
+    "ecdsa",
+]
+
+[dependencies.p384]
+version = "0.13"
+
+[dependencies.pem]
+version = "3"
+optional = true
+
+[dependencies.portable-atomic]
+version = "1.6"
+
+[dependencies.rand]
+version = "0.9"
+
+[dependencies.rand_core]
+version = "0.6"
+
+[dependencies.rcgen]
+version = "0.13"
+
+[dependencies.ring]
+version = "0.17.14"
+
+[dependencies.rkyv]
+version = "0.8"
+
+[dependencies.openssl]
+version = "0.10"
+features = ["vendored"]
+
+[dependencies.rustls-pki-types]
+version = "1"
+
+[dependencies.sec1]
+version = "0.7"
+features = ["std"]
+
+[dependencies.sha1]
+version = "0.10"
+
+[dependencies.sha2]
+version = "0.10"
+
+[dependencies.thiserror]
+version = "1"
+
+[dependencies.tokio]
+version = "1.32.0"
+features = [
+    "fs",
+    "io-util",
+    "io-std",
+    "macros",
+    "net",
+    "parking_lot",
+    "rt",
+    "rt-multi-thread",
+    "sync",
+    "time",
+]
+
+[dependencies.util]
+version = "0.17.1"
+features = ["conn"]
+default-features = false
+package = "webrtc-util"
+
+[dependencies.x25519-dalek]
+version = "2"
+features = ["static_secrets"]
+
+[dependencies.x509-parser]
+version = "0.16"
+
+[dev-dependencies]

libs/dtls/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

libs/dtls/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 WebRTC.rs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

libs/dtls/README.md

@@ -0,0 +1,20 @@
+# DTLS certificate verification backend
+
+This directory contains `dtls` 0.17.2 from the crates.io release of webrtc-rs.
+The original MIT and Apache-2.0 licenses are preserved.
+
+One-KVM patches only certificate-chain verification and its configuration to
+use vendored OpenSSL instead of rustls/WebPKI. DTLS flights, record protection,
+certificate signatures, SRTP negotiation and the application fingerprint check
+remain unchanged. `rustls-pki-types` remains a certificate-data representation,
+not a TLS implementation.
+
+`certificate_verifier.rs` implements trust-anchor, purpose, certificate-validity
+and DNS/IP identity checks. Server names do not fall back to the certificate
+subject, and partial-label wildcards are rejected. No trust checks are skipped
+by this backend. The upstream application-controlled `insecure_skip_verify`
+policy is preserved, including WebRTC's separate certificate fingerprint check.
+Authentication security level 2 rejects weak RSA keys and SHA-1 leaf signatures.
+
+Run `cargo test --manifest-path libs/dtls/Cargo.toml --lib` after updating this
+fork, and verify the application dependency tree contains no `rustls` engine.

libs/dtls/src/alert/alert_test.rs

@@ -0,0 +1,50 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+use crate::error::Error;
+
+#[test]
+fn test_alert() -> Result<()> {
+    let tests = vec![
+        (
+            "Valid Alert",
+            vec![0x02, 0x0A],
+            Alert {
+                alert_level: AlertLevel::Fatal,
+                alert_description: AlertDescription::UnexpectedMessage,
+            },
+            None,
+        ),
+        (
+            "Invalid alert length",
+            vec![0x00],
+            Alert {
+                alert_level: AlertLevel::Invalid,
+                alert_description: AlertDescription::Invalid,
+            },
+            Some(Error::Other("io".to_owned())),
+        ),
+    ];
+
+    for (name, data, wanted, unmarshal_error) in tests {
+        let mut reader = BufReader::new(data.as_slice());
+        let result = Alert::unmarshal(&mut reader);
+
+        if let Some(err) = unmarshal_error {
+            assert!(result.is_err(), "{name} expected error: {err}");
+        } else if let Ok(alert) = result {
+            assert_eq!(wanted, alert, "{name} expected {wanted}, but got {alert}");
+
+            let mut data2: Vec<u8> = vec![];
+            {
+                let mut writer = BufWriter::<&mut Vec<u8>>::new(data2.as_mut());
+                alert.marshal(&mut writer)?;
+            }
+            assert_eq!(data, data2, "{name} expected {data:?}, but got {data2:?}");
+        } else {
+            assert!(result.is_ok(), "{name} expected Ok, but has error");
+        }
+    }
+
+    Ok(())
+}

libs/dtls/src/alert/mod.rs

@@ -0,0 +1,189 @@
+#[cfg(test)]
+mod alert_test;
+
+use std::fmt;
+use std::io::{Read, Write};
+
+use byteorder::{ReadBytesExt, WriteBytesExt};
+
+use super::content::*;
+use crate::error::Result;
+
+#[derive(Copy, Clone, PartialEq, Debug)]
+pub(crate) enum AlertLevel {
+    Warning = 1,
+    Fatal = 2,
+    Invalid,
+}
+
+impl fmt::Display for AlertLevel {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match *self {
+            AlertLevel::Warning => write!(f, "LevelWarning"),
+            AlertLevel::Fatal => write!(f, "LevelFatal"),
+            _ => write!(f, "Invalid alert level"),
+        }
+    }
+}
+
+impl From<u8> for AlertLevel {
+    fn from(val: u8) -> Self {
+        match val {
+            1 => AlertLevel::Warning,
+            2 => AlertLevel::Fatal,
+            _ => AlertLevel::Invalid,
+        }
+    }
+}
+
+#[derive(Copy, Clone, PartialEq, Debug)]
+pub(crate) enum AlertDescription {
+    CloseNotify = 0,
+    UnexpectedMessage = 10,
+    BadRecordMac = 20,
+    DecryptionFailed = 21,
+    RecordOverflow = 22,
+    DecompressionFailure = 30,
+    HandshakeFailure = 40,
+    NoCertificate = 41,
+    BadCertificate = 42,
+    UnsupportedCertificate = 43,
+    CertificateRevoked = 44,
+    CertificateExpired = 45,
+    CertificateUnknown = 46,
+    IllegalParameter = 47,
+    UnknownCa = 48,
+    AccessDenied = 49,
+    DecodeError = 50,
+    DecryptError = 51,
+    ExportRestriction = 60,
+    ProtocolVersion = 70,
+    InsufficientSecurity = 71,
+    InternalError = 80,
+    UserCanceled = 90,
+    NoRenegotiation = 100,
+    UnsupportedExtension = 110,
+    UnknownPskIdentity = 115,
+    Invalid,
+}
+
+impl fmt::Display for AlertDescription {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match *self {
+            AlertDescription::CloseNotify => write!(f, "CloseNotify"),
+            AlertDescription::UnexpectedMessage => write!(f, "UnexpectedMessage"),
+            AlertDescription::BadRecordMac => write!(f, "BadRecordMac"),
+            AlertDescription::DecryptionFailed => write!(f, "DecryptionFailed"),
+            AlertDescription::RecordOverflow => write!(f, "RecordOverflow"),
+            AlertDescription::DecompressionFailure => write!(f, "DecompressionFailure"),
+            AlertDescription::HandshakeFailure => write!(f, "HandshakeFailure"),
+            AlertDescription::NoCertificate => write!(f, "NoCertificate"),
+            AlertDescription::BadCertificate => write!(f, "BadCertificate"),
+            AlertDescription::UnsupportedCertificate => write!(f, "UnsupportedCertificate"),
+            AlertDescription::CertificateRevoked => write!(f, "CertificateRevoked"),
+            AlertDescription::CertificateExpired => write!(f, "CertificateExpired"),
+            AlertDescription::CertificateUnknown => write!(f, "CertificateUnknown"),
+            AlertDescription::IllegalParameter => write!(f, "IllegalParameter"),
+            AlertDescription::UnknownCa => write!(f, "UnknownCA"),
+            AlertDescription::AccessDenied => write!(f, "AccessDenied"),
+            AlertDescription::DecodeError => write!(f, "DecodeError"),
+            AlertDescription::DecryptError => write!(f, "DecryptError"),
+            AlertDescription::ExportRestriction => write!(f, "ExportRestriction"),
+            AlertDescription::ProtocolVersion => write!(f, "ProtocolVersion"),
+            AlertDescription::InsufficientSecurity => write!(f, "InsufficientSecurity"),
+            AlertDescription::InternalError => write!(f, "InternalError"),
+            AlertDescription::UserCanceled => write!(f, "UserCanceled"),
+            AlertDescription::NoRenegotiation => write!(f, "NoRenegotiation"),
+            AlertDescription::UnsupportedExtension => write!(f, "UnsupportedExtension"),
+            AlertDescription::UnknownPskIdentity => write!(f, "UnknownPskIdentity"),
+            _ => write!(f, "Invalid alert description"),
+        }
+    }
+}
+
+impl From<u8> for AlertDescription {
+    fn from(val: u8) -> Self {
+        match val {
+            0 => AlertDescription::CloseNotify,
+            10 => AlertDescription::UnexpectedMessage,
+            20 => AlertDescription::BadRecordMac,
+            21 => AlertDescription::DecryptionFailed,
+            22 => AlertDescription::RecordOverflow,
+            30 => AlertDescription::DecompressionFailure,
+            40 => AlertDescription::HandshakeFailure,
+            41 => AlertDescription::NoCertificate,
+            42 => AlertDescription::BadCertificate,
+            43 => AlertDescription::UnsupportedCertificate,
+            44 => AlertDescription::CertificateRevoked,
+            45 => AlertDescription::CertificateExpired,
+            46 => AlertDescription::CertificateUnknown,
+            47 => AlertDescription::IllegalParameter,
+            48 => AlertDescription::UnknownCa,
+            49 => AlertDescription::AccessDenied,
+            50 => AlertDescription::DecodeError,
+            51 => AlertDescription::DecryptError,
+            60 => AlertDescription::ExportRestriction,
+            70 => AlertDescription::ProtocolVersion,
+            71 => AlertDescription::InsufficientSecurity,
+            80 => AlertDescription::InternalError,
+            90 => AlertDescription::UserCanceled,
+            100 => AlertDescription::NoRenegotiation,
+            110 => AlertDescription::UnsupportedExtension,
+            115 => AlertDescription::UnknownPskIdentity,
+            _ => AlertDescription::Invalid,
+        }
+    }
+}
+
+// One of the content types supported by the TLS record layer is the
+// alert type.  Alert messages convey the severity of the message
+// (warning or fatal) and a description of the alert.  Alert messages
+// with a level of fatal result in the immediate termination of the
+// connection.  In this case, other connections corresponding to the
+// session may continue, but the session identifier MUST be invalidated,
+// preventing the failed session from being used to establish new
+// connections.  Like other messages, alert messages are encrypted and
+// compressed, as specified by the current connection state.
+/// ## Specifications
+///
+/// * [RFC 5246 §7.2]
+///
+/// [RFC 5246 §7.2]: https://tools.ietf.org/html/rfc5246#section-7.2
+#[derive(Copy, Clone, PartialEq, Debug)]
+pub struct Alert {
+    pub(crate) alert_level: AlertLevel,
+    pub(crate) alert_description: AlertDescription,
+}
+
+impl fmt::Display for Alert {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Alert {}: {}", self.alert_level, self.alert_description)
+    }
+}
+
+impl Alert {
+    pub fn content_type(&self) -> ContentType {
+        ContentType::Alert
+    }
+
+    pub fn size(&self) -> usize {
+        2
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u8(self.alert_level as u8)?;
+        writer.write_u8(self.alert_description as u8)?;
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let alert_level = reader.read_u8()?.into();
+        let alert_description = reader.read_u8()?.into();
+
+        Ok(Alert {
+            alert_level,
+            alert_description,
+        })
+    }
+}

libs/dtls/src/application_data.rs

@@ -0,0 +1,41 @@
+use std::io::{Read, Write};
+
+use super::content::*;
+use crate::error::Result;
+
+// Application data messages are carried by the record layer and are
+// fragmented, compressed, and encrypted based on the current connection
+// state.  The messages are treated as transparent data to the record
+// layer.
+/// ## Specifications
+///
+/// * [RFC 5246 §10]
+///
+/// [RFC 5246 §10]: https://tools.ietf.org/html/rfc5246#section-10
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct ApplicationData {
+    pub data: Vec<u8>,
+}
+
+impl ApplicationData {
+    pub fn content_type(&self) -> ContentType {
+        ContentType::ApplicationData
+    }
+
+    pub fn size(&self) -> usize {
+        self.data.len()
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_all(&self.data)?;
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let mut data: Vec<u8> = vec![];
+        reader.read_to_end(&mut data)?;
+
+        Ok(ApplicationData { data })
+    }
+}

libs/dtls/src/certificate_verifier.rs

@@ -0,0 +1,378 @@
+use openssl::stack::Stack;
+use openssl::x509::store::X509StoreBuilder;
+use openssl::x509::verify::{X509CheckFlags, X509VerifyParam};
+use openssl::x509::{X509PurposeId, X509StoreContext, X509};
+use rustls_pki_types::{CertificateDer, ServerName};
+
+use crate::error::{Error, Result};
+
+#[derive(Clone, Debug, Default)]
+pub struct RootCertStore {
+    certificates: Vec<X509>,
+}
+
+impl RootCertStore {
+    pub fn empty() -> Self {
+        Self::default()
+    }
+
+    pub fn add(&mut self, certificate: CertificateDer<'_>) -> Result<()> {
+        self.certificates
+            .push(X509::from_der(certificate.as_ref()).map_err(openssl_error)?);
+        Ok(())
+    }
+}
+
+pub(crate) struct CertificateVerifier {
+    roots: RootCertStore,
+}
+
+impl CertificateVerifier {
+    pub(crate) fn new(roots: RootCertStore) -> Self {
+        Self { roots }
+    }
+
+    pub(crate) fn verify_client_cert(
+        &self,
+        end_entity: &CertificateDer<'_>,
+        intermediates: &[CertificateDer<'_>],
+    ) -> Result<()> {
+        self.verify(end_entity, intermediates, X509PurposeId::SSL_CLIENT, None)
+    }
+
+    pub(crate) fn verify_server_cert(
+        &self,
+        end_entity: &CertificateDer<'_>,
+        intermediates: &[CertificateDer<'_>],
+        server_name: &str,
+    ) -> Result<()> {
+        ServerName::try_from(server_name).map_err(|error| Error::Other(error.to_string()))?;
+        self.verify(
+            end_entity,
+            intermediates,
+            X509PurposeId::SSL_SERVER,
+            Some(server_name),
+        )
+    }
+
+    fn verify(
+        &self,
+        end_entity: &CertificateDer<'_>,
+        intermediates: &[CertificateDer<'_>],
+        purpose: X509PurposeId,
+        server_name: Option<&str>,
+    ) -> Result<()> {
+        let leaf = X509::from_der(end_entity.as_ref()).map_err(openssl_error)?;
+        let mut chain = Stack::new().map_err(openssl_error)?;
+        for certificate in intermediates {
+            chain
+                .push(X509::from_der(certificate.as_ref()).map_err(openssl_error)?)
+                .map_err(openssl_error)?;
+        }
+        let mut parameters = X509VerifyParam::new().map_err(openssl_error)?;
+        parameters.set_auth_level(2);
+        parameters.set_purpose(purpose).map_err(openssl_error)?;
+        parameters.set_hostflags(
+            X509CheckFlags::NO_PARTIAL_WILDCARDS | X509CheckFlags::NEVER_CHECK_SUBJECT,
+        );
+        if let Some(server_name) = server_name {
+            if let Ok(address) = server_name.parse() {
+                parameters.set_ip(address).map_err(openssl_error)?;
+            } else {
+                parameters.set_host(server_name).map_err(openssl_error)?;
+            }
+        }
+        let mut store = X509StoreBuilder::new().map_err(openssl_error)?;
+        store.set_param(&parameters).map_err(openssl_error)?;
+        for certificate in &self.roots.certificates {
+            store.add_cert(certificate.clone()).map_err(openssl_error)?;
+        }
+        let store = store.build();
+        let mut context = X509StoreContext::new().map_err(openssl_error)?;
+        context
+            .init(&store, &leaf, &chain, |context| {
+                if context.verify_cert()? {
+                    Ok(None)
+                } else {
+                    Ok(Some(context.error().to_string()))
+                }
+            })
+            .map_err(openssl_error)?
+            .map_or(Ok(()), |error| Err(Error::Other(error)))
+    }
+}
+
+fn openssl_error(error: openssl::error::ErrorStack) -> Error {
+    Error::Other(error.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use rcgen::{BasicConstraints, CertificateParams, ExtendedKeyUsagePurpose, IsCa, KeyPair};
+
+    fn signed_leaf(
+        parameters: CertificateParams,
+    ) -> (CertificateVerifier, CertificateDer<'static>) {
+        let mut issuer_parameters = CertificateParams::new(Vec::<String>::new()).unwrap();
+        issuer_parameters
+            .distinguished_name
+            .push(rcgen::DnType::CommonName, "test root");
+        issuer_parameters.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+        let issuer_key = KeyPair::generate().unwrap();
+        let issuer = issuer_parameters.self_signed(&issuer_key).unwrap();
+        let leaf_key = KeyPair::generate().unwrap();
+        let leaf = parameters
+            .signed_by(&leaf_key, &issuer, &issuer_key)
+            .unwrap();
+        let mut roots = RootCertStore::empty();
+        roots.add(issuer.der().clone()).unwrap();
+        (CertificateVerifier::new(roots), leaf.der().clone())
+    }
+
+    #[test]
+    fn trusted_server_matches_dns_and_ip_subject_alternative_names() {
+        let parameters =
+            CertificateParams::new(vec!["localhost".into(), "127.0.0.1".into()]).unwrap();
+        let (verifier, leaf) = signed_leaf(parameters);
+        verifier
+            .verify_server_cert(&leaf, &[], "localhost")
+            .unwrap();
+        assert!(verifier.verify_server_cert(&leaf, &[], "127.0.0.1").is_ok());
+        assert!(verifier
+            .verify_server_cert(&leaf, &[], "wrong.local")
+            .is_err());
+        assert!(verifier
+            .verify_server_cert(&leaf, &[], "127.0.0.2")
+            .is_err());
+        assert!(verifier.verify_server_cert(&leaf, &[], "").is_err());
+    }
+
+    #[test]
+    fn rejects_untrusted_and_tampered_certificates() {
+        let (verifier, leaf) =
+            signed_leaf(CertificateParams::new(vec!["localhost".into()]).unwrap());
+        let untrusted = CertificateVerifier::new(RootCertStore::empty());
+        assert!(untrusted
+            .verify_server_cert(&leaf, &[], "localhost")
+            .is_err());
+        let mut tampered = leaf.as_ref().to_vec();
+        let last = tampered.len() - 1;
+        tampered[last] ^= 1;
+        assert!(verifier
+            .verify_server_cert(&CertificateDer::from(tampered), &[], "localhost")
+            .is_err());
+        assert!(verifier
+            .verify_server_cert(&CertificateDer::from(vec![0]), &[], "localhost")
+            .is_err());
+    }
+
+    #[test]
+    fn rejects_expired_certificate_and_wrong_extended_key_usage() {
+        let mut expired = CertificateParams::new(vec!["localhost".into()]).unwrap();
+        expired.not_before = rcgen::date_time_ymd(2019, 1, 1);
+        expired.not_after = rcgen::date_time_ymd(2020, 1, 1);
+        let (verifier, leaf) = signed_leaf(expired);
+        assert!(verifier
+            .verify_server_cert(&leaf, &[], "localhost")
+            .is_err());
+        let mut server_only = CertificateParams::new(vec!["localhost".into()]).unwrap();
+        server_only.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
+        let (verifier, leaf) = signed_leaf(server_only);
+        verifier
+            .verify_server_cert(&leaf, &[], "localhost")
+            .unwrap();
+        assert!(verifier.verify_client_cert(&leaf, &[]).is_err());
+        let mut client_only = CertificateParams::new(vec!["localhost".into()]).unwrap();
+        client_only.extended_key_usages = vec![ExtendedKeyUsagePurpose::ClientAuth];
+        let (verifier, leaf) = signed_leaf(client_only);
+        assert!(verifier.verify_client_cert(&leaf, &[]).is_ok());
+        assert!(verifier
+            .verify_server_cert(&leaf, &[], "localhost")
+            .is_err());
+    }
+
+    #[test]
+    fn does_not_fall_back_to_common_name_or_partial_wildcard() {
+        let mut parameters = CertificateParams::new(Vec::<String>::new()).unwrap();
+        parameters
+            .distinguished_name
+            .push(rcgen::DnType::CommonName, "localhost");
+        let (verifier, leaf) = signed_leaf(parameters);
+        assert!(verifier
+            .verify_server_cert(&leaf, &[], "localhost")
+            .is_err());
+        let (verifier, leaf) =
+            signed_leaf(CertificateParams::new(vec!["local*.example".into()]).unwrap());
+        assert!(verifier
+            .verify_server_cert(&leaf, &[], "localhost.example")
+            .is_err());
+    }
+
+    #[test]
+    fn rejects_weak_rsa_keys_and_sha1_leaf_signatures() {
+        use openssl::asn1::Asn1Time;
+        use openssl::hash::MessageDigest;
+        use openssl::pkey::PKey;
+        use openssl::rsa::Rsa;
+        use openssl::x509::extension::{BasicConstraints, SubjectAlternativeName};
+        use openssl::x509::X509NameBuilder;
+
+        let issuer_key = PKey::from_rsa(Rsa::generate(2048).unwrap()).unwrap();
+        let mut issuer_name = X509NameBuilder::new().unwrap();
+        issuer_name
+            .append_entry_by_text("CN", "strong root")
+            .unwrap();
+        let issuer_name = issuer_name.build();
+        let mut issuer = X509::builder().unwrap();
+        issuer.set_version(2).unwrap();
+        issuer.set_subject_name(&issuer_name).unwrap();
+        issuer.set_issuer_name(&issuer_name).unwrap();
+        issuer.set_pubkey(&issuer_key).unwrap();
+        issuer
+            .set_not_before(&Asn1Time::days_from_now(0).unwrap())
+            .unwrap();
+        issuer
+            .set_not_after(&Asn1Time::days_from_now(1).unwrap())
+            .unwrap();
+        issuer
+            .append_extension(BasicConstraints::new().critical().ca().build().unwrap())
+            .unwrap();
+        issuer.sign(&issuer_key, MessageDigest::sha256()).unwrap();
+        let issuer = issuer.build();
+        let mut roots = RootCertStore::empty();
+        roots
+            .add(CertificateDer::from(issuer.to_der().unwrap()))
+            .unwrap();
+        let verifier = CertificateVerifier::new(roots);
+        for (bits, digest, expected) in [
+            (2048, MessageDigest::sha256(), true),
+            (1024, MessageDigest::sha256(), false),
+            (2048, MessageDigest::sha1(), false),
+        ] {
+            let leaf_key = PKey::from_rsa(Rsa::generate(bits).unwrap()).unwrap();
+            let mut leaf_name = X509NameBuilder::new().unwrap();
+            leaf_name.append_entry_by_text("CN", "localhost").unwrap();
+            let leaf_name = leaf_name.build();
+            let mut leaf = X509::builder().unwrap();
+            leaf.set_version(2).unwrap();
+            leaf.set_subject_name(&leaf_name).unwrap();
+            leaf.set_issuer_name(issuer.subject_name()).unwrap();
+            leaf.set_pubkey(&leaf_key).unwrap();
+            leaf.set_not_before(&Asn1Time::days_from_now(0).unwrap())
+                .unwrap();
+            leaf.set_not_after(&Asn1Time::days_from_now(1).unwrap())
+                .unwrap();
+            let names = SubjectAlternativeName::new()
+                .dns("localhost")
+                .build(&leaf.x509v3_context(Some(&issuer), None))
+                .unwrap();
+            leaf.append_extension(names).unwrap();
+            leaf.sign(&issuer_key, digest).unwrap();
+            let leaf = CertificateDer::from(leaf.build().to_der().unwrap());
+            assert_eq!(
+                verifier.verify_server_cert(&leaf, &[], "localhost").is_ok(),
+                expected
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn dtls_handshake_preserves_mutual_certificate_authentication() {
+        use crate::config::{ClientAuthType, Config};
+        use crate::conn::DTLSConn;
+        use crate::crypto::Certificate;
+        use std::sync::Arc;
+        use std::time::Duration;
+
+        let client_certificate =
+            Certificate::generate_self_signed(vec!["localhost".into()]).unwrap();
+        let server_certificate =
+            Certificate::generate_self_signed(vec!["localhost".into()]).unwrap();
+        let mut client_roots = RootCertStore::empty();
+        client_roots
+            .add(server_certificate.certificate[0].clone())
+            .unwrap();
+        let mut server_roots = RootCertStore::empty();
+        server_roots
+            .add(client_certificate.certificate[0].clone())
+            .unwrap();
+        let client_socket = Arc::new(tokio::net::UdpSocket::bind("127.0.0.1:0").await.unwrap());
+        let server_socket = Arc::new(tokio::net::UdpSocket::bind("127.0.0.1:0").await.unwrap());
+        client_socket
+            .connect(server_socket.local_addr().unwrap())
+            .await
+            .unwrap();
+        server_socket
+            .connect(client_socket.local_addr().unwrap())
+            .await
+            .unwrap();
+        let client_config = Config {
+            certificates: vec![client_certificate],
+            roots_cas: client_roots,
+            server_name: "localhost".into(),
+            ..Default::default()
+        };
+        let server_config = Config {
+            certificates: vec![server_certificate],
+            client_cas: server_roots,
+            client_auth: ClientAuthType::RequireAndVerifyClientCert,
+            ..Default::default()
+        };
+        let (client, server) = tokio::time::timeout(Duration::from_secs(10), async {
+            tokio::try_join!(
+                DTLSConn::new(client_socket, client_config, true, None),
+                DTLSConn::new(server_socket, server_config, false, None),
+            )
+        })
+        .await
+        .unwrap()
+        .unwrap();
+        client
+            .write(b"authenticated", Some(Duration::from_secs(5)))
+            .await
+            .unwrap();
+        let mut buffer = [0; 64];
+        let count = server
+            .read(&mut buffer, Some(Duration::from_secs(5)))
+            .await
+            .unwrap();
+        assert_eq!(&buffer[..count], b"authenticated");
+        client.close().await.unwrap();
+        server.close().await.unwrap();
+    }
+
+    #[test]
+    fn verifies_intermediate_chain_without_implicitly_trusting_it() {
+        let mut root_parameters = CertificateParams::new(Vec::<String>::new()).unwrap();
+        root_parameters
+            .distinguished_name
+            .push(rcgen::DnType::CommonName, "test root");
+        root_parameters.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+        let root_key = KeyPair::generate().unwrap();
+        let root = root_parameters.self_signed(&root_key).unwrap();
+        let mut intermediate_parameters = CertificateParams::new(Vec::<String>::new()).unwrap();
+        intermediate_parameters
+            .distinguished_name
+            .push(rcgen::DnType::CommonName, "test intermediate");
+        intermediate_parameters.is_ca = IsCa::Ca(BasicConstraints::Constrained(0));
+        let intermediate_key = KeyPair::generate().unwrap();
+        let intermediate = intermediate_parameters
+            .signed_by(&intermediate_key, &root, &root_key)
+            .unwrap();
+        let leaf_key = KeyPair::generate().unwrap();
+        let leaf = CertificateParams::new(vec!["localhost".into()])
+            .unwrap()
+            .signed_by(&leaf_key, &intermediate, &intermediate_key)
+            .unwrap();
+        let mut roots = RootCertStore::empty();
+        roots.add(root.der().clone()).unwrap();
+        let verifier = CertificateVerifier::new(roots);
+        assert!(verifier
+            .verify_server_cert(leaf.der(), &[intermediate.der().clone()], "localhost")
+            .is_ok());
+        assert!(verifier
+            .verify_server_cert(leaf.der(), &[], "localhost")
+            .is_err());
+    }
+}

libs/dtls/src/change_cipher_spec/change_cipher_spec_test.rs

@@ -0,0 +1,37 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_change_cipher_spec_round_trip() -> Result<()> {
+    let c = ChangeCipherSpec {};
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        c.marshal(&mut writer)?;
+    }
+
+    let mut reader = BufReader::new(raw.as_slice());
+    let cnew = ChangeCipherSpec::unmarshal(&mut reader)?;
+    assert_eq!(
+        c, cnew,
+        "ChangeCipherSpec round trip: got {cnew:?}, want {c:?}"
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_change_cipher_spec_invalid() -> Result<()> {
+    let data = vec![0x00];
+
+    let mut reader = BufReader::new(data.as_slice());
+    let result = ChangeCipherSpec::unmarshal(&mut reader);
+
+    match result {
+        Ok(_) => panic!("must be error"),
+        Err(err) => assert_eq!(err.to_string(), Error::ErrInvalidCipherSpec.to_string()),
+    };
+
+    Ok(())
+}

libs/dtls/src/change_cipher_spec/mod.rs

@@ -0,0 +1,46 @@
+#[cfg(test)]
+mod change_cipher_spec_test;
+
+use std::io::{Read, Write};
+
+use byteorder::{ReadBytesExt, WriteBytesExt};
+
+use super::content::*;
+use super::error::*;
+
+// The change cipher spec protocol exists to signal transitions in
+// ciphering strategies.  The protocol consists of a single message,
+// which is encrypted and compressed under the current (not the pending)
+// connection state.  The message consists of a single byte of value 1.
+/// ## Specifications
+///
+/// * [RFC 5246 §7.1]
+///
+/// [RFC 5246 §7.1]: https://tools.ietf.org/html/rfc5246#section-7.1
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct ChangeCipherSpec;
+
+impl ChangeCipherSpec {
+    pub fn content_type(&self) -> ContentType {
+        ContentType::ChangeCipherSpec
+    }
+
+    pub fn size(&self) -> usize {
+        1
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u8(0x01)?;
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let data = reader.read_u8()?;
+        if data != 0x01 {
+            return Err(Error::ErrInvalidCipherSpec);
+        }
+
+        Ok(ChangeCipherSpec {})
+    }
+}

libs/dtls/src/cipher_suite/cipher_suite_aes_128_ccm.rs

@@ -0,0 +1,112 @@
+use super::*;
+use crate::client_certificate_type::ClientCertificateType;
+use crate::crypto::crypto_ccm::{CryptoCcm, CryptoCcmTagLen};
+use crate::prf::*;
+
+#[derive(Clone)]
+pub struct CipherSuiteAes128Ccm {
+    ccm: Option<CryptoCcm>,
+    client_certificate_type: ClientCertificateType,
+    id: CipherSuiteId,
+    psk: bool,
+    crypto_ccm_tag_len: CryptoCcmTagLen,
+}
+
+impl CipherSuiteAes128Ccm {
+    const PRF_MAC_LEN: usize = 0;
+    const PRF_KEY_LEN: usize = 16;
+    const PRF_IV_LEN: usize = 4;
+
+    pub fn new(
+        client_certificate_type: ClientCertificateType,
+        id: CipherSuiteId,
+        psk: bool,
+        crypto_ccm_tag_len: CryptoCcmTagLen,
+    ) -> Self {
+        CipherSuiteAes128Ccm {
+            ccm: None,
+            client_certificate_type,
+            id,
+            psk,
+            crypto_ccm_tag_len,
+        }
+    }
+}
+
+impl CipherSuite for CipherSuiteAes128Ccm {
+    fn to_string(&self) -> String {
+        format!("{}", self.id)
+    }
+
+    fn id(&self) -> CipherSuiteId {
+        self.id
+    }
+
+    fn certificate_type(&self) -> ClientCertificateType {
+        self.client_certificate_type
+    }
+
+    fn hash_func(&self) -> CipherSuiteHash {
+        CipherSuiteHash::Sha256
+    }
+
+    fn is_psk(&self) -> bool {
+        self.psk
+    }
+
+    fn is_initialized(&self) -> bool {
+        self.ccm.is_some()
+    }
+
+    fn init(
+        &mut self,
+        master_secret: &[u8],
+        client_random: &[u8],
+        server_random: &[u8],
+        is_client: bool,
+    ) -> Result<()> {
+        let keys = prf_encryption_keys(
+            master_secret,
+            client_random,
+            server_random,
+            CipherSuiteAes128Ccm::PRF_MAC_LEN,
+            CipherSuiteAes128Ccm::PRF_KEY_LEN,
+            CipherSuiteAes128Ccm::PRF_IV_LEN,
+            self.hash_func(),
+        )?;
+
+        if is_client {
+            self.ccm = Some(CryptoCcm::new(
+                &self.crypto_ccm_tag_len,
+                &keys.client_write_key,
+                &keys.client_write_iv,
+                &keys.server_write_key,
+                &keys.server_write_iv,
+            ));
+        } else {
+            self.ccm = Some(CryptoCcm::new(
+                &self.crypto_ccm_tag_len,
+                &keys.server_write_key,
+                &keys.server_write_iv,
+                &keys.client_write_key,
+                &keys.client_write_iv,
+            ));
+        }
+
+        Ok(())
+    }
+
+    fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let ccm = self.ccm.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to encrypt".to_owned(),
+        ))?;
+        ccm.encrypt(pkt_rlh, raw)
+    }
+
+    fn decrypt(&self, input: &[u8]) -> Result<Vec<u8>> {
+        let ccm = self.ccm.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to decrypt".to_owned(),
+        ))?;
+        ccm.decrypt(input)
+    }
+}

libs/dtls/src/cipher_suite/cipher_suite_aes_128_gcm_sha256.rs

@@ -0,0 +1,107 @@
+use super::*;
+use crate::crypto::crypto_gcm::*;
+use crate::prf::*;
+
+#[derive(Clone)]
+pub struct CipherSuiteAes128GcmSha256 {
+    gcm: Option<CryptoGcm>,
+    rsa: bool,
+}
+
+impl CipherSuiteAes128GcmSha256 {
+    const PRF_MAC_LEN: usize = 0;
+    const PRF_KEY_LEN: usize = 16;
+    const PRF_IV_LEN: usize = 4;
+
+    pub fn new(rsa: bool) -> Self {
+        CipherSuiteAes128GcmSha256 { gcm: None, rsa }
+    }
+}
+
+impl CipherSuite for CipherSuiteAes128GcmSha256 {
+    fn to_string(&self) -> String {
+        if self.rsa {
+            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256".to_owned()
+        } else {
+            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256".to_owned()
+        }
+    }
+
+    fn id(&self) -> CipherSuiteId {
+        if self.rsa {
+            CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_128_Gcm_Sha256
+        } else {
+            CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Gcm_Sha256
+        }
+    }
+
+    fn certificate_type(&self) -> ClientCertificateType {
+        if self.rsa {
+            ClientCertificateType::RsaSign
+        } else {
+            ClientCertificateType::EcdsaSign
+        }
+    }
+
+    fn hash_func(&self) -> CipherSuiteHash {
+        CipherSuiteHash::Sha256
+    }
+
+    fn is_psk(&self) -> bool {
+        false
+    }
+
+    fn is_initialized(&self) -> bool {
+        self.gcm.is_some()
+    }
+
+    fn init(
+        &mut self,
+        master_secret: &[u8],
+        client_random: &[u8],
+        server_random: &[u8],
+        is_client: bool,
+    ) -> Result<()> {
+        let keys = prf_encryption_keys(
+            master_secret,
+            client_random,
+            server_random,
+            CipherSuiteAes128GcmSha256::PRF_MAC_LEN,
+            CipherSuiteAes128GcmSha256::PRF_KEY_LEN,
+            CipherSuiteAes128GcmSha256::PRF_IV_LEN,
+            self.hash_func(),
+        )?;
+
+        if is_client {
+            self.gcm = Some(CryptoGcm::new(
+                &keys.client_write_key,
+                &keys.client_write_iv,
+                &keys.server_write_key,
+                &keys.server_write_iv,
+            ));
+        } else {
+            self.gcm = Some(CryptoGcm::new(
+                &keys.server_write_key,
+                &keys.server_write_iv,
+                &keys.client_write_key,
+                &keys.client_write_iv,
+            ));
+        }
+
+        Ok(())
+    }
+
+    fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let cg = self.gcm.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to encrypt".to_owned(),
+        ))?;
+        cg.encrypt(pkt_rlh, raw)
+    }
+
+    fn decrypt(&self, input: &[u8]) -> Result<Vec<u8>> {
+        let cg = self.gcm.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to decrypt".to_owned(),
+        ))?;
+        cg.decrypt(input)
+    }
+}

libs/dtls/src/cipher_suite/cipher_suite_aes_256_cbc_sha.rs

@@ -0,0 +1,107 @@
+use super::*;
+use crate::crypto::crypto_cbc::*;
+use crate::prf::*;
+
+#[derive(Clone)]
+pub struct CipherSuiteAes256CbcSha {
+    cbc: Option<CryptoCbc>,
+    rsa: bool,
+}
+
+impl CipherSuiteAes256CbcSha {
+    const PRF_MAC_LEN: usize = 20;
+    const PRF_KEY_LEN: usize = 32;
+    const PRF_IV_LEN: usize = 16;
+
+    pub fn new(rsa: bool) -> Self {
+        CipherSuiteAes256CbcSha { cbc: None, rsa }
+    }
+}
+
+impl CipherSuite for CipherSuiteAes256CbcSha {
+    fn to_string(&self) -> String {
+        if self.rsa {
+            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA".to_owned()
+        } else {
+            "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA".to_owned()
+        }
+    }
+
+    fn id(&self) -> CipherSuiteId {
+        if self.rsa {
+            CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_256_Cbc_Sha
+        } else {
+            CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_256_Cbc_Sha
+        }
+    }
+
+    fn certificate_type(&self) -> ClientCertificateType {
+        if self.rsa {
+            ClientCertificateType::RsaSign
+        } else {
+            ClientCertificateType::EcdsaSign
+        }
+    }
+
+    fn hash_func(&self) -> CipherSuiteHash {
+        CipherSuiteHash::Sha256
+    }
+
+    fn is_psk(&self) -> bool {
+        false
+    }
+
+    fn is_initialized(&self) -> bool {
+        self.cbc.is_some()
+    }
+
+    fn init(
+        &mut self,
+        master_secret: &[u8],
+        client_random: &[u8],
+        server_random: &[u8],
+        is_client: bool,
+    ) -> Result<()> {
+        let keys = prf_encryption_keys(
+            master_secret,
+            client_random,
+            server_random,
+            CipherSuiteAes256CbcSha::PRF_MAC_LEN,
+            CipherSuiteAes256CbcSha::PRF_KEY_LEN,
+            CipherSuiteAes256CbcSha::PRF_IV_LEN,
+            self.hash_func(),
+        )?;
+
+        if is_client {
+            self.cbc = Some(CryptoCbc::new(
+                &keys.client_write_key,
+                &keys.client_mac_key,
+                &keys.server_write_key,
+                &keys.server_mac_key,
+            )?);
+        } else {
+            self.cbc = Some(CryptoCbc::new(
+                &keys.server_write_key,
+                &keys.server_mac_key,
+                &keys.client_write_key,
+                &keys.client_mac_key,
+            )?);
+        }
+
+        Ok(())
+    }
+
+    fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let cg = self.cbc.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to encrypt".to_owned(),
+        ))?;
+        cg.encrypt(pkt_rlh, raw)
+    }
+
+    fn decrypt(&self, input: &[u8]) -> Result<Vec<u8>> {
+        let cg = self.cbc.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to decrypt".to_owned(),
+        ))?;
+        cg.decrypt(input)
+    }
+}

libs/dtls/src/cipher_suite/cipher_suite_chacha20_poly1305_sha256.rs

@@ -0,0 +1,107 @@
+use super::*;
+use crate::crypto::crypto_chacha20::*;
+use crate::prf::*;
+
+#[derive(Clone)]
+pub struct CipherSuiteChaCha20Poly1305Sha256 {
+    rsa: bool,
+    cipher: Option<CryptoChaCha20>,
+}
+
+impl CipherSuiteChaCha20Poly1305Sha256 {
+    const PRF_MAC_LEN: usize = 0;
+    const PRF_KEY_LEN: usize = 32;
+    const PRF_IV_LEN: usize = 12;
+
+    pub fn new(rsa: bool) -> Self {
+        CipherSuiteChaCha20Poly1305Sha256 { rsa, cipher: None }
+    }
+}
+
+impl CipherSuite for CipherSuiteChaCha20Poly1305Sha256 {
+    fn to_string(&self) -> String {
+        if self.rsa {
+            "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256".to_owned()
+        } else {
+            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256".to_owned()
+        }
+    }
+
+    fn id(&self) -> CipherSuiteId {
+        if self.rsa {
+            CipherSuiteId::Tls_Ecdhe_Rsa_With_ChaCha20_Poly1305_Sha256
+        } else {
+            CipherSuiteId::Tls_Ecdhe_Ecdsa_With_ChaCha20_Poly1305_Sha256
+        }
+    }
+
+    fn certificate_type(&self) -> ClientCertificateType {
+        if self.rsa {
+            ClientCertificateType::RsaSign
+        } else {
+            ClientCertificateType::EcdsaSign
+        }
+    }
+
+    fn hash_func(&self) -> CipherSuiteHash {
+        CipherSuiteHash::Sha256
+    }
+
+    fn is_psk(&self) -> bool {
+        false
+    }
+
+    fn is_initialized(&self) -> bool {
+        self.cipher.is_some()
+    }
+
+    fn init(
+        &mut self,
+        master_secret: &[u8],
+        client_random: &[u8],
+        server_random: &[u8],
+        is_client: bool,
+    ) -> Result<()> {
+        let keys = prf_encryption_keys(
+            master_secret,
+            client_random,
+            server_random,
+            CipherSuiteChaCha20Poly1305Sha256::PRF_MAC_LEN,
+            CipherSuiteChaCha20Poly1305Sha256::PRF_KEY_LEN,
+            CipherSuiteChaCha20Poly1305Sha256::PRF_IV_LEN,
+            self.hash_func(),
+        )?;
+
+        if is_client {
+            self.cipher = Some(CryptoChaCha20::new(
+                &keys.client_write_key,
+                &keys.client_write_iv,
+                &keys.server_write_key,
+                &keys.server_write_iv,
+            ));
+        } else {
+            self.cipher = Some(CryptoChaCha20::new(
+                &keys.server_write_key,
+                &keys.server_write_iv,
+                &keys.client_write_key,
+                &keys.client_write_iv,
+            ));
+        }
+
+        Ok(())
+    }
+
+    fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let cg = self.cipher.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to encrypt".to_owned(),
+        ))?;
+        cg.encrypt(pkt_rlh, raw)
+    }
+
+    fn decrypt(&self, input: &[u8]) -> Result<Vec<u8>> {
+        let cg = self.cipher.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to decrypt".to_owned(),
+        ))?;
+        cg.decrypt(input)
+    }
+}

libs/dtls/src/cipher_suite/cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm.rs

@@ -0,0 +1,12 @@
+use super::*;
+use crate::cipher_suite::cipher_suite_aes_128_ccm::CipherSuiteAes128Ccm;
+use crate::crypto::crypto_ccm::CryptoCcmTagLen;
+
+pub fn new_cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm() -> CipherSuiteAes128Ccm {
+    CipherSuiteAes128Ccm::new(
+        ClientCertificateType::EcdsaSign,
+        CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm,
+        false,
+        CryptoCcmTagLen::CryptoCcmTagLength,
+    )
+}

libs/dtls/src/cipher_suite/cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm8.rs

@@ -0,0 +1,12 @@
+use super::*;
+use crate::cipher_suite::cipher_suite_aes_128_ccm::CipherSuiteAes128Ccm;
+use crate::crypto::crypto_ccm::CryptoCcmTagLen;
+
+pub fn new_cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm8() -> CipherSuiteAes128Ccm {
+    CipherSuiteAes128Ccm::new(
+        ClientCertificateType::EcdsaSign,
+        CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm_8,
+        false,
+        CryptoCcmTagLen::CryptoCcm8TagLength,
+    )
+}

libs/dtls/src/cipher_suite/cipher_suite_tls_psk_with_aes_128_ccm.rs

@@ -0,0 +1,12 @@
+use super::*;
+use crate::cipher_suite::cipher_suite_aes_128_ccm::CipherSuiteAes128Ccm;
+use crate::crypto::crypto_ccm::CryptoCcmTagLen;
+
+pub fn new_cipher_suite_tls_psk_with_aes_128_ccm() -> CipherSuiteAes128Ccm {
+    CipherSuiteAes128Ccm::new(
+        ClientCertificateType::Unsupported,
+        CipherSuiteId::Tls_Psk_With_Aes_128_Ccm,
+        true,
+        CryptoCcmTagLen::CryptoCcmTagLength,
+    )
+}

libs/dtls/src/cipher_suite/cipher_suite_tls_psk_with_aes_128_ccm8.rs

@@ -0,0 +1,12 @@
+use super::*;
+use crate::cipher_suite::cipher_suite_aes_128_ccm::CipherSuiteAes128Ccm;
+use crate::crypto::crypto_ccm::CryptoCcmTagLen;
+
+pub fn new_cipher_suite_tls_psk_with_aes_128_ccm8() -> CipherSuiteAes128Ccm {
+    CipherSuiteAes128Ccm::new(
+        ClientCertificateType::Unsupported,
+        CipherSuiteId::Tls_Psk_With_Aes_128_Ccm_8,
+        true,
+        CryptoCcmTagLen::CryptoCcm8TagLength,
+    )
+}

libs/dtls/src/cipher_suite/cipher_suite_tls_psk_with_aes_128_gcm_sha256.rs

@@ -0,0 +1,90 @@
+use super::*;
+use crate::crypto::crypto_gcm::*;
+use crate::prf::*;
+
+#[derive(Clone, Default)]
+pub struct CipherSuiteTlsPskWithAes128GcmSha256 {
+    gcm: Option<CryptoGcm>,
+}
+
+impl CipherSuiteTlsPskWithAes128GcmSha256 {
+    const PRF_MAC_LEN: usize = 0;
+    const PRF_KEY_LEN: usize = 16;
+    const PRF_IV_LEN: usize = 4;
+}
+
+impl CipherSuite for CipherSuiteTlsPskWithAes128GcmSha256 {
+    fn to_string(&self) -> String {
+        "TLS_PSK_WITH_AES_128_GCM_SHA256".to_owned()
+    }
+
+    fn id(&self) -> CipherSuiteId {
+        CipherSuiteId::Tls_Psk_With_Aes_128_Gcm_Sha256
+    }
+
+    fn certificate_type(&self) -> ClientCertificateType {
+        ClientCertificateType::Unsupported
+    }
+
+    fn hash_func(&self) -> CipherSuiteHash {
+        CipherSuiteHash::Sha256
+    }
+
+    fn is_psk(&self) -> bool {
+        true
+    }
+
+    fn is_initialized(&self) -> bool {
+        self.gcm.is_some()
+    }
+
+    fn init(
+        &mut self,
+        master_secret: &[u8],
+        client_random: &[u8],
+        server_random: &[u8],
+        is_client: bool,
+    ) -> Result<()> {
+        let keys = prf_encryption_keys(
+            master_secret,
+            client_random,
+            server_random,
+            CipherSuiteTlsPskWithAes128GcmSha256::PRF_MAC_LEN,
+            CipherSuiteTlsPskWithAes128GcmSha256::PRF_KEY_LEN,
+            CipherSuiteTlsPskWithAes128GcmSha256::PRF_IV_LEN,
+            self.hash_func(),
+        )?;
+
+        if is_client {
+            self.gcm = Some(CryptoGcm::new(
+                &keys.client_write_key,
+                &keys.client_write_iv,
+                &keys.server_write_key,
+                &keys.server_write_iv,
+            ));
+        } else {
+            self.gcm = Some(CryptoGcm::new(
+                &keys.server_write_key,
+                &keys.server_write_iv,
+                &keys.client_write_key,
+                &keys.client_write_iv,
+            ));
+        }
+
+        Ok(())
+    }
+
+    fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let cg = self.gcm.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to encrypt".to_owned(),
+        ))?;
+        cg.encrypt(pkt_rlh, raw)
+    }
+
+    fn decrypt(&self, input: &[u8]) -> Result<Vec<u8>> {
+        let cg = self.gcm.as_ref().ok_or(Error::Other(
+            "CipherSuite has not been initialized, unable to decrypt".to_owned(),
+        ))?;
+        cg.decrypt(input)
+    }
+}

libs/dtls/src/cipher_suite/mod.rs

@@ -0,0 +1,287 @@
+pub mod cipher_suite_aes_128_ccm;
+pub mod cipher_suite_aes_128_gcm_sha256;
+pub mod cipher_suite_aes_256_cbc_sha;
+pub mod cipher_suite_chacha20_poly1305_sha256;
+pub mod cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm;
+pub mod cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm8;
+pub mod cipher_suite_tls_psk_with_aes_128_ccm;
+pub mod cipher_suite_tls_psk_with_aes_128_ccm8;
+pub mod cipher_suite_tls_psk_with_aes_128_gcm_sha256;
+
+use std::fmt;
+use std::marker::{Send, Sync};
+
+use cipher_suite_aes_128_gcm_sha256::*;
+use cipher_suite_aes_256_cbc_sha::*;
+use cipher_suite_chacha20_poly1305_sha256::*;
+use cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm::*;
+use cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm8::*;
+use cipher_suite_tls_psk_with_aes_128_ccm::*;
+use cipher_suite_tls_psk_with_aes_128_ccm8::*;
+use cipher_suite_tls_psk_with_aes_128_gcm_sha256::*;
+
+use super::client_certificate_type::*;
+use super::error::*;
+use super::record_layer::record_layer_header::*;
+
+// CipherSuiteID is an ID for our supported CipherSuites
+// Supported Cipher Suites
+#[allow(non_camel_case_types)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum CipherSuiteId {
+    // AES-128-CCM
+    Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm = 0xc0ac,
+    Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm_8 = 0xc0ae,
+
+    // AES-128-GCM-SHA256
+    Tls_Ecdhe_Ecdsa_With_Aes_128_Gcm_Sha256 = 0xc02b,
+    Tls_Ecdhe_Rsa_With_Aes_128_Gcm_Sha256 = 0xc02f,
+
+    // AES-256-CBC-SHA
+    Tls_Ecdhe_Ecdsa_With_Aes_256_Cbc_Sha = 0xc00a,
+    Tls_Ecdhe_Rsa_With_Aes_256_Cbc_Sha = 0xc014,
+
+    Tls_Psk_With_Aes_128_Ccm = 0xc0a4,
+    Tls_Psk_With_Aes_128_Ccm_8 = 0xc0a8,
+    Tls_Psk_With_Aes_128_Gcm_Sha256 = 0x00a8,
+
+    // CHACHA20_POLY1305_SHA256
+    Tls_Ecdhe_Rsa_With_ChaCha20_Poly1305_Sha256 = 0xcca8,
+    Tls_Ecdhe_Ecdsa_With_ChaCha20_Poly1305_Sha256 = 0xcca9,
+
+    Unsupported,
+}
+
+impl fmt::Display for CipherSuiteId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match *self {
+            CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm => {
+                write!(f, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM")
+            }
+            CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm_8 => {
+                write!(f, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8")
+            }
+            CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Gcm_Sha256 => {
+                write!(f, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256")
+            }
+            CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_128_Gcm_Sha256 => {
+                write!(f, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256")
+            }
+            CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_256_Cbc_Sha => {
+                write!(f, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA")
+            }
+            CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_256_Cbc_Sha => {
+                write!(f, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA")
+            }
+            CipherSuiteId::Tls_Psk_With_Aes_128_Ccm => write!(f, "TLS_PSK_WITH_AES_128_CCM"),
+            CipherSuiteId::Tls_Psk_With_Aes_128_Ccm_8 => write!(f, "TLS_PSK_WITH_AES_128_CCM_8"),
+            CipherSuiteId::Tls_Psk_With_Aes_128_Gcm_Sha256 => {
+                write!(f, "TLS_PSK_WITH_AES_128_GCM_SHA256")
+            }
+            CipherSuiteId::Tls_Ecdhe_Rsa_With_ChaCha20_Poly1305_Sha256 => {
+                write!(f, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256")
+            }
+            CipherSuiteId::Tls_Ecdhe_Ecdsa_With_ChaCha20_Poly1305_Sha256 => {
+                write!(f, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256")
+            }
+
+            _ => write!(f, "Unsupported CipherSuiteID"),
+        }
+    }
+}
+
+impl From<u16> for CipherSuiteId {
+    fn from(val: u16) -> Self {
+        match val {
+            // AES-128-CCM
+            0xc0ac => CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm,
+            0xc0ae => CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm_8,
+
+            // AES-128-GCM-SHA256
+            0xc02b => CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Gcm_Sha256,
+            0xc02f => CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_128_Gcm_Sha256,
+
+            // AES-256-CBC-SHA
+            0xc00a => CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_256_Cbc_Sha,
+            0xc014 => CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_256_Cbc_Sha,
+
+            0xc0a4 => CipherSuiteId::Tls_Psk_With_Aes_128_Ccm,
+            0xc0a8 => CipherSuiteId::Tls_Psk_With_Aes_128_Ccm_8,
+            0x00a8 => CipherSuiteId::Tls_Psk_With_Aes_128_Gcm_Sha256,
+
+            // CHACHA20_POLY1305_SHA256
+            0xcca8 => CipherSuiteId::Tls_Ecdhe_Rsa_With_ChaCha20_Poly1305_Sha256,
+            0xcca9 => CipherSuiteId::Tls_Ecdhe_Ecdsa_With_ChaCha20_Poly1305_Sha256,
+
+            _ => CipherSuiteId::Unsupported,
+        }
+    }
+}
+
+impl From<&str> for CipherSuiteId {
+    fn from(val: &str) -> Self {
+        match val {
+            "TLS_ECDHE_ECDSA_WITH_AES_128_CCM" => CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm,
+            "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8" => {
+                CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm_8
+            }
+            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" => {
+                CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Gcm_Sha256
+            }
+            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" => {
+                CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_128_Gcm_Sha256
+            }
+            "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" => {
+                CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_256_Cbc_Sha
+            }
+            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" => {
+                CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_256_Cbc_Sha
+            }
+            "TLS_PSK_WITH_AES_128_CCM" => CipherSuiteId::Tls_Psk_With_Aes_128_Ccm,
+            "TLS_PSK_WITH_AES_128_CCM_8" => CipherSuiteId::Tls_Psk_With_Aes_128_Ccm_8,
+            "TLS_PSK_WITH_AES_128_GCM_SHA256" => CipherSuiteId::Tls_Psk_With_Aes_128_Gcm_Sha256,
+            "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" => {
+                CipherSuiteId::Tls_Ecdhe_Rsa_With_ChaCha20_Poly1305_Sha256
+            }
+            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" => {
+                CipherSuiteId::Tls_Ecdhe_Ecdsa_With_ChaCha20_Poly1305_Sha256
+            }
+            _ => CipherSuiteId::Unsupported,
+        }
+    }
+}
+
+#[derive(Copy, Clone, Debug)]
+pub enum CipherSuiteHash {
+    Sha256,
+}
+
+impl CipherSuiteHash {
+    pub(crate) fn size(&self) -> usize {
+        match *self {
+            CipherSuiteHash::Sha256 => 32,
+        }
+    }
+}
+
+pub trait CipherSuite {
+    fn to_string(&self) -> String;
+    fn id(&self) -> CipherSuiteId;
+    fn certificate_type(&self) -> ClientCertificateType;
+    fn hash_func(&self) -> CipherSuiteHash;
+    fn is_psk(&self) -> bool;
+    fn is_initialized(&self) -> bool;
+
+    // Generate the internal encryption state
+    fn init(
+        &mut self,
+        master_secret: &[u8],
+        client_random: &[u8],
+        server_random: &[u8],
+        is_client: bool,
+    ) -> Result<()>;
+
+    fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>>;
+    fn decrypt(&self, input: &[u8]) -> Result<Vec<u8>>;
+}
+
+// Taken from https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
+// A cipher_suite is a specific combination of key agreement, cipher and MAC
+// function.
+pub fn cipher_suite_for_id(id: CipherSuiteId) -> Result<Box<dyn CipherSuite + Send + Sync>> {
+    match id {
+        CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm => {
+            Ok(Box::new(new_cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm()))
+        }
+        CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Ccm_8 => Ok(Box::new(
+            new_cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm8(),
+        )),
+        CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_128_Gcm_Sha256 => {
+            Ok(Box::new(CipherSuiteAes128GcmSha256::new(false)))
+        }
+        CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_128_Gcm_Sha256 => {
+            Ok(Box::new(CipherSuiteAes128GcmSha256::new(true)))
+        }
+        CipherSuiteId::Tls_Ecdhe_Rsa_With_Aes_256_Cbc_Sha => {
+            Ok(Box::new(CipherSuiteAes256CbcSha::new(true)))
+        }
+        CipherSuiteId::Tls_Ecdhe_Ecdsa_With_Aes_256_Cbc_Sha => {
+            Ok(Box::new(CipherSuiteAes256CbcSha::new(false)))
+        }
+        CipherSuiteId::Tls_Psk_With_Aes_128_Ccm => {
+            Ok(Box::new(new_cipher_suite_tls_psk_with_aes_128_ccm()))
+        }
+        CipherSuiteId::Tls_Psk_With_Aes_128_Ccm_8 => {
+            Ok(Box::new(new_cipher_suite_tls_psk_with_aes_128_ccm8()))
+        }
+        CipherSuiteId::Tls_Psk_With_Aes_128_Gcm_Sha256 => {
+            Ok(Box::<CipherSuiteTlsPskWithAes128GcmSha256>::default())
+        }
+        CipherSuiteId::Tls_Ecdhe_Rsa_With_ChaCha20_Poly1305_Sha256 => {
+            Ok(Box::new(CipherSuiteChaCha20Poly1305Sha256::new(true)))
+        }
+        CipherSuiteId::Tls_Ecdhe_Ecdsa_With_ChaCha20_Poly1305_Sha256 => {
+            Ok(Box::new(CipherSuiteChaCha20Poly1305Sha256::new(false)))
+        }
+
+        _ => Err(Error::ErrInvalidCipherSuite),
+    }
+}
+
+// CipherSuites we support in order of preference
+pub(crate) fn default_cipher_suites() -> Vec<Box<dyn CipherSuite + Send + Sync>> {
+    vec![
+        Box::new(CipherSuiteAes128GcmSha256::new(false)),
+        Box::new(CipherSuiteAes256CbcSha::new(false)),
+        Box::new(CipherSuiteAes128GcmSha256::new(true)),
+        Box::new(CipherSuiteAes256CbcSha::new(true)),
+        Box::new(CipherSuiteChaCha20Poly1305Sha256::new(false)),
+    ]
+}
+
+fn all_cipher_suites() -> Vec<Box<dyn CipherSuite + Send + Sync>> {
+    vec![
+        Box::new(new_cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm()),
+        Box::new(new_cipher_suite_tls_ecdhe_ecdsa_with_aes_128_ccm8()),
+        Box::new(CipherSuiteAes128GcmSha256::new(false)),
+        Box::new(CipherSuiteAes128GcmSha256::new(true)),
+        Box::new(CipherSuiteAes256CbcSha::new(false)),
+        Box::new(CipherSuiteAes256CbcSha::new(true)),
+        Box::new(new_cipher_suite_tls_psk_with_aes_128_ccm()),
+        Box::new(new_cipher_suite_tls_psk_with_aes_128_ccm8()),
+        Box::<CipherSuiteTlsPskWithAes128GcmSha256>::default(),
+        Box::new(CipherSuiteChaCha20Poly1305Sha256::new(false)),
+        Box::new(CipherSuiteChaCha20Poly1305Sha256::new(true)),
+    ]
+}
+
+fn cipher_suites_for_ids(ids: &[CipherSuiteId]) -> Result<Vec<Box<dyn CipherSuite + Send + Sync>>> {
+    let mut cipher_suites = vec![];
+    for id in ids {
+        cipher_suites.push(cipher_suite_for_id(*id)?);
+    }
+    Ok(cipher_suites)
+}
+
+pub(crate) fn parse_cipher_suites(
+    user_selected_suites: &[CipherSuiteId],
+    exclude_psk: bool,
+    exclude_non_psk: bool,
+) -> Result<Vec<Box<dyn CipherSuite + Send + Sync>>> {
+    let cipher_suites = if !user_selected_suites.is_empty() {
+        cipher_suites_for_ids(user_selected_suites)?
+    } else {
+        default_cipher_suites()
+    };
+
+    let filtered_cipher_suites: Vec<Box<dyn CipherSuite + Send + Sync>> = cipher_suites
+        .into_iter()
+        .filter(|c| !((exclude_psk && c.is_psk()) || (exclude_non_psk && !c.is_psk())))
+        .collect();
+
+    if filtered_cipher_suites.is_empty() {
+        Err(Error::ErrNoAvailableCipherSuites)
+    } else {
+        Ok(filtered_cipher_suites)
+    }
+}

libs/dtls/src/client_certificate_type.rs

@@ -0,0 +1,16 @@
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum ClientCertificateType {
+    RsaSign = 1,
+    EcdsaSign = 64,
+    Unsupported,
+}
+
+impl From<u8> for ClientCertificateType {
+    fn from(val: u8) -> Self {
+        match val {
+            1 => ClientCertificateType::RsaSign,
+            64 => ClientCertificateType::EcdsaSign,
+            _ => ClientCertificateType::Unsupported,
+        }
+    }
+}

libs/dtls/src/compression_methods.rs

@@ -0,0 +1,60 @@
+use std::io::{Read, Write};
+
+use byteorder::{ReadBytesExt, WriteBytesExt};
+
+use crate::error::Result;
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum CompressionMethodId {
+    Null = 0,
+    Unsupported,
+}
+
+impl From<u8> for CompressionMethodId {
+    fn from(val: u8) -> Self {
+        match val {
+            0 => CompressionMethodId::Null,
+            _ => CompressionMethodId::Unsupported,
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CompressionMethods {
+    pub ids: Vec<CompressionMethodId>,
+}
+
+impl CompressionMethods {
+    pub fn size(&self) -> usize {
+        1 + self.ids.len()
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u8(self.ids.len() as u8)?;
+
+        for id in &self.ids {
+            writer.write_u8(*id as u8)?;
+        }
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let compression_methods_count = reader.read_u8()? as usize;
+        let mut ids = vec![];
+        for _ in 0..compression_methods_count {
+            let id = reader.read_u8()?.into();
+            if id != CompressionMethodId::Unsupported {
+                ids.push(id);
+            }
+        }
+
+        Ok(CompressionMethods { ids })
+    }
+}
+
+pub fn default_compression_methods() -> CompressionMethods {
+    CompressionMethods {
+        ids: vec![CompressionMethodId::Null],
+    }
+}

libs/dtls/src/config.rs

@@ -0,0 +1,193 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use tokio::time::Duration;
+
+use crate::cipher_suite::*;
+use crate::crypto::*;
+use crate::error::*;
+use crate::extension::extension_use_srtp::SrtpProtectionProfile;
+use crate::handshaker::VerifyPeerCertificateFn;
+use crate::signature_hash_algorithm::SignatureScheme;
+
+/// Config is used to configure a DTLS client or server.
+/// After a Config is passed to a DTLS function it must not be modified.
+#[derive(Clone)]
+pub struct Config {
+    /// certificates contains certificate chain to present to the other side of the connection.
+    /// Server MUST set this if psk is non-nil
+    /// client SHOULD sets this so CertificateRequests can be handled if psk is non-nil
+    pub certificates: Vec<Certificate>,
+
+    /// cipher_suites is a list of supported cipher suites.
+    /// If cipher_suites is nil, a default list is used
+    pub cipher_suites: Vec<CipherSuiteId>,
+
+    /// signature_schemes contains the signature and hash schemes that the peer requests to verify.
+    pub signature_schemes: Vec<SignatureScheme>,
+
+    /// srtp_protection_profiles are the supported protection profiles
+    /// Clients will send this via use_srtp and assert that the server properly responds
+    /// Servers will assert that clients send one of these profiles and will respond as needed
+    pub srtp_protection_profiles: Vec<SrtpProtectionProfile>,
+
+    /// client_auth determines the server's policy for
+    /// TLS Client Authentication. The default is NoClientCert.
+    pub client_auth: ClientAuthType,
+
+    /// extended_master_secret determines if the "Extended Master Secret" extension
+    /// should be disabled, requested, or required (default requested).
+    pub extended_master_secret: ExtendedMasterSecretType,
+
+    /// flight_interval controls how often we send outbound handshake messages
+    /// defaults to time.Second
+    pub flight_interval: Duration,
+
+    /// psk sets the pre-shared key used by this DTLS connection
+    /// If psk is non-nil only psk cipher_suites will be used
+    pub psk: Option<PskCallback>,
+    pub psk_identity_hint: Option<Vec<u8>>,
+
+    /// insecure_skip_verify controls whether a client verifies the
+    /// server's certificate chain and host name.
+    /// If insecure_skip_verify is true, TLS accepts any certificate
+    /// presented by the server and any host name in that certificate.
+    /// In this mode, TLS is susceptible to man-in-the-middle attacks.
+    /// This should be used only for testing.
+    pub insecure_skip_verify: bool,
+
+    /// insecure_hashes allows the use of hashing algorithms that are known
+    /// to be vulnerable.
+    pub insecure_hashes: bool,
+
+    /// insecure_verification allows the use of verification algorithms that are
+    /// known to be vulnerable or deprecated
+    pub insecure_verification: bool,
+    /// VerifyPeerCertificate, if not nil, is called after normal
+    /// certificate verification by either a client or server. It
+    /// receives the certificate provided by the peer and also a flag
+    /// that tells if normal verification has succeeded. If it returns a
+    /// non-nil error, the handshake is aborted and that error results.
+    ///
+    /// If normal verification fails then the handshake will abort before
+    /// considering this callback. If normal verification is disabled by
+    /// setting insecure_skip_verify, or (for a server) when client_auth is
+    /// RequestClientCert or RequireAnyClientCert, then this callback will
+    /// be considered but the verifiedChains will always be nil.
+    pub verify_peer_certificate: Option<VerifyPeerCertificateFn>,
+
+    /// roots_cas defines the set of root certificate authorities
+    /// that one peer uses when verifying the other peer's certificates.
+    /// If RootCAs is nil, TLS uses the host's root CA set.
+    /// Used by Client to verify server's certificate
+    pub roots_cas: crate::certificate_verifier::RootCertStore,
+
+    /// client_cas defines the set of root certificate authorities
+    /// that servers use if required to verify a client certificate
+    /// by the policy in client_auth.
+    /// Used by Server to verify client's certificate
+    pub client_cas: crate::certificate_verifier::RootCertStore,
+
+    /// server_name is used to verify the hostname on the returned
+    /// certificates unless insecure_skip_verify is given.
+    pub server_name: String,
+
+    /// mtu is the length at which handshake messages will be fragmented to
+    /// fit within the maximum transmission unit (default is 1200 bytes)
+    pub mtu: usize,
+
+    /// replay_protection_window is the size of the replay attack protection window.
+    /// Duplication of the sequence number is checked in this window size.
+    /// Packet with sequence number older than this value compared to the latest
+    /// accepted packet will be discarded. (default is 64)
+    pub replay_protection_window: usize,
+}
+
+impl Default for Config {
+    fn default() -> Self {
+        Config {
+            certificates: vec![],
+            cipher_suites: vec![],
+            signature_schemes: vec![],
+            srtp_protection_profiles: vec![],
+            client_auth: ClientAuthType::default(),
+            extended_master_secret: ExtendedMasterSecretType::default(),
+            flight_interval: Duration::default(),
+            psk: None,
+            psk_identity_hint: None,
+            insecure_skip_verify: false,
+            insecure_hashes: false,
+            insecure_verification: false,
+            verify_peer_certificate: None,
+            roots_cas: crate::certificate_verifier::RootCertStore::empty(),
+            client_cas: crate::certificate_verifier::RootCertStore::empty(),
+            server_name: String::default(),
+            mtu: 0,
+            replay_protection_window: 0,
+        }
+    }
+}
+
+pub(crate) const DEFAULT_MTU: usize = 1200; // bytes
+
+// PSKCallback is called once we have the remote's psk_identity_hint.
+// If the remote provided none it will be nil
+pub(crate) type PskCallback =
+    Arc<dyn (Fn(&[u8]) -> Pin<Box<dyn Future<Output = Result<Vec<u8>>> + Send>>) + Send + Sync>;
+
+// ClientAuthType declares the policy the server will follow for
+// TLS Client Authentication.
+#[derive(Default, Copy, Clone, PartialEq, Eq)]
+pub enum ClientAuthType {
+    #[default]
+    NoClientCert = 0,
+    RequestClientCert = 1,
+    RequireAnyClientCert = 2,
+    VerifyClientCertIfGiven = 3,
+    RequireAndVerifyClientCert = 4,
+}
+
+// ExtendedMasterSecretType declares the policy the client and server
+// will follow for the Extended Master Secret extension
+#[derive(Default, PartialEq, Eq, Copy, Clone)]
+pub enum ExtendedMasterSecretType {
+    #[default]
+    Request = 0,
+    Require = 1,
+    Disable = 2,
+}
+
+pub(crate) fn validate_config(is_client: bool, config: &Config) -> Result<()> {
+    if is_client && config.psk.is_some() && config.psk_identity_hint.is_none() {
+        return Err(Error::ErrPskAndIdentityMustBeSetForClient);
+    }
+
+    if !is_client && config.psk.is_none() && config.certificates.is_empty() {
+        return Err(Error::ErrServerMustHaveCertificate);
+    }
+
+    if !config.certificates.is_empty() && config.psk.is_some() {
+        return Err(Error::ErrPskAndCertificate);
+    }
+
+    if config.psk_identity_hint.is_some() && config.psk.is_none() {
+        return Err(Error::ErrIdentityNoPsk);
+    }
+
+    for cert in &config.certificates {
+        match cert.private_key.kind {
+            CryptoPrivateKeyKind::Ed25519(_) => {}
+            CryptoPrivateKeyKind::Ecdsa256(_) => {}
+            _ => return Err(Error::ErrInvalidPrivateKey),
+        }
+    }
+
+    parse_cipher_suites(
+        &config.cipher_suites,
+        config.psk.is_none(),
+        config.psk.is_some(),
+    )?;
+
+    Ok(())
+}

libs/dtls/src/content.rs

@@ -0,0 +1,85 @@
+use std::io::{Read, Write};
+
+use super::alert::*;
+use super::application_data::*;
+use super::change_cipher_spec::*;
+use super::handshake::*;
+use crate::error::*;
+
+/// ## Specifications
+///
+/// * [RFC 4346 §6.2.1]
+///
+/// [RFC 4346 §6.2.1]: https://tools.ietf.org/html/rfc4346#section-6.2.1
+#[derive(Default, Copy, Clone, PartialEq, Eq, Debug)]
+pub enum ContentType {
+    ChangeCipherSpec = 20,
+    Alert = 21,
+    Handshake = 22,
+    ApplicationData = 23,
+    #[default]
+    Invalid,
+}
+
+impl From<u8> for ContentType {
+    fn from(val: u8) -> Self {
+        match val {
+            20 => ContentType::ChangeCipherSpec,
+            21 => ContentType::Alert,
+            22 => ContentType::Handshake,
+            23 => ContentType::ApplicationData,
+            _ => ContentType::Invalid,
+        }
+    }
+}
+
+#[derive(PartialEq, Debug, Clone)]
+pub enum Content {
+    ChangeCipherSpec(ChangeCipherSpec),
+    Alert(Alert),
+    Handshake(Handshake),
+    ApplicationData(ApplicationData),
+}
+
+impl Content {
+    pub fn content_type(&self) -> ContentType {
+        match self {
+            Content::ChangeCipherSpec(c) => c.content_type(),
+            Content::Alert(c) => c.content_type(),
+            Content::Handshake(c) => c.content_type(),
+            Content::ApplicationData(c) => c.content_type(),
+        }
+    }
+
+    pub fn size(&self) -> usize {
+        match self {
+            Content::ChangeCipherSpec(c) => c.size(),
+            Content::Alert(c) => c.size(),
+            Content::Handshake(c) => c.size(),
+            Content::ApplicationData(c) => c.size(),
+        }
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        match self {
+            Content::ChangeCipherSpec(c) => c.marshal(writer),
+            Content::Alert(c) => c.marshal(writer),
+            Content::Handshake(c) => c.marshal(writer),
+            Content::ApplicationData(c) => c.marshal(writer),
+        }
+    }
+
+    pub fn unmarshal<R: Read>(content_type: ContentType, reader: &mut R) -> Result<Self> {
+        match content_type {
+            ContentType::ChangeCipherSpec => Ok(Content::ChangeCipherSpec(
+                ChangeCipherSpec::unmarshal(reader)?,
+            )),
+            ContentType::Alert => Ok(Content::Alert(Alert::unmarshal(reader)?)),
+            ContentType::Handshake => Ok(Content::Handshake(Handshake::unmarshal(reader)?)),
+            ContentType::ApplicationData => Ok(Content::ApplicationData(
+                ApplicationData::unmarshal(reader)?,
+            )),
+            _ => Err(Error::ErrInvalidContentType),
+        }
+    }
+}

libs/dtls/src/crypto/crypto_cbc.rs

@@ -0,0 +1,136 @@
+// AES-CBC (Cipher Block Chaining)
+// First historic block cipher for AES.
+// CBC mode is insecure and must not be used. It’s been progressively deprecated and
+// removed from SSL libraries.
+// Introduced with TLS 1.0 year 2002. Superseded by GCM in TLS 1.2 year 2008.
+// Removed in TLS 1.3 year 2018.
+// RFC 3268 year 2002 https://tools.ietf.org/html/rfc3268
+
+// https://github.com/RustCrypto/block-ciphers
+
+use aes::cipher::{BlockDecryptMut, BlockEncryptMut, KeyIvInit};
+use p256::elliptic_curve::subtle::ConstantTimeEq;
+use rand::Rng;
+use std::io::Cursor;
+use std::ops::Not;
+
+use super::padding::DtlsPadding;
+use crate::content::*;
+use crate::error::*;
+use crate::prf::*;
+use crate::record_layer::record_layer_header::*;
+type Aes256CbcEnc = cbc::Encryptor<aes::Aes256>;
+type Aes256CbcDec = cbc::Decryptor<aes::Aes256>;
+
+// State needed to handle encrypted input/output
+#[derive(Clone)]
+pub struct CryptoCbc {
+    local_key: Vec<u8>,
+    remote_key: Vec<u8>,
+    write_mac: Vec<u8>,
+    read_mac: Vec<u8>,
+}
+
+impl CryptoCbc {
+    const BLOCK_SIZE: usize = 16;
+    const MAC_SIZE: usize = 20;
+
+    pub fn new(
+        local_key: &[u8],
+        local_mac: &[u8],
+        remote_key: &[u8],
+        remote_mac: &[u8],
+    ) -> Result<Self> {
+        Ok(CryptoCbc {
+            local_key: local_key.to_vec(),
+            write_mac: local_mac.to_vec(),
+
+            remote_key: remote_key.to_vec(),
+            read_mac: remote_mac.to_vec(),
+        })
+    }
+
+    pub fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let mut payload = raw[RECORD_LAYER_HEADER_SIZE..].to_vec();
+        let raw = &raw[..RECORD_LAYER_HEADER_SIZE];
+
+        // Generate + Append MAC
+        let h = pkt_rlh;
+
+        let mac = prf_mac(
+            h.epoch,
+            h.sequence_number,
+            h.content_type,
+            h.protocol_version,
+            &payload,
+            &self.write_mac,
+        )?;
+        payload.extend_from_slice(&mac);
+
+        let mut iv: Vec<u8> = vec![0; Self::BLOCK_SIZE];
+        rand::rng().fill(iv.as_mut_slice());
+
+        let write_cbc = Aes256CbcEnc::new_from_slices(&self.local_key, &iv)?;
+        let encrypted = write_cbc.encrypt_padded_vec_mut::<DtlsPadding>(&payload);
+
+        // Prepend unencrypte header with encrypted payload
+        let mut r = vec![];
+        r.extend_from_slice(raw);
+        r.extend_from_slice(&iv);
+        r.extend_from_slice(&encrypted);
+
+        let r_len = (r.len() - RECORD_LAYER_HEADER_SIZE) as u16;
+        r[RECORD_LAYER_HEADER_SIZE - 2..RECORD_LAYER_HEADER_SIZE]
+            .copy_from_slice(&r_len.to_be_bytes());
+
+        Ok(r)
+    }
+
+    pub fn decrypt(&self, r: &[u8]) -> Result<Vec<u8>> {
+        let mut reader = Cursor::new(r);
+        let h = RecordLayerHeader::unmarshal(&mut reader)?;
+        if h.content_type == ContentType::ChangeCipherSpec {
+            // Nothing to encrypt with ChangeCipherSpec
+            return Ok(r.to_vec());
+        }
+
+        if r.len() < RECORD_LAYER_HEADER_SIZE + Self::BLOCK_SIZE {
+            return Err(Error::ErrInvalidPacketLength);
+        }
+
+        let body = &r[RECORD_LAYER_HEADER_SIZE..];
+        let iv = &body[0..Self::BLOCK_SIZE];
+        let body = &body[Self::BLOCK_SIZE..];
+
+        if body.is_empty() || !body.len().is_multiple_of(Self::BLOCK_SIZE) {
+            return Err(Error::ErrInvalidPacketLength);
+        }
+
+        let read_cbc = Aes256CbcDec::new_from_slices(&self.remote_key, iv)?;
+
+        let decrypted = read_cbc
+            .decrypt_padded_vec_mut::<DtlsPadding>(body)
+            .map_err(|_| Error::ErrInvalidPacketLength)?;
+
+        let recv_mac = &decrypted[decrypted.len() - Self::MAC_SIZE..];
+        let decrypted = &decrypted[0..decrypted.len() - Self::MAC_SIZE];
+        let mac = prf_mac(
+            h.epoch,
+            h.sequence_number,
+            h.content_type,
+            h.protocol_version,
+            decrypted,
+            &self.read_mac,
+        )?;
+
+        if recv_mac.ct_eq(&mac).not().into() {
+            return Err(Error::ErrInvalidMac);
+        }
+
+        let mut d = Vec::with_capacity(RECORD_LAYER_HEADER_SIZE + decrypted.len());
+        d.extend_from_slice(&r[..RECORD_LAYER_HEADER_SIZE]);
+        d.extend_from_slice(decrypted);
+
+        Ok(d)
+    }
+}

libs/dtls/src/crypto/crypto_ccm.rs

@@ -0,0 +1,188 @@
+// AES-CCM (Counter with CBC-MAC)
+// Alternative to GCM mode.
+// Available in OpenSSL as of TLS 1.3 (2018), but disabled by default.
+// Two AES computations per block, thus expected to be somewhat slower than AES-GCM.
+// RFC 6655 year 2012 https://tools.ietf.org/html/rfc6655
+// Much lower adoption, probably because it came after GCM and offer no significant benefit.
+
+// https://github.com/RustCrypto/AEADs
+// https://docs.rs/ccm/0.3.0/ccm/ Or https://crates.io/crates/aes-ccm?
+
+use std::io::Cursor;
+
+use aes::Aes128;
+use ccm::aead::generic_array::GenericArray;
+use ccm::aead::AeadInPlace;
+use ccm::consts::{U12, U16, U8};
+use ccm::Ccm;
+use ccm::KeyInit;
+use rand::Rng;
+
+use super::*;
+use crate::content::*;
+use crate::error::*;
+use crate::record_layer::record_layer_header::*;
+
+const CRYPTO_CCM_8_TAG_LENGTH: usize = 8;
+const CRYPTO_CCM_TAG_LENGTH: usize = 16;
+const CRYPTO_CCM_NONCE_LENGTH: usize = 12;
+
+type AesCcm8 = Ccm<Aes128, U8, U12>;
+type AesCcm = Ccm<Aes128, U16, U12>;
+
+#[derive(Clone)]
+pub enum CryptoCcmTagLen {
+    CryptoCcm8TagLength,
+    CryptoCcmTagLength,
+}
+
+enum CryptoCcmType {
+    CryptoCcm8(AesCcm8),
+    CryptoCcm(AesCcm),
+}
+
+// State needed to handle encrypted input/output
+pub struct CryptoCcm {
+    local_ccm: CryptoCcmType,
+    remote_ccm: CryptoCcmType,
+    local_write_iv: Vec<u8>,
+    remote_write_iv: Vec<u8>,
+    // used by clone()
+    local_write_key: Vec<u8>,
+    remote_write_key: Vec<u8>,
+}
+
+impl Clone for CryptoCcm {
+    fn clone(&self) -> Self {
+        match self.local_ccm {
+            CryptoCcmType::CryptoCcm(_) => Self::new(
+                &CryptoCcmTagLen::CryptoCcmTagLength,
+                &self.local_write_key,
+                &self.local_write_iv,
+                &self.remote_write_key,
+                &self.remote_write_iv,
+            ),
+            CryptoCcmType::CryptoCcm8(_) => Self::new(
+                &CryptoCcmTagLen::CryptoCcm8TagLength,
+                &self.local_write_key,
+                &self.local_write_iv,
+                &self.remote_write_key,
+                &self.remote_write_iv,
+            ),
+        }
+    }
+}
+
+impl CryptoCcm {
+    pub fn new(
+        tag_len: &CryptoCcmTagLen,
+        local_key: &[u8],
+        local_write_iv: &[u8],
+        remote_key: &[u8],
+        remote_write_iv: &[u8],
+    ) -> Self {
+        let key = GenericArray::from_slice(local_key);
+        let local_ccm = match tag_len {
+            CryptoCcmTagLen::CryptoCcmTagLength => CryptoCcmType::CryptoCcm(AesCcm::new(key)),
+            CryptoCcmTagLen::CryptoCcm8TagLength => CryptoCcmType::CryptoCcm8(AesCcm8::new(key)),
+        };
+
+        let key = GenericArray::from_slice(remote_key);
+        let remote_ccm = match tag_len {
+            CryptoCcmTagLen::CryptoCcmTagLength => CryptoCcmType::CryptoCcm(AesCcm::new(key)),
+            CryptoCcmTagLen::CryptoCcm8TagLength => CryptoCcmType::CryptoCcm8(AesCcm8::new(key)),
+        };
+
+        CryptoCcm {
+            local_ccm,
+            local_write_key: local_key.to_vec(),
+            local_write_iv: local_write_iv.to_vec(),
+            remote_ccm,
+            remote_write_key: remote_key.to_vec(),
+            remote_write_iv: remote_write_iv.to_vec(),
+        }
+    }
+
+    pub fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let payload = &raw[RECORD_LAYER_HEADER_SIZE..];
+        let raw = &raw[..RECORD_LAYER_HEADER_SIZE];
+
+        let mut nonce = vec![0u8; CRYPTO_CCM_NONCE_LENGTH];
+        nonce[..4].copy_from_slice(&self.local_write_iv[..4]);
+        rand::rng().fill(&mut nonce[4..]);
+        let nonce = GenericArray::from_slice(&nonce);
+
+        let additional_data = generate_aead_additional_data(pkt_rlh, payload.len());
+
+        let mut buffer: Vec<u8> = Vec::new();
+        buffer.extend_from_slice(payload);
+
+        match &self.local_ccm {
+            CryptoCcmType::CryptoCcm(ccm) => {
+                ccm.encrypt_in_place(nonce, &additional_data, &mut buffer)
+                    .map_err(|e| Error::Other(e.to_string()))?;
+            }
+            CryptoCcmType::CryptoCcm8(ccm8) => {
+                ccm8.encrypt_in_place(nonce, &additional_data, &mut buffer)
+                    .map_err(|e| Error::Other(e.to_string()))?;
+            }
+        }
+
+        let mut r = Vec::with_capacity(raw.len() + nonce.len() + buffer.len());
+
+        r.extend_from_slice(raw);
+        r.extend_from_slice(&nonce[4..]);
+        r.extend_from_slice(&buffer);
+
+        // Update recordLayer size to include explicit nonce
+        let r_len = (r.len() - RECORD_LAYER_HEADER_SIZE) as u16;
+        r[RECORD_LAYER_HEADER_SIZE - 2..RECORD_LAYER_HEADER_SIZE]
+            .copy_from_slice(&r_len.to_be_bytes());
+
+        Ok(r)
+    }
+
+    pub fn decrypt(&self, r: &[u8]) -> Result<Vec<u8>> {
+        let mut reader = Cursor::new(r);
+        let h = RecordLayerHeader::unmarshal(&mut reader)?;
+        if h.content_type == ContentType::ChangeCipherSpec {
+            // Nothing to encrypt with ChangeCipherSpec
+            return Ok(r.to_vec());
+        }
+
+        if r.len() <= (RECORD_LAYER_HEADER_SIZE + 8) {
+            return Err(Error::ErrNotEnoughRoomForNonce);
+        }
+
+        let mut nonce = vec![];
+        nonce.extend_from_slice(&self.remote_write_iv[..4]);
+        nonce.extend_from_slice(&r[RECORD_LAYER_HEADER_SIZE..RECORD_LAYER_HEADER_SIZE + 8]);
+        let nonce = GenericArray::from_slice(&nonce);
+
+        let out = &r[RECORD_LAYER_HEADER_SIZE + 8..];
+
+        let mut buffer: Vec<u8> = Vec::new();
+        buffer.extend_from_slice(out);
+
+        match &self.remote_ccm {
+            CryptoCcmType::CryptoCcm(ccm) => {
+                let additional_data =
+                    generate_aead_additional_data(&h, out.len() - CRYPTO_CCM_TAG_LENGTH);
+                ccm.decrypt_in_place(nonce, &additional_data, &mut buffer)
+                    .map_err(|e| Error::Other(e.to_string()))?;
+            }
+            CryptoCcmType::CryptoCcm8(ccm8) => {
+                let additional_data =
+                    generate_aead_additional_data(&h, out.len() - CRYPTO_CCM_8_TAG_LENGTH);
+                ccm8.decrypt_in_place(nonce, &additional_data, &mut buffer)
+                    .map_err(|e| Error::Other(e.to_string()))?;
+            }
+        }
+
+        let mut d = Vec::with_capacity(RECORD_LAYER_HEADER_SIZE + buffer.len());
+        d.extend_from_slice(&r[..RECORD_LAYER_HEADER_SIZE]);
+        d.extend_from_slice(&buffer);
+
+        Ok(d)
+    }
+}

libs/dtls/src/crypto/crypto_chacha20.rs

@@ -0,0 +1,123 @@
+use std::io::Cursor;
+
+use chacha20poly1305::aead::generic_array::GenericArray;
+use chacha20poly1305::aead::AeadInPlace;
+use chacha20poly1305::{ChaCha20Poly1305, KeyInit};
+
+use super::*;
+use crate::content::*;
+use crate::error::*;
+use crate::record_layer::record_layer_header::*; // what about Aes256Gcm?
+
+const CRYPTO_CHACHA20_TAG_LENGTH: usize = 16;
+const CRYPTO_CHACHA20_NONCE_LENGTH: usize = 12;
+
+// State needed to handle encrypted input/output
+#[derive(Clone)]
+pub struct CryptoChaCha20 {
+    local_cc: ChaCha20Poly1305,
+    remote_cc: ChaCha20Poly1305,
+    local_key: Vec<u8>,
+    remote_key: Vec<u8>,
+    local_write_iv: Vec<u8>,
+    remote_write_iv: Vec<u8>,
+}
+
+fn noncegen(nonce: &mut [u8], epoch: u16, seqnum: u64) {
+    let epoch: u64 = epoch.into();
+    let seqnum = (seqnum & 0xFFFFFFFFFFFF) | (epoch << 48);
+    for i in 0..8 {
+        nonce[i + 4] ^= ((seqnum >> (8 * (7 - i))) & 0xFF) as u8;
+    }
+}
+
+impl CryptoChaCha20 {
+    pub fn new(
+        local_key: &[u8],
+        local_write_iv: &[u8],
+        remote_key: &[u8],
+        remote_write_iv: &[u8],
+    ) -> Self {
+        let key = GenericArray::from_slice(local_key);
+        let local_cc = ChaCha20Poly1305::new(key);
+
+        let key = GenericArray::from_slice(remote_key);
+        let remote_cc = ChaCha20Poly1305::new(key);
+
+        CryptoChaCha20 {
+            local_cc,
+            local_write_iv: local_write_iv.to_vec(),
+            remote_cc,
+            local_key: local_key.to_vec(),
+            remote_key: remote_key.to_vec(),
+            remote_write_iv: remote_write_iv.to_vec(),
+        }
+    }
+
+    pub fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let payload = &raw[RECORD_LAYER_HEADER_SIZE..];
+        let raw = &raw[..RECORD_LAYER_HEADER_SIZE];
+
+        let mut nonce = vec![0u8; CRYPTO_CHACHA20_NONCE_LENGTH];
+        nonce[..CRYPTO_CHACHA20_NONCE_LENGTH]
+            .copy_from_slice(&self.local_write_iv[..CRYPTO_CHACHA20_NONCE_LENGTH]);
+
+        noncegen(&mut nonce[..], pkt_rlh.epoch, pkt_rlh.sequence_number);
+        let nonce = GenericArray::from_slice(&nonce);
+
+        let additional_data = generate_aead_additional_data(pkt_rlh, payload.len());
+
+        let mut buffer: Vec<u8> = Vec::new();
+        buffer.extend_from_slice(payload);
+
+        let tag = self
+            .local_cc
+            .encrypt_in_place_detached(nonce, &additional_data, &mut buffer)
+            .map_err(|e| Error::Other(e.to_string()))?;
+
+        let mut r = Vec::with_capacity(raw.len() + buffer.len() + tag.len());
+        r.extend_from_slice(raw);
+        r.extend_from_slice(&buffer);
+        r.extend_from_slice(&tag);
+
+        // Update recordLayer size to include explicit nonce
+        let r_len = (r.len() - RECORD_LAYER_HEADER_SIZE) as u16;
+        r[RECORD_LAYER_HEADER_SIZE - 2..RECORD_LAYER_HEADER_SIZE]
+            .copy_from_slice(&r_len.to_be_bytes());
+
+        Ok(r)
+    }
+
+    pub fn decrypt(&self, r: &[u8]) -> Result<Vec<u8>> {
+        let mut reader = Cursor::new(r);
+        let h = RecordLayerHeader::unmarshal(&mut reader)?;
+        if h.content_type == ContentType::ChangeCipherSpec {
+            // Nothing to encrypt with ChangeCipherSpec
+            return Ok(r.to_vec());
+        }
+
+        let mut nonce = vec![];
+        nonce.extend_from_slice(&self.remote_write_iv[..]);
+
+        noncegen(&mut nonce[..], h.epoch, h.sequence_number);
+        let nonce = GenericArray::from_slice(&nonce);
+
+        let out = &r[RECORD_LAYER_HEADER_SIZE..];
+
+        let additional_data =
+            generate_aead_additional_data(&h, out.len() - CRYPTO_CHACHA20_TAG_LENGTH);
+
+        let mut buffer: Vec<u8> = Vec::new();
+        buffer.extend_from_slice(out);
+
+        self.remote_cc
+            .decrypt_in_place(nonce, &additional_data, &mut buffer)
+            .map_err(|e| Error::Other(e.to_string()))?;
+
+        let mut d = Vec::with_capacity(RECORD_LAYER_HEADER_SIZE + buffer.len());
+        d.extend_from_slice(&r[..RECORD_LAYER_HEADER_SIZE]);
+        d.extend_from_slice(&buffer);
+
+        Ok(d)
+    }
+}

libs/dtls/src/crypto/crypto_gcm.rs

@@ -0,0 +1,119 @@
+// AES-GCM (Galois Counter Mode)
+// The most widely used block cipher worldwide.
+// Mandatory as of TLS 1.2 (2008) and used by default by most clients.
+// RFC 5288 year 2008 https://tools.ietf.org/html/rfc5288
+
+// https://github.com/RustCrypto/AEADs
+// https://docs.rs/aes-gcm/0.8.0/aes_gcm/
+
+use std::io::Cursor;
+
+use aes_gcm::aead::generic_array::GenericArray;
+use aes_gcm::aead::AeadInPlace;
+use aes_gcm::{Aes128Gcm, KeyInit};
+use rand::Rng;
+
+use super::*;
+use crate::content::*;
+use crate::error::*;
+use crate::record_layer::record_layer_header::*; // what about Aes256Gcm?
+
+const CRYPTO_GCM_TAG_LENGTH: usize = 16;
+const CRYPTO_GCM_NONCE_LENGTH: usize = 12;
+
+// State needed to handle encrypted input/output
+#[derive(Clone)]
+pub struct CryptoGcm {
+    local_gcm: Aes128Gcm,
+    remote_gcm: Aes128Gcm,
+    local_write_iv: Vec<u8>,
+    remote_write_iv: Vec<u8>,
+}
+
+impl CryptoGcm {
+    pub fn new(
+        local_key: &[u8],
+        local_write_iv: &[u8],
+        remote_key: &[u8],
+        remote_write_iv: &[u8],
+    ) -> Self {
+        let key = GenericArray::from_slice(local_key);
+        let local_gcm = Aes128Gcm::new(key);
+
+        let key = GenericArray::from_slice(remote_key);
+        let remote_gcm = Aes128Gcm::new(key);
+
+        CryptoGcm {
+            local_gcm,
+            local_write_iv: local_write_iv.to_vec(),
+            remote_gcm,
+            remote_write_iv: remote_write_iv.to_vec(),
+        }
+    }
+
+    pub fn encrypt(&self, pkt_rlh: &RecordLayerHeader, raw: &[u8]) -> Result<Vec<u8>> {
+        let payload = &raw[RECORD_LAYER_HEADER_SIZE..];
+        let raw = &raw[..RECORD_LAYER_HEADER_SIZE];
+
+        let mut nonce = vec![0u8; CRYPTO_GCM_NONCE_LENGTH];
+        nonce[..4].copy_from_slice(&self.local_write_iv[..4]);
+        rand::rng().fill(&mut nonce[4..]);
+        let nonce = GenericArray::from_slice(&nonce);
+
+        let additional_data = generate_aead_additional_data(pkt_rlh, payload.len());
+
+        let mut buffer: Vec<u8> = Vec::new();
+        buffer.extend_from_slice(payload);
+
+        self.local_gcm
+            .encrypt_in_place(nonce, &additional_data, &mut buffer)
+            .map_err(|e| Error::Other(e.to_string()))?;
+
+        let mut r = Vec::with_capacity(raw.len() + nonce.len() + buffer.len());
+        r.extend_from_slice(raw);
+        r.extend_from_slice(&nonce[4..]);
+        r.extend_from_slice(&buffer);
+
+        // Update recordLayer size to include explicit nonce
+        let r_len = (r.len() - RECORD_LAYER_HEADER_SIZE) as u16;
+        r[RECORD_LAYER_HEADER_SIZE - 2..RECORD_LAYER_HEADER_SIZE]
+            .copy_from_slice(&r_len.to_be_bytes());
+
+        Ok(r)
+    }
+
+    pub fn decrypt(&self, r: &[u8]) -> Result<Vec<u8>> {
+        let mut reader = Cursor::new(r);
+        let h = RecordLayerHeader::unmarshal(&mut reader)?;
+        if h.content_type == ContentType::ChangeCipherSpec {
+            // Nothing to encrypt with ChangeCipherSpec
+            return Ok(r.to_vec());
+        }
+
+        if r.len() <= (RECORD_LAYER_HEADER_SIZE + 8) {
+            return Err(Error::ErrNotEnoughRoomForNonce);
+        }
+
+        let mut nonce = vec![];
+        nonce.extend_from_slice(&self.remote_write_iv[..4]);
+        nonce.extend_from_slice(&r[RECORD_LAYER_HEADER_SIZE..RECORD_LAYER_HEADER_SIZE + 8]);
+        let nonce = GenericArray::from_slice(&nonce);
+
+        let out = &r[RECORD_LAYER_HEADER_SIZE + 8..];
+
+        let additional_data = generate_aead_additional_data(&h, out.len() - CRYPTO_GCM_TAG_LENGTH);
+
+        let mut buffer: Vec<u8> = Vec::new();
+        buffer.extend_from_slice(out);
+
+        self.remote_gcm
+            .decrypt_in_place(nonce, &additional_data, &mut buffer)
+            .map_err(|e| Error::Other(e.to_string()))?;
+
+        let mut d = Vec::with_capacity(RECORD_LAYER_HEADER_SIZE + buffer.len());
+        d.extend_from_slice(&r[..RECORD_LAYER_HEADER_SIZE]);
+        d.extend_from_slice(&buffer);
+
+        Ok(d)
+    }
+}

libs/dtls/src/crypto/crypto_test.rs

@@ -0,0 +1,221 @@
+use std::io::Cursor;
+
+use x509_parser::pem::Pem;
+
+use super::crypto_ccm::*;
+use super::*;
+use crate::content::ContentType;
+use crate::record_layer::record_layer_header::{ProtocolVersion, RECORD_LAYER_HEADER_SIZE};
+
+const RAW_PRIVATE_KEY: &str = "
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAxIA2BrrnR2sIlATsp7aRBD/3krwZ7vt9dNeoDQAee0s6SuYP
+6MBx/HPnAkwNvPS90R05a7pwRkoT6Ur4PfPhCVlUe8lV+0Eto3ZSEeHz3HdsqlM3
+bso67L7Dqrc7MdVstlKcgJi8yeAoGOIL9/igOv0XBFCeznm9nznx6mnsR5cugw+1
+ypXelaHmBCLV7r5SeVSh57+KhvZGbQ2fFpUaTPegRpJZXBNS8lSeWvtOv9d6N5UB
+ROTAJodMZT5AfX0jB0QB9IT/0I96H6BSENH08NXOeXApMuLKvnAf361rS7cRAfRL
+rWZqERMP4u6Cnk0Cnckc3WcW27kGGIbtwbqUIQIDAQABAoIBAGF7OVIdZp8Hejn0
+N3L8HvT8xtUEe9kS6ioM0lGgvX5s035Uo4/T6LhUx0VcdXRH9eLHnLTUyN4V4cra
+ZkxVsE3zAvZl60G6E+oDyLMWZOP6Wu4kWlub9597A5atT7BpMIVCdmFVZFLB4SJ3
+AXkC3nplFAYP+Lh1rJxRIrIn2g+pEeBboWbYA++oDNuMQffDZaokTkJ8Bn1JZYh0
+xEXKY8Bi2Egd5NMeZa1UFO6y8tUbZfwgVs6Enq5uOgtfayq79vZwyjj1kd29MBUD
+8g8byV053ZKxbUOiOuUts97eb+fN3DIDRTcT2c+lXt/4C54M1FclJAbtYRK/qwsl
+pYWKQAECgYEA4ZUbqQnTo1ICvj81ifGrz+H4LKQqe92Hbf/W51D/Umk2kP702W22
+HP4CvrJRtALThJIG9m2TwUjl/WAuZIBrhSAbIvc3Fcoa2HjdRp+sO5U1ueDq7d/S
+Z+PxRI8cbLbRpEdIaoR46qr/2uWZ943PHMv9h4VHPYn1w8b94hwD6vkCgYEA3v87
+mFLzyM9ercnEv9zHMRlMZFQhlcUGQZvfb8BuJYl/WogyT6vRrUuM0QXULNEPlrin
+mBQTqc1nCYbgkFFsD2VVt1qIyiAJsB9MD1LNV6YuvE7T2KOSadmsA4fa9PUqbr71
+hf3lTTq+LeR09LebO7WgSGYY+5YKVOEGpYMR1GkCgYEAxPVQmk3HKHEhjgRYdaG5
+lp9A9ZE8uruYVJWtiHgzBTxx9TV2iST+fd/We7PsHFTfY3+wbpcMDBXfIVRKDVwH
+BMwchXH9+Ztlxx34bYJaegd0SmA0Hw9ugWEHNgoSEmWpM1s9wir5/ELjc7dGsFtz
+uzvsl9fpdLSxDYgAAdzeGtkCgYBAzKIgrVox7DBzB8KojhtD5ToRnXD0+H/M6OKQ
+srZPKhlb0V/tTtxrIx0UUEFLlKSXA6mPw6XDHfDnD86JoV9pSeUSlrhRI+Ysy6tq
+eIE7CwthpPZiaYXORHZ7wCqcK/HcpJjsCs9rFbrV0yE5S3FMdIbTAvgXg44VBB7O
+UbwIoQKBgDuY8gSrA5/A747wjjmsdRWK4DMTMEV4eCW1BEP7Tg7Cxd5n3xPJiYhr
+nhLGN+mMnVIcv2zEMS0/eNZr1j/0BtEdx+3IC6Eq+ONY0anZ4Irt57/5QeKgKn/L
+JPhfPySIPG4UmwE4gW8t79vfOKxnUu2fDD1ZXUYopan6EckACNH/
+-----END RSA PRIVATE KEY-----
+";
+
+#[test]
+fn test_generate_key_signature() -> Result<()> {
+    let reader = Cursor::new(RAW_PRIVATE_KEY.as_bytes());
+    let pem = match Pem::read(reader) {
+        Ok((pem, _)) => pem,
+        Err(_) => return Err(Error::Other("Pem::read error".to_owned())),
+    };
+    //let private_key = rsa::RSAPrivateKey::from_pkcs1(&pem.contents)?;
+
+    let client_random = vec![
+        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e,
+        0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
+        0x1e, 0x1f,
+    ];
+    let server_random = vec![
+        0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e,
+        0x7f, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d,
+        0x8e, 0x8f,
+    ];
+    let public_key = vec![
+        0x20, 0x9f, 0xd7, 0xad, 0x6d, 0xcf, 0xf4, 0x29, 0x8d, 0xd3, 0xf9, 0x6d, 0x5b, 0x1b, 0x2a,
+        0xf9, 0x10, 0xa0, 0x53, 0x5b, 0x14, 0x88, 0xd7, 0xf8, 0xfa, 0xbb, 0x34, 0x9a, 0x98, 0x28,
+        0x80, 0xb6, 0x15,
+    ];
+    let expected_signature = vec![
+        0x6f, 0x47, 0x97, 0x85, 0xcc, 0x76, 0x50, 0x93, 0xbd, 0xe2, 0x6a, 0x69, 0x0b, 0xc3, 0x03,
+        0xd1, 0xb7, 0xe4, 0xab, 0x88, 0x7b, 0xa6, 0x52, 0x80, 0xdf, 0xaa, 0x25, 0x7a, 0xdb, 0x29,
+        0x32, 0xe4, 0xd8, 0x28, 0x28, 0xb3, 0xe8, 0x04, 0x3c, 0x38, 0x16, 0xfc, 0x78, 0xe9, 0x15,
+        0x7b, 0xc5, 0xbd, 0x7d, 0xfc, 0xcd, 0x83, 0x00, 0x57, 0x4a, 0x3c, 0x23, 0x85, 0x75, 0x6b,
+        0x37, 0xd5, 0x89, 0x72, 0x73, 0xf0, 0x44, 0x8c, 0x00, 0x70, 0x1f, 0x6e, 0xa2, 0x81, 0xd0,
+        0x09, 0xc5, 0x20, 0x36, 0xab, 0x23, 0x09, 0x40, 0x1f, 0x4d, 0x45, 0x96, 0x62, 0xbb, 0x81,
+        0xb0, 0x30, 0x72, 0xad, 0x3a, 0x0a, 0xac, 0x31, 0x63, 0x40, 0x52, 0x0a, 0x27, 0xf3, 0x34,
+        0xde, 0x27, 0x7d, 0xb7, 0x54, 0xff, 0x0f, 0x9f, 0x5a, 0xfe, 0x07, 0x0f, 0x4e, 0x9f, 0x53,
+        0x04, 0x34, 0x62, 0xf4, 0x30, 0x74, 0x83, 0x35, 0xfc, 0xe4, 0x7e, 0xbf, 0x5a, 0xc4, 0x52,
+        0xd0, 0xea, 0xf9, 0x61, 0x4e, 0xf5, 0x1c, 0x0e, 0x58, 0x02, 0x71, 0xfb, 0x1f, 0x34, 0x55,
+        0xe8, 0x36, 0x70, 0x3c, 0xc1, 0xcb, 0xc9, 0xb7, 0xbb, 0xb5, 0x1c, 0x44, 0x9a, 0x6d, 0x88,
+        0x78, 0x98, 0xd4, 0x91, 0x2e, 0xeb, 0x98, 0x81, 0x23, 0x30, 0x73, 0x39, 0x43, 0xd5, 0xbb,
+        0x70, 0x39, 0xba, 0x1f, 0xdb, 0x70, 0x9f, 0x91, 0x83, 0x56, 0xc2, 0xde, 0xed, 0x17, 0x6d,
+        0x2c, 0x3e, 0x21, 0xea, 0x36, 0xb4, 0x91, 0xd8, 0x31, 0x05, 0x60, 0x90, 0xfd, 0xc6, 0x74,
+        0xa9, 0x7b, 0x18, 0xfc, 0x1c, 0x6a, 0x1c, 0x6e, 0xec, 0xd3, 0xc1, 0xc0, 0x0d, 0x11, 0x25,
+        0x48, 0x37, 0x3d, 0x45, 0x11, 0xa2, 0x31, 0x14, 0x0a, 0x66, 0x9f, 0xd8, 0xac, 0x74, 0xa2,
+        0xcd, 0xc8, 0x79, 0xb3, 0x9e, 0xc6, 0x66, 0x25, 0xcf, 0x2c, 0x87, 0x5e, 0x5c, 0x36, 0x75,
+        0x86,
+    ];
+
+    let signature = generate_key_signature(
+        &client_random,
+        &server_random,
+        &public_key,
+        NamedCurve::X25519,
+        &CryptoPrivateKey {
+            kind: CryptoPrivateKeyKind::Rsa256(
+                ring::rsa::KeyPair::from_der(&pem.contents)
+                    .map_err(|e| Error::Other(e.to_string()))?,
+            ),
+            serialized_der: pem.contents.clone(),
+        }, //hashAlgorithmSHA256,
+    )?;
+
+    assert_eq!(
+        signature, expected_signature,
+        "Signature generation failed \nexp {expected_signature:?} \nactual {signature:?} "
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_ccm_encryption_and_decryption() -> Result<()> {
+    let key = vec![
+        0x18, 0x78, 0xac, 0xc2, 0x2a, 0xd8, 0xbd, 0xd8, 0xc6, 0x01, 0xa6, 0x17, 0x12, 0x6f, 0x63,
+        0x54,
+    ];
+    let iv = vec![0x0e, 0xb2, 0x09, 0x06];
+
+    let ccm = CryptoCcm::new(&CryptoCcmTagLen::CryptoCcmTagLength, &key, &iv, &key, &iv);
+
+    let rlh = RecordLayerHeader {
+        content_type: ContentType::ApplicationData,
+        protocol_version: ProtocolVersion {
+            major: 0xfe,
+            minor: 0xff,
+        },
+        epoch: 0,
+        sequence_number: 18,
+        content_len: 3,
+    };
+
+    let raw = vec![
+        0x17, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x00, 0x03, 0xff, 0xaa,
+        0xbb,
+    ];
+
+    let cipher_text = ccm.encrypt(&rlh, &raw)?;
+
+    assert_eq!(
+        &cipher_text[RECORD_LAYER_HEADER_SIZE - 2..RECORD_LAYER_HEADER_SIZE],
+        [0, 27],
+        "RecordLayer size updating failed \nexp: {:?} \nactual {:?} ",
+        [0, 27],
+        &cipher_text[RECORD_LAYER_HEADER_SIZE - 2..RECORD_LAYER_HEADER_SIZE]
+    );
+
+    let plain_text = ccm.decrypt(&cipher_text)?;
+
+    assert_eq!(
+        raw[RECORD_LAYER_HEADER_SIZE..],
+        plain_text[RECORD_LAYER_HEADER_SIZE..],
+        "Decryption failed \nexp: {:?} \nactual {:?} ",
+        &raw[RECORD_LAYER_HEADER_SIZE..],
+        &plain_text[RECORD_LAYER_HEADER_SIZE..]
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_certificate_verify() -> Result<()> {
+    let plain_text: Vec<u8> = vec![
+        0x6f, 0x47, 0x97, 0x85, 0xcc, 0x76, 0x50, 0x93, 0xbd, 0xe2, 0x6a, 0x69, 0x0b, 0xc3, 0x03,
+        0xd1, 0xb7, 0xe4, 0xab, 0x88, 0x7b, 0xa6, 0x52, 0x80, 0xdf, 0xaa, 0x25, 0x7a, 0xdb, 0x29,
+        0x32, 0xe4, 0xd8, 0x28, 0x28, 0xb3, 0xe8, 0x04, 0x3c, 0x38, 0x16, 0xfc, 0x78, 0xe9, 0x15,
+        0x7b, 0xc5, 0xbd, 0x7d, 0xfc, 0xcd, 0x83, 0x00, 0x57, 0x4a, 0x3c, 0x23, 0x85, 0x75, 0x6b,
+        0x37, 0xd5, 0x89, 0x72, 0x73, 0xf0, 0x44, 0x8c, 0x00, 0x70, 0x1f, 0x6e, 0xa2, 0x81, 0xd0,
+        0x09, 0xc5, 0x20, 0x36, 0xab, 0x23, 0x09, 0x40, 0x1f, 0x4d, 0x45, 0x96, 0x62, 0xbb, 0x81,
+        0xb0, 0x30, 0x72, 0xad, 0x3a, 0x0a, 0xac, 0x31, 0x63, 0x40, 0x52, 0x0a, 0x27, 0xf3, 0x34,
+        0xde, 0x27, 0x7d, 0xb7, 0x54, 0xff, 0x0f, 0x9f, 0x5a, 0xfe, 0x07, 0x0f, 0x4e, 0x9f, 0x53,
+        0x04, 0x34, 0x62, 0xf4, 0x30, 0x74, 0x83, 0x35, 0xfc, 0xe4, 0x7e, 0xbf, 0x5a, 0xc4, 0x52,
+        0xd0, 0xea, 0xf9, 0x61, 0x4e, 0xf5, 0x1c, 0x0e, 0x58, 0x02, 0x71, 0xfb, 0x1f, 0x34, 0x55,
+        0xe8, 0x36, 0x70, 0x3c, 0xc1, 0xcb, 0xc9, 0xb7, 0xbb, 0xb5, 0x1c, 0x44, 0x9a, 0x6d, 0x88,
+        0x78, 0x98, 0xd4, 0x91, 0x2e, 0xeb, 0x98, 0x81, 0x23, 0x30, 0x73, 0x39, 0x43, 0xd5, 0xbb,
+        0x70, 0x39, 0xba, 0x1f, 0xdb, 0x70, 0x9f, 0x91, 0x83, 0x56, 0xc2, 0xde, 0xed, 0x17, 0x6d,
+        0x2c, 0x3e, 0x21, 0xea, 0x36, 0xb4, 0x91, 0xd8, 0x31, 0x05, 0x60, 0x90, 0xfd, 0xc6, 0x74,
+        0xa9, 0x7b, 0x18, 0xfc, 0x1c, 0x6a, 0x1c, 0x6e, 0xec, 0xd3, 0xc1, 0xc0, 0x0d, 0x11, 0x25,
+        0x48, 0x37, 0x3d, 0x45, 0x11, 0xa2, 0x31, 0x14, 0x0a, 0x66, 0x9f, 0xd8, 0xac, 0x74, 0xa2,
+        0xcd, 0xc8, 0x79, 0xb3, 0x9e, 0xc6, 0x66, 0x25, 0xcf, 0x2c, 0x87, 0x5e, 0x5c, 0x36, 0x75,
+        0x86,
+    ];
+
+    //test ECDSA256
+    let certificate_ecdsa256 = Certificate::generate_self_signed(vec!["localhost".to_owned()])?;
+    let cert_verify_ecdsa256 =
+        generate_certificate_verify(&plain_text, &certificate_ecdsa256.private_key)?;
+    verify_certificate_verify(
+        &plain_text,
+        &SignatureHashAlgorithm {
+            hash: HashAlgorithm::Sha256,
+            signature: SignatureAlgorithm::Ecdsa,
+        },
+        &cert_verify_ecdsa256,
+        &certificate_ecdsa256
+            .certificate
+            .iter()
+            .map(|x| x.as_ref().to_owned())
+            .collect::<Vec<Vec<u8>>>(),
+        false,
+    )?;
+
+    //test ED25519
+    let certificate_ed25519 = Certificate::generate_self_signed_with_alg(
+        vec!["localhost".to_owned()],
+        &rcgen::PKCS_ED25519,
+    )?;
+    let cert_verify_ed25519 =
+        generate_certificate_verify(&plain_text, &certificate_ed25519.private_key)?;
+    verify_certificate_verify(
+        &plain_text,
+        &SignatureHashAlgorithm {
+            hash: HashAlgorithm::Sha256,
+            signature: SignatureAlgorithm::Ed25519,
+        },
+        &cert_verify_ed25519,
+        &certificate_ed25519
+            .certificate
+            .iter()
+            .map(|x| x.as_ref().to_owned())
+            .collect::<Vec<Vec<u8>>>(),
+        false,
+    )?;
+
+    Ok(())
+}

libs/dtls/src/crypto/mod.rs

@@ -0,0 +1,514 @@
+#[cfg(test)]
+mod crypto_test;
+
+pub mod crypto_cbc;
+pub mod crypto_ccm;
+pub mod crypto_chacha20;
+pub mod crypto_gcm;
+pub mod padding;
+
+use std::convert::TryFrom;
+use std::sync::Arc;
+
+use der_parser::oid;
+use der_parser::oid::Oid;
+
+use crate::certificate_verifier::CertificateVerifier;
+use rustls_pki_types::CertificateDer;
+
+use rcgen::{generate_simple_self_signed, CertifiedKey, KeyPair};
+use ring::rand::SystemRandom;
+use ring::signature::{EcdsaKeyPair, Ed25519KeyPair};
+
+use crate::curve::named_curve::*;
+use crate::error::*;
+use crate::record_layer::record_layer_header::*;
+use crate::signature_hash_algorithm::{HashAlgorithm, SignatureAlgorithm, SignatureHashAlgorithm};
+
+/// A X.509 certificate(s) used to authenticate a DTLS connection.
+#[derive(Clone, PartialEq, Debug)]
+pub struct Certificate {
+    /// DER-encoded certificates.
+    pub certificate: Vec<CertificateDer<'static>>,
+    /// Private key.
+    pub private_key: CryptoPrivateKey,
+}
+
+impl Certificate {
+    /// Generate a self-signed certificate.
+    ///
+    /// See [`rcgen::generate_simple_self_signed`].
+    pub fn generate_self_signed(subject_alt_names: impl Into<Vec<String>>) -> Result<Self> {
+        let CertifiedKey { cert, key_pair } =
+            generate_simple_self_signed(subject_alt_names).unwrap();
+        Ok(Certificate {
+            certificate: vec![cert.der().to_owned()],
+            private_key: CryptoPrivateKey::try_from(&key_pair)?,
+        })
+    }
+
+    /// Generate a self-signed certificate with the given algorithm.
+    ///
+    /// See [`rcgen::Certificate::from_params`].
+    pub fn generate_self_signed_with_alg(
+        subject_alt_names: impl Into<Vec<String>>,
+        alg: &'static rcgen::SignatureAlgorithm,
+    ) -> Result<Self> {
+        let params = rcgen::CertificateParams::new(subject_alt_names).unwrap();
+        let key_pair = rcgen::KeyPair::generate_for(alg).unwrap();
+        let cert = params.self_signed(&key_pair).unwrap();
+
+        Ok(Certificate {
+            certificate: vec![cert.der().to_owned()],
+            private_key: CryptoPrivateKey::try_from(&key_pair)?,
+        })
+    }
+
+    /// Parses a certificate from the ASCII PEM format.
+    #[cfg(feature = "pem")]
+    pub fn from_pem(pem_str: &str) -> Result<Self> {
+        let mut pems = pem::parse_many(pem_str).map_err(|e| Error::InvalidPEM(e.to_string()))?;
+        if pems.len() < 2 {
+            return Err(Error::InvalidPEM(format!(
+                "expected at least two PEM blocks, got {}",
+                pems.len()
+            )));
+        }
+        if pems[0].tag() != "PRIVATE_KEY" {
+            return Err(Error::InvalidPEM(format!(
+                "invalid tag (expected: 'PRIVATE_KEY', got: '{}')",
+                pems[0].tag()
+            )));
+        }
+
+        let keypair = KeyPair::try_from(pems[0].contents())
+            .map_err(|e| Error::InvalidPEM(format!("can't decode keypair: {e}")))?;
+
+        let mut rustls_certs = Vec::new();
+        for p in pems.drain(1..) {
+            if p.tag() != "CERTIFICATE" {
+                return Err(Error::InvalidPEM(format!(
+                    "invalid tag (expected: 'CERTIFICATE', got: '{}')",
+                    p.tag()
+                )));
+            }
+            rustls_certs.push(CertificateDer::from(p.contents().to_vec()));
+        }
+
+        Ok(Certificate {
+            certificate: rustls_certs,
+            private_key: CryptoPrivateKey::try_from(&keypair)?,
+        })
+    }
+
+    /// Serializes the certificate (including the private key) in PKCS#8 format in PEM.
+    #[cfg(feature = "pem")]
+    pub fn serialize_pem(&self) -> String {
+        let mut data = vec![pem::Pem::new(
+            "PRIVATE_KEY".to_string(),
+            self.private_key.serialized_der.clone(),
+        )];
+        for rustls_cert in &self.certificate {
+            data.push(pem::Pem::new(
+                "CERTIFICATE".to_string(),
+                rustls_cert.as_ref(),
+            ));
+        }
+        pem::encode_many(&data)
+    }
+}
+
+pub(crate) fn value_key_message(
+    client_random: &[u8],
+    server_random: &[u8],
+    public_key: &[u8],
+    named_curve: NamedCurve,
+) -> Vec<u8> {
+    let mut server_ecdh_params = vec![0u8; 4];
+    server_ecdh_params[0] = 3; // named curve
+    server_ecdh_params[1..3].copy_from_slice(&(named_curve as u16).to_be_bytes());
+    server_ecdh_params[3] = public_key.len() as u8;
+
+    let mut plaintext = vec![];
+    plaintext.extend_from_slice(client_random);
+    plaintext.extend_from_slice(server_random);
+    plaintext.extend_from_slice(&server_ecdh_params);
+    plaintext.extend_from_slice(public_key);
+
+    plaintext
+}
+
+/// Either ED25519, ECDSA or RSA keypair.
+#[derive(Debug)]
+pub enum CryptoPrivateKeyKind {
+    Ed25519(Ed25519KeyPair),
+    Ecdsa256(EcdsaKeyPair),
+    Rsa256(ring::rsa::KeyPair),
+}
+
+/// Private key.
+#[derive(Debug)]
+pub struct CryptoPrivateKey {
+    /// Keypair.
+    pub kind: CryptoPrivateKeyKind,
+    /// DER-encoded keypair.
+    pub serialized_der: Vec<u8>,
+}
+
+impl PartialEq for CryptoPrivateKey {
+    fn eq(&self, other: &Self) -> bool {
+        if self.serialized_der != other.serialized_der {
+            return false;
+        }
+
+        matches!(
+            (&self.kind, &other.kind),
+            (
+                CryptoPrivateKeyKind::Rsa256(_),
+                CryptoPrivateKeyKind::Rsa256(_)
+            ) | (
+                CryptoPrivateKeyKind::Ecdsa256(_),
+                CryptoPrivateKeyKind::Ecdsa256(_)
+            ) | (
+                CryptoPrivateKeyKind::Ed25519(_),
+                CryptoPrivateKeyKind::Ed25519(_)
+            )
+        )
+    }
+}
+
+impl Clone for CryptoPrivateKey {
+    fn clone(&self) -> Self {
+        match self.kind {
+            CryptoPrivateKeyKind::Ed25519(_) => CryptoPrivateKey {
+                kind: CryptoPrivateKeyKind::Ed25519(
+                    Ed25519KeyPair::from_pkcs8_maybe_unchecked(&self.serialized_der).unwrap(),
+                ),
+                serialized_der: self.serialized_der.clone(),
+            },
+            CryptoPrivateKeyKind::Ecdsa256(_) => CryptoPrivateKey {
+                kind: CryptoPrivateKeyKind::Ecdsa256(
+                    EcdsaKeyPair::from_pkcs8(
+                        &ring::signature::ECDSA_P256_SHA256_ASN1_SIGNING,
+                        &self.serialized_der,
+                        &SystemRandom::new(),
+                    )
+                    .unwrap(),
+                ),
+                serialized_der: self.serialized_der.clone(),
+            },
+            CryptoPrivateKeyKind::Rsa256(_) => CryptoPrivateKey {
+                kind: CryptoPrivateKeyKind::Rsa256(
+                    ring::rsa::KeyPair::from_pkcs8(&self.serialized_der).unwrap(),
+                ),
+                serialized_der: self.serialized_der.clone(),
+            },
+        }
+    }
+}
+
+impl TryFrom<&KeyPair> for CryptoPrivateKey {
+    type Error = Error;
+
+    fn try_from(key_pair: &KeyPair) -> Result<Self> {
+        Self::from_key_pair(key_pair)
+    }
+}
+
+impl CryptoPrivateKey {
+    pub fn from_key_pair(key_pair: &KeyPair) -> Result<Self> {
+        let serialized_der = key_pair.serialize_der();
+        if key_pair.is_compatible(&rcgen::PKCS_ED25519) {
+            Ok(CryptoPrivateKey {
+                kind: CryptoPrivateKeyKind::Ed25519(
+                    Ed25519KeyPair::from_pkcs8_maybe_unchecked(&serialized_der)
+                        .map_err(|e| Error::Other(e.to_string()))?,
+                ),
+                serialized_der,
+            })
+        } else if key_pair.is_compatible(&rcgen::PKCS_ECDSA_P256_SHA256) {
+            Ok(CryptoPrivateKey {
+                kind: CryptoPrivateKeyKind::Ecdsa256(
+                    EcdsaKeyPair::from_pkcs8(
+                        &ring::signature::ECDSA_P256_SHA256_ASN1_SIGNING,
+                        &serialized_der,
+                        &SystemRandom::new(),
+                    )
+                    .map_err(|e| Error::Other(e.to_string()))?,
+                ),
+                serialized_der,
+            })
+        } else if key_pair.is_compatible(&rcgen::PKCS_RSA_SHA256) {
+            Ok(CryptoPrivateKey {
+                kind: CryptoPrivateKeyKind::Rsa256(
+                    ring::rsa::KeyPair::from_pkcs8(&serialized_der)
+                        .map_err(|e| Error::Other(e.to_string()))?,
+                ),
+                serialized_der,
+            })
+        } else {
+            Err(Error::Other("Unsupported key_pair".to_owned()))
+        }
+    }
+}
+
+// If the client provided a "signature_algorithms" extension, then all
+// certificates provided by the server MUST be signed by a
+// hash/signature algorithm pair that appears in that extension
+//
+// https://tools.ietf.org/html/rfc5246#section-7.4.2
+pub(crate) fn generate_key_signature(
+    client_random: &[u8],
+    server_random: &[u8],
+    public_key: &[u8],
+    named_curve: NamedCurve,
+    private_key: &CryptoPrivateKey, /*, hash_algorithm: HashAlgorithm*/
+) -> Result<Vec<u8>> {
+    let msg = value_key_message(client_random, server_random, public_key, named_curve);
+    let signature = match &private_key.kind {
+        CryptoPrivateKeyKind::Ed25519(kp) => kp.sign(&msg).as_ref().to_vec(),
+        CryptoPrivateKeyKind::Ecdsa256(kp) => {
+            let system_random = SystemRandom::new();
+            kp.sign(&system_random, &msg)
+                .map_err(|e| Error::Other(e.to_string()))?
+                .as_ref()
+                .to_vec()
+        }
+        CryptoPrivateKeyKind::Rsa256(kp) => {
+            let system_random = SystemRandom::new();
+            let mut signature = vec![0; kp.public().modulus_len()];
+            kp.sign(
+                &ring::signature::RSA_PKCS1_SHA256,
+                &system_random,
+                &msg,
+                &mut signature,
+            )
+            .map_err(|e| Error::Other(e.to_string()))?;
+
+            signature
+        }
+    };
+
+    Ok(signature)
+}
+
+// add OID_ED25519 which is not defined in x509_parser
+pub const OID_ED25519: Oid<'static> = oid!(1.3.101 .112);
+pub const OID_ECDSA: Oid<'static> = oid!(1.2.840 .10045 .2 .1);
+
+fn verify_signature(
+    message: &[u8],
+    hash_algorithm: &SignatureHashAlgorithm,
+    remote_key_signature: &[u8],
+    raw_certificates: &[Vec<u8>],
+    insecure_verification: bool,
+) -> Result<()> {
+    if raw_certificates.is_empty() {
+        return Err(Error::ErrLengthMismatch);
+    }
+
+    let (_, certificate) = x509_parser::parse_x509_certificate(&raw_certificates[0])
+        .map_err(|e| Error::Other(e.to_string()))?;
+
+    let verify_alg: &dyn ring::signature::VerificationAlgorithm = match hash_algorithm.signature {
+        SignatureAlgorithm::Ed25519 => &ring::signature::ED25519,
+        SignatureAlgorithm::Ecdsa if hash_algorithm.hash == HashAlgorithm::Sha256 => {
+            &ring::signature::ECDSA_P256_SHA256_ASN1
+        }
+        SignatureAlgorithm::Ecdsa if hash_algorithm.hash == HashAlgorithm::Sha384 => {
+            &ring::signature::ECDSA_P384_SHA384_ASN1
+        }
+        SignatureAlgorithm::Rsa if hash_algorithm.hash == HashAlgorithm::Sha1 => {
+            &ring::signature::RSA_PKCS1_1024_8192_SHA1_FOR_LEGACY_USE_ONLY
+        }
+        SignatureAlgorithm::Rsa if (hash_algorithm.hash == HashAlgorithm::Sha256) => {
+            if remote_key_signature.len() < 256 && insecure_verification {
+                &ring::signature::RSA_PKCS1_1024_8192_SHA256_FOR_LEGACY_USE_ONLY
+            } else {
+                &ring::signature::RSA_PKCS1_2048_8192_SHA256
+            }
+        }
+        SignatureAlgorithm::Rsa if hash_algorithm.hash == HashAlgorithm::Sha384 => {
+            &ring::signature::RSA_PKCS1_2048_8192_SHA384
+        }
+        SignatureAlgorithm::Rsa if hash_algorithm.hash == HashAlgorithm::Sha512 => {
+            if remote_key_signature.len() < 256 && insecure_verification {
+                &ring::signature::RSA_PKCS1_1024_8192_SHA512_FOR_LEGACY_USE_ONLY
+            } else {
+                &ring::signature::RSA_PKCS1_2048_8192_SHA512
+            }
+        }
+        _ => return Err(Error::ErrKeySignatureVerifyUnimplemented),
+    };
+
+    log::trace!("Picked an algorithm {verify_alg:?}");
+
+    let public_key = ring::signature::UnparsedPublicKey::new(
+        verify_alg,
+        certificate
+            .tbs_certificate
+            .subject_pki
+            .subject_public_key
+            .data,
+    );
+
+    public_key
+        .verify(message, remote_key_signature)
+        .map_err(|e| Error::Other(e.to_string()))?;
+
+    Ok(())
+}
+
+pub(crate) fn verify_key_signature(
+    message: &[u8],
+    hash_algorithm: &SignatureHashAlgorithm,
+    remote_key_signature: &[u8],
+    raw_certificates: &[Vec<u8>],
+    insecure_verification: bool,
+) -> Result<()> {
+    verify_signature(
+        message,
+        hash_algorithm,
+        remote_key_signature,
+        raw_certificates,
+        insecure_verification,
+    )
+}
+
+// If the server has sent a CertificateRequest message, the client MUST send the Certificate
+// message.  The ClientKeyExchange message is now sent, and the content
+// of that message will depend on the public key algorithm selected
+// between the ClientHello and the ServerHello.  If the client has sent
+// a certificate with signing ability, a digitally-signed
+// CertificateVerify message is sent to explicitly verify possession of
+// the private key in the certificate.
+// https://tools.ietf.org/html/rfc5246#section-7.3
+pub(crate) fn generate_certificate_verify(
+    handshake_bodies: &[u8],
+    private_key: &CryptoPrivateKey, /*, hashAlgorithm hashAlgorithm*/
+) -> Result<Vec<u8>> {
+    let signature = match &private_key.kind {
+        CryptoPrivateKeyKind::Ed25519(kp) => kp.sign(handshake_bodies).as_ref().to_vec(),
+        CryptoPrivateKeyKind::Ecdsa256(kp) => {
+            let system_random = SystemRandom::new();
+            kp.sign(&system_random, handshake_bodies)
+                .map_err(|e| Error::Other(e.to_string()))?
+                .as_ref()
+                .to_vec()
+        }
+        CryptoPrivateKeyKind::Rsa256(kp) => {
+            let system_random = SystemRandom::new();
+            let mut signature = vec![0; kp.public().modulus_len()];
+            kp.sign(
+                &ring::signature::RSA_PKCS1_SHA256,
+                &system_random,
+                handshake_bodies,
+                &mut signature,
+            )
+            .map_err(|e| Error::Other(e.to_string()))?;
+
+            signature
+        }
+    };
+
+    Ok(signature)
+}
+
+pub(crate) fn verify_certificate_verify(
+    handshake_bodies: &[u8],
+    hash_algorithm: &SignatureHashAlgorithm,
+    remote_key_signature: &[u8],
+    raw_certificates: &[Vec<u8>],
+    insecure_verification: bool,
+) -> Result<()> {
+    verify_signature(
+        handshake_bodies,
+        hash_algorithm,
+        remote_key_signature,
+        raw_certificates,
+        insecure_verification,
+    )
+}
+
+pub(crate) fn load_certs(raw_certificates: &[Vec<u8>]) -> Result<Vec<CertificateDer<'static>>> {
+    if raw_certificates.is_empty() {
+        return Err(Error::ErrLengthMismatch);
+    }
+
+    let mut certs = vec![];
+    for raw_cert in raw_certificates {
+        let cert = CertificateDer::from(raw_cert.to_vec());
+        certs.push(cert);
+    }
+
+    Ok(certs)
+}
+
+pub(crate) fn verify_client_cert(
+    raw_certificates: &[Vec<u8>],
+    cert_verifier: &Arc<CertificateVerifier>,
+) -> Result<Vec<CertificateDer<'static>>> {
+    let chains = load_certs(raw_certificates)?;
+
+    let (end_entity, intermediates) = chains
+        .split_first()
+        .ok_or(Error::ErrClientCertificateRequired)?;
+
+    match cert_verifier.verify_client_cert(end_entity, intermediates) {
+        Ok(_) => {}
+        Err(err) => return Err(Error::Other(err.to_string())),
+    };
+
+    Ok(chains)
+}
+
+pub(crate) fn verify_server_cert(
+    raw_certificates: &[Vec<u8>],
+    cert_verifier: &Arc<CertificateVerifier>,
+    server_name: &str,
+) -> Result<Vec<CertificateDer<'static>>> {
+    let chains = load_certs(raw_certificates)?;
+
+    let (end_entity, intermediates) = chains
+        .split_first()
+        .ok_or(Error::ErrServerMustHaveCertificate)?;
+    match cert_verifier.verify_server_cert(end_entity, intermediates, server_name) {
+        Ok(_) => {}
+        Err(err) => return Err(Error::Other(err.to_string())),
+    };
+
+    Ok(chains)
+}
+
+pub(crate) fn generate_aead_additional_data(h: &RecordLayerHeader, payload_len: usize) -> Vec<u8> {
+    let mut additional_data = vec![0u8; 13];
+    // SequenceNumber MUST be set first
+    // we only want uint48, clobbering an extra 2 (using uint64, rust doesn't have uint48)
+    additional_data[..8].copy_from_slice(&h.sequence_number.to_be_bytes());
+    additional_data[..2].copy_from_slice(&h.epoch.to_be_bytes());
+    additional_data[8] = h.content_type as u8;
+    additional_data[9] = h.protocol_version.major;
+    additional_data[10] = h.protocol_version.minor;
+    additional_data[11..].copy_from_slice(&(payload_len as u16).to_be_bytes());
+
+    additional_data
+}
+
+#[cfg(test)]
+mod test {
+    #[cfg(feature = "pem")]
+    use super::*;
+
+    #[cfg(feature = "pem")]
+    #[test]
+    fn test_certificate_serialize_pem_and_from_pem() -> crate::error::Result<()> {
+        let cert = Certificate::generate_self_signed(vec!["webrtc.rs".to_owned()])?;
+
+        let pem = cert.serialize_pem();
+        let loaded_cert = Certificate::from_pem(&pem)?;
+
+        assert_eq!(loaded_cert, cert);
+
+        Ok(())
+    }
+}

libs/dtls/src/crypto/padding.rs

@@ -0,0 +1,122 @@
+use cbc::cipher::block_padding::{PadType, RawPadding, UnpadError};
+use core::panic;
+
+pub enum DtlsPadding {}
+/// Reference: RFC5246, 6.2.3.2
+impl RawPadding for DtlsPadding {
+    const TYPE: PadType = PadType::Reversible;
+
+    fn raw_pad(block: &mut [u8], pos: usize) {
+        if pos >= block.len() {
+            panic!("`pos` is bigger or equal to block size");
+        }
+
+        let padding_length = block.len() - pos - 1;
+        if padding_length > 255 {
+            panic!("block size is too big for DTLS");
+        }
+
+        set(&mut block[pos..], padding_length as u8);
+    }
+
+    fn raw_unpad(data: &[u8]) -> Result<&[u8], UnpadError> {
+        let padding_length = data.last().copied().unwrap_or(1) as usize;
+        if padding_length + 1 > data.len() {
+            return Err(UnpadError);
+        }
+
+        let padding_begin = data.len() - padding_length - 1;
+
+        if data[padding_begin..data.len() - 1]
+            .iter()
+            .any(|&byte| byte as usize != padding_length)
+        {
+            return Err(UnpadError);
+        }
+
+        Ok(&data[0..padding_begin])
+    }
+}
+
+/// Sets all bytes in `dst` equal to `value`
+#[inline(always)]
+fn set(dst: &mut [u8], value: u8) {
+    // SAFETY: we overwrite valid memory behind `dst`
+    // note: loop is not used here because it produces
+    // unnecessary branch which tests for zero-length slices
+    unsafe {
+        core::ptr::write_bytes(dst.as_mut_ptr(), value, dst.len());
+    }
+}
+
+#[cfg(test)]
+pub mod tests {
+    use rand::Rng;
+
+    use super::*;
+
+    #[test]
+    fn padding_length_is_amount_of_bytes_excluding_the_padding_length_itself() -> Result<(), ()> {
+        for original_length in 0..128 {
+            for padding_length in 0..(256 - original_length) {
+                let mut block = vec![0; original_length + padding_length + 1];
+                rand::rng().fill(&mut block[0..original_length]);
+                let original = block[0..original_length].to_vec();
+                DtlsPadding::raw_pad(&mut block, original_length);
+
+                for byte in block[original_length..].iter() {
+                    assert_eq!(*byte as usize, padding_length);
+                }
+                assert_eq!(block[0..original_length], original);
+            }
+        }
+
+        Ok(())
+    }
+
+    #[test]
+    #[should_panic]
+    fn full_block_is_padding_error() {
+        for original_length in 0..256 {
+            let mut block = vec![0; original_length];
+            DtlsPadding::raw_pad(&mut block, original_length);
+        }
+    }
+
+    #[test]
+    #[should_panic]
+    fn padding_length_bigger_than_255_is_a_pad_error() {
+        let padding_length = 256;
+        for original_length in 0..128 {
+            let mut block = vec![0; original_length + padding_length + 1];
+            DtlsPadding::raw_pad(&mut block, original_length);
+        }
+    }
+
+    #[test]
+    fn empty_block_is_unpadding_error() {
+        let r = DtlsPadding::raw_unpad(&[]);
+        assert!(r.is_err());
+    }
+
+    #[test]
+    fn padding_too_big_for_block_is_unpadding_error() {
+        let r = DtlsPadding::raw_unpad(&[1]);
+        assert!(r.is_err());
+    }
+
+    #[test]
+    fn one_of_the_padding_bytes_with_value_different_than_padding_length_is_unpadding_error() {
+        for padding_length in 0..16 {
+            for invalid_byte in 0..padding_length {
+                let mut block = vec![0; padding_length + 1];
+                DtlsPadding::raw_pad(&mut block, 0);
+
+                assert_eq!(DtlsPadding::raw_unpad(&block).ok(), Some(&[][..]));
+                block[invalid_byte] = (padding_length - 1) as u8;
+                let r = DtlsPadding::raw_unpad(&block);
+                assert!(r.is_err());
+            }
+        }
+    }
+}

libs/dtls/src/curve/mod.rs

@@ -0,0 +1,17 @@
+pub mod named_curve;
+
+// https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-10
+#[derive(Copy, Clone, PartialEq, Eq, Debug)]
+pub enum EllipticCurveType {
+    NamedCurve = 0x03,
+    Unsupported,
+}
+
+impl From<u8> for EllipticCurveType {
+    fn from(val: u8) -> Self {
+        match val {
+            0x03 => EllipticCurveType::NamedCurve,
+            _ => EllipticCurveType::Unsupported,
+        }
+    }
+}

libs/dtls/src/curve/named_curve.rs

@@ -0,0 +1,83 @@
+use rand_core::OsRng; // requires 'getrandom' feature
+
+use crate::error::*;
+
+// https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8
+#[repr(u16)]
+#[derive(Copy, Clone, PartialEq, Eq, Debug)]
+pub enum NamedCurve {
+    Unsupported = 0x0000,
+    P256 = 0x0017,
+    P384 = 0x0018,
+    X25519 = 0x001d,
+}
+
+impl From<u16> for NamedCurve {
+    fn from(val: u16) -> Self {
+        match val {
+            0x0017 => NamedCurve::P256,
+            0x0018 => NamedCurve::P384,
+            0x001d => NamedCurve::X25519,
+            _ => NamedCurve::Unsupported,
+        }
+    }
+}
+
+pub(crate) enum NamedCurvePrivateKey {
+    EphemeralSecretP256(p256::ecdh::EphemeralSecret),
+    EphemeralSecretP384(p384::ecdh::EphemeralSecret),
+    StaticSecretX25519(x25519_dalek::StaticSecret),
+}
+
+pub struct NamedCurveKeypair {
+    pub(crate) curve: NamedCurve,
+    pub(crate) public_key: Vec<u8>,
+    pub(crate) private_key: NamedCurvePrivateKey,
+}
+
+fn elliptic_curve_keypair(curve: NamedCurve) -> Result<NamedCurveKeypair> {
+    let (public_key, private_key) = match curve {
+        NamedCurve::P256 => {
+            let secret_key = p256::ecdh::EphemeralSecret::random(&mut OsRng);
+            let public_key = p256::EncodedPoint::from(secret_key.public_key());
+            (
+                public_key.as_bytes().to_vec(),
+                NamedCurvePrivateKey::EphemeralSecretP256(secret_key),
+            )
+        }
+        NamedCurve::P384 => {
+            let secret_key = p384::ecdh::EphemeralSecret::random(&mut OsRng);
+            let public_key = p384::EncodedPoint::from(secret_key.public_key());
+            (
+                public_key.as_bytes().to_vec(),
+                NamedCurvePrivateKey::EphemeralSecretP384(secret_key),
+            )
+        }
+        NamedCurve::X25519 => {
+            let secret_key = x25519_dalek::StaticSecret::random_from_rng(OsRng);
+            let public_key = x25519_dalek::PublicKey::from(&secret_key);
+            (
+                public_key.as_bytes().to_vec(),
+                NamedCurvePrivateKey::StaticSecretX25519(secret_key),
+            )
+        }
+        _ => return Err(Error::ErrInvalidNamedCurve),
+    };
+
+    Ok(NamedCurveKeypair {
+        curve,
+        public_key,
+        private_key,
+    })
+}
+
+impl NamedCurve {
+    pub fn generate_keypair(&self) -> Result<NamedCurveKeypair> {
+        match *self {
+            NamedCurve::X25519 => elliptic_curve_keypair(NamedCurve::X25519),
+            NamedCurve::P256 => elliptic_curve_keypair(NamedCurve::P256),
+            NamedCurve::P384 => elliptic_curve_keypair(NamedCurve::P384),
+            _ => Err(Error::ErrInvalidNamedCurve),
+        }
+    }
+}

libs/dtls/src/error.rs

@@ -0,0 +1,223 @@
+use std::io;
+use std::string::FromUtf8Error;
+
+use thiserror::Error;
+use tokio::sync::mpsc::error::SendError as MpscSendError;
+use util::KeyingMaterialExporterError;
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, Error, PartialEq)]
+#[non_exhaustive]
+pub enum Error {
+    #[error("conn is closed")]
+    ErrConnClosed,
+    #[error("read/write timeout")]
+    ErrDeadlineExceeded,
+    #[error("buffer is too small")]
+    ErrBufferTooSmall,
+    #[error("context is not supported for export_keying_material")]
+    ErrContextUnsupported,
+    #[error("packet is too short")]
+    ErrDtlspacketInvalidLength,
+    #[error("handshake is in progress")]
+    ErrHandshakeInProgress,
+    #[error("invalid content type")]
+    ErrInvalidContentType,
+    #[error("invalid mac")]
+    ErrInvalidMac,
+    #[error("packet length and declared length do not match")]
+    ErrInvalidPacketLength,
+    #[error("export_keying_material can not be used with a reserved label")]
+    ErrReservedExportKeyingMaterial,
+    #[error("client sent certificate verify but we have no certificate to verify")]
+    ErrCertificateVerifyNoCertificate,
+    #[error("client+server do not support any shared cipher suites")]
+    ErrCipherSuiteNoIntersection,
+    #[error("server hello can not be created without a cipher suite")]
+    ErrCipherSuiteUnset,
+    #[error("client sent certificate but did not verify it")]
+    ErrClientCertificateNotVerified,
+    #[error("server required client verification, but got none")]
+    ErrClientCertificateRequired,
+    #[error("server responded with SRTP Profile we do not support")]
+    ErrClientNoMatchingSrtpProfile,
+    #[error("client required Extended Master Secret extension, but server does not support it")]
+    ErrClientRequiredButNoServerEms,
+    #[error("server hello can not be created without a compression method")]
+    ErrCompressionMethodUnset,
+    #[error("client+server cookie does not match")]
+    ErrCookieMismatch,
+    #[error("cookie must not be longer then 255 bytes")]
+    ErrCookieTooLong,
+    #[error("PSK Identity Hint provided but PSK is nil")]
+    ErrIdentityNoPsk,
+    #[error("no certificate provided")]
+    ErrInvalidCertificate,
+    #[error("cipher spec invalid")]
+    ErrInvalidCipherSpec,
+    #[error("invalid or unknown cipher suite")]
+    ErrInvalidCipherSuite,
+    #[error("unable to determine if ClientKeyExchange is a public key or PSK Identity")]
+    ErrInvalidClientKeyExchange,
+    #[error("invalid or unknown compression method")]
+    ErrInvalidCompressionMethod,
+    #[error("ECDSA signature contained zero or negative values")]
+    ErrInvalidEcdsasignature,
+    #[error("invalid or unknown elliptic curve type")]
+    ErrInvalidEllipticCurveType,
+    #[error("invalid extension type")]
+    ErrInvalidExtensionType,
+    #[error("invalid hash algorithm")]
+    ErrInvalidHashAlgorithm,
+    #[error("invalid named curve")]
+    ErrInvalidNamedCurve,
+    #[error("invalid private key type")]
+    ErrInvalidPrivateKey,
+    #[error("named curve and private key type does not match")]
+    ErrNamedCurveAndPrivateKeyMismatch,
+    #[error("invalid server name format")]
+    ErrInvalidSniFormat,
+    #[error("invalid signature algorithm")]
+    ErrInvalidSignatureAlgorithm,
+    #[error("expected and actual key signature do not match")]
+    ErrKeySignatureMismatch,
+    #[error("Conn can not be created with a nil nextConn")]
+    ErrNilNextConn,
+    #[error("connection can not be created, no CipherSuites satisfy this Config")]
+    ErrNoAvailableCipherSuites,
+    #[error("connection can not be created, no SignatureScheme satisfy this Config")]
+    ErrNoAvailableSignatureSchemes,
+    #[error("no certificates configured")]
+    ErrNoCertificates,
+    #[error("no config provided")]
+    ErrNoConfigProvided,
+    #[error("client requested zero or more elliptic curves that are not supported by the server")]
+    ErrNoSupportedEllipticCurves,
+    #[error("unsupported protocol version")]
+    ErrUnsupportedProtocolVersion,
+    #[error("Certificate and PSK provided")]
+    ErrPskAndCertificate,
+    #[error("PSK and PSK Identity Hint must both be set for client")]
+    ErrPskAndIdentityMustBeSetForClient,
+    #[error("SRTP support was requested but server did not respond with use_srtp extension")]
+    ErrRequestedButNoSrtpExtension,
+    #[error("Certificate is mandatory for server")]
+    ErrServerMustHaveCertificate,
+    #[error("client requested SRTP but we have no matching profiles")]
+    ErrServerNoMatchingSrtpProfile,
+    #[error(
+        "server requires the Extended Master Secret extension, but the client does not support it"
+    )]
+    ErrServerRequiredButNoClientEms,
+    #[error("expected and actual verify data does not match")]
+    ErrVerifyDataMismatch,
+    #[error("handshake message unset, unable to marshal")]
+    ErrHandshakeMessageUnset,
+    #[error("invalid flight number")]
+    ErrInvalidFlight,
+    #[error("unable to generate key signature, unimplemented")]
+    ErrKeySignatureGenerateUnimplemented,
+    #[error("unable to verify key signature, unimplemented")]
+    ErrKeySignatureVerifyUnimplemented,
+    #[error("data length and declared length do not match")]
+    ErrLengthMismatch,
+    #[error("buffer not long enough to contain nonce")]
+    ErrNotEnoughRoomForNonce,
+    #[error("feature has not been implemented yet")]
+    ErrNotImplemented,
+    #[error("sequence number overflow")]
+    ErrSequenceNumberOverflow,
+    #[error("unable to marshal fragmented handshakes")]
+    ErrUnableToMarshalFragmented,
+    #[error("invalid state machine transition")]
+    ErrInvalidFsmTransition,
+    #[error("ApplicationData with epoch of 0")]
+    ErrApplicationDataEpochZero,
+    #[error("unhandled contentType")]
+    ErrUnhandledContextType,
+    #[error("context canceled")]
+    ErrContextCanceled,
+    #[error("empty fragment")]
+    ErrEmptyFragment,
+    #[error("Alert is Fatal or Close Notify")]
+    ErrAlertFatalOrClose,
+
+    #[error(
+        "Fragment buffer overflow. New size {new_size} is greater than specified max {max_size}"
+    )]
+    ErrFragmentBufferOverflow { new_size: usize, max_size: usize },
+
+    #[error("{0}")]
+    Io(#[source] IoError),
+    #[error("{0}")]
+    Util(#[from] util::Error),
+    #[error("utf8: {0}")]
+    Utf8(#[from] FromUtf8Error),
+    #[error("{0}")]
+    Sec1(#[source] sec1::Error),
+    #[error("{0}")]
+    Aes(#[from] aes::cipher::InvalidLength),
+    #[error("{0}")]
+    P256(#[source] P256Error),
+    #[error("{0}")]
+    RcGen(#[from] rcgen::Error),
+    #[error("mpsc send: {0}")]
+    MpscSend(String),
+    #[error("keying material: {0}")]
+    KeyingMaterial(#[from] KeyingMaterialExporterError),
+
+    /// Error parsing a given PEM string.
+    #[error("invalid PEM: {0}")]
+    InvalidPEM(String),
+
+    #[allow(non_camel_case_types)]
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Debug, Error)]
+#[error("io error: {0}")]
+pub struct IoError(#[from] pub io::Error);
+
+// Workaround for wanting PartialEq for io::Error.
+impl PartialEq for IoError {
+    fn eq(&self, other: &Self) -> bool {
+        self.0.kind() == other.0.kind()
+    }
+}
+
+impl From<io::Error> for Error {
+    fn from(e: io::Error) -> Self {
+        Error::Io(IoError(e))
+    }
+}
+
+impl From<sec1::Error> for Error {
+    fn from(e: sec1::Error) -> Self {
+        Error::Sec1(e)
+    }
+}
+
+#[derive(Debug, Error)]
+#[error("{0}")]
+pub struct P256Error(#[source] p256::elliptic_curve::Error);
+
+impl PartialEq for P256Error {
+    fn eq(&self, _: &Self) -> bool {
+        false
+    }
+}
+
+impl From<p256::elliptic_curve::Error> for Error {
+    fn from(e: p256::elliptic_curve::Error) -> Self {
+        Error::P256(P256Error(e))
+    }
+}
+
+// Because Tokio SendError is parameterized, we sadly lose the backtrace.
+impl<T> From<MpscSendError<T>> for Error {
+    fn from(e: MpscSendError<T>) -> Self {
+        Error::MpscSend(e.to_string())
+    }
+}

libs/dtls/src/extension/extension_server_name.rs

@@ -0,0 +1,56 @@
+#[cfg(test)]
+mod extension_server_name_test;
+
+use std::io::{Read, Write};
+
+use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
+
+use super::*;
+
+const EXTENSION_SERVER_NAME_TYPE_DNSHOST_NAME: u8 = 0;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ExtensionServerName {
+    pub(crate) server_name: String,
+}
+
+impl ExtensionServerName {
+    pub fn extension_value(&self) -> ExtensionValue {
+        ExtensionValue::ServerName
+    }
+
+    pub fn size(&self) -> usize {
+        //TODO: check how to do cryptobyte?
+        2 + 2 + 1 + 2 + self.server_name.len()
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        //TODO: check how to do cryptobyte?
+        writer.write_u16::<BigEndian>(2 + 1 + 2 + self.server_name.len() as u16)?;
+        writer.write_u16::<BigEndian>(1 + 2 + self.server_name.len() as u16)?;
+        writer.write_u8(EXTENSION_SERVER_NAME_TYPE_DNSHOST_NAME)?;
+        writer.write_u16::<BigEndian>(self.server_name.len() as u16)?;
+        writer.write_all(self.server_name.as_bytes())?;
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        //TODO: check how to do cryptobyte?
+        let _ = reader.read_u16::<BigEndian>()? as usize;
+        let _ = reader.read_u16::<BigEndian>()? as usize;
+
+        let name_type = reader.read_u8()?;
+        if name_type != EXTENSION_SERVER_NAME_TYPE_DNSHOST_NAME {
+            return Err(Error::ErrInvalidSniFormat);
+        }
+
+        let buf_len = reader.read_u16::<BigEndian>()? as usize;
+        let mut buf: Vec<u8> = vec![0u8; buf_len];
+        reader.read_exact(&mut buf)?;
+
+        let server_name = String::from_utf8(buf)?;
+
+        Ok(ExtensionServerName { server_name })
+    }
+}

libs/dtls/src/extension/extension_server_name/extension_server_name_test.rs

@@ -0,0 +1,26 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_extension_server_name() -> Result<()> {
+    let extension = ExtensionServerName {
+        server_name: "test.domain".to_owned(),
+    };
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        extension.marshal(&mut writer)?;
+    }
+
+    let mut reader = BufReader::new(raw.as_slice());
+    let new_extension = ExtensionServerName::unmarshal(&mut reader)?;
+
+    assert_eq!(
+        new_extension, extension,
+        "extensionServerName marshal: got {new_extension:?} expected {extension:?}",
+    );
+
+    Ok(())
+}

libs/dtls/src/extension/extension_supported_elliptic_curves.rs

@@ -0,0 +1,50 @@
+#[cfg(test)]
+mod extension_supported_elliptic_curves_test;
+
+use super::*;
+use crate::curve::named_curve::*;
+
+const EXTENSION_SUPPORTED_GROUPS_HEADER_SIZE: usize = 6;
+
+/// ## Specifications
+///
+/// * [RFC 8422 §5.1.1]
+///
+/// [RFC 8422 §5.1.1]: https://tools.ietf.org/html/rfc8422#section-5.1.1
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ExtensionSupportedEllipticCurves {
+    pub elliptic_curves: Vec<NamedCurve>,
+}
+
+impl ExtensionSupportedEllipticCurves {
+    pub fn extension_value(&self) -> ExtensionValue {
+        ExtensionValue::SupportedEllipticCurves
+    }
+
+    pub fn size(&self) -> usize {
+        2 + 2 + self.elliptic_curves.len() * 2
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u16::<BigEndian>(2 + 2 * self.elliptic_curves.len() as u16)?;
+        writer.write_u16::<BigEndian>(2 * self.elliptic_curves.len() as u16)?;
+        for v in &self.elliptic_curves {
+            writer.write_u16::<BigEndian>(*v as u16)?;
+        }
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let _ = reader.read_u16::<BigEndian>()?;
+
+        let group_count = reader.read_u16::<BigEndian>()? as usize / 2;
+        let mut elliptic_curves = vec![];
+        for _ in 0..group_count {
+            let elliptic_curve = reader.read_u16::<BigEndian>()?.into();
+            elliptic_curves.push(elliptic_curve);
+        }
+
+        Ok(ExtensionSupportedEllipticCurves { elliptic_curves })
+    }
+}

libs/dtls/src/extension/extension_supported_elliptic_curves/extension_supported_elliptic_curves_test.rs

@@ -0,0 +1,32 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_extension_supported_groups() -> Result<()> {
+    let raw_supported_groups = vec![0x0, 0x4, 0x0, 0x2, 0x0, 0x1d]; // 0x0, 0xa,
+    let parsed_supported_groups = ExtensionSupportedEllipticCurves {
+        elliptic_curves: vec![NamedCurve::X25519],
+    };
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        parsed_supported_groups.marshal(&mut writer)?;
+    }
+
+    assert_eq!(
+        raw, raw_supported_groups,
+        "extensionSupportedGroups marshal: got {raw:?}, want {raw_supported_groups:?}"
+    );
+
+    let mut reader = BufReader::new(raw.as_slice());
+    let new_supported_groups = ExtensionSupportedEllipticCurves::unmarshal(&mut reader)?;
+
+    assert_eq!(
+        new_supported_groups, parsed_supported_groups,
+        "extensionSupportedGroups unmarshal: got {new_supported_groups:?}, want {parsed_supported_groups:?}"
+    );
+
+    Ok(())
+}

libs/dtls/src/extension/extension_supported_point_formats.rs

@@ -0,0 +1,53 @@
+#[cfg(test)]
+mod extension_supported_point_formats_test;
+
+use super::*;
+
+const EXTENSION_SUPPORTED_POINT_FORMATS_SIZE: usize = 5;
+
+pub type EllipticCurvePointFormat = u8;
+
+pub const ELLIPTIC_CURVE_POINT_FORMAT_UNCOMPRESSED: EllipticCurvePointFormat = 0;
+
+/// ## Specifications
+///
+/// * [RFC 4492 §5.1.2]
+///
+/// [RFC 4492 §5.1.2]: https://tools.ietf.org/html/rfc4492#section-5.1.2
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ExtensionSupportedPointFormats {
+    pub(crate) point_formats: Vec<EllipticCurvePointFormat>,
+}
+
+impl ExtensionSupportedPointFormats {
+    pub fn extension_value(&self) -> ExtensionValue {
+        ExtensionValue::SupportedPointFormats
+    }
+
+    pub fn size(&self) -> usize {
+        2 + 1 + self.point_formats.len()
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u16::<BigEndian>(1 + self.point_formats.len() as u16)?;
+        writer.write_u8(self.point_formats.len() as u8)?;
+        for v in &self.point_formats {
+            writer.write_u8(*v)?;
+        }
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let _ = reader.read_u16::<BigEndian>()?;
+
+        let point_format_count = reader.read_u8()? as usize;
+        let mut point_formats = vec![];
+        for _ in 0..point_format_count {
+            let point_format = reader.read_u8()?;
+            point_formats.push(point_format);
+        }
+
+        Ok(ExtensionSupportedPointFormats { point_formats })
+    }
+}

libs/dtls/src/extension/extension_supported_point_formats/extension_supported_point_formats_test.rs

@@ -0,0 +1,33 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_extension_supported_point_formats() -> Result<()> {
+    let raw_extension_supported_point_formats = vec![0x00, 0x02, 0x01, 0x00]; // 0x00, 0x0b,
+    let parsed_extension_supported_point_formats = ExtensionSupportedPointFormats {
+        point_formats: vec![ELLIPTIC_CURVE_POINT_FORMAT_UNCOMPRESSED],
+    };
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        parsed_extension_supported_point_formats.marshal(&mut writer)?;
+    }
+
+    assert_eq!(
+        raw, raw_extension_supported_point_formats,
+        "extensionSupportedPointFormats marshal: got {raw:?}, want {raw_extension_supported_point_formats:?}"
+    );
+
+    let mut reader = BufReader::new(raw.as_slice());
+    let new_extension_supported_point_formats =
+        ExtensionSupportedPointFormats::unmarshal(&mut reader)?;
+
+    assert_eq!(
+        new_extension_supported_point_formats, parsed_extension_supported_point_formats,
+        "extensionSupportedPointFormats unmarshal: got {new_extension_supported_point_formats:?}, want {parsed_extension_supported_point_formats:?}"
+    );
+
+    Ok(())
+}

libs/dtls/src/extension/extension_supported_signature_algorithms.rs

@@ -0,0 +1,54 @@
+#[cfg(test)]
+mod extension_supported_signature_algorithms_test;
+
+use super::*;
+use crate::signature_hash_algorithm::*;
+
+const EXTENSION_SUPPORTED_SIGNATURE_ALGORITHMS_HEADER_SIZE: usize = 6;
+
+/// ## Specifications
+///
+/// * [RFC 5246 §7.4.1.4.1]
+///
+/// [RFC 5246 §7.4.1.4.1]: https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ExtensionSupportedSignatureAlgorithms {
+    pub(crate) signature_hash_algorithms: Vec<SignatureHashAlgorithm>,
+}
+
+impl ExtensionSupportedSignatureAlgorithms {
+    pub fn extension_value(&self) -> ExtensionValue {
+        ExtensionValue::SupportedSignatureAlgorithms
+    }
+
+    pub fn size(&self) -> usize {
+        2 + 2 + self.signature_hash_algorithms.len() * 2
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u16::<BigEndian>(2 + 2 * self.signature_hash_algorithms.len() as u16)?;
+        writer.write_u16::<BigEndian>(2 * self.signature_hash_algorithms.len() as u16)?;
+        for v in &self.signature_hash_algorithms {
+            writer.write_u8(v.hash as u8)?;
+            writer.write_u8(v.signature as u8)?;
+        }
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let _ = reader.read_u16::<BigEndian>()?;
+
+        let algorithm_count = reader.read_u16::<BigEndian>()? as usize / 2;
+        let mut signature_hash_algorithms = vec![];
+        for _ in 0..algorithm_count {
+            let hash = reader.read_u8()?.into();
+            let signature = reader.read_u8()?.into();
+            signature_hash_algorithms.push(SignatureHashAlgorithm { hash, signature });
+        }
+
+        Ok(ExtensionSupportedSignatureAlgorithms {
+            signature_hash_algorithms,
+        })
+    }
+}

libs/dtls/src/extension/extension_supported_signature_algorithms/extension_supported_signature_algorithms_test.rs

@@ -0,0 +1,48 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_extension_supported_signature_algorithms() -> Result<()> {
+    let raw_extension_supported_signature_algorithms =
+        vec![0x00, 0x08, 0x00, 0x06, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03]; //0x00, 0x0d,
+    let parsed_extension_supported_signature_algorithms = ExtensionSupportedSignatureAlgorithms {
+        signature_hash_algorithms: vec![
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha256,
+                signature: SignatureAlgorithm::Ecdsa,
+            },
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha384,
+                signature: SignatureAlgorithm::Ecdsa,
+            },
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha512,
+                signature: SignatureAlgorithm::Ecdsa,
+            },
+        ],
+    };
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        parsed_extension_supported_signature_algorithms.marshal(&mut writer)?;
+    }
+
+    assert_eq!(
+        raw, raw_extension_supported_signature_algorithms,
+        "extensionSupportedSignatureAlgorithms marshal: got {raw:?}, want {raw_extension_supported_signature_algorithms:?}"
+    );
+
+    let mut reader = BufReader::new(raw.as_slice());
+    let new_extension_supported_signature_algorithms =
+        ExtensionSupportedSignatureAlgorithms::unmarshal(&mut reader)?;
+
+    assert_eq!(
+        new_extension_supported_signature_algorithms,
+        parsed_extension_supported_signature_algorithms,
+        "extensionSupportedSignatureAlgorithms unmarshal: got {new_extension_supported_signature_algorithms:?}, want {parsed_extension_supported_signature_algorithms:?}"
+    );
+
+    Ok(())
+}

libs/dtls/src/extension/extension_use_extended_master_secret.rs

@@ -0,0 +1,39 @@
+#[cfg(test)]
+mod extension_use_extended_master_secret_test;
+
+use super::*;
+
+const EXTENSION_USE_EXTENDED_MASTER_SECRET_HEADER_SIZE: usize = 4;
+
+/// ## Specifications
+///
+/// * [RFC 8422]
+///
+/// [RFC 8422]: https://tools.ietf.org/html/rfc8422
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ExtensionUseExtendedMasterSecret {
+    pub(crate) supported: bool,
+}
+
+impl ExtensionUseExtendedMasterSecret {
+    pub fn extension_value(&self) -> ExtensionValue {
+        ExtensionValue::UseExtendedMasterSecret
+    }
+
+    pub fn size(&self) -> usize {
+        2
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        // length
+        writer.write_u16::<BigEndian>(0)?;
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let _ = reader.read_u16::<BigEndian>()?;
+
+        Ok(ExtensionUseExtendedMasterSecret { supported: true })
+    }
+}

libs/dtls/src/extension/extension_use_extended_master_secret/extension_use_extended_master_secret_test.rs

@@ -0,0 +1,32 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_extension_use_extended_master_secret() -> Result<()> {
+    let raw_extension_use_extended_master_secret = vec![0x00, 0x00];
+    let parsed_extension_use_extended_master_secret =
+        ExtensionUseExtendedMasterSecret { supported: true };
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        parsed_extension_use_extended_master_secret.marshal(&mut writer)?;
+    }
+
+    assert_eq!(
+        raw, raw_extension_use_extended_master_secret,
+        "extension_use_extended_master_secret marshal: got {raw:?}, want {raw_extension_use_extended_master_secret:?}"
+    );
+
+    let mut reader = BufReader::new(raw.as_slice());
+    let new_extension_use_extended_master_secret =
+        ExtensionUseExtendedMasterSecret::unmarshal(&mut reader)?;
+
+    assert_eq!(
+        new_extension_use_extended_master_secret, parsed_extension_use_extended_master_secret,
+        "extension_use_extended_master_secret unmarshal: got {new_extension_use_extended_master_secret:?}, want {parsed_extension_use_extended_master_secret:?}"
+    );
+
+    Ok(())
+}

libs/dtls/src/extension/extension_use_srtp.rs

@@ -0,0 +1,88 @@
+#[cfg(test)]
+mod extension_use_srtp_test;
+
+use super::*;
+
+// SRTPProtectionProfile defines the parameters and options that are in effect for the SRTP processing
+/// ## Specifications
+///
+/// * [RFC 5764 §4.1.2]
+///
+/// [RFC 5764 §4.1.2]: https://tools.ietf.org/html/rfc5764#section-4.1.2
+#[allow(non_camel_case_types)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum SrtpProtectionProfile {
+    Srtp_Aes128_Cm_Hmac_Sha1_80 = 0x0001,
+    Srtp_Aes128_Cm_Hmac_Sha1_32 = 0x0002,
+    Srtp_Aead_Aes_128_Gcm = 0x0007,
+    Srtp_Aead_Aes_256_Gcm = 0x0008,
+    Unsupported,
+}
+
+impl From<u16> for SrtpProtectionProfile {
+    fn from(val: u16) -> Self {
+        match val {
+            0x0001 => SrtpProtectionProfile::Srtp_Aes128_Cm_Hmac_Sha1_80,
+            0x0002 => SrtpProtectionProfile::Srtp_Aes128_Cm_Hmac_Sha1_32,
+            0x0007 => SrtpProtectionProfile::Srtp_Aead_Aes_128_Gcm,
+            0x0008 => SrtpProtectionProfile::Srtp_Aead_Aes_256_Gcm,
+            _ => SrtpProtectionProfile::Unsupported,
+        }
+    }
+}
+
+const EXTENSION_USE_SRTPHEADER_SIZE: usize = 6;
+
+/// ## Specifications
+///
+/// * [RFC 8422]
+///
+/// [RFC 8422]: https://tools.ietf.org/html/rfc8422
+#[allow(non_camel_case_types)]
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ExtensionUseSrtp {
+    pub(crate) protection_profiles: Vec<SrtpProtectionProfile>,
+}
+
+impl ExtensionUseSrtp {
+    pub fn extension_value(&self) -> ExtensionValue {
+        ExtensionValue::UseSrtp
+    }
+
+    pub fn size(&self) -> usize {
+        2 + 2 + self.protection_profiles.len() * 2 + 1
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u16::<BigEndian>(
+            2 + /* MKI Length */ 1 + 2 * self.protection_profiles.len() as u16,
+        )?;
+        writer.write_u16::<BigEndian>(2 * self.protection_profiles.len() as u16)?;
+        for v in &self.protection_profiles {
+            writer.write_u16::<BigEndian>(*v as u16)?;
+        }
+
+        /* MKI Length */
+        writer.write_u8(0x00)?;
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let _ = reader.read_u16::<BigEndian>()?;
+
+        let profile_count = reader.read_u16::<BigEndian>()? as usize / 2;
+        let mut protection_profiles = vec![];
+        for _ in 0..profile_count {
+            let protection_profile = reader.read_u16::<BigEndian>()?.into();
+            protection_profiles.push(protection_profile);
+        }
+
+        /* MKI Length */
+        let _ = reader.read_u8()?;
+
+        Ok(ExtensionUseSrtp {
+            protection_profiles,
+        })
+    }
+}

libs/dtls/src/extension/extension_use_srtp/extension_use_srtp_test.rs

@@ -0,0 +1,32 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_extension_use_srtp() -> Result<()> {
+    let raw_use_srtp = vec![0x00, 0x05, 0x00, 0x02, 0x00, 0x01, 0x00]; //0x00, 0x0e,
+    let parsed_use_srtp = ExtensionUseSrtp {
+        protection_profiles: vec![SrtpProtectionProfile::Srtp_Aes128_Cm_Hmac_Sha1_80],
+    };
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        parsed_use_srtp.marshal(&mut writer)?;
+    }
+
+    assert_eq!(
+        raw, raw_use_srtp,
+        "extensionUseSRTP marshal: got {raw:?}, want {raw_use_srtp:?}"
+    );
+
+    let mut reader = BufReader::new(raw.as_slice());
+    let new_use_srtp = ExtensionUseSrtp::unmarshal(&mut reader)?;
+
+    assert_eq!(
+        new_use_srtp, parsed_use_srtp,
+        "extensionUseSRTP unmarshal: got {new_use_srtp:?}, want {parsed_use_srtp:?}"
+    );
+
+    Ok(())
+}

libs/dtls/src/extension/mod.rs

@@ -0,0 +1,130 @@
+pub mod extension_server_name;
+pub mod extension_supported_elliptic_curves;
+pub mod extension_supported_point_formats;
+pub mod extension_supported_signature_algorithms;
+pub mod extension_use_extended_master_secret;
+pub mod extension_use_srtp;
+pub mod renegotiation_info;
+
+use std::io::{Read, Write};
+
+use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
+use extension_server_name::*;
+use extension_supported_elliptic_curves::*;
+use extension_supported_point_formats::*;
+use extension_supported_signature_algorithms::*;
+use extension_use_extended_master_secret::*;
+use extension_use_srtp::*;
+
+use crate::error::*;
+use crate::extension::renegotiation_info::ExtensionRenegotiationInfo;
+
+// https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ExtensionValue {
+    ServerName = 0,
+    SupportedEllipticCurves = 10,
+    SupportedPointFormats = 11,
+    SupportedSignatureAlgorithms = 13,
+    UseSrtp = 14,
+    UseExtendedMasterSecret = 23,
+    RenegotiationInfo = 65281,
+    Unsupported,
+}
+
+impl From<u16> for ExtensionValue {
+    fn from(val: u16) -> Self {
+        match val {
+            0 => ExtensionValue::ServerName,
+            10 => ExtensionValue::SupportedEllipticCurves,
+            11 => ExtensionValue::SupportedPointFormats,
+            13 => ExtensionValue::SupportedSignatureAlgorithms,
+            14 => ExtensionValue::UseSrtp,
+            23 => ExtensionValue::UseExtendedMasterSecret,
+            65281 => ExtensionValue::RenegotiationInfo,
+            _ => ExtensionValue::Unsupported,
+        }
+    }
+}
+
+#[derive(PartialEq, Eq, Debug, Clone)]
+pub enum Extension {
+    ServerName(ExtensionServerName),
+    SupportedEllipticCurves(ExtensionSupportedEllipticCurves),
+    SupportedPointFormats(ExtensionSupportedPointFormats),
+    SupportedSignatureAlgorithms(ExtensionSupportedSignatureAlgorithms),
+    UseSrtp(ExtensionUseSrtp),
+    UseExtendedMasterSecret(ExtensionUseExtendedMasterSecret),
+    RenegotiationInfo(ExtensionRenegotiationInfo),
+}
+
+impl Extension {
+    pub fn extension_value(&self) -> ExtensionValue {
+        match self {
+            Extension::ServerName(ext) => ext.extension_value(),
+            Extension::SupportedEllipticCurves(ext) => ext.extension_value(),
+            Extension::SupportedPointFormats(ext) => ext.extension_value(),
+            Extension::SupportedSignatureAlgorithms(ext) => ext.extension_value(),
+            Extension::UseSrtp(ext) => ext.extension_value(),
+            Extension::UseExtendedMasterSecret(ext) => ext.extension_value(),
+            Extension::RenegotiationInfo(ext) => ext.extension_value(),
+        }
+    }
+
+    pub fn size(&self) -> usize {
+        let mut len = 2;
+
+        len += match self {
+            Extension::ServerName(ext) => ext.size(),
+            Extension::SupportedEllipticCurves(ext) => ext.size(),
+            Extension::SupportedPointFormats(ext) => ext.size(),
+            Extension::SupportedSignatureAlgorithms(ext) => ext.size(),
+            Extension::UseSrtp(ext) => ext.size(),
+            Extension::UseExtendedMasterSecret(ext) => ext.size(),
+            Extension::RenegotiationInfo(ext) => ext.size(),
+        };
+
+        len
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u16::<BigEndian>(self.extension_value() as u16)?;
+        match self {
+            Extension::ServerName(ext) => ext.marshal(writer),
+            Extension::SupportedEllipticCurves(ext) => ext.marshal(writer),
+            Extension::SupportedPointFormats(ext) => ext.marshal(writer),
+            Extension::SupportedSignatureAlgorithms(ext) => ext.marshal(writer),
+            Extension::UseSrtp(ext) => ext.marshal(writer),
+            Extension::UseExtendedMasterSecret(ext) => ext.marshal(writer),
+            Extension::RenegotiationInfo(ext) => ext.marshal(writer),
+        }
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let extension_value: ExtensionValue = reader.read_u16::<BigEndian>()?.into();
+        match extension_value {
+            ExtensionValue::ServerName => Ok(Extension::ServerName(
+                ExtensionServerName::unmarshal(reader)?,
+            )),
+            ExtensionValue::SupportedEllipticCurves => Ok(Extension::SupportedEllipticCurves(
+                ExtensionSupportedEllipticCurves::unmarshal(reader)?,
+            )),
+            ExtensionValue::SupportedPointFormats => Ok(Extension::SupportedPointFormats(
+                ExtensionSupportedPointFormats::unmarshal(reader)?,
+            )),
+            ExtensionValue::SupportedSignatureAlgorithms => {
+                Ok(Extension::SupportedSignatureAlgorithms(
+                    ExtensionSupportedSignatureAlgorithms::unmarshal(reader)?,
+                ))
+            }
+            ExtensionValue::UseSrtp => Ok(Extension::UseSrtp(ExtensionUseSrtp::unmarshal(reader)?)),
+            ExtensionValue::UseExtendedMasterSecret => Ok(Extension::UseExtendedMasterSecret(
+                ExtensionUseExtendedMasterSecret::unmarshal(reader)?,
+            )),
+            ExtensionValue::RenegotiationInfo => Ok(Extension::RenegotiationInfo(
+                ExtensionRenegotiationInfo::unmarshal(reader)?,
+            )),
+            _ => Err(Error::ErrInvalidExtensionType),
+        }
+    }
+}

libs/dtls/src/extension/renegotiation_info.rs

@@ -0,0 +1,53 @@
+#[cfg(test)]
+mod renegotiation_info_test;
+
+use super::*;
+use crate::error::Error::ErrInvalidPacketLength;
+
+const RENEGOTIATION_INFO_HEADER_SIZE: usize = 5;
+
+/// RenegotiationInfo allows a Client/Server to
+/// communicate their renegotiation support
+///
+/// ## Specifications
+///
+/// * [RFC 5746]
+///
+/// [RFC 5746]: https://tools.ietf.org/html/rfc5746
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ExtensionRenegotiationInfo {
+    pub(crate) renegotiated_connection: u8,
+}
+
+impl ExtensionRenegotiationInfo {
+    // TypeValue returns the extension TypeValue
+    pub fn extension_value(&self) -> ExtensionValue {
+        ExtensionValue::RenegotiationInfo
+    }
+
+    pub fn size(&self) -> usize {
+        3
+    }
+
+    /// marshal encodes the extension
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u16::<BigEndian>(1)?; //length
+        writer.write_u8(self.renegotiated_connection)?;
+
+        Ok(writer.flush()?)
+    }
+
+    /// Unmarshal populates the extension from encoded data
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let l = reader.read_u16::<BigEndian>()?; //length
+        if l != 1 {
+            return Err(ErrInvalidPacketLength);
+        }
+
+        let renegotiated_connection = reader.read_u8()?;
+
+        Ok(ExtensionRenegotiationInfo {
+            renegotiated_connection,
+        })
+    }
+}

libs/dtls/src/extension/renegotiation_info/renegotiation_info_test.rs

@@ -0,0 +1,26 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_renegotiation_info() -> Result<()> {
+    let extension = ExtensionRenegotiationInfo {
+        renegotiated_connection: 0,
+    };
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        extension.marshal(&mut writer)?;
+    }
+
+    let mut reader = BufReader::new(raw.as_slice());
+    let new_extension = ExtensionRenegotiationInfo::unmarshal(&mut reader)?;
+
+    assert_eq!(
+        new_extension.renegotiated_connection,
+        extension.renegotiated_connection
+    );
+
+    Ok(())
+}

libs/dtls/src/flight/flight0.rs

@@ -0,0 +1,209 @@
+use std::fmt;
+use std::sync::atomic::Ordering;
+
+use async_trait::async_trait;
+use rand::Rng;
+
+use super::flight2::*;
+use super::*;
+use crate::config::*;
+use crate::conn::*;
+use crate::curve::named_curve::NamedCurve;
+use crate::error::Error;
+use crate::extension::*;
+use crate::handshake::*;
+use crate::record_layer::record_layer_header::*;
+use crate::*;
+
+#[derive(Debug, PartialEq)]
+pub(crate) struct Flight0;
+
+impl fmt::Display for Flight0 {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Flight 0")
+    }
+}
+
+#[async_trait]
+impl Flight for Flight0 {
+    async fn parse(
+        &self,
+        _tx: &mut mpsc::Sender<mpsc::Sender<()>>,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Box<dyn Flight + Send + Sync>, (Option<Alert>, Option<Error>)> {
+        let (seq, msgs) = match cache
+            .full_pull_map(
+                0,
+                &[HandshakeCachePullRule {
+                    typ: HandshakeType::ClientHello,
+                    epoch: cfg.initial_epoch,
+                    is_client: true,
+                    optional: false,
+                }],
+            )
+            .await
+        {
+            Ok((seq, msgs)) => (seq, msgs),
+            Err(_) => return Err((None, None)),
+        };
+
+        state.handshake_recv_sequence = seq;
+
+        if let Some(message) = msgs.get(&HandshakeType::ClientHello) {
+            // Validate type
+            let client_hello = match message {
+                HandshakeMessage::ClientHello(client_hello) => client_hello,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+
+            if client_hello.version != PROTOCOL_VERSION1_2 {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::ProtocolVersion,
+                    }),
+                    Some(Error::ErrUnsupportedProtocolVersion),
+                ));
+            }
+
+            state.remote_random = client_hello.random.clone();
+
+            if let Ok(id) =
+                find_matching_cipher_suite(&client_hello.cipher_suites, &cfg.local_cipher_suites)
+            {
+                if let Ok(cipher_suite) = cipher_suite_for_id(id) {
+                    log::debug!(
+                        "[handshake:{}] use cipher suite: {}",
+                        srv_cli_str(state.is_client),
+                        cipher_suite.to_string()
+                    );
+                    let mut cs = state.cipher_suite.lock().await;
+                    *cs = Some(cipher_suite);
+                }
+            } else {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InsufficientSecurity,
+                    }),
+                    Some(Error::ErrCipherSuiteNoIntersection),
+                ));
+            }
+
+            for extension in &client_hello.extensions {
+                match extension {
+                    Extension::SupportedEllipticCurves(e) => {
+                        if e.elliptic_curves.is_empty() {
+                            return Err((
+                                Some(Alert {
+                                    alert_level: AlertLevel::Fatal,
+                                    alert_description: AlertDescription::InsufficientSecurity,
+                                }),
+                                Some(Error::ErrNoSupportedEllipticCurves),
+                            ));
+                        }
+                        for curve in e.elliptic_curves.iter() {
+                            if curve != &NamedCurve::Unsupported {
+                                state.named_curve = *curve;
+                                break;
+                            }
+                        }
+                    }
+                    Extension::UseSrtp(e) => {
+                        if let Ok(profile) = find_matching_srtp_profile(
+                            &e.protection_profiles,
+                            &cfg.local_srtp_protection_profiles,
+                        ) {
+                            state.srtp_protection_profile = profile;
+                        } else {
+                            return Err((
+                                Some(Alert {
+                                    alert_level: AlertLevel::Fatal,
+                                    alert_description: AlertDescription::InsufficientSecurity,
+                                }),
+                                Some(Error::ErrServerNoMatchingSrtpProfile),
+                            ));
+                        }
+                    }
+                    Extension::UseExtendedMasterSecret(_) => {
+                        if cfg.extended_master_secret != ExtendedMasterSecretType::Disable {
+                            state.extended_master_secret = true;
+                        }
+                    }
+                    Extension::ServerName(e) => {
+                        state.server_name.clone_from(&e.server_name); // remote server name
+                    }
+                    _ => {}
+                }
+            }
+
+            if cfg.extended_master_secret == ExtendedMasterSecretType::Require
+                && !state.extended_master_secret
+            {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InsufficientSecurity,
+                    }),
+                    Some(Error::ErrServerRequiredButNoClientEms),
+                ));
+            }
+
+            if state.local_keypair.is_none() {
+                state.local_keypair = match state.named_curve.generate_keypair() {
+                    Ok(local_keypar) => Some(local_keypar),
+                    Err(err) => {
+                        return Err((
+                            Some(Alert {
+                                alert_level: AlertLevel::Fatal,
+                                alert_description: AlertDescription::IllegalParameter,
+                            }),
+                            Some(err),
+                        ))
+                    }
+                };
+            }
+
+            Ok(Box::new(Flight2 {}))
+        } else {
+            Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::InternalError,
+                }),
+                None,
+            ))
+        }
+    }
+
+    async fn generate(
+        &self,
+        state: &mut State,
+        _cache: &HandshakeCache,
+        _cfg: &HandshakeConfig,
+    ) -> Result<Vec<Packet>, (Option<Alert>, Option<Error>)> {
+        // Initialize
+        state.cookie = vec![0; COOKIE_LENGTH];
+        rand::rng().fill(state.cookie.as_mut_slice());
+
+        //TODO: figure out difference between golang's atom store and rust atom store
+        let zero_epoch = 0;
+        state.local_epoch.store(zero_epoch, Ordering::SeqCst);
+        state.remote_epoch.store(zero_epoch, Ordering::SeqCst);
+
+        state.named_curve = DEFAULT_NAMED_CURVE;
+        state.local_random.populate();
+
+        Ok(vec![])
+    }
+}

libs/dtls/src/flight/flight1.rs

@@ -0,0 +1,193 @@
+use std::fmt;
+use std::sync::atomic::Ordering;
+
+use async_trait::async_trait;
+
+use super::flight3::*;
+use super::*;
+use crate::compression_methods::*;
+use crate::config::*;
+use crate::conn::*;
+use crate::content::*;
+use crate::curve::named_curve::*;
+use crate::error::Error;
+use crate::extension::extension_server_name::*;
+use crate::extension::extension_supported_elliptic_curves::*;
+use crate::extension::extension_supported_point_formats::*;
+use crate::extension::extension_supported_signature_algorithms::*;
+use crate::extension::extension_use_extended_master_secret::*;
+use crate::extension::extension_use_srtp::*;
+use crate::extension::renegotiation_info::ExtensionRenegotiationInfo;
+use crate::extension::*;
+use crate::handshake::handshake_message_client_hello::*;
+use crate::handshake::*;
+use crate::record_layer::record_layer_header::*;
+use crate::record_layer::*;
+
+#[derive(Debug, PartialEq)]
+pub(crate) struct Flight1;
+
+impl fmt::Display for Flight1 {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Flight 1")
+    }
+}
+
+#[async_trait]
+impl Flight for Flight1 {
+    async fn parse(
+        &self,
+        tx: &mut mpsc::Sender<mpsc::Sender<()>>,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Box<dyn Flight + Send + Sync>, (Option<Alert>, Option<Error>)> {
+        // HelloVerifyRequest can be skipped by the server,
+        // so allow ServerHello during flight1 also
+        let (seq, msgs) = match cache
+            .full_pull_map(
+                state.handshake_recv_sequence,
+                &[
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::HelloVerifyRequest,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: true,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: true,
+                    },
+                ],
+            )
+            .await
+        {
+            // No valid message received. Keep reading
+            Ok((seq, msgs)) => (seq, msgs),
+            Err(_) => return Err((None, None)),
+        };
+
+        if msgs.contains_key(&HandshakeType::ServerHello) {
+            // Flight1 and flight2 were skipped.
+            // Parse as flight3.
+            let flight3 = Flight3 {};
+            return flight3.parse(tx, state, cache, cfg).await;
+        }
+
+        if let Some(message) = msgs.get(&HandshakeType::HelloVerifyRequest) {
+            // DTLS 1.2 clients must not assume that the server will use the protocol version
+            // specified in HelloVerifyRequest message. RFC 6347 Section 4.2.1
+            let h = match message {
+                HandshakeMessage::HelloVerifyRequest(h) => h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+
+            if h.version != PROTOCOL_VERSION1_0 && h.version != PROTOCOL_VERSION1_2 {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::ProtocolVersion,
+                    }),
+                    Some(Error::ErrUnsupportedProtocolVersion),
+                ));
+            }
+
+            state.cookie.clone_from(&h.cookie);
+            state.handshake_recv_sequence = seq;
+            Ok(Box::new(Flight3 {}))
+        } else {
+            Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::InternalError,
+                }),
+                None,
+            ))
+        }
+    }
+
+    async fn generate(
+        &self,
+        state: &mut State,
+        _cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Vec<Packet>, (Option<Alert>, Option<Error>)> {
+        let zero_epoch = 0;
+        state.local_epoch.store(zero_epoch, Ordering::SeqCst);
+        state.remote_epoch.store(zero_epoch, Ordering::SeqCst);
+
+        state.named_curve = DEFAULT_NAMED_CURVE;
+        state.cookie = vec![];
+        state.local_random.populate();
+
+        let mut extensions = vec![
+            Extension::SupportedSignatureAlgorithms(ExtensionSupportedSignatureAlgorithms {
+                signature_hash_algorithms: cfg.local_signature_schemes.clone(),
+            }),
+            Extension::RenegotiationInfo(ExtensionRenegotiationInfo {
+                renegotiated_connection: 0,
+            }),
+        ];
+
+        if cfg.local_psk_callback.is_none() {
+            extensions.extend_from_slice(&[
+                Extension::SupportedEllipticCurves(ExtensionSupportedEllipticCurves {
+                    elliptic_curves: vec![NamedCurve::P256, NamedCurve::X25519, NamedCurve::P384],
+                }),
+                Extension::SupportedPointFormats(ExtensionSupportedPointFormats {
+                    point_formats: vec![ELLIPTIC_CURVE_POINT_FORMAT_UNCOMPRESSED],
+                }),
+            ]);
+        }
+
+        if !cfg.local_srtp_protection_profiles.is_empty() {
+            extensions.push(Extension::UseSrtp(ExtensionUseSrtp {
+                protection_profiles: cfg.local_srtp_protection_profiles.clone(),
+            }));
+        }
+
+        if cfg.extended_master_secret == ExtendedMasterSecretType::Request
+            || cfg.extended_master_secret == ExtendedMasterSecretType::Require
+        {
+            extensions.push(Extension::UseExtendedMasterSecret(
+                ExtensionUseExtendedMasterSecret { supported: true },
+            ));
+        }
+
+        if !cfg.server_name.is_empty() {
+            extensions.push(Extension::ServerName(ExtensionServerName {
+                server_name: cfg.server_name.clone(),
+            }));
+        }
+
+        Ok(vec![Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                0,
+                Content::Handshake(Handshake::new(HandshakeMessage::ClientHello(
+                    HandshakeMessageClientHello {
+                        version: PROTOCOL_VERSION1_2,
+                        random: state.local_random.clone(),
+                        cookie: state.cookie.clone(),
+
+                        cipher_suites: cfg.local_cipher_suites.clone(),
+                        compression_methods: default_compression_methods(),
+                        extensions,
+                    },
+                ))),
+            ),
+            should_encrypt: false,
+            reset_local_sequence_number: false,
+        }])
+    }
+}

libs/dtls/src/flight/flight2.rs

@@ -0,0 +1,131 @@
+use std::fmt;
+
+use async_trait::async_trait;
+
+use super::flight0::*;
+use super::flight4::*;
+use super::*;
+use crate::content::*;
+use crate::error::Error;
+use crate::handshake::handshake_message_hello_verify_request::*;
+use crate::handshake::*;
+use crate::record_layer::record_layer_header::*;
+
+#[derive(Debug, PartialEq)]
+pub(crate) struct Flight2;
+
+impl fmt::Display for Flight2 {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Flight 2")
+    }
+}
+
+#[async_trait]
+impl Flight for Flight2 {
+    fn has_retransmit(&self) -> bool {
+        false
+    }
+
+    async fn parse(
+        &self,
+        tx: &mut mpsc::Sender<mpsc::Sender<()>>,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Box<dyn Flight + Send + Sync>, (Option<Alert>, Option<Error>)> {
+        let (seq, msgs) = match cache
+            .full_pull_map(
+                state.handshake_recv_sequence,
+                &[HandshakeCachePullRule {
+                    typ: HandshakeType::ClientHello,
+                    epoch: cfg.initial_epoch,
+                    is_client: true,
+                    optional: false,
+                }],
+            )
+            .await
+        {
+            // No valid message received. Keep reading
+            Ok((seq, msgs)) => (seq, msgs),
+
+            // Client may retransmit the first ClientHello when HelloVerifyRequest is dropped.
+            // Parse as flight 0 in this case.
+            Err(_) => return Flight0 {}.parse(tx, state, cache, cfg).await,
+        };
+
+        state.handshake_recv_sequence = seq;
+
+        if let Some(message) = msgs.get(&HandshakeType::ClientHello) {
+            // Validate type
+            let client_hello = match message {
+                HandshakeMessage::ClientHello(client_hello) => client_hello,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+
+            if client_hello.version != PROTOCOL_VERSION1_2 {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::ProtocolVersion,
+                    }),
+                    Some(Error::ErrUnsupportedProtocolVersion),
+                ));
+            }
+
+            if client_hello.cookie.is_empty() {
+                return Err((None, None));
+            }
+
+            if state.cookie != client_hello.cookie {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::AccessDenied,
+                    }),
+                    Some(Error::ErrCookieMismatch),
+                ));
+            }
+
+            Ok(Box::new(Flight4 {}))
+        } else {
+            Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::InternalError,
+                }),
+                None,
+            ))
+        }
+    }
+
+    async fn generate(
+        &self,
+        state: &mut State,
+        _cache: &HandshakeCache,
+        _cfg: &HandshakeConfig,
+    ) -> Result<Vec<Packet>, (Option<Alert>, Option<Error>)> {
+        state.handshake_send_sequence = 0;
+        Ok(vec![Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                0,
+                Content::Handshake(Handshake::new(HandshakeMessage::HelloVerifyRequest(
+                    HandshakeMessageHelloVerifyRequest {
+                        version: PROTOCOL_VERSION1_2,
+                        cookie: state.cookie.clone(),
+                    },
+                ))),
+            ),
+            should_encrypt: false,
+            reset_local_sequence_number: false,
+        }])
+    }
+}

libs/dtls/src/flight/flight3.rs

@@ -0,0 +1,470 @@
+use std::fmt;
+
+use async_trait::async_trait;
+use log::*;
+
+use super::flight5::*;
+use super::*;
+use crate::cipher_suite::cipher_suite_for_id;
+use crate::compression_methods::*;
+use crate::config::*;
+use crate::content::*;
+use crate::curve::named_curve::*;
+use crate::error::Error;
+use crate::extension::extension_server_name::*;
+use crate::extension::extension_supported_elliptic_curves::*;
+use crate::extension::extension_supported_point_formats::*;
+use crate::extension::extension_supported_signature_algorithms::*;
+use crate::extension::extension_use_extended_master_secret::*;
+use crate::extension::extension_use_srtp::*;
+use crate::extension::renegotiation_info::ExtensionRenegotiationInfo;
+use crate::extension::*;
+use crate::handshake::handshake_message_client_hello::*;
+use crate::handshake::handshake_message_server_key_exchange::*;
+use crate::handshake::*;
+use crate::prf::{prf_pre_master_secret, prf_psk_pre_master_secret};
+use crate::record_layer::record_layer_header::*;
+use crate::record_layer::*;
+use crate::{find_matching_cipher_suite, find_matching_srtp_profile};
+
+#[derive(Debug, PartialEq)]
+pub(crate) struct Flight3;
+
+impl fmt::Display for Flight3 {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Flight 3")
+    }
+}
+
+#[async_trait]
+impl Flight for Flight3 {
+    async fn parse(
+        &self,
+        _tx: &mut mpsc::Sender<mpsc::Sender<()>>,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Box<dyn Flight + Send + Sync>, (Option<Alert>, Option<Error>)> {
+        // Clients may receive multiple HelloVerifyRequest messages with different cookies.
+        // Clients SHOULD handle this by sending a new ClientHello with a cookie in response
+        // to the new HelloVerifyRequest. RFC 6347 Section 4.2.1
+        if let Ok((seq, msgs)) = cache
+            .full_pull_map(
+                state.handshake_recv_sequence,
+                &[HandshakeCachePullRule {
+                    typ: HandshakeType::HelloVerifyRequest,
+                    epoch: cfg.initial_epoch,
+                    is_client: false,
+                    optional: true,
+                }],
+            )
+            .await
+        {
+            if let Some(message) = msgs.get(&HandshakeType::HelloVerifyRequest) {
+                // DTLS 1.2 clients must not assume that the server will use the protocol version
+                // specified in HelloVerifyRequest message. RFC 6347 Section 4.2.1
+                let h = match message {
+                    HandshakeMessage::HelloVerifyRequest(h) => h,
+                    _ => {
+                        return Err((
+                            Some(Alert {
+                                alert_level: AlertLevel::Fatal,
+                                alert_description: AlertDescription::InternalError,
+                            }),
+                            None,
+                        ))
+                    }
+                };
+
+                // DTLS 1.2 clients must not assume that the server will use the protocol version
+                // specified in HelloVerifyRequest message. RFC 6347 Section 4.2.1
+                if h.version != PROTOCOL_VERSION1_0 && h.version != PROTOCOL_VERSION1_2 {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::ProtocolVersion,
+                        }),
+                        Some(Error::ErrUnsupportedProtocolVersion),
+                    ));
+                }
+
+                state.cookie.clone_from(&h.cookie);
+                state.handshake_recv_sequence = seq;
+                return Ok(Box::new(Flight3 {}) as Box<dyn Flight + Send + Sync>);
+            }
+        }
+
+        let result = if cfg.local_psk_callback.is_some() {
+            cache
+                .full_pull_map(
+                    state.handshake_recv_sequence,
+                    &[
+                        HandshakeCachePullRule {
+                            typ: HandshakeType::ServerHello,
+                            epoch: cfg.initial_epoch,
+                            is_client: false,
+                            optional: false,
+                        },
+                        HandshakeCachePullRule {
+                            typ: HandshakeType::ServerKeyExchange,
+                            epoch: cfg.initial_epoch,
+                            is_client: false,
+                            optional: true,
+                        },
+                        HandshakeCachePullRule {
+                            typ: HandshakeType::ServerHelloDone,
+                            epoch: cfg.initial_epoch,
+                            is_client: false,
+                            optional: false,
+                        },
+                    ],
+                )
+                .await
+        } else {
+            cache
+                .full_pull_map(
+                    state.handshake_recv_sequence,
+                    &[
+                        HandshakeCachePullRule {
+                            typ: HandshakeType::ServerHello,
+                            epoch: cfg.initial_epoch,
+                            is_client: false,
+                            optional: false,
+                        },
+                        HandshakeCachePullRule {
+                            typ: HandshakeType::Certificate,
+                            epoch: cfg.initial_epoch,
+                            is_client: false,
+                            optional: true,
+                        },
+                        HandshakeCachePullRule {
+                            typ: HandshakeType::ServerKeyExchange,
+                            epoch: cfg.initial_epoch,
+                            is_client: false,
+                            optional: false,
+                        },
+                        HandshakeCachePullRule {
+                            typ: HandshakeType::CertificateRequest,
+                            epoch: cfg.initial_epoch,
+                            is_client: false,
+                            optional: true,
+                        },
+                        HandshakeCachePullRule {
+                            typ: HandshakeType::ServerHelloDone,
+                            epoch: cfg.initial_epoch,
+                            is_client: false,
+                            optional: false,
+                        },
+                    ],
+                )
+                .await
+        };
+
+        let (seq, msgs) = match result {
+            Ok((seq, msgs)) => (seq, msgs),
+            Err(_) => return Err((None, None)),
+        };
+
+        state.handshake_recv_sequence = seq;
+
+        if let Some(message) = msgs.get(&HandshakeType::ServerHello) {
+            let h = match message {
+                HandshakeMessage::ServerHello(h) => h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+
+            if h.version != PROTOCOL_VERSION1_2 {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::ProtocolVersion,
+                    }),
+                    Some(Error::ErrUnsupportedProtocolVersion),
+                ));
+            }
+
+            for extension in &h.extensions {
+                match extension {
+                    Extension::UseSrtp(e) => {
+                        let profile = match find_matching_srtp_profile(
+                            &e.protection_profiles,
+                            &cfg.local_srtp_protection_profiles,
+                        ) {
+                            Ok(profile) => profile,
+                            Err(_) => {
+                                return Err((
+                                    Some(Alert {
+                                        alert_level: AlertLevel::Fatal,
+                                        alert_description: AlertDescription::IllegalParameter,
+                                    }),
+                                    Some(Error::ErrClientNoMatchingSrtpProfile),
+                                ))
+                            }
+                        };
+                        state.srtp_protection_profile = profile;
+                    }
+                    Extension::UseExtendedMasterSecret(_) => {
+                        if cfg.extended_master_secret != ExtendedMasterSecretType::Disable {
+                            state.extended_master_secret = true;
+                        }
+                    }
+                    _ => {}
+                };
+            }
+
+            if cfg.extended_master_secret == ExtendedMasterSecretType::Require
+                && !state.extended_master_secret
+            {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InsufficientSecurity,
+                    }),
+                    Some(Error::ErrClientRequiredButNoServerEms),
+                ));
+            }
+            if !cfg.local_srtp_protection_profiles.is_empty()
+                && state.srtp_protection_profile == SrtpProtectionProfile::Unsupported
+            {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InsufficientSecurity,
+                    }),
+                    Some(Error::ErrRequestedButNoSrtpExtension),
+                ));
+            }
+            if find_matching_cipher_suite(&[h.cipher_suite], &cfg.local_cipher_suites).is_err() {
+                debug!(
+                    "[handshake:{}] use cipher suite: {}",
+                    srv_cli_str(state.is_client),
+                    h.cipher_suite
+                );
+
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InsufficientSecurity,
+                    }),
+                    Some(Error::ErrCipherSuiteNoIntersection),
+                ));
+            }
+
+            let cipher_suite = match cipher_suite_for_id(h.cipher_suite) {
+                Ok(cipher_suite) => cipher_suite,
+                Err(_) => {
+                    debug!(
+                        "[handshake:{}] use cipher suite: {}",
+                        srv_cli_str(state.is_client),
+                        h.cipher_suite
+                    );
+
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InsufficientSecurity,
+                        }),
+                        Some(Error::ErrInvalidCipherSuite),
+                    ));
+                }
+            };
+
+            trace!(
+                "[handshake:{}] use cipher suite: {}",
+                srv_cli_str(state.is_client),
+                cipher_suite.to_string()
+            );
+            {
+                let mut cs = state.cipher_suite.lock().await;
+                *cs = Some(cipher_suite);
+            }
+            state.remote_random = h.random.clone();
+        }
+
+        if let Some(message) = msgs.get(&HandshakeType::Certificate) {
+            let h = match message {
+                HandshakeMessage::Certificate(h) => h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+            state.peer_certificates.clone_from(&h.certificate);
+        }
+
+        if let Some(message) = msgs.get(&HandshakeType::ServerKeyExchange) {
+            let h = match message {
+                HandshakeMessage::ServerKeyExchange(h) => h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+
+            if let Err((alert, err)) = handle_server_key_exchange(state, cfg, h).await {
+                return Err((alert, err));
+            }
+        }
+
+        if let Some(message) = msgs.get(&HandshakeType::CertificateRequest) {
+            match message {
+                HandshakeMessage::CertificateRequest(_) => {}
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+            state.remote_requested_certificate = true;
+        }
+
+        Ok(Box::new(Flight5 {}) as Box<dyn Flight + Send + Sync>)
+    }
+
+    async fn generate(
+        &self,
+        state: &mut State,
+        _cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Vec<Packet>, (Option<Alert>, Option<Error>)> {
+        let mut extensions = vec![
+            Extension::SupportedSignatureAlgorithms(ExtensionSupportedSignatureAlgorithms {
+                signature_hash_algorithms: cfg.local_signature_schemes.clone(),
+            }),
+            Extension::RenegotiationInfo(ExtensionRenegotiationInfo {
+                renegotiated_connection: 0,
+            }),
+        ];
+
+        if cfg.local_psk_callback.is_none() {
+            extensions.extend_from_slice(&[
+                Extension::SupportedEllipticCurves(ExtensionSupportedEllipticCurves {
+                    elliptic_curves: vec![NamedCurve::P256, NamedCurve::X25519, NamedCurve::P384],
+                }),
+                Extension::SupportedPointFormats(ExtensionSupportedPointFormats {
+                    point_formats: vec![ELLIPTIC_CURVE_POINT_FORMAT_UNCOMPRESSED],
+                }),
+            ]);
+        }
+
+        if !cfg.local_srtp_protection_profiles.is_empty() {
+            extensions.push(Extension::UseSrtp(ExtensionUseSrtp {
+                protection_profiles: cfg.local_srtp_protection_profiles.clone(),
+            }));
+        }
+
+        if cfg.extended_master_secret == ExtendedMasterSecretType::Request
+            || cfg.extended_master_secret == ExtendedMasterSecretType::Require
+        {
+            extensions.push(Extension::UseExtendedMasterSecret(
+                ExtensionUseExtendedMasterSecret { supported: true },
+            ));
+        }
+
+        if !cfg.server_name.is_empty() {
+            extensions.push(Extension::ServerName(ExtensionServerName {
+                server_name: cfg.server_name.clone(),
+            }));
+        }
+
+        Ok(vec![Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                0,
+                Content::Handshake(Handshake::new(HandshakeMessage::ClientHello(
+                    HandshakeMessageClientHello {
+                        version: PROTOCOL_VERSION1_2,
+                        random: state.local_random.clone(),
+                        cookie: state.cookie.clone(),
+
+                        cipher_suites: cfg.local_cipher_suites.clone(),
+                        compression_methods: default_compression_methods(),
+                        extensions,
+                    },
+                ))),
+            ),
+            should_encrypt: false,
+            reset_local_sequence_number: false,
+        }])
+    }
+}
+
+pub(crate) async fn handle_server_key_exchange(
+    state: &mut State,
+    cfg: &HandshakeConfig,
+    h: &HandshakeMessageServerKeyExchange,
+) -> Result<(), (Option<Alert>, Option<Error>)> {
+    if let Some(local_psk_callback) = &cfg.local_psk_callback {
+        let psk = match local_psk_callback(&h.identity_hint).await {
+            Ok(psk) => psk,
+            Err(err) => {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InternalError,
+                    }),
+                    Some(err),
+                ))
+            }
+        };
+
+        state.identity_hint.clone_from(&h.identity_hint);
+        state.pre_master_secret = prf_psk_pre_master_secret(&psk);
+    } else {
+        let local_keypair = match h.named_curve.generate_keypair() {
+            Ok(local_keypair) => local_keypair,
+            Err(err) => {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InternalError,
+                    }),
+                    Some(err),
+                ))
+            }
+        };
+
+        state.pre_master_secret = match prf_pre_master_secret(
+            &h.public_key,
+            &local_keypair.private_key,
+            local_keypair.curve,
+        ) {
+            Ok(pre_master_secret) => pre_master_secret,
+            Err(err) => {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InternalError,
+                    }),
+                    Some(err),
+                ))
+            }
+        };
+
+        state.local_keypair = Some(local_keypair);
+    }
+
+    Ok(())
+}

libs/dtls/src/flight/flight4.rs

@@ -0,0 +1,853 @@
+use std::fmt;
+use std::io::BufWriter;
+
+use async_trait::async_trait;
+use log::*;
+
+use super::flight6::*;
+use super::*;
+use crate::cipher_suite::*;
+use crate::client_certificate_type::*;
+use crate::compression_methods::*;
+use crate::config::*;
+use crate::content::*;
+use crate::crypto::*;
+use crate::curve::named_curve::*;
+use crate::curve::*;
+use crate::error::Error;
+use crate::extension::extension_supported_elliptic_curves::*;
+use crate::extension::extension_supported_point_formats::*;
+use crate::extension::extension_use_extended_master_secret::*;
+use crate::extension::extension_use_srtp::*;
+use crate::extension::renegotiation_info::ExtensionRenegotiationInfo;
+use crate::extension::*;
+use crate::handshake::handshake_message_certificate::*;
+use crate::handshake::handshake_message_certificate_request::*;
+use crate::handshake::handshake_message_server_hello::*;
+use crate::handshake::handshake_message_server_hello_done::*;
+use crate::handshake::handshake_message_server_key_exchange::*;
+use crate::handshake::*;
+use crate::prf::*;
+use crate::record_layer::record_layer_header::*;
+use crate::record_layer::*;
+use crate::signature_hash_algorithm::*;
+
+#[derive(Debug, PartialEq)]
+pub(crate) struct Flight4;
+
+impl fmt::Display for Flight4 {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Flight 4")
+    }
+}
+
+#[async_trait]
+impl Flight for Flight4 {
+    async fn parse(
+        &self,
+        tx: &mut mpsc::Sender<mpsc::Sender<()>>,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Box<dyn Flight + Send + Sync>, (Option<Alert>, Option<Error>)> {
+        let (seq, msgs) = match cache
+            .full_pull_map(
+                state.handshake_recv_sequence,
+                &[
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: true,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::CertificateVerify,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: true,
+                    },
+                ],
+            )
+            .await
+        {
+            Ok((seq, msgs)) => (seq, msgs),
+            Err(_) => return Err((None, None)),
+        };
+
+        let client_key_exchange = if let Some(HandshakeMessage::ClientKeyExchange(h)) =
+            msgs.get(&HandshakeType::ClientKeyExchange)
+        {
+            h
+        } else {
+            return Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::InternalError,
+                }),
+                None,
+            ));
+        };
+
+        if let Some(message) = msgs.get(&HandshakeType::Certificate) {
+            let h = match message {
+                HandshakeMessage::Certificate(h) => h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+
+            state.peer_certificates.clone_from(&h.certificate);
+            trace!(
+                "[handshake] PeerCertificates4 {}",
+                state.peer_certificates.len()
+            );
+        }
+
+        if let Some(message) = msgs.get(&HandshakeType::CertificateVerify) {
+            let h = match message {
+                HandshakeMessage::CertificateVerify(h) => h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+
+            if state.peer_certificates.is_empty() {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::NoCertificate,
+                    }),
+                    Some(Error::ErrCertificateVerifyNoCertificate),
+                ));
+            }
+
+            let plain_text = cache
+                .pull_and_merge(&[
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::CertificateRequest,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHelloDone,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                ])
+                .await;
+
+            // Verify that the pair of hash algorithm and signature is listed.
+            let mut valid_signature_scheme = false;
+            for ss in &cfg.local_signature_schemes {
+                if ss.hash == h.algorithm.hash && ss.signature == h.algorithm.signature {
+                    valid_signature_scheme = true;
+                    break;
+                }
+            }
+            if !valid_signature_scheme {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InsufficientSecurity,
+                    }),
+                    Some(Error::ErrNoAvailableSignatureSchemes),
+                ));
+            }
+
+            if let Err(err) = verify_certificate_verify(
+                &plain_text,
+                &h.algorithm,
+                &h.signature,
+                &state.peer_certificates,
+                cfg.insecure_verification,
+            ) {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::BadCertificate,
+                    }),
+                    Some(err),
+                ));
+            }
+
+            let mut chains = vec![];
+            let mut verified = false;
+            if cfg.client_auth as u8 >= ClientAuthType::VerifyClientCertIfGiven as u8 {
+                if let Some(client_cert_verifier) = &cfg.client_cert_verifier {
+                    chains =
+                        match verify_client_cert(&state.peer_certificates, client_cert_verifier) {
+                            Ok(chains) => chains,
+                            Err(err) => {
+                                return Err((
+                                    Some(Alert {
+                                        alert_level: AlertLevel::Fatal,
+                                        alert_description: AlertDescription::BadCertificate,
+                                    }),
+                                    Some(err),
+                                ))
+                            }
+                        };
+                } else {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::BadCertificate,
+                        }),
+                        Some(Error::ErrInvalidCertificate),
+                    ));
+                }
+
+                verified = true
+            }
+            if let Some(verify_peer_certificate) = &cfg.verify_peer_certificate {
+                if let Err(err) = verify_peer_certificate(&state.peer_certificates, &chains) {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::BadCertificate,
+                        }),
+                        Some(err),
+                    ));
+                }
+            }
+            state.peer_certificates_verified = verified
+        } else if !state.peer_certificates.is_empty() {
+            // A certificate was received, but we haven't seen a CertificateVerify
+            // keep reading until we receive one
+            return Err((None, None));
+        }
+
+        {
+            let mut cipher_suite = state.cipher_suite.lock().await;
+            if let Some(cipher_suite) = &mut *cipher_suite {
+                if !cipher_suite.is_initialized() {
+                    let mut server_random = vec![];
+                    {
+                        let mut writer = BufWriter::<&mut Vec<u8>>::new(server_random.as_mut());
+                        let _ = state.local_random.marshal(&mut writer);
+                    }
+                    let mut client_random = vec![];
+                    {
+                        let mut writer = BufWriter::<&mut Vec<u8>>::new(client_random.as_mut());
+                        let _ = state.remote_random.marshal(&mut writer);
+                    }
+
+                    let mut pre_master_secret = vec![];
+                    if let Some(local_psk_callback) = &cfg.local_psk_callback {
+                        let psk = match local_psk_callback(&client_key_exchange.identity_hint).await
+                        {
+                            Ok(psk) => psk,
+                            Err(err) => {
+                                return Err((
+                                    Some(Alert {
+                                        alert_level: AlertLevel::Fatal,
+                                        alert_description: AlertDescription::InternalError,
+                                    }),
+                                    Some(err),
+                                ))
+                            }
+                        };
+
+                        state
+                            .identity_hint
+                            .clone_from(&client_key_exchange.identity_hint);
+                        pre_master_secret = prf_psk_pre_master_secret(&psk);
+                    } else if let Some(local_keypair) = &state.local_keypair {
+                        pre_master_secret = match prf_pre_master_secret(
+                            &client_key_exchange.public_key,
+                            &local_keypair.private_key,
+                            local_keypair.curve,
+                        ) {
+                            Ok(pre_master_secret) => pre_master_secret,
+                            Err(err) => {
+                                return Err((
+                                    Some(Alert {
+                                        alert_level: AlertLevel::Fatal,
+                                        alert_description: AlertDescription::IllegalParameter,
+                                    }),
+                                    Some(err),
+                                ))
+                            }
+                        };
+                    }
+
+                    if state.extended_master_secret {
+                        let hf = cipher_suite.hash_func();
+                        let session_hash =
+                            match cache.session_hash(hf, cfg.initial_epoch, &[]).await {
+                                Ok(s) => s,
+                                Err(err) => {
+                                    return Err((
+                                        Some(Alert {
+                                            alert_level: AlertLevel::Fatal,
+                                            alert_description: AlertDescription::InternalError,
+                                        }),
+                                        Some(err),
+                                    ))
+                                }
+                            };
+
+                        state.master_secret = match prf_extended_master_secret(
+                            &pre_master_secret,
+                            &session_hash,
+                            cipher_suite.hash_func(),
+                        ) {
+                            Ok(ms) => ms,
+                            Err(err) => {
+                                return Err((
+                                    Some(Alert {
+                                        alert_level: AlertLevel::Fatal,
+                                        alert_description: AlertDescription::InternalError,
+                                    }),
+                                    Some(err),
+                                ))
+                            }
+                        };
+                    } else {
+                        state.master_secret = match prf_master_secret(
+                            &pre_master_secret,
+                            &client_random,
+                            &server_random,
+                            cipher_suite.hash_func(),
+                        ) {
+                            Ok(ms) => ms,
+                            Err(err) => {
+                                return Err((
+                                    Some(Alert {
+                                        alert_level: AlertLevel::Fatal,
+                                        alert_description: AlertDescription::InternalError,
+                                    }),
+                                    Some(err),
+                                ))
+                            }
+                        };
+                    }
+
+                    if let Err(err) = cipher_suite.init(
+                        &state.master_secret,
+                        &client_random,
+                        &server_random,
+                        false,
+                    ) {
+                        return Err((
+                            Some(Alert {
+                                alert_level: AlertLevel::Fatal,
+                                alert_description: AlertDescription::InternalError,
+                            }),
+                            Some(err),
+                        ));
+                    }
+                }
+            }
+        }
+
+        // Now, encrypted packets can be handled
+        let (done_tx, mut done_rx) = mpsc::channel(1);
+        if let Err(err) = tx.send(done_tx).await {
+            return Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::InternalError,
+                }),
+                Some(Error::Other(err.to_string())),
+            ));
+        }
+
+        done_rx.recv().await;
+
+        let (seq, msgs) = match cache
+            .full_pull_map(
+                seq,
+                &[HandshakeCachePullRule {
+                    typ: HandshakeType::Finished,
+                    epoch: cfg.initial_epoch + 1,
+                    is_client: true,
+                    optional: false,
+                }],
+            )
+            .await
+        {
+            Ok((seq, msgs)) => (seq, msgs),
+            // No valid message received. Keep reading
+            Err(_) => return Err((None, None)),
+        };
+
+        state.handshake_recv_sequence = seq;
+
+        if let Some(HandshakeMessage::Finished(h)) = msgs.get(&HandshakeType::Finished) {
+            h
+        } else {
+            return Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::InternalError,
+                }),
+                None,
+            ));
+        };
+
+        match cfg.client_auth {
+            ClientAuthType::RequireAnyClientCert => {
+                trace!(
+                    "{} peer_certificates.len() {}",
+                    srv_cli_str(state.is_client),
+                    state.peer_certificates.len(),
+                );
+                if state.peer_certificates.is_empty() {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::NoCertificate,
+                        }),
+                        Some(Error::ErrClientCertificateRequired),
+                    ));
+                }
+            }
+            ClientAuthType::VerifyClientCertIfGiven => {
+                if !state.peer_certificates.is_empty() && !state.peer_certificates_verified {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::BadCertificate,
+                        }),
+                        Some(Error::ErrClientCertificateNotVerified),
+                    ));
+                }
+            }
+            ClientAuthType::RequireAndVerifyClientCert => {
+                if state.peer_certificates.is_empty() {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::NoCertificate,
+                        }),
+                        Some(Error::ErrClientCertificateRequired),
+                    ));
+                }
+                if !state.peer_certificates_verified {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::BadCertificate,
+                        }),
+                        Some(Error::ErrClientCertificateNotVerified),
+                    ));
+                }
+            }
+            ClientAuthType::NoClientCert | ClientAuthType::RequestClientCert => {
+                return Ok(Box::new(Flight6 {}) as Box<dyn Flight + Send + Sync>);
+            }
+        }
+
+        Ok(Box::new(Flight6 {}) as Box<dyn Flight + Send + Sync>)
+    }
+
+    async fn generate(
+        &self,
+        state: &mut State,
+        _cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Vec<Packet>, (Option<Alert>, Option<Error>)> {
+        let mut extensions = vec![Extension::RenegotiationInfo(ExtensionRenegotiationInfo {
+            renegotiated_connection: 0,
+        })];
+        if (cfg.extended_master_secret == ExtendedMasterSecretType::Request
+            || cfg.extended_master_secret == ExtendedMasterSecretType::Require)
+            && state.extended_master_secret
+        {
+            extensions.push(Extension::UseExtendedMasterSecret(
+                ExtensionUseExtendedMasterSecret { supported: true },
+            ));
+        }
+
+        if state.srtp_protection_profile != SrtpProtectionProfile::Unsupported {
+            extensions.push(Extension::UseSrtp(ExtensionUseSrtp {
+                protection_profiles: vec![state.srtp_protection_profile],
+            }));
+        }
+
+        if cfg.local_psk_callback.is_none() {
+            extensions.extend_from_slice(&[
+                Extension::SupportedEllipticCurves(ExtensionSupportedEllipticCurves {
+                    elliptic_curves: vec![NamedCurve::P256, NamedCurve::X25519, NamedCurve::P384],
+                }),
+                Extension::SupportedPointFormats(ExtensionSupportedPointFormats {
+                    point_formats: vec![ELLIPTIC_CURVE_POINT_FORMAT_UNCOMPRESSED],
+                }),
+            ]);
+        }
+
+        let mut pkts = vec![Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                0,
+                Content::Handshake(Handshake::new(HandshakeMessage::ServerHello(
+                    HandshakeMessageServerHello {
+                        version: PROTOCOL_VERSION1_2,
+                        random: state.local_random.clone(),
+                        cipher_suite: {
+                            let cipher_suite = state.cipher_suite.lock().await;
+                            if let Some(cipher_suite) = &*cipher_suite {
+                                cipher_suite.id()
+                            } else {
+                                CipherSuiteId::Unsupported
+                            }
+                        },
+                        compression_method: default_compression_methods().ids[0],
+                        extensions,
+                    },
+                ))),
+            ),
+            should_encrypt: false,
+            reset_local_sequence_number: false,
+        }];
+
+        if cfg.local_psk_callback.is_none() {
+            let certificate = match cfg.get_certificate(&cfg.server_name) {
+                Ok(cert) => cert,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::HandshakeFailure,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+
+            pkts.push(Packet {
+                record: RecordLayer::new(
+                    PROTOCOL_VERSION1_2,
+                    0,
+                    Content::Handshake(Handshake::new(HandshakeMessage::Certificate(
+                        HandshakeMessageCertificate {
+                            certificate: certificate
+                                .certificate
+                                .iter()
+                                .map(|x| x.as_ref().to_owned())
+                                .collect(),
+                        },
+                    ))),
+                ),
+                should_encrypt: false,
+                reset_local_sequence_number: false,
+            });
+
+            let mut server_random = vec![];
+            {
+                let mut writer = BufWriter::<&mut Vec<u8>>::new(server_random.as_mut());
+                let _ = state.local_random.marshal(&mut writer);
+            }
+            let mut client_random = vec![];
+            {
+                let mut writer = BufWriter::<&mut Vec<u8>>::new(client_random.as_mut());
+                let _ = state.remote_random.marshal(&mut writer);
+            }
+
+            // Find compatible signature scheme
+            let signature_hash_algo = match select_signature_scheme(
+                &cfg.local_signature_schemes,
+                &certificate.private_key,
+            ) {
+                Ok(s) => s,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InsufficientSecurity,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+
+            if let Some(local_keypair) = &state.local_keypair {
+                let signature = match generate_key_signature(
+                    &client_random,
+                    &server_random,
+                    &local_keypair.public_key,
+                    state.named_curve,
+                    &certificate.private_key, /*, signature_hash_algo.hash*/
+                ) {
+                    Ok(s) => s,
+                    Err(err) => {
+                        return Err((
+                            Some(Alert {
+                                alert_level: AlertLevel::Fatal,
+                                alert_description: AlertDescription::InternalError,
+                            }),
+                            Some(err),
+                        ))
+                    }
+                };
+
+                state.local_key_signature = signature;
+
+                pkts.push(Packet {
+                    record: RecordLayer::new(
+                        PROTOCOL_VERSION1_2,
+                        0,
+                        Content::Handshake(Handshake::new(HandshakeMessage::ServerKeyExchange(
+                            HandshakeMessageServerKeyExchange {
+                                identity_hint: vec![],
+                                elliptic_curve_type: EllipticCurveType::NamedCurve,
+                                named_curve: state.named_curve,
+                                public_key: local_keypair.public_key.clone(),
+                                algorithm: SignatureHashAlgorithm {
+                                    hash: signature_hash_algo.hash,
+                                    signature: signature_hash_algo.signature,
+                                },
+                                signature: state.local_key_signature.clone(),
+                            },
+                        ))),
+                    ),
+                    should_encrypt: false,
+                    reset_local_sequence_number: false,
+                });
+            }
+
+            if cfg.client_auth as u8 > ClientAuthType::NoClientCert as u8 {
+                pkts.push(Packet {
+                    record: RecordLayer::new(
+                        PROTOCOL_VERSION1_2,
+                        0,
+                        Content::Handshake(Handshake::new(HandshakeMessage::CertificateRequest(
+                            HandshakeMessageCertificateRequest {
+                                certificate_types: vec![
+                                    ClientCertificateType::RsaSign,
+                                    ClientCertificateType::EcdsaSign,
+                                ],
+                                signature_hash_algorithms: cfg.local_signature_schemes.clone(),
+                            },
+                        ))),
+                    ),
+                    should_encrypt: false,
+                    reset_local_sequence_number: false,
+                });
+            }
+        } else if let Some(local_psk_identity_hint) = &cfg.local_psk_identity_hint {
+            // To help the client in selecting which identity to use, the server
+            // can provide a "PSK identity hint" in the ServerKeyExchange message.
+            // If no hint is provided, the ServerKeyExchange message is omitted.
+            //
+            // https://tools.ietf.org/html/rfc4279#section-2
+            pkts.push(Packet {
+                record: RecordLayer::new(
+                    PROTOCOL_VERSION1_2,
+                    0,
+                    Content::Handshake(Handshake::new(HandshakeMessage::ServerKeyExchange(
+                        HandshakeMessageServerKeyExchange {
+                            identity_hint: local_psk_identity_hint.clone(),
+                            elliptic_curve_type: EllipticCurveType::Unsupported,
+                            named_curve: NamedCurve::Unsupported,
+                            public_key: vec![],
+                            algorithm: SignatureHashAlgorithm {
+                                hash: HashAlgorithm::Unsupported,
+                                signature: SignatureAlgorithm::Unsupported,
+                            },
+                            signature: vec![],
+                        },
+                    ))),
+                ),
+                should_encrypt: false,
+                reset_local_sequence_number: false,
+            });
+        }
+
+        pkts.push(Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                0,
+                Content::Handshake(Handshake::new(HandshakeMessage::ServerHelloDone(
+                    HandshakeMessageServerHelloDone {},
+                ))),
+            ),
+            should_encrypt: false,
+            reset_local_sequence_number: false,
+        });
+
+        Ok(pkts)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use tokio::sync::Mutex;
+
+    use super::*;
+    use crate::error::Result;
+
+    struct MockCipherSuite {}
+
+    impl CipherSuite for MockCipherSuite {
+        fn to_string(&self) -> String {
+            "MockCipherSuite".into()
+        }
+        fn id(&self) -> CipherSuiteId {
+            unimplemented!();
+        }
+        fn certificate_type(&self) -> ClientCertificateType {
+            unimplemented!();
+        }
+        fn hash_func(&self) -> CipherSuiteHash {
+            unimplemented!();
+        }
+        fn is_psk(&self) -> bool {
+            false
+        }
+        fn is_initialized(&self) -> bool {
+            panic!("is_initialized called with Certificate but not CertificateVerify");
+        }
+
+        // Generate the internal encryption state
+        fn init(
+            &mut self,
+            _master_secret: &[u8],
+            _client_random: &[u8],
+            _server_random: &[u8],
+            _is_client: bool,
+        ) -> Result<()> {
+            unimplemented!();
+        }
+
+        fn encrypt(&self, _pkt_rlh: &RecordLayerHeader, _raw: &[u8]) -> Result<Vec<u8>> {
+            unimplemented!();
+        }
+        fn decrypt(&self, _input: &[u8]) -> Result<Vec<u8>> {
+            unimplemented!();
+        }
+    }
+
+    // Assert that if a client sends a certificate they must also send a `CertificateVerify`
+    // message. The `Flight4` must not interact with the `cipher_suite` if the `CertificateVerify`
+    // is missing.
+    #[tokio::test]
+    async fn test_flight4_process_certificateverify() {
+        let mut state = State {
+            cipher_suite: Arc::new(Mutex::new(Some(Box::new(MockCipherSuite {})))),
+            ..Default::default()
+        };
+
+        let raw_certificate = vec![
+            0x0b, 0x00, 0x01, 0x9b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x9b, 0x00, 0x01,
+            0x98, 0x00, 0x01, 0x95, 0x30, 0x82, 0x01, 0x91, 0x30, 0x82, 0x01, 0x38, 0xa0, 0x03,
+            0x02, 0x01, 0x02, 0x02, 0x11, 0x01, 0x65, 0x03, 0x3f, 0x4d, 0x0b, 0x9a, 0x62, 0x91,
+            0xdb, 0x4d, 0x28, 0x2c, 0x1f, 0xd6, 0x73, 0x32, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86,
+            0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x00, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x32,
+            0x30, 0x35, 0x31, 0x35, 0x31, 0x38, 0x34, 0x33, 0x35, 0x35, 0x5a, 0x17, 0x0d, 0x32,
+            0x32, 0x30, 0x36, 0x31, 0x35, 0x31, 0x38, 0x34, 0x33, 0x35, 0x35, 0x5a, 0x30, 0x00,
+            0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06,
+            0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xc3,
+            0xb7, 0x13, 0x1a, 0x0a, 0xfc, 0xd0, 0x82, 0xf8, 0x94, 0x5e, 0xc0, 0x77, 0x07, 0x81,
+            0x28, 0xc9, 0xcb, 0x08, 0x84, 0x50, 0x6b, 0xf0, 0x22, 0xe8, 0x79, 0xb9, 0x15, 0x33,
+            0xc4, 0x56, 0xa1, 0xd3, 0x1b, 0x24, 0xe3, 0x61, 0xbd, 0x4d, 0x65, 0x80, 0x6b, 0x5d,
+            0x96, 0x48, 0xa2, 0x44, 0x9e, 0xce, 0xe8, 0x65, 0xd6, 0x3c, 0xe0, 0x9b, 0x6b, 0xa1,
+            0x36, 0x34, 0xb2, 0x39, 0xe2, 0x03, 0x00, 0xa3, 0x81, 0x92, 0x30, 0x81, 0x8f, 0x30,
+            0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x02,
+            0xa4, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08,
+            0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
+            0x05, 0x07, 0x03, 0x01, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff,
+            0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
+            0x04, 0x16, 0x04, 0x14, 0xb1, 0x1a, 0xe3, 0xeb, 0x6f, 0x7c, 0xc3, 0x8f, 0xba, 0x6f,
+            0x1c, 0xe8, 0xf0, 0x23, 0x08, 0x50, 0x8d, 0x3c, 0xea, 0x31, 0x30, 0x2e, 0x06, 0x03,
+            0x55, 0x1d, 0x11, 0x01, 0x01, 0xff, 0x04, 0x24, 0x30, 0x22, 0x82, 0x20, 0x30, 0x30,
+            0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30,
+            0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30,
+            0x30, 0x30, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02,
+            0x03, 0x47, 0x00, 0x30, 0x44, 0x02, 0x20, 0x06, 0x31, 0x43, 0xac, 0x03, 0x45, 0x79,
+            0x3c, 0xd7, 0x5f, 0x6e, 0x6a, 0xf8, 0x0e, 0xfd, 0x35, 0x49, 0xee, 0x1b, 0xbc, 0x47,
+            0xce, 0xe3, 0x39, 0xec, 0xe4, 0x62, 0xe1, 0x30, 0x1a, 0xa1, 0x89, 0x02, 0x20, 0x35,
+            0xcd, 0x7a, 0x15, 0x68, 0x09, 0x50, 0x49, 0x9e, 0x3e, 0x05, 0xd7, 0xc2, 0x69, 0x3f,
+            0x9c, 0x0c, 0x98, 0x92, 0x65, 0xec, 0xae, 0x44, 0xfe, 0xe5, 0x68, 0xb8, 0x09, 0x78,
+            0x7f, 0x6b, 0x77,
+        ];
+
+        let raw_client_key_exchange = vec![
+            0x10, 0x00, 0x00, 0x21, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x21, 0x20, 0x96,
+            0xed, 0x0c, 0xee, 0xf3, 0x11, 0xb1, 0x9d, 0x8b, 0x1c, 0x02, 0x7f, 0x06, 0x7c, 0x57,
+            0x7a, 0x14, 0xa6, 0x41, 0xde, 0x63, 0x57, 0x9e, 0xcd, 0x34, 0x54, 0xba, 0x37, 0x4d,
+            0x34, 0x15, 0x18,
+        ];
+
+        let mut cache = HandshakeCache::new();
+        cache
+            .push(raw_certificate, 0, 0, HandshakeType::Certificate, true)
+            .await;
+        cache
+            .push(
+                raw_client_key_exchange,
+                0,
+                1,
+                HandshakeType::ClientKeyExchange,
+                true,
+            )
+            .await;
+
+        let cfg = HandshakeConfig::default();
+
+        let (mut tx, _rx) = mpsc::channel::<mpsc::Sender<()>>(1);
+
+        let f = Flight4 {};
+        let res = f.parse(&mut tx, &mut state, &cache, &cfg).await;
+        assert!(res.is_err());
+    }
+}

libs/dtls/src/flight/flight5.rs

@@ -0,0 +1,779 @@
+use std::fmt;
+use std::io::{BufReader, BufWriter};
+
+use async_trait::async_trait;
+
+use super::flight3::*;
+use super::*;
+use crate::change_cipher_spec::ChangeCipherSpec;
+use crate::content::*;
+use crate::crypto::*;
+use crate::curve::named_curve::*;
+use crate::curve::*;
+use crate::error::Error;
+use crate::handshake::handshake_message_certificate::*;
+use crate::handshake::handshake_message_certificate_verify::*;
+use crate::handshake::handshake_message_client_key_exchange::*;
+use crate::handshake::handshake_message_finished::*;
+use crate::handshake::handshake_message_server_key_exchange::*;
+use crate::handshake::*;
+use crate::prf::*;
+use crate::record_layer::record_layer_header::*;
+use crate::record_layer::*;
+use crate::signature_hash_algorithm::*;
+
+#[derive(Debug, PartialEq)]
+pub(crate) struct Flight5;
+
+impl fmt::Display for Flight5 {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Flight 5")
+    }
+}
+
+#[async_trait]
+impl Flight for Flight5 {
+    fn is_last_recv_flight(&self) -> bool {
+        true
+    }
+
+    async fn parse(
+        &self,
+        _tx: &mut mpsc::Sender<mpsc::Sender<()>>,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Box<dyn Flight + Send + Sync>, (Option<Alert>, Option<Error>)> {
+        let (_seq, msgs) = match cache
+            .full_pull_map(
+                state.handshake_recv_sequence,
+                &[HandshakeCachePullRule {
+                    typ: HandshakeType::Finished,
+                    epoch: cfg.initial_epoch + 1,
+                    is_client: false,
+                    optional: false,
+                }],
+            )
+            .await
+        {
+            Ok((seq, msgs)) => (seq, msgs),
+            Err(_) => return Err((None, None)),
+        };
+
+        let finished =
+            if let Some(HandshakeMessage::Finished(h)) = msgs.get(&HandshakeType::Finished) {
+                h
+            } else {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::InternalError,
+                    }),
+                    None,
+                ));
+            };
+
+        let plain_text = cache
+            .pull_and_merge(&[
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ClientHello,
+                    epoch: cfg.initial_epoch,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ServerHello,
+                    epoch: cfg.initial_epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::Certificate,
+                    epoch: cfg.initial_epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ServerKeyExchange,
+                    epoch: cfg.initial_epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::CertificateRequest,
+                    epoch: cfg.initial_epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ServerHelloDone,
+                    epoch: cfg.initial_epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::Certificate,
+                    epoch: cfg.initial_epoch,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ClientKeyExchange,
+                    epoch: cfg.initial_epoch,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::CertificateVerify,
+                    epoch: cfg.initial_epoch,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::Finished,
+                    epoch: cfg.initial_epoch + 1,
+                    is_client: true,
+                    optional: false,
+                },
+            ])
+            .await;
+
+        {
+            let cipher_suite = state.cipher_suite.lock().await;
+            if let Some(cipher_suite) = &*cipher_suite {
+                let expected_verify_data = match prf_verify_data_server(
+                    &state.master_secret,
+                    &plain_text,
+                    cipher_suite.hash_func(),
+                ) {
+                    Ok(d) => d,
+                    Err(err) => {
+                        return Err((
+                            Some(Alert {
+                                alert_level: AlertLevel::Fatal,
+                                alert_description: AlertDescription::InsufficientSecurity,
+                            }),
+                            Some(err),
+                        ))
+                    }
+                };
+
+                if expected_verify_data != finished.verify_data {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::HandshakeFailure,
+                        }),
+                        Some(Error::ErrVerifyDataMismatch),
+                    ));
+                }
+            }
+        }
+
+        Ok(Box::new(Flight5 {}))
+    }
+
+    async fn generate(
+        &self,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Vec<Packet>, (Option<Alert>, Option<Error>)> {
+        let certificate = if !cfg.local_certificates.is_empty() {
+            let cert = match cfg.get_certificate(&cfg.server_name) {
+                Ok(cert) => cert,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::HandshakeFailure,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+            Some(cert)
+        } else {
+            None
+        };
+
+        let mut pkts = vec![];
+
+        if state.remote_requested_certificate {
+            pkts.push(Packet {
+                record: RecordLayer::new(
+                    PROTOCOL_VERSION1_2,
+                    0,
+                    Content::Handshake(Handshake::new(HandshakeMessage::Certificate(
+                        HandshakeMessageCertificate {
+                            certificate: if let Some(cert) = &certificate {
+                                cert.certificate
+                                    .iter()
+                                    .map(|x| x.as_ref().to_owned())
+                                    .collect()
+                            } else {
+                                vec![]
+                            },
+                        },
+                    ))),
+                ),
+                should_encrypt: false,
+                reset_local_sequence_number: false,
+            });
+        }
+
+        let mut client_key_exchange = HandshakeMessageClientKeyExchange {
+            identity_hint: vec![],
+            public_key: vec![],
+        };
+        if cfg.local_psk_callback.is_none() {
+            if let Some(local_keypair) = &state.local_keypair {
+                client_key_exchange
+                    .public_key
+                    .clone_from(&local_keypair.public_key);
+            }
+        } else if let Some(local_psk_identity_hint) = &cfg.local_psk_identity_hint {
+            client_key_exchange
+                .identity_hint
+                .clone_from(local_psk_identity_hint);
+        }
+
+        pkts.push(Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                0,
+                Content::Handshake(Handshake::new(HandshakeMessage::ClientKeyExchange(
+                    client_key_exchange,
+                ))),
+            ),
+            should_encrypt: false,
+            reset_local_sequence_number: false,
+        });
+
+        let server_key_exchange_data = cache
+            .pull_and_merge(&[HandshakeCachePullRule {
+                typ: HandshakeType::ServerKeyExchange,
+                epoch: cfg.initial_epoch,
+                is_client: false,
+                optional: false,
+            }])
+            .await;
+
+        let mut server_key_exchange = HandshakeMessageServerKeyExchange {
+            identity_hint: vec![],
+            elliptic_curve_type: EllipticCurveType::Unsupported,
+            named_curve: NamedCurve::Unsupported,
+            public_key: vec![],
+            algorithm: SignatureHashAlgorithm {
+                hash: HashAlgorithm::Unsupported,
+                signature: SignatureAlgorithm::Unsupported,
+            },
+            signature: vec![],
+        };
+
+        // handshakeMessageServerKeyExchange is optional for PSK
+        if server_key_exchange_data.is_empty() {
+            if let Err((alert, err)) =
+                handle_server_key_exchange(state, cfg, &server_key_exchange).await
+            {
+                return Err((alert, err));
+            }
+        } else {
+            let mut reader = BufReader::new(server_key_exchange_data.as_slice());
+            let raw_handshake = match Handshake::unmarshal(&mut reader) {
+                Ok(h) => h,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::UnexpectedMessage,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+
+            match raw_handshake.handshake_message {
+                HandshakeMessage::ServerKeyExchange(h) => server_key_exchange = h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::UnexpectedMessage,
+                        }),
+                        Some(Error::ErrInvalidContentType),
+                    ))
+                }
+            };
+        }
+
+        // Append not-yet-sent packets
+        let mut merged = vec![];
+        let mut seq_pred = state.handshake_send_sequence as u16;
+        for p in &mut pkts {
+            let h = match &mut p.record.content {
+                Content::Handshake(h) => h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        Some(Error::ErrInvalidContentType),
+                    ))
+                }
+            };
+            h.handshake_header.message_sequence = seq_pred;
+            seq_pred += 1;
+
+            let mut raw = vec![];
+            {
+                let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+                if let Err(err) = h.marshal(&mut writer) {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        Some(err),
+                    ));
+                }
+            }
+
+            merged.extend_from_slice(&raw);
+        }
+
+        if let Err((alert, err)) =
+            initialize_cipher_suite(state, cache, cfg, &server_key_exchange, &merged).await
+        {
+            return Err((alert, err));
+        }
+
+        // If the client has sent a certificate with signing ability, a digitally-signed
+        // CertificateVerify message is sent to explicitly verify possession of the
+        // private key in the certificate.
+        if state.remote_requested_certificate && !cfg.local_certificates.is_empty() {
+            let mut plain_text = cache
+                .pull_and_merge(&[
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::CertificateRequest,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHelloDone,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                ])
+                .await;
+
+            plain_text.extend_from_slice(&merged);
+
+            // Find compatible signature scheme
+            let signature_hash_algo = match select_signature_scheme(
+                &cfg.local_signature_schemes,
+                &certificate.as_ref().unwrap().private_key,
+            ) {
+                Ok(s) => s,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InsufficientSecurity,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+
+            let cert_verify = match generate_certificate_verify(
+                &plain_text,
+                &certificate.as_ref().unwrap().private_key, /*, signature_hash_algo.hash*/
+            ) {
+                Ok(cert) => cert,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+            state.local_certificates_verify = cert_verify;
+
+            let mut p = Packet {
+                record: RecordLayer::new(
+                    PROTOCOL_VERSION1_2,
+                    0,
+                    Content::Handshake(Handshake::new(HandshakeMessage::CertificateVerify(
+                        HandshakeMessageCertificateVerify {
+                            algorithm: signature_hash_algo,
+                            signature: state.local_certificates_verify.clone(),
+                        },
+                    ))),
+                ),
+                should_encrypt: false,
+                reset_local_sequence_number: false,
+            };
+
+            let h = match &mut p.record.content {
+                Content::Handshake(h) => h,
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        Some(Error::ErrInvalidContentType),
+                    ))
+                }
+            };
+            h.handshake_header.message_sequence = seq_pred;
+
+            // seqPred++ // this is the last use of seqPred
+
+            let mut raw = vec![];
+            {
+                let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+                if let Err(err) = h.marshal(&mut writer) {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        Some(err),
+                    ));
+                }
+            }
+            merged.extend_from_slice(&raw);
+
+            pkts.push(p);
+        }
+
+        pkts.push(Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                0,
+                Content::ChangeCipherSpec(ChangeCipherSpec {}),
+            ),
+            should_encrypt: false,
+            reset_local_sequence_number: false,
+        });
+
+        if state.local_verify_data.is_empty() {
+            let mut plain_text = cache
+                .pull_and_merge(&[
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::CertificateRequest,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHelloDone,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::CertificateVerify,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Finished,
+                        epoch: cfg.initial_epoch + 1,
+                        is_client: true,
+                        optional: false,
+                    },
+                ])
+                .await;
+
+            plain_text.extend_from_slice(&merged);
+
+            let cipher_suite = state.cipher_suite.lock().await;
+            if let Some(cipher_suite) = &*cipher_suite {
+                state.local_verify_data = match prf_verify_data_client(
+                    &state.master_secret,
+                    &plain_text,
+                    cipher_suite.hash_func(),
+                ) {
+                    Ok(data) => data,
+                    Err(err) => {
+                        return Err((
+                            Some(Alert {
+                                alert_level: AlertLevel::Fatal,
+                                alert_description: AlertDescription::InternalError,
+                            }),
+                            Some(err),
+                        ))
+                    }
+                };
+            }
+        }
+
+        pkts.push(Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                1,
+                Content::Handshake(Handshake::new(HandshakeMessage::Finished(
+                    HandshakeMessageFinished {
+                        verify_data: state.local_verify_data.clone(),
+                    },
+                ))),
+            ),
+            should_encrypt: true,
+            reset_local_sequence_number: true,
+        });
+
+        Ok(pkts)
+    }
+}
+async fn initialize_cipher_suite(
+    state: &mut State,
+    cache: &HandshakeCache,
+    cfg: &HandshakeConfig,
+    h: &HandshakeMessageServerKeyExchange,
+    sending_plain_text: &[u8],
+) -> Result<(), (Option<Alert>, Option<Error>)> {
+    let mut cipher_suite = state.cipher_suite.lock().await;
+
+    if let Some(cipher_suite) = &*cipher_suite {
+        if cipher_suite.is_initialized() {
+            return Ok(());
+        }
+    }
+
+    let mut client_random = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(client_random.as_mut());
+        let _ = state.local_random.marshal(&mut writer);
+    }
+    let mut server_random = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(server_random.as_mut());
+        let _ = state.remote_random.marshal(&mut writer);
+    }
+
+    if let Some(cipher_suite) = &*cipher_suite {
+        if state.extended_master_secret {
+            let session_hash = match cache
+                .session_hash(
+                    cipher_suite.hash_func(),
+                    cfg.initial_epoch,
+                    sending_plain_text,
+                )
+                .await
+            {
+                Ok(s) => s,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+
+            state.master_secret = match prf_extended_master_secret(
+                &state.pre_master_secret,
+                &session_hash,
+                cipher_suite.hash_func(),
+            ) {
+                Ok(m) => m,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::IllegalParameter,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+        } else {
+            state.master_secret = match prf_master_secret(
+                &state.pre_master_secret,
+                &client_random,
+                &server_random,
+                cipher_suite.hash_func(),
+            ) {
+                Ok(m) => m,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        Some(err),
+                    ))
+                }
+            };
+        }
+    }
+
+    if cfg.local_psk_callback.is_none() {
+        // Verify that the pair of hash algorithm and signiture is listed.
+        let mut valid_signature_scheme = false;
+        for ss in &cfg.local_signature_schemes {
+            if ss.hash == h.algorithm.hash && ss.signature == h.algorithm.signature {
+                valid_signature_scheme = true;
+                break;
+            }
+        }
+        if !valid_signature_scheme {
+            return Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::InsufficientSecurity,
+                }),
+                Some(Error::ErrNoAvailableSignatureSchemes),
+            ));
+        }
+
+        let expected_msg =
+            value_key_message(&client_random, &server_random, &h.public_key, h.named_curve);
+        if let Err(err) = verify_key_signature(
+            &expected_msg,
+            &h.algorithm,
+            &h.signature,
+            &state.peer_certificates,
+            cfg.insecure_verification,
+        ) {
+            return Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::BadCertificate,
+                }),
+                Some(err),
+            ));
+        }
+
+        let mut chains = vec![];
+        if !cfg.insecure_skip_verify {
+            chains = match verify_server_cert(
+                &state.peer_certificates,
+                &cfg.server_cert_verifier,
+                &cfg.server_name,
+            ) {
+                Ok(chains) => chains,
+                Err(err) => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::BadCertificate,
+                        }),
+                        Some(err),
+                    ))
+                }
+            }
+        }
+        if let Some(verify_peer_certificate) = &cfg.verify_peer_certificate {
+            if let Err(err) = verify_peer_certificate(&state.peer_certificates, &chains) {
+                return Err((
+                    Some(Alert {
+                        alert_level: AlertLevel::Fatal,
+                        alert_description: AlertDescription::BadCertificate,
+                    }),
+                    Some(err),
+                ));
+            }
+        }
+    }
+
+    if let Some(cipher_suite) = &mut *cipher_suite {
+        if let Err(err) =
+            cipher_suite.init(&state.master_secret, &client_random, &server_random, true)
+        {
+            return Err((
+                Some(Alert {
+                    alert_level: AlertLevel::Fatal,
+                    alert_description: AlertDescription::InternalError,
+                }),
+                Some(err),
+            ));
+        }
+    }
+
+    Ok(())
+}

libs/dtls/src/flight/flight6.rs

@@ -0,0 +1,190 @@
+use std::fmt;
+
+use async_trait::async_trait;
+
+use super::*;
+use crate::change_cipher_spec::*;
+use crate::content::*;
+use crate::handshake::handshake_message_finished::*;
+use crate::handshake::*;
+use crate::prf::*;
+use crate::record_layer::record_layer_header::*;
+
+#[derive(Debug, PartialEq)]
+pub(crate) struct Flight6;
+
+impl fmt::Display for Flight6 {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Flight 6")
+    }
+}
+
+#[async_trait]
+impl Flight for Flight6 {
+    fn is_last_send_flight(&self) -> bool {
+        true
+    }
+
+    async fn parse(
+        &self,
+        _tx: &mut mpsc::Sender<mpsc::Sender<()>>,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Box<dyn Flight + Send + Sync>, (Option<Alert>, Option<Error>)> {
+        let (_, msgs) = match cache
+            .full_pull_map(
+                state.handshake_recv_sequence - 1,
+                &[HandshakeCachePullRule {
+                    typ: HandshakeType::Finished,
+                    epoch: cfg.initial_epoch + 1,
+                    is_client: true,
+                    optional: false,
+                }],
+            )
+            .await
+        {
+            Ok((seq, msgs)) => (seq, msgs),
+            // No valid message received. Keep reading
+            Err(_) => return Err((None, None)),
+        };
+
+        if let Some(message) = msgs.get(&HandshakeType::Finished) {
+            match message {
+                HandshakeMessage::Finished(_) => {}
+                _ => {
+                    return Err((
+                        Some(Alert {
+                            alert_level: AlertLevel::Fatal,
+                            alert_description: AlertDescription::InternalError,
+                        }),
+                        None,
+                    ))
+                }
+            };
+        }
+
+        // Other party retransmitted the last flight.
+        Ok(Box::new(Flight6 {}))
+    }
+
+    async fn generate(
+        &self,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Vec<Packet>, (Option<Alert>, Option<Error>)> {
+        let mut pkts = vec![Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                0,
+                Content::ChangeCipherSpec(ChangeCipherSpec {}),
+            ),
+            should_encrypt: false,
+            reset_local_sequence_number: false,
+        }];
+
+        if state.local_verify_data.is_empty() {
+            let plain_text = cache
+                .pull_and_merge(&[
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHello,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::CertificateRequest,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ServerHelloDone,
+                        epoch: cfg.initial_epoch,
+                        is_client: false,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Certificate,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::ClientKeyExchange,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::CertificateVerify,
+                        epoch: cfg.initial_epoch,
+                        is_client: true,
+                        optional: false,
+                    },
+                    HandshakeCachePullRule {
+                        typ: HandshakeType::Finished,
+                        epoch: cfg.initial_epoch + 1,
+                        is_client: true,
+                        optional: false,
+                    },
+                ])
+                .await;
+
+            let cipher_suite = state.cipher_suite.lock().await;
+            if let Some(cipher_suite) = &*cipher_suite {
+                state.local_verify_data = match prf_verify_data_server(
+                    &state.master_secret,
+                    &plain_text,
+                    cipher_suite.hash_func(),
+                ) {
+                    Ok(data) => data,
+                    Err(err) => {
+                        return Err((
+                            Some(Alert {
+                                alert_level: AlertLevel::Fatal,
+                                alert_description: AlertDescription::InternalError,
+                            }),
+                            Some(err),
+                        ))
+                    }
+                };
+            }
+        }
+
+        pkts.push(Packet {
+            record: RecordLayer::new(
+                PROTOCOL_VERSION1_2,
+                1,
+                Content::Handshake(Handshake::new(HandshakeMessage::Finished(
+                    HandshakeMessageFinished {
+                        verify_data: state.local_verify_data.clone(),
+                    },
+                ))),
+            ),
+            should_encrypt: true,
+            reset_local_sequence_number: true,
+        });
+
+        Ok(pkts)
+    }
+}

libs/dtls/src/flight/mod.rs

@@ -0,0 +1,87 @@
+pub(crate) mod flight0;
+pub(crate) mod flight1;
+pub(crate) mod flight2;
+pub(crate) mod flight3;
+pub(crate) mod flight4;
+pub(crate) mod flight5;
+pub(crate) mod flight6;
+
+use std::fmt;
+
+use async_trait::async_trait;
+use tokio::sync::mpsc;
+
+use crate::alert::*;
+use crate::error::Error;
+use crate::handshake::handshake_cache::*;
+use crate::handshaker::*;
+use crate::record_layer::*;
+use crate::state::*;
+
+/*
+  DTLS messages are grouped into a series of message flights, according
+  to the diagrams below.  Although each Flight of messages may consist
+  of a number of messages, they should be viewed as monolithic for the
+  purpose of timeout and retransmission.
+  https://tools.ietf.org/html/rfc4347#section-4.2.4
+  Client                                          Server
+  ------                                          ------
+                                      Waiting                 Flight 0
+
+  ClientHello             -------->                           Flight 1
+
+                          <-------    HelloVerifyRequest      Flight 2
+
+  ClientHello              -------->                           Flight 3
+
+                                             ServerHello    \
+                                            Certificate*     \
+                                      ServerKeyExchange*      Flight 4
+                                     CertificateRequest*     /
+                          <--------      ServerHelloDone    /
+
+  Certificate*                                              \
+  ClientKeyExchange                                          \
+  CertificateVerify*                                          Flight 5
+  [ChangeCipherSpec]                                         /
+  Finished                -------->                         /
+
+                                      [ChangeCipherSpec]    \ Flight 6
+                          <--------             Finished    /
+
+*/
+
+#[derive(Clone, Debug)]
+pub(crate) struct Packet {
+    pub(crate) record: RecordLayer,
+    pub(crate) should_encrypt: bool,
+    pub(crate) reset_local_sequence_number: bool,
+}
+
+#[async_trait]
+pub(crate) trait Flight: fmt::Display + fmt::Debug {
+    fn is_last_send_flight(&self) -> bool {
+        false
+    }
+    fn is_last_recv_flight(&self) -> bool {
+        false
+    }
+    fn has_retransmit(&self) -> bool {
+        true
+    }
+
+    async fn parse(
+        &self,
+        tx: &mut mpsc::Sender<mpsc::Sender<()>>,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Box<dyn Flight + Send + Sync>, (Option<Alert>, Option<Error>)>;
+
+    async fn generate(
+        &self,
+        state: &mut State,
+        cache: &HandshakeCache,
+        cfg: &HandshakeConfig,
+    ) -> Result<Vec<Packet>, (Option<Alert>, Option<Error>)>;
+}

libs/dtls/src/fragment_buffer/fragment_buffer_test.rs

@@ -0,0 +1,174 @@
+use super::*;
+
+#[test]
+fn test_fragment_buffer() -> Result<()> {
+    let tests = vec![
+        (
+            "Single Fragment",
+            vec![vec![
+                0x16, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x03,
+                0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xfe, 0xff, 0x00,
+            ]],
+            vec![vec![
+                0x03, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xfe, 0xff,
+                0x00,
+            ]],
+            0,
+        ),
+        (
+            "Single Fragment Epoch 3",
+            vec![vec![
+                0x16, 0xfe, 0xff, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x03,
+                0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xfe, 0xff, 0x00,
+            ]],
+            vec![vec![
+                0x03, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xfe, 0xff,
+                0x00,
+            ]],
+            3,
+        ),
+        (
+            "Multiple Fragments",
+            vec![
+                vec![
+                    0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x81,
+                    0x0b, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,
+                    0x01, 0x02, 0x03, 0x04,
+                ],
+                vec![
+                    0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x81,
+                    0x0b, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x05, 0x05,
+                    0x06, 0x07, 0x08, 0x09,
+                ],
+                vec![
+                    0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x81,
+                    0x0b, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x05, 0x0A,
+                    0x0B, 0x0C, 0x0D, 0x0E,
+                ],
+            ],
+            vec![vec![
+                0x0b, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x01,
+                0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e,
+            ]],
+            0,
+        ),
+        (
+            "Multiple Unordered Fragments",
+            vec![
+                vec![
+                    0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x81,
+                    0x0b, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,
+                    0x01, 0x02, 0x03, 0x04,
+                ],
+                vec![
+                    0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x81,
+                    0x0b, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x05, 0x0A,
+                    0x0B, 0x0C, 0x0D, 0x0E,
+                ],
+                vec![
+                    0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x81,
+                    0x0b, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x05, 0x05,
+                    0x06, 0x07, 0x08, 0x09,
+                ],
+            ],
+            vec![vec![
+                0x0b, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x01,
+                0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e,
+            ]],
+            0,
+        ),
+        (
+            "Multiple Handshakes in Single Fragment",
+            vec![vec![
+                0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+                0x30, /* record header */
+                0x03, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xfe, 0xff,
+                0x01, 0x01, /*handshake msg 1*/
+                0x03, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xfe, 0xff,
+                0x01, 0x01, /*handshake msg 2*/
+                0x03, 0x00, 0x00, 0x04, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xfe, 0xff,
+                0x01, 0x01, /*handshake msg 3*/
+            ]],
+            vec![
+                vec![
+                    0x03, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xfe,
+                    0xff, 0x01, 0x01,
+                ],
+                vec![
+                    0x03, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xfe,
+                    0xff, 0x01, 0x01,
+                ],
+                vec![
+                    0x03, 0x00, 0x00, 0x04, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xfe,
+                    0xff, 0x01, 0x01,
+                ],
+            ],
+            0,
+        ),
+        // Ensure zero length fragments don't cause an infinite recursive loop which in turn causes
+        // a stack overflow.
+        (
+            "Zero length fragment",
+            vec![vec![
+                0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00,
+                0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            ]],
+            vec![vec![
+                0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+            ]],
+            0,
+        ),
+    ];
+
+    for (name, inputs, expects, expected_epoch) in tests {
+        let mut fragment_buffer = FragmentBuffer::new();
+        for frag in inputs {
+            let status = fragment_buffer.push(&frag)?;
+            assert!(
+                status,
+                "fragment_buffer didn't accept fragments for '{name}'"
+            );
+        }
+
+        for expected in expects {
+            let (out, epoch) = fragment_buffer.pop()?;
+            assert_eq!(
+                out, expected,
+                "fragment_buffer '{name}' push/pop: got {out:?}, want {expected:?}"
+            );
+
+            assert_eq!(
+                epoch, expected_epoch,
+                "fragment_buffer returned wrong epoch: got {epoch}, want {expected_epoch}"
+            );
+        }
+
+        let result = fragment_buffer.pop();
+        assert!(
+            result.is_err(),
+            "fragment_buffer popped single buffer multiple times for '{name}'"
+        );
+    }
+
+    Ok(())
+}
+
+#[test]
+fn test_fragment_buffer_overflow() -> Result<()> {
+    let mut fragment_buffer = FragmentBuffer::new();
+
+    fragment_buffer.push(&[
+        0x16, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x03, 0x00,
+        0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xfe, 0xff, 0x00,
+    ])?;
+
+    let big_buffer = vec![0; 2_000_000];
+    let result = fragment_buffer.push(&big_buffer);
+
+    assert!(
+        result.is_err(),
+        "Pushing a buffer of size 2MB should have caused FragmentBuffer::push to return an error"
+    );
+
+    Ok(())
+}

libs/dtls/src/fragment_buffer/mod.rs

@@ -0,0 +1,160 @@
+#[cfg(test)]
+mod fragment_buffer_test;
+
+use std::collections::HashMap;
+use std::io::{BufWriter, Cursor};
+
+use crate::content::*;
+use crate::error::*;
+use crate::handshake::handshake_header::*;
+use crate::record_layer::record_layer_header::*;
+
+// 2 mb max buffer size
+const FRAGMENT_BUFFER_MAX_SIZE: usize = 2_000_000;
+
+pub(crate) struct Fragment {
+    record_layer_header: RecordLayerHeader,
+    handshake_header: HandshakeHeader,
+    data: Vec<u8>,
+}
+
+pub(crate) struct FragmentBuffer {
+    // map of MessageSequenceNumbers that hold slices of fragments
+    cache: HashMap<u16, Vec<Fragment>>,
+
+    current_message_sequence_number: u16,
+}
+
+impl FragmentBuffer {
+    pub fn new() -> Self {
+        FragmentBuffer {
+            cache: HashMap::new(),
+            current_message_sequence_number: 0,
+        }
+    }
+
+    // Attempts to push a DTLS packet to the FragmentBuffer
+    // when it returns true it means the FragmentBuffer has inserted and the buffer shouldn't be handled
+    // when an error returns it is fatal, and the DTLS connection should be stopped
+    pub fn push(&mut self, mut buf: &[u8]) -> Result<bool> {
+        let current_size = self.size();
+        if current_size + buf.len() >= FRAGMENT_BUFFER_MAX_SIZE {
+            return Err(Error::ErrFragmentBufferOverflow {
+                new_size: current_size + buf.len(),
+                max_size: FRAGMENT_BUFFER_MAX_SIZE,
+            });
+        }
+
+        let mut reader = Cursor::new(buf);
+        let record_layer_header = RecordLayerHeader::unmarshal(&mut reader)?;
+
+        // Fragment isn't a handshake, we don't need to handle it
+        if record_layer_header.content_type != ContentType::Handshake {
+            return Ok(false);
+        }
+
+        buf = &buf[RECORD_LAYER_HEADER_SIZE..];
+        while !buf.is_empty() {
+            let mut reader = Cursor::new(buf);
+            let handshake_header = HandshakeHeader::unmarshal(&mut reader)?;
+
+            self.cache
+                .entry(handshake_header.message_sequence)
+                .or_default();
+
+            // end index should be the length of handshake header but if the handshake
+            // was fragmented, we should keep them all
+            let mut end = HANDSHAKE_HEADER_LENGTH + handshake_header.length as usize;
+            if end > buf.len() {
+                end = buf.len();
+            }
+
+            // Discard all headers, when rebuilding the packet we will re-build
+            let data = buf[HANDSHAKE_HEADER_LENGTH..end].to_vec();
+
+            if let Some(x) = self.cache.get_mut(&handshake_header.message_sequence) {
+                x.push(Fragment {
+                    record_layer_header,
+                    handshake_header,
+                    data,
+                });
+            }
+            buf = &buf[end..];
+        }
+
+        Ok(true)
+    }
+
+    pub fn pop(&mut self) -> Result<(Vec<u8>, u16)> {
+        let seq_num = self.current_message_sequence_number;
+        if !self.cache.contains_key(&seq_num) {
+            return Err(Error::ErrEmptyFragment);
+        }
+
+        let (content, epoch) = if let Some(frags) = self.cache.get_mut(&seq_num) {
+            let mut raw_message = vec![];
+            // Recursively collect up
+            if !append_message(0, frags, &mut raw_message) {
+                return Err(Error::ErrEmptyFragment);
+            }
+
+            let mut first_header = frags[0].handshake_header;
+            first_header.fragment_offset = 0;
+            first_header.fragment_length = first_header.length;
+
+            let mut raw_header = vec![];
+            {
+                let mut writer = BufWriter::<&mut Vec<u8>>::new(raw_header.as_mut());
+                if first_header.marshal(&mut writer).is_err() {
+                    return Err(Error::ErrEmptyFragment);
+                }
+            }
+
+            let message_epoch = frags[0].record_layer_header.epoch;
+
+            raw_header.extend_from_slice(&raw_message);
+
+            (raw_header, message_epoch)
+        } else {
+            return Err(Error::ErrEmptyFragment);
+        };
+
+        self.cache.remove(&seq_num);
+        self.current_message_sequence_number += 1;
+
+        Ok((content, epoch))
+    }
+
+    fn size(&self) -> usize {
+        self.cache
+            .values()
+            .map(|fragment| fragment.iter().map(|f| f.data.len()).sum::<usize>())
+            .sum()
+    }
+}
+
+fn append_message(target_offset: u32, frags: &[Fragment], raw_message: &mut Vec<u8>) -> bool {
+    for f in frags {
+        if f.handshake_header.fragment_offset == target_offset {
+            let fragment_end =
+                f.handshake_header.fragment_offset + f.handshake_header.fragment_length;
+
+            // NB: Order here is important, the `f.handshake_header.fragment_length != 0`
+            // MUST come before the recursive call.
+            if fragment_end != f.handshake_header.length
+                && f.handshake_header.fragment_length != 0
+                && !append_message(fragment_end, frags, raw_message)
+            {
+                return false;
+            }
+
+            let mut message = vec![];
+            message.extend_from_slice(&f.data);
+            message.extend_from_slice(raw_message);
+            *raw_message = message;
+            return true;
+        }
+    }
+
+    false
+}

libs/dtls/src/handshake/handshake_cache.rs

@@ -0,0 +1,241 @@
+#[cfg(test)]
+mod handshake_cache_test;
+
+use std::collections::HashMap;
+use std::io::BufReader;
+use std::sync::Arc;
+
+use sha2::{Digest, Sha256};
+use tokio::sync::Mutex;
+
+use crate::cipher_suite::*;
+use crate::handshake::*;
+
+#[derive(Clone, Debug)]
+pub(crate) struct HandshakeCacheItem {
+    typ: HandshakeType,
+    is_client: bool,
+    epoch: u16,
+    message_sequence: u16,
+    data: Vec<u8>,
+}
+
+#[derive(Copy, Clone, Debug)]
+pub(crate) struct HandshakeCachePullRule {
+    pub(crate) typ: HandshakeType,
+    pub(crate) epoch: u16,
+    pub(crate) is_client: bool,
+    pub(crate) optional: bool,
+}
+
+#[derive(Clone)]
+pub(crate) struct HandshakeCache {
+    cache: Arc<Mutex<Vec<HandshakeCacheItem>>>,
+}
+
+impl HandshakeCache {
+    pub(crate) fn new() -> Self {
+        HandshakeCache {
+            cache: Arc::new(Mutex::new(vec![])),
+        }
+    }
+
+    pub(crate) async fn push(
+        &mut self,
+        data: Vec<u8>,
+        epoch: u16,
+        message_sequence: u16,
+        typ: HandshakeType,
+        is_client: bool,
+    ) -> bool {
+        let mut cache = self.cache.lock().await;
+
+        for i in &*cache {
+            if i.message_sequence == message_sequence && i.is_client == is_client {
+                return false;
+            }
+        }
+
+        cache.push(HandshakeCacheItem {
+            typ,
+            is_client,
+            epoch,
+            message_sequence,
+            data,
+        });
+
+        true
+    }
+
+    // returns a list handshakes that match the requested rules
+    // the list will contain null entries for rules that can't be satisfied
+    // multiple entries may match a rule, but only the last match is returned (ie ClientHello with cookies)
+    pub(crate) async fn pull(&self, rules: &[HandshakeCachePullRule]) -> Vec<HandshakeCacheItem> {
+        let cache = self.cache.lock().await;
+
+        let mut out = vec![];
+        for r in rules {
+            let mut item: Option<HandshakeCacheItem> = None;
+            for c in &*cache {
+                if c.typ == r.typ && c.is_client == r.is_client && c.epoch == r.epoch {
+                    if let Some(x) = &item {
+                        if x.message_sequence < c.message_sequence {
+                            item = Some(c.clone());
+                        }
+                    } else {
+                        item = Some(c.clone());
+                    }
+                }
+            }
+
+            if let Some(c) = item {
+                out.push(c);
+            }
+        }
+
+        out
+    }
+
+    // full_pull_map pulls all handshakes between rules[0] to rules[len(rules)-1] as map.
+    pub(crate) async fn full_pull_map(
+        &self,
+        start_seq: isize,
+        rules: &[HandshakeCachePullRule],
+    ) -> Result<(isize, HashMap<HandshakeType, HandshakeMessage>)> {
+        let cache = self.cache.lock().await;
+
+        let mut ci = HashMap::new();
+        for r in rules {
+            let mut item: Option<HandshakeCacheItem> = None;
+            for c in &*cache {
+                if c.typ == r.typ && c.is_client == r.is_client && c.epoch == r.epoch {
+                    if let Some(x) = &item {
+                        if x.message_sequence < c.message_sequence {
+                            item = Some(c.clone());
+                        }
+                    } else {
+                        item = Some(c.clone());
+                    }
+                }
+            }
+            if !r.optional && item.is_none() {
+                // Missing mandatory message.
+                return Err(Error::Other("Missing mandatory message".to_owned()));
+            }
+
+            if let Some(c) = item {
+                ci.insert(r.typ, c);
+            }
+        }
+
+        let mut out = HashMap::new();
+        let mut seq = start_seq;
+        for r in rules {
+            let t = r.typ;
+            if let Some(i) = ci.get(&t) {
+                let mut reader = BufReader::new(i.data.as_slice());
+                let raw_handshake = Handshake::unmarshal(&mut reader)?;
+                if seq as u16 != raw_handshake.handshake_header.message_sequence {
+                    // There is a gap. Some messages are not arrived.
+                    return Err(Error::Other(
+                        "There is a gap. Some messages are not arrived.".to_owned(),
+                    ));
+                }
+                seq += 1;
+                out.insert(t, raw_handshake.handshake_message);
+            }
+        }
+
+        Ok((seq, out))
+    }
+
+    // pull_and_merge calls pull and then merges the results, ignoring any null entries
+    pub(crate) async fn pull_and_merge(&self, rules: &[HandshakeCachePullRule]) -> Vec<u8> {
+        let mut merged = vec![];
+
+        for p in &self.pull(rules).await {
+            merged.extend_from_slice(&p.data);
+        }
+
+        merged
+    }
+
+    // session_hash returns the session hash for Extended Master Secret support
+    // https://tools.ietf.org/html/draft-ietf-tls-session-hash-06#section-4
+    pub(crate) async fn session_hash(
+        &self,
+        hf: CipherSuiteHash,
+        epoch: u16,
+        additional: &[u8],
+    ) -> Result<Vec<u8>> {
+        let mut merged = vec![];
+
+        // Order defined by https://tools.ietf.org/html/rfc5246#section-7.3
+        let handshake_buffer = self
+            .pull(&[
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ClientHello,
+                    epoch,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ServerHello,
+                    epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::Certificate,
+                    epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ServerKeyExchange,
+                    epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::CertificateRequest,
+                    epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ServerHelloDone,
+                    epoch,
+                    is_client: false,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::Certificate,
+                    epoch,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: HandshakeType::ClientKeyExchange,
+                    epoch,
+                    is_client: true,
+                    optional: false,
+                },
+            ])
+            .await;
+
+        for p in &handshake_buffer {
+            merged.extend_from_slice(&p.data);
+        }
+
+        merged.extend_from_slice(additional);
+
+        let mut hasher = match hf {
+            CipherSuiteHash::Sha256 => Sha256::new(),
+        };
+        hasher.update(&merged);
+        let result = hasher.finalize();
+
+        Ok(result.as_slice().to_vec())
+    }
+}

libs/dtls/src/handshake/handshake_cache/handshake_cache_test.rs

@@ -0,0 +1,658 @@
+use super::*;
+
+#[tokio::test]
+async fn test_handshake_cache_single_push() -> Result<()> {
+    let tests = vec![
+        (
+            "Single Push",
+            vec![HandshakeCacheItem {
+                typ: 0.into(),
+                is_client: true,
+                epoch: 0,
+                message_sequence: 0,
+                data: vec![0x00],
+            }],
+            vec![HandshakeCachePullRule {
+                typ: 0.into(),
+                epoch: 0,
+                is_client: true,
+                optional: false,
+            }],
+            vec![0x00],
+        ),
+        (
+            "Multi Push",
+            vec![
+                HandshakeCacheItem {
+                    typ: 0.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: 1.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: 2.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 2,
+                    data: vec![0x02],
+                },
+            ],
+            vec![
+                HandshakeCachePullRule {
+                    typ: 0.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 1.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 2.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+            ],
+            vec![0x00, 0x01, 0x02],
+        ),
+        (
+            "Multi Push, Rules set order",
+            vec![
+                HandshakeCacheItem {
+                    typ: 2.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 2,
+                    data: vec![0x02],
+                },
+                HandshakeCacheItem {
+                    typ: 0.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: 1.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+            ],
+            vec![
+                HandshakeCachePullRule {
+                    typ: 0.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 1.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 2.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+            ],
+            vec![0x00, 0x01, 0x02],
+        ),
+        (
+            "Multi Push, Dupe Seqnum",
+            vec![
+                HandshakeCacheItem {
+                    typ: 0.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: 1.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: 1.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+            ],
+            vec![
+                HandshakeCachePullRule {
+                    typ: 0.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 1.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+            ],
+            vec![0x00, 0x01],
+        ),
+        (
+            "Multi Push, Dupe Seqnum Client/Server",
+            vec![
+                HandshakeCacheItem {
+                    typ: 0.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: 1.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: 1.into(),
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x02],
+                },
+            ],
+            vec![
+                HandshakeCachePullRule {
+                    typ: 0.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 1.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 1.into(),
+                    epoch: 0,
+                    is_client: false,
+                    optional: false,
+                },
+            ],
+            vec![0x00, 0x01, 0x02],
+        ),
+        (
+            "Multi Push, Dupe Seqnum with Unique HandshakeType",
+            vec![
+                HandshakeCacheItem {
+                    typ: 1.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: 2.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: 3.into(),
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x02],
+                },
+            ],
+            vec![
+                HandshakeCachePullRule {
+                    typ: 1.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 2.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 3.into(),
+                    epoch: 0,
+                    is_client: false,
+                    optional: false,
+                },
+            ],
+            vec![0x00, 0x01, 0x02],
+        ),
+        (
+            "Multi Push, Wrong epoch",
+            vec![
+                HandshakeCacheItem {
+                    typ: 1.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: 2.into(),
+                    is_client: true,
+                    epoch: 1,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: 2.into(),
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 2,
+                    data: vec![0x11],
+                },
+                HandshakeCacheItem {
+                    typ: 3.into(),
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x02],
+                },
+                HandshakeCacheItem {
+                    typ: 3.into(),
+                    is_client: false,
+                    epoch: 1,
+                    message_sequence: 0,
+                    data: vec![0x12],
+                },
+                HandshakeCacheItem {
+                    typ: 3.into(),
+                    is_client: false,
+                    epoch: 2,
+                    message_sequence: 0,
+                    data: vec![0x12],
+                },
+            ],
+            vec![
+                HandshakeCachePullRule {
+                    typ: 1.into(),
+                    epoch: 0,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 2.into(),
+                    epoch: 1,
+                    is_client: true,
+                    optional: false,
+                },
+                HandshakeCachePullRule {
+                    typ: 3.into(),
+                    epoch: 0,
+                    is_client: false,
+                    optional: false,
+                },
+            ],
+            vec![0x00, 0x01, 0x02],
+        ),
+    ];
+
+    for (name, inputs, rules, expected) in tests {
+        let mut h = HandshakeCache::new();
+        for i in inputs {
+            h.push(i.data, i.epoch, i.message_sequence, i.typ, i.is_client)
+                .await;
+        }
+        let verify_data = h.pull_and_merge(&rules).await;
+        assert_eq!(
+            verify_data, expected,
+            "handshakeCache '{name}' exp:{expected:?} actual {verify_data:?}",
+        );
+    }
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_handshake_cache_session_hash() -> Result<()> {
+    let tests = vec![
+        (
+            "Standard Handshake",
+            vec![
+                HandshakeCacheItem {
+                    typ: HandshakeType::ClientHello,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerHello,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Certificate,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 2,
+                    data: vec![0x02],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerKeyExchange,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 3,
+                    data: vec![0x03],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerHelloDone,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 4,
+                    data: vec![0x04],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ClientKeyExchange,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 5,
+                    data: vec![0x05],
+                },
+            ],
+            vec![
+                0x17, 0xe8, 0x8d, 0xb1, 0x87, 0xaf, 0xd6, 0x2c, 0x16, 0xe5, 0xde, 0xbf, 0x3e, 0x65,
+                0x27, 0xcd, 0x00, 0x6b, 0xc0, 0x12, 0xbc, 0x90, 0xb5, 0x1a, 0x81, 0x0c, 0xd8, 0x0c,
+                0x2d, 0x51, 0x1f, 0x43,
+            ],
+        ),
+        (
+            "Handshake With Client Cert Request",
+            vec![
+                HandshakeCacheItem {
+                    typ: HandshakeType::ClientHello,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerHello,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Certificate,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 2,
+                    data: vec![0x02],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerKeyExchange,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 3,
+                    data: vec![0x03],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::CertificateRequest,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 4,
+                    data: vec![0x04],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerHelloDone,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 5,
+                    data: vec![0x05],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ClientKeyExchange,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 6,
+                    data: vec![0x06],
+                },
+            ],
+            vec![
+                0x57, 0x35, 0x5a, 0xc3, 0x30, 0x3c, 0x14, 0x8f, 0x11, 0xae, 0xf7, 0xcb, 0x17, 0x94,
+                0x56, 0xb9, 0x23, 0x2c, 0xde, 0x33, 0xa8, 0x18, 0xdf, 0xda, 0x2c, 0x2f, 0xcb, 0x93,
+                0x25, 0x74, 0x9a, 0x6b,
+            ],
+        ),
+        (
+            "Handshake Ignores after ClientKeyExchange",
+            vec![
+                HandshakeCacheItem {
+                    typ: HandshakeType::ClientHello,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerHello,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Certificate,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 2,
+                    data: vec![0x02],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerKeyExchange,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 3,
+                    data: vec![0x03],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::CertificateRequest,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 4,
+                    data: vec![0x04],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerHelloDone,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 5,
+                    data: vec![0x05],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ClientKeyExchange,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 6,
+                    data: vec![0x06],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::CertificateVerify,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 7,
+                    data: vec![0x07],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Finished,
+                    is_client: true,
+                    epoch: 1,
+                    message_sequence: 7,
+                    data: vec![0x08],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Finished,
+                    is_client: false,
+                    epoch: 1,
+                    message_sequence: 7,
+                    data: vec![0x09],
+                },
+            ],
+            vec![
+                0x57, 0x35, 0x5a, 0xc3, 0x30, 0x3c, 0x14, 0x8f, 0x11, 0xae, 0xf7, 0xcb, 0x17, 0x94,
+                0x56, 0xb9, 0x23, 0x2c, 0xde, 0x33, 0xa8, 0x18, 0xdf, 0xda, 0x2c, 0x2f, 0xcb, 0x93,
+                0x25, 0x74, 0x9a, 0x6b,
+            ],
+        ),
+        (
+            "Handshake Ignores wrong epoch",
+            vec![
+                HandshakeCacheItem {
+                    typ: HandshakeType::ClientHello,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 0,
+                    data: vec![0x00],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerHello,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 1,
+                    data: vec![0x01],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Certificate,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 2,
+                    data: vec![0x02],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerKeyExchange,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 3,
+                    data: vec![0x03],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::CertificateRequest,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 4,
+                    data: vec![0x04],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ServerHelloDone,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 5,
+                    data: vec![0x05],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::ClientKeyExchange,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 6,
+                    data: vec![0x06],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::CertificateVerify,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 7,
+                    data: vec![0x07],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Finished,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 7,
+                    data: vec![0xf0],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Finished,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 7,
+                    data: vec![0xf1],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Finished,
+                    is_client: true,
+                    epoch: 1,
+                    message_sequence: 7,
+                    data: vec![0x08],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Finished,
+                    is_client: false,
+                    epoch: 1,
+                    message_sequence: 7,
+                    data: vec![0x09],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Finished,
+                    is_client: true,
+                    epoch: 0,
+                    message_sequence: 7,
+                    data: vec![0xf0],
+                },
+                HandshakeCacheItem {
+                    typ: HandshakeType::Finished,
+                    is_client: false,
+                    epoch: 0,
+                    message_sequence: 7,
+                    data: vec![0xf1],
+                },
+            ],
+            vec![
+                0x57, 0x35, 0x5a, 0xc3, 0x30, 0x3c, 0x14, 0x8f, 0x11, 0xae, 0xf7, 0xcb, 0x17, 0x94,
+                0x56, 0xb9, 0x23, 0x2c, 0xde, 0x33, 0xa8, 0x18, 0xdf, 0xda, 0x2c, 0x2f, 0xcb, 0x93,
+                0x25, 0x74, 0x9a, 0x6b,
+            ],
+        ),
+    ];
+
+    for (name, inputs, expected) in tests {
+        let mut h = HandshakeCache::new();
+        for i in inputs {
+            h.push(i.data, i.epoch, i.message_sequence, i.typ, i.is_client)
+                .await;
+        }
+
+        let verify_data = h.session_hash(CipherSuiteHash::Sha256, 0, &[]).await?;
+
+        assert_eq!(
+            verify_data, expected,
+            "handshakeCacheSessionHassh '{name}' exp: {expected:?} actual {verify_data:?}"
+        );
+    }
+
+    Ok(())
+}

libs/dtls/src/handshake/handshake_header.rs

@@ -0,0 +1,50 @@
+use std::io::{Read, Write};
+
+use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
+
+use super::*;
+
+// msg_len for Handshake messages assumes an extra 12 bytes for
+// sequence, Fragment and version information
+pub(crate) const HANDSHAKE_HEADER_LENGTH: usize = 12;
+
+#[derive(Copy, Clone, PartialEq, Eq, Debug, Default)]
+pub struct HandshakeHeader {
+    pub(crate) handshake_type: HandshakeType,
+    pub(crate) length: u32, // uint24 in spec
+    pub(crate) message_sequence: u16,
+    pub(crate) fragment_offset: u32, // uint24 in spec
+    pub(crate) fragment_length: u32, // uint24 in spec
+}
+
+impl HandshakeHeader {
+    pub fn size(&self) -> usize {
+        1 + 3 + 2 + 3 + 3
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u8(self.handshake_type as u8)?;
+        writer.write_u24::<BigEndian>(self.length)?;
+        writer.write_u16::<BigEndian>(self.message_sequence)?;
+        writer.write_u24::<BigEndian>(self.fragment_offset)?;
+        writer.write_u24::<BigEndian>(self.fragment_length)?;
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let handshake_type = reader.read_u8()?.into();
+        let length = reader.read_u24::<BigEndian>()?;
+        let message_sequence = reader.read_u16::<BigEndian>()?;
+        let fragment_offset = reader.read_u24::<BigEndian>()?;
+        let fragment_length = reader.read_u24::<BigEndian>()?;
+
+        Ok(HandshakeHeader {
+            handshake_type,
+            length,
+            message_sequence,
+            fragment_offset,
+            fragment_length,
+        })
+    }
+}

libs/dtls/src/handshake/handshake_message_certificate.rs

@@ -0,0 +1,70 @@
+use std::io::{Read, Write};
+
+use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
+
+use super::*;
+
+#[cfg(test)]
+mod handshake_message_certificate_test;
+
+const HANDSHAKE_MESSAGE_CERTIFICATE_LENGTH_FIELD_SIZE: usize = 3;
+
+#[derive(PartialEq, Eq, Debug, Clone)]
+pub struct HandshakeMessageCertificate {
+    pub(crate) certificate: Vec<Vec<u8>>,
+}
+
+impl HandshakeMessageCertificate {
+    pub fn handshake_type(&self) -> HandshakeType {
+        HandshakeType::Certificate
+    }
+
+    pub fn size(&self) -> usize {
+        let mut len = 3;
+
+        for r in &self.certificate {
+            len += HANDSHAKE_MESSAGE_CERTIFICATE_LENGTH_FIELD_SIZE + r.len();
+        }
+
+        len
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        let mut payload_size = 0;
+        for r in &self.certificate {
+            payload_size += HANDSHAKE_MESSAGE_CERTIFICATE_LENGTH_FIELD_SIZE + r.len();
+        }
+
+        // Total Payload Size
+        writer.write_u24::<BigEndian>(payload_size as u32)?;
+
+        for r in &self.certificate {
+            // Certificate Length
+            writer.write_u24::<BigEndian>(r.len() as u32)?;
+
+            // Certificate body
+            writer.write_all(r)?;
+        }
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let mut certificate: Vec<Vec<u8>> = vec![];
+
+        let payload_size = reader.read_u24::<BigEndian>()? as usize;
+        let mut offset = 0;
+        while offset < payload_size {
+            let certificate_len = reader.read_u24::<BigEndian>()? as usize;
+            offset += HANDSHAKE_MESSAGE_CERTIFICATE_LENGTH_FIELD_SIZE;
+
+            let mut buf = vec![0; certificate_len];
+            reader.read_exact(&mut buf)?;
+            offset += certificate_len;
+
+            certificate.push(buf);
+        }
+
+        Ok(HandshakeMessageCertificate { certificate })
+    }
+}

libs/dtls/src/handshake/handshake_message_certificate/handshake_message_certificate_test.rs

@@ -0,0 +1,79 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+
+#[test]
+fn test_handshake_message_certificate() -> Result<()> {
+    let raw_certificate = vec![
+        0x00, 0x01, 0x8c, 0x00, 0x01, 0x89, 0x30, 0x82, 0x01, 0x85, 0x30, 0x82, 0x01, 0x2b, 0x02,
+        0x14, 0x7d, 0x00, 0xcf, 0x07, 0xfc, 0xe2, 0xb6, 0xb8, 0x3f, 0x72, 0xeb, 0x11, 0x36, 0x1b,
+        0xf6, 0x39, 0xf1, 0x3c, 0x33, 0x41, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d,
+        0x04, 0x03, 0x02, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
+        0x02, 0x41, 0x55, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x0a, 0x53,
+        0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74, 0x61, 0x74, 0x65, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03,
+        0x55, 0x04, 0x0a, 0x0c, 0x18, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x57,
+        0x69, 0x64, 0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79, 0x20, 0x4c, 0x74, 0x64, 0x30,
+        0x1e, 0x17, 0x0d, 0x31, 0x38, 0x31, 0x30, 0x32, 0x35, 0x30, 0x38, 0x35, 0x31, 0x31, 0x32,
+        0x5a, 0x17, 0x0d, 0x31, 0x39, 0x31, 0x30, 0x32, 0x35, 0x30, 0x38, 0x35, 0x31, 0x31, 0x32,
+        0x5a, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x41,
+        0x55, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x0a, 0x53, 0x6f, 0x6d,
+        0x65, 0x2d, 0x53, 0x74, 0x61, 0x74, 0x65, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04,
+        0x0a, 0x0c, 0x18, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x57, 0x69, 0x64,
+        0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79, 0x20, 0x4c, 0x74, 0x64, 0x30, 0x59, 0x30,
+        0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48,
+        0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xf9, 0xb1, 0x62, 0xd6, 0x07, 0xae,
+        0xc3, 0x36, 0x34, 0xf5, 0xa3, 0x09, 0x39, 0x86, 0xe7, 0x3b, 0x59, 0xf7, 0x4a, 0x1d, 0xf4,
+        0x97, 0x4f, 0x91, 0x40, 0x56, 0x1b, 0x3d, 0x6c, 0x5a, 0x38, 0x10, 0x15, 0x58, 0xf5, 0xa4,
+        0xcc, 0xdf, 0xd5, 0xf5, 0x4a, 0x35, 0x40, 0x0f, 0x9f, 0x54, 0xb7, 0xe9, 0xe2, 0xae, 0x63,
+        0x83, 0x6a, 0x4c, 0xfc, 0xc2, 0x5f, 0x78, 0xa0, 0xbb, 0x46, 0x54, 0xa4, 0xda, 0x30, 0x0a,
+        0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, 0x30, 0x45,
+        0x02, 0x20, 0x47, 0x1a, 0x5f, 0x58, 0x2a, 0x74, 0x33, 0x6d, 0xed, 0xac, 0x37, 0x21, 0xfa,
+        0x76, 0x5a, 0x4d, 0x78, 0x68, 0x1a, 0xdd, 0x80, 0xa4, 0xd4, 0xb7, 0x7f, 0x7d, 0x78, 0xb3,
+        0xfb, 0xf3, 0x95, 0xfb, 0x02, 0x21, 0x00, 0xc0, 0x73, 0x30, 0xda, 0x2b, 0xc0, 0x0c, 0x9e,
+        0xb2, 0x25, 0x0d, 0x46, 0xb0, 0xbc, 0x66, 0x7f, 0x71, 0x66, 0xbf, 0x16, 0xb3, 0x80, 0x78,
+        0xd0, 0x0c, 0xef, 0xcc, 0xf5, 0xc1, 0x15, 0x0f, 0x58,
+    ];
+
+    let mut reader = BufReader::new(raw_certificate.as_slice());
+    let c = HandshakeMessageCertificate::unmarshal(&mut reader)?;
+    //TODO: add x509 parse
+    //  certificate, err := x509.ParseCertificate(c.certificate[0])
+    //  if err != nil {
+    //  	t.Error(err)
+    //  }
+    //  copyCertificatePrivateMembers(certificate, parsedCertificate)
+    //  if !reflect.DeepEqual(certificate, parsedCertificate) {
+    //  	t.Errorf("handshakeMessageCertificate unmarshal: got %#v, want %#v", c, parsedCertificate)
+    //  }
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        c.marshal(&mut writer)?;
+    }
+    assert_eq!(
+        raw, raw_certificate,
+        "handshakeMessageCertificate marshal: got {raw:?}, want {raw_certificate:?}"
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_empty_handshake_message_certificate() -> Result<()> {
+    let raw_certificate = vec![0x00, 0x00, 0x00];
+
+    let expected_certificate = HandshakeMessageCertificate {
+        certificate: vec![],
+    };
+
+    let mut reader = BufReader::new(raw_certificate.as_slice());
+    let c = HandshakeMessageCertificate::unmarshal(&mut reader)?;
+
+    assert_eq!(
+        c, expected_certificate,
+        "handshakeMessageCertificate unmarshal: got {c:?}, want {expected_certificate:?}",
+    );
+
+    Ok(())
+}

libs/dtls/src/handshake/handshake_message_certificate_request.rs

@@ -0,0 +1,77 @@
+#[cfg(test)]
+mod handshake_message_certificate_request_test;
+
+use std::io::{Read, Write};
+
+use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
+
+use super::*;
+use crate::client_certificate_type::*;
+use crate::signature_hash_algorithm::*;
+
+/*
+A non-anonymous server can optionally request a certificate from
+the client, if appropriate for the selected cipher suite.  This
+message, if sent, will immediately follow the ServerKeyExchange
+message (if it is sent; otherwise, this message follows the
+server's Certificate message).
+*/
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct HandshakeMessageCertificateRequest {
+    pub(crate) certificate_types: Vec<ClientCertificateType>,
+    pub(crate) signature_hash_algorithms: Vec<SignatureHashAlgorithm>,
+}
+
+const HANDSHAKE_MESSAGE_CERTIFICATE_REQUEST_MIN_LENGTH: usize = 5;
+
+impl HandshakeMessageCertificateRequest {
+    pub fn handshake_type(&self) -> HandshakeType {
+        HandshakeType::CertificateRequest
+    }
+
+    pub fn size(&self) -> usize {
+        1 + self.certificate_types.len() + 2 + self.signature_hash_algorithms.len() * 2 + 2
+    }
+
+    pub fn marshal<W: Write>(&self, writer: &mut W) -> Result<()> {
+        writer.write_u8(self.certificate_types.len() as u8)?;
+        for v in &self.certificate_types {
+            writer.write_u8(*v as u8)?;
+        }
+
+        writer.write_u16::<BigEndian>(2 * self.signature_hash_algorithms.len() as u16)?;
+        for v in &self.signature_hash_algorithms {
+            writer.write_u8(v.hash as u8)?;
+            writer.write_u8(v.signature as u8)?;
+        }
+
+        writer.write_all(&[0x00, 0x00])?; // Distinguished Names Length
+
+        Ok(writer.flush()?)
+    }
+
+    pub fn unmarshal<R: Read>(reader: &mut R) -> Result<Self> {
+        let certificate_types_length = reader.read_u8()?;
+
+        let mut certificate_types = vec![];
+        for _ in 0..certificate_types_length {
+            let cert_type = reader.read_u8()?.into();
+            certificate_types.push(cert_type);
+        }
+
+        let signature_hash_algorithms_length = reader.read_u16::<BigEndian>()?;
+
+        let mut signature_hash_algorithms = vec![];
+        for _ in (0..signature_hash_algorithms_length).step_by(2) {
+            let hash = reader.read_u8()?.into();
+            let signature = reader.read_u8()?.into();
+
+            signature_hash_algorithms.push(SignatureHashAlgorithm { hash, signature });
+        }
+
+        Ok(HandshakeMessageCertificateRequest {
+            certificate_types,
+            signature_hash_algorithms,
+        })
+    }
+}

libs/dtls/src/handshake/handshake_message_certificate_request/handshake_message_certificate_request_test.rs

@@ -0,0 +1,64 @@
+use std::io::{BufReader, BufWriter};
+
+use super::*;
+use crate::signature_hash_algorithm::*;
+
+#[test]
+fn test_handshake_message_certificate_request() -> Result<()> {
+    let raw_certificate_request = vec![
+        0x02, 0x01, 0x40, 0x00, 0x0C, 0x04, 0x03, 0x04, 0x01, 0x05, 0x03, 0x05, 0x01, 0x06, 0x01,
+        0x02, 0x01, 0x00, 0x00,
+    ];
+
+    let parsed_certificate_request = HandshakeMessageCertificateRequest {
+        certificate_types: vec![
+            ClientCertificateType::RsaSign,
+            ClientCertificateType::EcdsaSign,
+        ],
+        signature_hash_algorithms: vec![
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha256,
+                signature: SignatureAlgorithm::Ecdsa,
+            },
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha256,
+                signature: SignatureAlgorithm::Rsa,
+            },
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha384,
+                signature: SignatureAlgorithm::Ecdsa,
+            },
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha384,
+                signature: SignatureAlgorithm::Rsa,
+            },
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha512,
+                signature: SignatureAlgorithm::Rsa,
+            },
+            SignatureHashAlgorithm {
+                hash: HashAlgorithm::Sha1,
+                signature: SignatureAlgorithm::Rsa,
+            },
+        ],
+    };
+
+    let mut reader = BufReader::new(raw_certificate_request.as_slice());
+    let c = HandshakeMessageCertificateRequest::unmarshal(&mut reader)?;
+    assert_eq!(
+        c, parsed_certificate_request,
+        "parsedCertificateRequest unmarshal: got {c:?}, want {parsed_certificate_request:?}"
+    );
+
+    let mut raw = vec![];
+    {
+        let mut writer = BufWriter::<&mut Vec<u8>>::new(raw.as_mut());
+        c.marshal(&mut writer)?;
+    }
+    assert_eq!(
+        raw, raw_certificate_request,
+        "parsedCertificateRequest marshal: got {raw:?}, want {raw_certificate_request:?}"
+    );
+
+    Ok(())
+}