Xirsys.Sockets.Transport.TLS (xturn_sockets v2.2.1)

View Source

TLS stream transport (:ssl) for TURNS listeners and connections.

What problem this solves

Browsers and native clients often require TURN over TLS (TURNS). This module wraps OTP :ssl behind the Transport behaviour: secure listen defaults, handshake on accept, and normalized {:ssl, ...} messages for the drain loop.

Defaults to TLS 1.2/1.3 and AEAD cipher suites. Legacy versions (:tlsv1, :"tlsv1.1", :sslv3) are stripped from :versions. Certificates come from listen/3 opts (certfile, keyfile, cacertfile), then Config.get(:certs), then legacy :certs / :xturn application env.

RFCs

  • RFC 8656 - TURN (TLS as transport)
  • RFC 8446 - TLS 1.3 (handshake and record layer)

Summary

Functions

handle_message(arg1, socket)

Maps :ssl / :ssl_closed / :ssl_error / :ssl_passive messages.

security_opts()

Normalized listen/security options: TLS 1.2/1.3 and AEAD-only ciphers.

Functions

handle_message(arg1, socket)

Maps :ssl / :ssl_closed / :ssl_error / :ssl_passive messages.

iex> Xirsys.Sockets.Transport.TLS.handle_message({:ssl, :port, "hi"}, :sock)
{:data, "hi", nil}
iex> Xirsys.Sockets.Transport.TLS.handle_message({:ssl_closed, :port}, :sock)
{:closed, :normal}
iex> Xirsys.Sockets.Transport.TLS.framing()
:stream

security_opts()

@spec security_opts() :: keyword()

Normalized listen/security options: TLS 1.2/1.3 and AEAD-only ciphers.

iex> opts = Xirsys.Sockets.Transport.TLS.security_opts()
iex> :"tlsv1.2" in Keyword.get(opts, :versions)
true
iex> :"tlsv1.3" in Keyword.get(opts, :versions)
true
iex> :tlsv1 in Keyword.get(opts, :versions)
false