yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-22 19:41:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enforce SRTP mandatory HS messages

Browse source 
Enforce CertificateRequest, client and server Certificates, and
CertificateVerify messages, which are mandatory in DTLS-SRTP,
as defined in RFC 5764 section 4.1

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
This commit is contained in:
Ron Eldor 2018-04-02 18:25:16 +03:00 committed by Johan Pascal
parent 9e9096476e
commit 57cc70ec81
3 changed files with 75 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
library/ssl_cli.c
View file

@ -3454,8 +3454,20 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
if( ssl->client_auth == 0 )
{
/* Current message is probably the ServerHelloDone */
ssl->keep_current_message = 1;
#if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
}
else
{
#endif
/* MBEDTLS_SSL_DTLS_SRTP */
/* Current message is probably the ServerHelloDone */
ssl->keep_current_message = 1;
#if defined(MBEDTLS_SSL_DTLS_SRTP)
}
#endif
goto exit;
}
@ -4102,9 +4114,19 @@ static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
ssl->state++;
return( 0 );
#if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
}
else
{
#endif /* MBEDTLS_SSL_DTLS_SRTP */
ssl->state++;
return( 0 );
#if defined(MBEDTLS_SSL_DTLS_SRTP)
}
#endif
}
if( mbedtls_ssl_own_key( ssl ) == NULL )

23
library/ssl_srv.c
View file

@ -3018,14 +3018,33 @@ static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
authmode = ssl->handshake->sni_authmode;
else
#endif
#if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
}
else
#endif
authmode = ssl->conf->authmode;
if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ||
authmode == MBEDTLS_SSL_VERIFY_NONE )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
return( 0 );
#if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
MBEDTLS_SSL_DEBUG_MSG( 2, ( "should not happen" ) );
return ( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
}
else
{
#endif
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
return( 0 );
#if defined(MBEDTLS_SSL_DTLS_SRTP)
}
#endif
}
/*

33
library/ssl_tls.c
View file

@ -873,7 +873,7 @@ static int ssl_populate_transform( mbedtls_ssl_transform *transform,
#if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */
if (ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE) {
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
/* derive key material for srtp session RFC5764 section 4.2 */
/* master key and master salt are respectively 128 bits and 112 bits for all currently available modes :
* SRTP_AES128_CM_HMAC_SHA1_80, SRTP_AES128_CM_HMAC_SHA1_32
@ -2112,9 +2112,20 @@ int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
ssl->state++;
return( 0 );
#if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
}
else
{
#endif /* MBEDTLS_SSL_DTLS_SRTP */
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
ssl->state++;
return( 0 );
#if defined(MBEDTLS_SSL_DTLS_SRTP)
}
#endif
}
#if defined(MBEDTLS_SSL_CLI_C)
@ -2739,9 +2750,20 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
? ssl->handshake->sni_authmode
#if defined(MBEDTLS_SSL_DTLS_SRTP)
: ssl->dtls_srtp_info.chosen_dtls_srtp_profile !=
MBEDTLS_SRTP_UNSET_PROFILE
? MBEDTLS_SSL_VERIFY_REQUIRED
#endif /* MBEDTLS_SSL_DTLS_SRTP */
: ssl->conf->authmode;
#else
const int authmode = ssl->conf->authmode;
const int authmode =
#if defined(MBEDTLS_SSL_DTLS_SRTP)
ssl->dtls_srtp_info.chosen_dtls_srtp_profile !=
MBEDTLS_SRTP_UNSET_PROFILE ?
MBEDTLS_SSL_VERIFY_REQUIRED :
#endif /* MBEDTLS_SSL_DTLS_SRTP */
ssl->conf->authmode;
#endif
void *rs_ctx = NULL;
mbedtls_x509_crt *chain = NULL;
@ -4772,7 +4794,6 @@ mbedtls_ssl_srtp_profile mbedtls_ssl_get_dtls_srtp_protection_profile( const mbe
}
int mbedtls_ssl_get_dtls_srtp_key_material( const mbedtls_ssl_context *ssl, unsigned char *key, size_t *key_len ) {
*key_len = 0;
/* check output buffer size */
if ( *key_len < ssl->dtls_srtp_info.dtls_srtp_keys_len) {