Enforce SRTP mandatory HS messages

Enforce CertificateRequest, client and server Certificates, and
CertificateVerify messages, which are mandatory in DTLS-SRTP,
as defined in RFC 5764 section 4.1

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>

library/ssl_cli.c

@@ -3454,8 +3454,20 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
 
     if( ssl->client_auth == 0 )
     {
-        /* Current message is probably the ServerHelloDone */
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
-        ssl->keep_current_message = 1;
+    /* check if we have a chosen srtp protection profile */
+        if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+            ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
+        }
+        else
+        {
+#endif
+            /* MBEDTLS_SSL_DTLS_SRTP */
+            /* Current message is probably the ServerHelloDone */
+            ssl->keep_current_message = 1;
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+        }
+#endif
         goto exit;
     }
 
@@ -4102,9 +4114,19 @@ static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
 
     if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
-        ssl->state++;
+    /* check if we have a chosen srtp protection profile */
-        return( 0 );
+        if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+            return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
+        }
+        else
+        {
+#endif /* MBEDTLS_SSL_DTLS_SRTP */
+            ssl->state++;
+            return( 0 );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+        }
+#endif
     }
 
     if( mbedtls_ssl_own_key( ssl ) == NULL )

library/ssl_srv.c

@@ -3018,14 +3018,33 @@ static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
     if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
         authmode = ssl->handshake->sni_authmode;
     else
+#endif
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+    /* check if we have a chosen srtp protection profile */
+    if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+        authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
+    }
+        else
 #endif
         authmode = ssl->conf->authmode;
 
     if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ||
         authmode == MBEDTLS_SSL_VERIFY_NONE )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
-        return( 0 );
+    /* check if we have a chosen srtp protection profile */
+        if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+            MBEDTLS_SSL_DEBUG_MSG( 2, ( "should not happen" ) );
+            return ( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        }
+        else
+        {
+#endif
+            MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
+            return( 0 );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+        }
+#endif
     }
 
     /*

library/ssl_tls.c

@@ -873,7 +873,7 @@ static int ssl_populate_transform( mbedtls_ssl_transform *transform,
 
 #if defined(MBEDTLS_SSL_DTLS_SRTP)
     /* check if we have a chosen srtp protection profile */
-    if (ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE) {
+    if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
         /* derive key material for srtp session RFC5764 section 4.2 */
         /* master key and master salt are respectively 128 bits and 112 bits for all currently available modes :
          * SRTP_AES128_CM_HMAC_SHA1_80, SRTP_AES128_CM_HMAC_SHA1_32
@@ -2112,9 +2112,20 @@ int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
 
     if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
-        ssl->state++;
+    /* check if we have a chosen srtp protection profile */
-        return( 0 );
+        if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+            return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
+        }
+        else
+        {
+#endif /* MBEDTLS_SSL_DTLS_SRTP */
+            MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
+            ssl->state++;
+            return( 0 );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+        }
+#endif
     }
 
 #if defined(MBEDTLS_SSL_CLI_C)
@@ -2739,9 +2750,20 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
     const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
                        ? ssl->handshake->sni_authmode
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+                       : ssl->dtls_srtp_info.chosen_dtls_srtp_profile !=
+                               MBEDTLS_SRTP_UNSET_PROFILE
+                       ? MBEDTLS_SSL_VERIFY_REQUIRED
+#endif /* MBEDTLS_SSL_DTLS_SRTP */
                        : ssl->conf->authmode;
 #else
-    const int authmode = ssl->conf->authmode;
+    const int authmode =
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+            ssl->dtls_srtp_info.chosen_dtls_srtp_profile !=
+                                           MBEDTLS_SRTP_UNSET_PROFILE ?
+                         MBEDTLS_SSL_VERIFY_REQUIRED :
+#endif /* MBEDTLS_SSL_DTLS_SRTP */
+            ssl->conf->authmode;
 #endif
     void *rs_ctx = NULL;
     mbedtls_x509_crt *chain = NULL;
@@ -4772,7 +4794,6 @@ mbedtls_ssl_srtp_profile mbedtls_ssl_get_dtls_srtp_protection_profile( const mbe
 }
 
 int mbedtls_ssl_get_dtls_srtp_key_material( const mbedtls_ssl_context *ssl, unsigned char *key, size_t *key_len ) {
-    *key_len = 0;
 
     /* check output buffer size */
     if ( *key_len < ssl->dtls_srtp_info.dtls_srtp_keys_len) {