yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Style fixes

Browse source 
1. Fix indentations.
2. Remove redundant whitespaces.
3. Keep short lines.
4. Grammar fixes.
5. Rephrase function description.

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
This commit is contained in:
Ron Eldor 2018-12-05 11:04:31 +02:00 committed by Johan Pascal
parent ef72faf2bb
commit a978804a1b
6 changed files with 116 additions and 80 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ChangeLog
View file

@ -731,8 +731,8 @@ Changes
they are enabled. they are enabled.
Features Features
* Add support for DTLS-SRTP as defined in RFC 5764. Based on contribution done * Add support for DTLS-SRTP as defined in RFC 5764. Based on #361 contributed
by Johan Pascal in #361. by Johan Pascal.
= mbed TLS 2.16.0 branch released 2018-12-21 = mbed TLS 2.16.0 branch released 2018-12-21

84
include/mbedtls/ssl.h
View file

@ -415,7 +415,8 @@
#define MBEDTLS_TLS_EXT_RENEGOTIATION_INFO 0xFF01 #define MBEDTLS_TLS_EXT_RENEGOTIATION_INFO 0xFF01
/* /*
* use_srtp extension protection profiles values as defined in http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml * Use_srtp extension protection profiles values as defined in
* http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml
*/ */
#define MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80_IANA_VALUE 0x0001 #define MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80_IANA_VALUE 0x0001
#define MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_32_IANA_VALUE 0x0002 #define MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_32_IANA_VALUE 0x0002
@ -890,10 +891,17 @@ mbedtls_ssl_srtp_profile_info;
typedef struct mbedtls_dtls_srtp_info_t typedef struct mbedtls_dtls_srtp_info_t
{ {
mbedtls_ssl_srtp_profile chosen_dtls_srtp_profile; /*!< negotiated SRTP profile */ /*! The SRTP profile that was negotiated*/
unsigned char dtls_srtp_keys[MBEDTLS_DTLS_SRTP_MAX_KEY_MATERIAL_LENGTH]; /*!< master keys and master salt for SRTP generated during handshake */ mbedtls_ssl_srtp_profile chosen_dtls_srtp_profile;
size_t dtls_srtp_keys_len; /*!< length in bytes of master keys and master salt for SRTP generated during handshake */ /*! master keys and master salt for SRTP generated during handshake */
unsigned char mki_value[MBEDTLS_DTLS_SRTP_MAX_MKI_LENGTH]; /* opaque srtp_mki<0..255> */ unsigned char dtls_srtp_keys[MBEDTLS_DTLS_SRTP_MAX_KEY_MATERIAL_LENGTH];
/*! length in bytes of master keys and master salt for
* SRTP generated during handshake
*/
size_t dtls_srtp_keys_len;
/*! The mki_value used, with max size of 256 bytes */
unsigned char mki_value[MBEDTLS_DTLS_SRTP_MAX_MKI_LENGTH];
/*! The length of mki_value */
size_t mki_len; size_t mki_len;
} }
mbedtls_dtls_srtp_info; mbedtls_dtls_srtp_info;
@ -1107,8 +1115,10 @@ struct mbedtls_ssl_config
#endif #endif
#if defined(MBEDTLS_SSL_DTLS_SRTP) #if defined(MBEDTLS_SSL_DTLS_SRTP)
mbedtls_ssl_srtp_profile *dtls_srtp_profile_list; /*!< ordered list of supported srtp profile */ /*! ordered list of supported srtp profile */
size_t dtls_srtp_profile_list_len; /*!< number of supported profiles */ mbedtls_ssl_srtp_profile *dtls_srtp_profile_list;
/*! number of supported profiles */
size_t dtls_srtp_profile_list_len;
#endif /* MBEDTLS_SSL_DTLS_SRTP */ #endif /* MBEDTLS_SSL_DTLS_SRTP */
/* /*
@ -3186,12 +3196,14 @@ const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl );
#if defined(MBEDTLS_SSL_DTLS_SRTP) #if defined(MBEDTLS_SSL_DTLS_SRTP)
/** /**
* \brief Add support for mki value in use_srtp extension * \brief Add support for mki value in use_srtp extension.
* (Default: MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED) * The default value is
* #MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED.
* *
* \param conf SSL configuration * \param conf SSL configuration
* \param support_mki_value Enable or disable (MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED * \param support_mki_value Enable or disable mki usage. Values are
* or MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED) * #MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED
* or #MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED.
*/ */
void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf, void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
int support_mki_value ); int support_mki_value );
@ -3204,21 +3216,22 @@ void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
* in decreasing preference order. * in decreasing preference order.
* \param profiles_number Number of supported profiles. * \param profiles_number Number of supported profiles.
* *
* \return 0 on success, or MBEDTLS_ERR_SSL_BAD_INPUT_DATA. * \return 0 on success, or #MBEDTLS_ERR_SSL_BAD_INPUT_DATA.
*/ */
int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf, int mbedtls_ssl_conf_dtls_srtp_protection_profiles
const mbedtls_ssl_srtp_profile *profiles, ( mbedtls_ssl_config *conf,
size_t profiles_number ); const mbedtls_ssl_srtp_profile *profiles,
size_t profiles_number );
/** /**
* \brief Set the mki_value for the current dtls session. * \brief Set the mki_value for the current DTLS-SRTP session.
* *
* \param ssl SSL context * \param ssl SSL context to use.
* \param mki_value MKI value to set * \param mki_value The MKI value to set.
* \param mki_len MKI length * \param mki_len The length of the MKI value.
* *
* \return 0 on success, MBEDTLS_ERR_SSL_BAD_INPUT_DATA * \return 0 on success, #MBEDTLS_ERR_SSL_BAD_INPUT_DATA
* or MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE on failure * or #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE on failure
*/ */
int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl, int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
unsigned char *mki_value, unsigned char *mki_value,
@ -3231,36 +3244,39 @@ int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
* \param ssl SSL context * \param ssl SSL context
* *
* \return Protection Profile enum member, * \return Protection Profile enum member,
* MBEDTLS_SRTP_UNSET_PROFILE if no protocol was negotiated. * #MBEDTLS_SRTP_UNSET_PROFILE if no protocol was negotiated.
*/ */
mbedtls_ssl_srtp_profile mbedtls_ssl_get_dtls_srtp_protection_profile( const mbedtls_ssl_context *ssl ); mbedtls_ssl_srtp_profile mbedtls_ssl_get_dtls_srtp_protection_profile
( const mbedtls_ssl_context *ssl );
/** /**
* \brief Get the generated DTLS-SRTP key material. * \brief Get the generated DTLS-SRTP key material.
* This function should be called after the handshake is * This function should be called after the handshake is
* completed. It shall returns 80 bytes of key material * completed. It shall returns 60 bytes of key material
* generated according to RFC5764 * generated according to RFC 5764
* *
* \param ssl SSL context * \param ssl SSL context tobe used.
* \param key Buffer to hold the generated key material * \param key Buffer to hold the generated key material.
* \param key_len [in/out] key buffer size. outputs the actual number * \param key_len [in/out] key buffer size. outputs the actual number
* of bytes written * of bytes written.
* *
* \return 0 on succes, MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if the key buffer * \return 0 on success, #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if
* is too small to hold the generated key * the key buffer is too small to hold the generated key.
*/ */
int mbedtls_ssl_get_dtls_srtp_key_material( const mbedtls_ssl_context *ssl, int mbedtls_ssl_get_dtls_srtp_key_material( const mbedtls_ssl_context *ssl,
unsigned char *key, unsigned char *key,
size_t *key_len ); size_t *key_len );
/** /**
* \brief Utility function to get information on dtls srtp profile. * \brief Utility function to get information on DTLS-SRTP profile.
* *
* \param profile The dtls-srtp profile id to get info on. * \param profile The dtls-srtp profile id to get info on.
* *
* \return mbedtls_ssl_srtp_profile_info* on success, NULL if not found * \return Address of the SRTP profile information structure on
* success,NULL if not found.
*/ */
const mbedtls_ssl_srtp_profile_info *mbedtls_ssl_dtls_srtp_profile_info_from_id( mbedtls_ssl_srtp_profile profile ); const mbedtls_ssl_srtp_profile_info *mbedtls_ssl_dtls_srtp_profile_info_from_id
( mbedtls_ssl_srtp_profile profile );
#endif /* MBEDTLS_SSL_DTLS_SRTP */ #endif /* MBEDTLS_SSL_DTLS_SRTP */
/** /**
@ -3279,7 +3295,7 @@ const mbedtls_ssl_srtp_profile_info *mbedtls_ssl_dtls_srtp_profile_info_from_id(
* MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2, * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,
* MBEDTLS_SSL_MINOR_VERSION_3 supported) * MBEDTLS_SSL_MINOR_VERSION_3 supported)
*/ */
void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf,int major, int minor ); void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor );
/** /**
* \brief Set the minimum accepted SSL/TLS protocol version * \brief Set the minimum accepted SSL/TLS protocol version

29
library/ssl_cli.c
View file

@ -756,9 +756,9 @@ static int ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
} }
#endif /* MBEDTLS_SSL_ALPN */ #endif /* MBEDTLS_SSL_ALPN */
#if defined (MBEDTLS_SSL_DTLS_SRTP) #if defined(MBEDTLS_SSL_DTLS_SRTP)
static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl, static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
unsigned char *buf, size_t *olen ) unsigned char *buf, size_t *olen )
{ {
unsigned char *p = buf; unsigned char *p = buf;
size_t protection_profiles_index = 0; size_t protection_profiles_index = 0;
@ -766,8 +766,8 @@ static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
*olen = 0; *olen = 0;
if( (ssl->conf->dtls_srtp_profile_list == NULL) || if( ( ssl->conf->dtls_srtp_profile_list == NULL ) ||
(ssl->conf->dtls_srtp_profile_list_len == 0) ) ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
{ {
return; return;
} }
@ -777,14 +777,13 @@ static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP >> 8 ) & 0xFF ); *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP >> 8 ) & 0xFF );
*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP ) & 0xFF ); *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP ) & 0xFF );
/* RFC5764 section 4.1.1 /* RFC 5764 section 4.1.1
* uint8 SRTPProtectionProfile[2]; * uint8 SRTPProtectionProfile[2];
* *
* struct { * struct {
* SRTPProtectionProfiles SRTPProtectionProfiles; * SRTPProtectionProfiles SRTPProtectionProfiles;
* opaque srtp_mki<0..255>; * opaque srtp_mki<0..255>;
* } UseSRTPData; * } UseSRTPData;
* SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>; * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>;
*/ */
if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED && if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED &&
@ -811,7 +810,7 @@ static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
protection_profiles_index < ssl->conf->dtls_srtp_profile_list_len; protection_profiles_index < ssl->conf->dtls_srtp_profile_list_len;
protection_profiles_index++ ) protection_profiles_index++ )
{ {
switch (ssl->conf->dtls_srtp_profile_list[protection_profiles_index]) { switch( ssl->conf->dtls_srtp_profile_list[protection_profiles_index] ) {
case MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80: case MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80:
MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_write_use_srtp_ext, add profile: %04x", MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_write_use_srtp_ext, add profile: %04x",
MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80_IANA_VALUE ) ); MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80_IANA_VALUE ) );
@ -848,7 +847,7 @@ static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
* is checked by ssl_set_dtls_srtp_protection_profiles function * is checked by ssl_set_dtls_srtp_protection_profiles function
*/ */
MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello, ignore illegal DTLS-SRTP protection profile %d", MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello, ignore illegal DTLS-SRTP protection profile %d",
ssl->conf->dtls_srtp_profile_list[protection_profiles_index]) ); ssl->conf->dtls_srtp_profile_list[protection_profiles_index] ) );
break; break;
} }
} }
@ -1853,7 +1852,7 @@ static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl,
ssl->conf->dtls_srtp_profile_list_len == 0 ) ssl->conf->dtls_srtp_profile_list_len == 0 )
return( 0 ); return( 0 );
/* RFC5764 section 4.1.1 /* RFC 5764 section 4.1.1
* uint8 SRTPProtectionProfile[2]; * uint8 SRTPProtectionProfile[2];
* *
* struct { * struct {
@ -1954,11 +1953,11 @@ static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl,
#if defined (MBEDTLS_DEBUG_C) #if defined (MBEDTLS_DEBUG_C)
if( len > 5 ) if( len > 5 )
{ {
MBEDTLS_SSL_DEBUG_BUF( 3, "received mki", ssl->dtls_srtp_info.mki_value, MBEDTLS_SSL_DEBUG_BUF( 3, "received mki", ssl->dtls_srtp_info.mki_value,
ssl->dtls_srtp_info.mki_len ); ssl->dtls_srtp_info.mki_len );
} }
#endif #endif
return 0; return( 0 );
} }
#endif /* MBEDTLS_SSL_DTLS_SRTP */ #endif /* MBEDTLS_SSL_DTLS_SRTP */
@ -3510,7 +3509,8 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
{ {
#if defined(MBEDTLS_SSL_DTLS_SRTP) #if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */ /* check if we have a chosen srtp protection profile */
if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) { if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE )
{
ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
} }
else else
@ -4169,7 +4169,8 @@ static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
{ {
#if defined(MBEDTLS_SSL_DTLS_SRTP) #if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */ /* check if we have a chosen srtp protection profile */
if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) { if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE )
{
return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
} }
else else

12
library/ssl_srv.c
View file

@ -847,7 +847,7 @@ static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl,
MBEDTLS_SSL_DEBUG_MSG( 3, ( "found srtp profile: %s", profile_info->name ) ); MBEDTLS_SSL_DEBUG_MSG( 3, ( "found srtp profile: %s", profile_info->name ) );
} }
/* check if suggested profile is in our list */ /* check if suggested profile is in our list */
for( i=0; i < ssl->conf->dtls_srtp_profile_list_len; i++) for( i = 0; i < ssl->conf->dtls_srtp_profile_list_len; i++)
{ {
if( client_protection == ssl->conf->dtls_srtp_profile_list[i] ) if( client_protection == ssl->conf->dtls_srtp_profile_list[i] )
{ {
@ -860,7 +860,7 @@ static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl,
break; break;
} }
if( ( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED ) && if( ( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED ) &&
( len > ( profile_length + 2 ) ) ) ( len > ( profile_length + 2 ) ) )
{ {
ssl->dtls_srtp_info.mki_len = buf[profile_length + 2]; ssl->dtls_srtp_info.mki_len = buf[profile_length + 2];
if( ssl->dtls_srtp_info.mki_len > MBEDTLS_DTLS_SRTP_MAX_MKI_LENGTH ) if( ssl->dtls_srtp_info.mki_len > MBEDTLS_DTLS_SRTP_MAX_MKI_LENGTH )
@ -3056,7 +3056,8 @@ static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
* force verify mode to be at least OPTIONAL * force verify mode to be at least OPTIONAL
*/ */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE && if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE &&
ssl->conf->authmode == MBEDTLS_SSL_VERIFY_NONE ) { ssl->conf->authmode == MBEDTLS_SSL_VERIFY_NONE )
{
authmode = MBEDTLS_SSL_VERIFY_OPTIONAL; authmode = MBEDTLS_SSL_VERIFY_OPTIONAL;
} }
else else
@ -3067,8 +3068,9 @@ static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
authmode == MBEDTLS_SSL_VERIFY_NONE ) authmode == MBEDTLS_SSL_VERIFY_NONE )
{ {
#if defined(MBEDTLS_SSL_DTLS_SRTP) #if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */ /* check if we have a chosen srtp protection profile */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) { if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "should not happen" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "should not happen" ) );
return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
} }

44
library/ssl_tls.c
View file

@ -873,10 +873,11 @@ static int ssl_populate_transform( mbedtls_ssl_transform *transform,
#if defined(MBEDTLS_SSL_DTLS_SRTP) #if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */ /* check if we have a chosen srtp protection profile */
if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) { if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE )
{
/* derive key material for srtp session RFC5764 section 4.2 /* derive key material for srtp session RFC5764 section 4.2
* master key and master salt are respectively 128 bits and 112 bits * master key and master salt are respectively 128 bits and 112 bits
* for all currently available modes : * for all currently available modes:
* SRTP_AES128_CM_HMAC_SHA1_80, SRTP_AES128_CM_HMAC_SHA1_32 * SRTP_AES128_CM_HMAC_SHA1_80, SRTP_AES128_CM_HMAC_SHA1_32
* SRTP_NULL_HMAC_SHA1_80, SRTP_NULL_HMAC_SHA1_32 * SRTP_NULL_HMAC_SHA1_80, SRTP_NULL_HMAC_SHA1_32
* So we must export 2*(128 + 112) = 480 bits * So we must export 2*(128 + 112) = 480 bits
@ -2114,7 +2115,8 @@ int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
{ {
#if defined(MBEDTLS_SSL_DTLS_SRTP) #if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */ /* check if we have a chosen srtp protection profile */
if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) { if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE )
{
return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
} }
else else
@ -4773,14 +4775,18 @@ int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
size_t mki_len ) size_t mki_len )
{ {
if ( mki_len > MBEDTLS_DTLS_SRTP_MAX_MKI_LENGTH ) if ( mki_len > MBEDTLS_DTLS_SRTP_MAX_MKI_LENGTH )
{
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
}
if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED ) if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
{
return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
}
memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len ); memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
ssl->dtls_srtp_info.mki_len = mki_len; ssl->dtls_srtp_info.mki_len = mki_len;
return 0; return( 0 );
} }
int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf, int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
@ -4788,14 +4794,19 @@ int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
size_t profiles_number ) size_t profiles_number )
{ {
size_t i; size_t i;
/* check in put validity : must be a list of profiles from enumeration */ /*
/* maximum length is 4 as only 4 protection profiles are defined */ * Check input validity : must be a list of profiles from enumeration.
if( profiles_number > 4 ) { * Maximum length is 4 as only 4 protection profiles are defined.
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; */
if( profiles_number > 4 )
{
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
} }
mbedtls_free( conf->dtls_srtp_profile_list ); mbedtls_free( conf->dtls_srtp_profile_list );
conf->dtls_srtp_profile_list = (mbedtls_ssl_srtp_profile*)mbedtls_calloc(1, profiles_number * sizeof( mbedtls_ssl_srtp_profile ) ); conf->dtls_srtp_profile_list =
(mbedtls_ssl_srtp_profile*)mbedtls_calloc(1,
profiles_number * sizeof( mbedtls_ssl_srtp_profile ) );
for( i=0; i < profiles_number; i++ ) { for( i=0; i < profiles_number; i++ ) {
switch( profiles[i] ) { switch( profiles[i] ) {
@ -4809,7 +4820,7 @@ int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
mbedtls_free( conf->dtls_srtp_profile_list ); mbedtls_free( conf->dtls_srtp_profile_list );
conf->dtls_srtp_profile_list = NULL; conf->dtls_srtp_profile_list = NULL;
conf->dtls_srtp_profile_list_len = 0; conf->dtls_srtp_profile_list_len = 0;
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
} }
} }
@ -4819,25 +4830,28 @@ int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
return( 0 ); return( 0 );
} }
mbedtls_ssl_srtp_profile mbedtls_ssl_get_dtls_srtp_protection_profile( const mbedtls_ssl_context *ssl ) mbedtls_ssl_srtp_profile
mbedtls_ssl_get_dtls_srtp_protection_profile( const mbedtls_ssl_context *ssl )
{ {
return( ssl->dtls_srtp_info.chosen_dtls_srtp_profile ); return( ssl->dtls_srtp_info.chosen_dtls_srtp_profile );
} }
int mbedtls_ssl_get_dtls_srtp_key_material( const mbedtls_ssl_context *ssl, int mbedtls_ssl_get_dtls_srtp_key_material( const mbedtls_ssl_context *ssl,
unsigned char *key, unsigned char *key,
size_t *key_len ) { size_t *key_len )
{
/* check output buffer size */ /* check output buffer size */
if( *key_len < ssl->dtls_srtp_info.dtls_srtp_keys_len ) { if( *key_len < ssl->dtls_srtp_info.dtls_srtp_keys_len )
return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; {
return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
} }
memcpy( key, ssl->dtls_srtp_info.dtls_srtp_keys, memcpy( key, ssl->dtls_srtp_info.dtls_srtp_keys,
ssl->dtls_srtp_info.dtls_srtp_keys_len ); ssl->dtls_srtp_info.dtls_srtp_keys_len );
*key_len = ssl->dtls_srtp_info.dtls_srtp_keys_len; *key_len = ssl->dtls_srtp_info.dtls_srtp_keys_len;
return 0; return( 0 );
} }
#endif /* MBEDTLS_SSL_DTLS_SRTP */ #endif /* MBEDTLS_SSL_DTLS_SRTP */

23
programs/ssl/ssl_client2.c
View file

@ -2285,19 +2285,22 @@ int main( int argc, char *argv[] )
if( opt.force_srtp_profile != DFL_SRTP_FORCE_PROFILE ) if( opt.force_srtp_profile != DFL_SRTP_FORCE_PROFILE )
{ {
const mbedtls_ssl_srtp_profile forced_profile[] = { opt.force_srtp_profile }; const mbedtls_ssl_srtp_profile forced_profile[] = { opt.force_srtp_profile };
ret = mbedtls_ssl_conf_dtls_srtp_protection_profiles( &conf, ret = mbedtls_ssl_conf_dtls_srtp_protection_profiles
forced_profile, ( &conf,
sizeof( forced_profile ) / sizeof( mbedtls_ssl_srtp_profile ) ); forced_profile,
sizeof( forced_profile ) / sizeof( mbedtls_ssl_srtp_profile ) );
} }
else else
{ {
const mbedtls_ssl_srtp_profile default_profiles[] = { MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80, const mbedtls_ssl_srtp_profile default_profiles[] =
MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_32, { MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80,
MBEDTLS_SRTP_NULL_HMAC_SHA1_80, MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_32,
MBEDTLS_SRTP_NULL_HMAC_SHA1_32 }; MBEDTLS_SRTP_NULL_HMAC_SHA1_80,
ret = mbedtls_ssl_conf_dtls_srtp_protection_profiles( &conf, MBEDTLS_SRTP_NULL_HMAC_SHA1_32 };
default_profiles, ret = mbedtls_ssl_conf_dtls_srtp_protection_profiles
sizeof( default_profiles ) / sizeof( mbedtls_ssl_srtp_profile ) ); ( &conf,
default_profiles,
sizeof( default_profiles ) / sizeof( mbedtls_ssl_srtp_profile ) );
} }
if( ret != 0 ) if( ret != 0 )