Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1220)

Side by Side Diff: srtp/ekt.c

Issue 2344973002: Update libsrtp to version 2.0 (Closed)
Patch Set: Add '.' back to include_dirs Created 4 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « srtp/doc/references.txt ('k') | srtp/include/ekt.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * ekt.c 2 * ekt.c
3 * 3 *
4 * Encrypted Key Transport for SRTP 4 * Encrypted Key Transport for SRTP
5 * 5 *
6 * David McGrew 6 * David McGrew
7 * Cisco Systems, Inc. 7 * Cisco Systems, Inc.
8 */ 8 */
9 /* 9 /*
10 * 10 *
(...skipping 29 matching lines...) Expand all
40 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 40 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
41 * OF THE POSSIBILITY OF SUCH DAMAGE. 41 * OF THE POSSIBILITY OF SUCH DAMAGE.
42 * 42 *
43 */ 43 */
44 44
45 45
46 #include "srtp_priv.h" 46 #include "srtp_priv.h"
47 #include "err.h" 47 #include "err.h"
48 #include "ekt.h" 48 #include "ekt.h"
49 49
50 extern debug_module_t mod_srtp; 50 extern srtp_debug_module_t mod_srtp;
51 51
52 /* 52 /*
53 * The EKT Authentication Tag format. 53 * The EKT Authentication Tag format.
54 * 54 *
55 * 0 1 2 3 55 * 0 1 2 3
56 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 56 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
57 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 57 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
58 * : Base Authentication Tag : 58 * : Base Authentication Tag :
59 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 59 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
60 * : Encrypted Master Key : 60 * : Encrypted Master Key :
61 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 61 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
62 * | Rollover Counter | 62 * | Rollover Counter |
63 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 63 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
64 * | Initial Sequence Number | Security Parameter Index | 64 * | Initial Sequence Number | Security Parameter Index |
65 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 65 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
66 * 66 *
67 */ 67 */
68 68
69 #define EKT_OCTETS_AFTER_BASE_TAG 24 69 #define EKT_OCTETS_AFTER_BASE_TAG 24
70 #define EKT_OCTETS_AFTER_EMK 8 70 #define EKT_OCTETS_AFTER_EMK 8
71 #define EKT_OCTETS_AFTER_ROC 4 71 #define EKT_OCTETS_AFTER_ROC 4
72 #define EKT_SPI_LEN 2 72 #define EKT_SPI_LEN 2
73 73
74 unsigned 74 unsigned srtp_ekt_octets_after_base_tag(srtp_ekt_stream_t ekt) {
75 ekt_octets_after_base_tag(ekt_stream_t ekt) {
76 /* 75 /*
77 * if the pointer ekt is NULL, then EKT is not in effect, so we 76 * if the pointer ekt is NULL, then EKT is not in effect, so we
78 * indicate this by returning zero 77 * indicate this by returning zero
79 */ 78 */
80 if (!ekt) 79 if (!ekt)
81 return 0; 80 return 0;
82 81
83 switch(ekt->data->ekt_cipher_type) { 82 switch(ekt->data->ekt_cipher_type) {
84 case EKT_CIPHER_AES_128_ECB: 83 case SRTP_EKT_CIPHER_AES_128_ECB:
85 return 16 + EKT_OCTETS_AFTER_EMK; 84 return 16 + EKT_OCTETS_AFTER_EMK;
86 break; 85 break;
87 default: 86 default:
88 break; 87 break;
89 } 88 }
90 return 0; 89 return 0;
91 } 90 }
92 91
93 static inline ekt_spi_t 92 static inline srtp_ekt_spi_t srtcp_packet_get_ekt_spi(const uint8_t *packet_star t, unsigned pkt_octet_len) {
94 srtcp_packet_get_ekt_spi(const uint8_t *packet_start, unsigned pkt_octet_len) {
95 const uint8_t *spi_location; 93 const uint8_t *spi_location;
96 94
97 spi_location = packet_start + (pkt_octet_len - EKT_SPI_LEN); 95 spi_location = packet_start + (pkt_octet_len - EKT_SPI_LEN);
98 96
99 return *((const ekt_spi_t *)spi_location); 97 return *((const srtp_ekt_spi_t *)spi_location);
100 } 98 }
101 99
102 static inline uint32_t 100 static inline uint32_t srtcp_packet_get_ekt_roc(const uint8_t *packet_start, uns igned pkt_octet_len) {
103 srtcp_packet_get_ekt_roc(const uint8_t *packet_start, unsigned pkt_octet_len) {
104 const uint8_t *roc_location; 101 const uint8_t *roc_location;
105 102
106 roc_location = packet_start + (pkt_octet_len - EKT_OCTETS_AFTER_ROC); 103 roc_location = packet_start + (pkt_octet_len - EKT_OCTETS_AFTER_ROC);
107 104
108 return *((const uint32_t *)roc_location); 105 return *((const uint32_t *)roc_location);
109 } 106 }
110 107
111 static inline const uint8_t * 108 static inline const uint8_t * srtcp_packet_get_emk_location(const uint8_t *packe t_start, unsigned pkt_octet_len) {
112 srtcp_packet_get_emk_location(const uint8_t *packet_start,
113 » » » unsigned pkt_octet_len) {
114 const uint8_t *location; 109 const uint8_t *location;
115 110
116 location = packet_start + (pkt_octet_len - EKT_OCTETS_AFTER_BASE_TAG); 111 location = packet_start + (pkt_octet_len - EKT_OCTETS_AFTER_BASE_TAG);
117 112
118 return location; 113 return location;
119 } 114 }
120 115
121 116
122 err_status_t 117 srtp_err_status_t srtp_ekt_alloc(srtp_ekt_stream_t *stream_data, srtp_ekt_policy _t policy) {
123 ekt_alloc(ekt_stream_t *stream_data, ekt_policy_t policy) {
124 118
125 /* 119 /*
126 * if the policy pointer is NULL, then EKT is not in use 120 * if the policy pointer is NULL, then EKT is not in use
127 * so we just set the EKT stream data pointer to NULL 121 * so we just set the EKT stream data pointer to NULL
128 */ 122 */
129 if (!policy) { 123 if (!policy) {
130 *stream_data = NULL; 124 *stream_data = NULL;
131 return err_status_ok; 125 return srtp_err_status_ok;
132 } 126 }
133 127
134 /* TODO */ 128 /* TODO */
135 *stream_data = NULL; 129 *stream_data = NULL;
136 130
137 return err_status_ok; 131 return srtp_err_status_ok;
138 } 132 }
139 133
140 err_status_t 134 srtp_err_status_t srtp_ekt_stream_init_from_policy(srtp_ekt_stream_t stream_data , srtp_ekt_policy_t policy) {
141 ekt_stream_init_from_policy(ekt_stream_t stream_data, ekt_policy_t policy) {
142 if (!stream_data) 135 if (!stream_data)
143 return err_status_ok; 136 return srtp_err_status_ok;
144 137
145 return err_status_ok; 138 return srtp_err_status_ok;
146 } 139 }
147 140
148 141
149 void 142 void aes_decrypt_with_raw_key(void *ciphertext, const void *key, int key_len) {
150 aes_decrypt_with_raw_key(void *ciphertext, const void *key, int key_len) {
151 #ifndef OPENSSL 143 #ifndef OPENSSL
152 //FIXME: need to get this working through the crypto module interface 144 //FIXME: need to get this working through the crypto module interface
153 aes_expanded_key_t expanded_key; 145 srtp_aes_expanded_key_t expanded_key;
154 146
155 aes_expand_decryption_key(key, key_len, &expanded_key); 147 srtp_aes_expand_decryption_key(key, key_len, &expanded_key);
156 aes_decrypt(ciphertext, &expanded_key); 148 srtp_aes_decrypt(ciphertext, &expanded_key);
157 #endif 149 #endif
158 } 150 }
159 151
160 /* 152 /*
161 * The function srtp_stream_init_from_ekt() initializes a stream using 153 * The function srtp_stream_init_from_ekt() initializes a stream using
162 * the EKT data from an SRTCP trailer. 154 * the EKT data from an SRTCP trailer.
163 */ 155 */
164 156
165 err_status_t 157 srtp_err_status_t srtp_stream_init_from_ekt(srtp_stream_t stream, const void *sr tcp_hdr, unsigned pkt_octet_len) {
166 srtp_stream_init_from_ekt(srtp_stream_t stream,»» » 158 srtp_err_status_t err;
167 » » » const void *srtcp_hdr,
168 » » » unsigned pkt_octet_len) {
169 err_status_t err;
170 const uint8_t *master_key; 159 const uint8_t *master_key;
171 srtp_policy_t srtp_policy; 160 srtp_policy_t srtp_policy;
172 uint32_t roc; 161 uint32_t roc;
173 162
174 /* 163 /*
175 * NOTE: at present, we only support a single ekt_policy at a time. 164 * NOTE: at present, we only support a single ekt_policy at a time.
176 */ 165 */
177 if (stream->ekt->data->spi != 166 if (stream->ekt->data->spi !=
178 srtcp_packet_get_ekt_spi(srtcp_hdr, pkt_octet_len)) 167 srtcp_packet_get_ekt_spi(srtcp_hdr, pkt_octet_len))
179 return err_status_no_ctx; 168 return srtp_err_status_no_ctx;
180 169
181 if (stream->ekt->data->ekt_cipher_type != EKT_CIPHER_AES_128_ECB) 170 if (stream->ekt->data->ekt_cipher_type != SRTP_EKT_CIPHER_AES_128_ECB)
182 return err_status_bad_param; 171 return srtp_err_status_bad_param;
183 172
184 /* decrypt the Encrypted Master Key field */ 173 /* decrypt the Encrypted Master Key field */
185 master_key = srtcp_packet_get_emk_location(srtcp_hdr, pkt_octet_len); 174 master_key = srtcp_packet_get_emk_location(srtcp_hdr, pkt_octet_len);
186 /* FIX!? This decrypts the master key in-place, and never uses it */ 175 /* FIX!? This decrypts the master key in-place, and never uses it */
187 /* FIX!? It's also passing to ekt_dec_key (which is an aes_expanded_key_t) 176 /* FIX!? It's also passing to ekt_dec_key (which is an aes_expanded_key_t)
188 * to a function which expects a raw (unexpanded) key */ 177 * to a function which expects a raw (unexpanded) key */
189 aes_decrypt_with_raw_key((void*)master_key, &stream->ekt->data->ekt_dec_key, 1 6); 178 aes_decrypt_with_raw_key((void*)master_key, &stream->ekt->data->ekt_dec_key, 1 6);
190 179
191 /* set the SRTP ROC */ 180 /* set the SRTP ROC */
192 roc = srtcp_packet_get_ekt_roc(srtcp_hdr, pkt_octet_len); 181 roc = srtcp_packet_get_ekt_roc(srtcp_hdr, pkt_octet_len);
193 err = rdbx_set_roc(&stream->rtp_rdbx, roc); 182 err = srtp_rdbx_set_roc(&stream->rtp_rdbx, roc);
194 if (err) return err; 183 if (err) return err;
195 184
196 err = srtp_stream_init(stream, &srtp_policy); 185 err = srtp_stream_init(stream, &srtp_policy);
197 if (err) return err; 186 if (err) return err;
198 187
199 return err_status_ok; 188 return srtp_err_status_ok;
200 } 189 }
201 190
202 void 191 void srtp_ekt_write_data(srtp_ekt_stream_t ekt, uint8_t *base_tag, unsigned base _tag_len, int *packet_len, srtp_xtd_seq_num_t pkt_index) {
203 ekt_write_data(ekt_stream_t ekt,
204 » uint8_t *base_tag,
205 » unsigned base_tag_len,
206 » int *packet_len,
207 » xtd_seq_num_t pkt_index) {
208 uint32_t roc; 192 uint32_t roc;
209 uint16_t isn; 193 uint16_t isn;
210 unsigned emk_len; 194 unsigned emk_len;
211 uint8_t *packet; 195 uint8_t *packet;
212 196
213 /* if the pointer ekt is NULL, then EKT is not in effect */ 197 /* if the pointer ekt is NULL, then EKT is not in effect */
214 if (!ekt) { 198 if (!ekt) {
215 debug_print(mod_srtp, "EKT not in use", NULL); 199 debug_print(mod_srtp, "EKT not in use", NULL);
216 return; 200 return;
217 } 201 }
218 202
219 /* write zeros into the location of the base tag */ 203 /* write zeros into the location of the base tag */
220 octet_string_set_to_zero(base_tag, base_tag_len); 204 octet_string_set_to_zero(base_tag, base_tag_len);
221 packet = base_tag + base_tag_len; 205 packet = base_tag + base_tag_len;
222 206
223 /* copy encrypted master key into packet */ 207 /* copy encrypted master key into packet */
224 emk_len = ekt_octets_after_base_tag(ekt); 208 emk_len = srtp_ekt_octets_after_base_tag(ekt);
225 memcpy(packet, ekt->encrypted_master_key, emk_len); 209 memcpy(packet, ekt->encrypted_master_key, emk_len);
226 debug_print(mod_srtp, "writing EKT EMK: %s,", 210 debug_print(mod_srtp, "writing EKT EMK: %s,",
227 » octet_string_hex_string(packet, emk_len)); 211 » srtp_octet_string_hex_string(packet, emk_len));
228 packet += emk_len; 212 packet += emk_len;
229 213
230 /* copy ROC into packet */ 214 /* copy ROC into packet */
231 roc = (uint32_t)(pkt_index >> 16); 215 roc = (uint32_t)(pkt_index >> 16);
232 *((uint32_t *)packet) = be32_to_cpu(roc); 216 *((uint32_t *)packet) = be32_to_cpu(roc);
233 debug_print(mod_srtp, "writing EKT ROC: %s,", 217 debug_print(mod_srtp, "writing EKT ROC: %s,",
234 » octet_string_hex_string(packet, sizeof(roc))); 218 » srtp_octet_string_hex_string(packet, sizeof(roc)));
235 packet += sizeof(roc); 219 packet += sizeof(roc);
236 220
237 /* copy ISN into packet */ 221 /* copy ISN into packet */
238 isn = (uint16_t)pkt_index; 222 isn = (uint16_t)pkt_index;
239 *((uint16_t *)packet) = htons(isn); 223 *((uint16_t *)packet) = htons(isn);
240 debug_print(mod_srtp, "writing EKT ISN: %s,", 224 debug_print(mod_srtp, "writing EKT ISN: %s,",
241 » octet_string_hex_string(packet, sizeof(isn))); 225 » srtp_octet_string_hex_string(packet, sizeof(isn)));
242 packet += sizeof(isn); 226 packet += sizeof(isn);
243 227
244 /* copy SPI into packet */ 228 /* copy SPI into packet */
245 *((uint16_t *)packet) = htons(ekt->data->spi); 229 *((uint16_t *)packet) = htons(ekt->data->spi);
246 debug_print(mod_srtp, "writing EKT SPI: %s,", 230 debug_print(mod_srtp, "writing EKT SPI: %s,",
247 » octet_string_hex_string(packet, sizeof(ekt->data->spi))); 231 » srtp_octet_string_hex_string(packet, sizeof(ekt->data->spi)));
248 232
249 /* increase packet length appropriately */ 233 /* increase packet length appropriately */
250 *packet_len += EKT_OCTETS_AFTER_EMK + emk_len; 234 *packet_len += EKT_OCTETS_AFTER_EMK + emk_len;
251 } 235 }
252 236
253 237
254 /* 238 /*
255 * The function call srtcp_ekt_trailer(ekt, auth_len, auth_tag ) 239 * The function call srtcp_ekt_trailer(ekt, auth_len, auth_tag )
256 * 240 *
257 * If the pointer ekt is NULL, then the other inputs are unaffected. 241 * If the pointer ekt is NULL, then the other inputs are unaffected.
258 * 242 *
259 * auth_tag is a pointer to the pointer to the location of the 243 * auth_tag is a pointer to the pointer to the location of the
260 * authentication tag in the packet. If EKT is in effect, then the 244 * authentication tag in the packet. If EKT is in effect, then the
261 * auth_tag pointer is set to the location 245 * auth_tag pointer is set to the location
262 */ 246 */
263 247
264 void 248 void srtcp_ekt_trailer(srtp_ekt_stream_t ekt, unsigned *auth_len, void **auth_ta g, void *tag_copy) {
265 srtcp_ekt_trailer(ekt_stream_t ekt,
266 » » unsigned *auth_len,
267 » » void **auth_tag,
268 » » void *tag_copy) {
269
270 /* 249 /*
271 * if there is no EKT policy, then the other inputs are unaffected 250 * if there is no EKT policy, then the other inputs are unaffected
272 */ 251 */
273 if (!ekt) 252 if (!ekt)
274 return; 253 return;
275 254
276 /* copy auth_tag into temporary location */ 255 /* copy auth_tag into temporary location */
277 256
278 } 257 }
279 258
OLDNEW
« no previous file with comments | « srtp/doc/references.txt ('k') | srtp/include/ekt.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698