Add DTLS-SRTP. (333f926d) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+6 −0

Original line number	Diff line number	Diff line
		@@ -198,6 +198,12 @@
		security.
		[Emilia Käsper <emilia.kasper@esat.kuleuven.be> (Google)]

		*) Add DTLS-SRTP negotiation from RFC 5764.
		[Eric Rescorla]

		*) Add DTLS-SRTP negotiation from RFC 5764.
		[Eric Rescorla]

		*) Add Next Protocol Negotiation,
		http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
		disabled with a no-npn flag to config or Configure. Code donated

apps/s_client.c

+18 −1

Original line number	Diff line number	Diff line
		@@ -359,6 +359,7 @@ static void sc_usage(void)
		# endif
		#endif
		BIO_printf(bio_err," -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n");
		BIO_printf(bio_err," -use_srtp profiles - Offer SRTP key management with a colon-separated profile list");
		}

		#ifndef OPENSSL_NO_TLSEXT
		@@ -487,6 +488,7 @@ static char * MS_CALLBACK missing_srp_username_callback(SSL s, void arg)
		}

		#endif
		char *srtp_profiles = NULL;

		# ifndef OPENSSL_NO_NEXTPROTONEG
		/* This the context that we pass to next_proto_cb */
		@@ -935,6 +937,11 @@ int MAIN(int argc, char **argv)
		jpake_secret = *++argv;
		}
		#endif
		else if (strcmp(*argv,"-use_srtp") == 0)
		{
		if (--argc < 1) goto bad;
		srtp_profiles = *(++argv);
		}
		else
		{
		BIO_printf(bio_err,"unknown option %s\n",*argv);
		@@ -1105,6 +1112,8 @@ bad:
		BIO_printf(bio_c_out, "PSK key given or JPAKE in use, setting client callback\n");
		SSL_CTX_set_psk_client_callback(ctx, psk_client_cb);
		}
		if (srtp_profiles != NULL)
		SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
		#endif
		if (bugs)
		SSL_CTX_set_options(ctx,SSL_OP_ALL\|off);
		@@ -2027,6 +2036,14 @@ static void print_stuff(BIO bio, SSL s, int full)
		}
		#endif

		{
		SRTP_PROTECTION_PROFILE *srtp_profile=SSL_get_selected_srtp_profile(s);

		if(srtp_profile)
		BIO_printf(bio,"SRTP Extension negotiated, profile=%s\n",
		srtp_profile->name);
		}

		SSL_SESSION_print(bio,SSL_get_session(s));
		BIO_printf(bio,"---\n");
		if (peer != NULL)

apps/s_server.c

+21 −1

Original line number	Diff line number	Diff line
		@@ -309,6 +309,7 @@ static long socket_mtu;
		static int cert_chain = 0;
		#endif


		#ifndef OPENSSL_NO_PSK
		static char *psk_identity="Client_identity";
		char psk_key=NULL; / by default PSK is not used */
		@@ -545,6 +546,7 @@ static void sv_usage(void)
		# ifndef OPENSSL_NO_NEXTPROTONEG
		BIO_printf(bio_err," -nextprotoneg arg - set the advertised protocols for the NPN extension (comma-separated list)\n");
		# endif
		BIO_printf(bio_err," -use_srtp profiles - Offer SRTP key management with a colon-separated profile list");
		#endif
		}

		@@ -910,6 +912,7 @@ int MAIN(int, char **);
		#ifndef OPENSSL_NO_JPAKE
		static char *jpake_secret = NULL;
		#endif
		static char *srtp_profiles = NULL;

		int MAIN(int argc, char *argv[])
		{
		@@ -1324,6 +1327,11 @@ int MAIN(int argc, char *argv[])
		jpake_secret = *(++argv);
		}
		#endif
		else if (strcmp(*argv,"-use_srtp") == 0)
		{
		if (--argc < 1) goto bad;
		srtp_profiles = *(++argv);
		}
		else
		{
		BIO_printf(bio_err,"unknown option %s\n",*argv);
		@@ -1540,6 +1548,9 @@ bad:
		else
		SSL_CTX_sess_set_cache_size(ctx,128);

		if (srtp_profiles != NULL)
		SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);

		#if 0
		if (cipher == NULL) cipher=getenv("SSL_CIPHER");
		#endif
		@@ -2391,10 +2402,19 @@ static int init_ssl_connection(SSL *con)
		BIO_printf(bio_s_out, "\n");
		}
		#endif
		{
		SRTP_PROTECTION_PROFILE *srtp_profile
		= SSL_get_selected_srtp_profile(con);

		if(srtp_profile)
		BIO_printf(bio_s_out,"SRTP Extension negotiated, profile=%s\n",
		srtp_profile->name);
		}
		if (SSL_cache_hit(con)) BIO_printf(bio_s_out,"Reused session-id\n");
		if (SSL_ctrl(con,SSL_CTRL_GET_FLAGS,0,NULL) &
		TLS1_FLAGS_TLS_PADDING_BUG)
		BIO_printf(bio_s_out,"Peer has incorrect TLSv1 block padding\n");
		BIO_printf(bio_s_out,
		"Peer has incorrect TLSv1 block padding\n");
		#ifndef OPENSSL_NO_KRB5
		client_princ = kssl_ctx_get0_client_princ(SSL_get0_kssl_ctx(con));
		if (client_princ != NULL)

crypto/stack/safestack.h

+22 −0

Original line number	Diff line number	Diff line
		@@ -1525,6 +1525,28 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void)
		#define sk_SRP_user_pwd_sort(st) SKM_sk_sort(SRP_user_pwd, (st))
		#define sk_SRP_user_pwd_is_sorted(st) SKM_sk_is_sorted(SRP_user_pwd, (st))

		#define sk_SRTP_PROTECTION_PROFILE_new(cmp) SKM_sk_new(SRTP_PROTECTION_PROFILE, (cmp))
		#define sk_SRTP_PROTECTION_PROFILE_new_null() SKM_sk_new_null(SRTP_PROTECTION_PROFILE)
		#define sk_SRTP_PROTECTION_PROFILE_free(st) SKM_sk_free(SRTP_PROTECTION_PROFILE, (st))
		#define sk_SRTP_PROTECTION_PROFILE_num(st) SKM_sk_num(SRTP_PROTECTION_PROFILE, (st))
		#define sk_SRTP_PROTECTION_PROFILE_value(st, i) SKM_sk_value(SRTP_PROTECTION_PROFILE, (st), (i))
		#define sk_SRTP_PROTECTION_PROFILE_set(st, i, val) SKM_sk_set(SRTP_PROTECTION_PROFILE, (st), (i), (val))
		#define sk_SRTP_PROTECTION_PROFILE_zero(st) SKM_sk_zero(SRTP_PROTECTION_PROFILE, (st))
		#define sk_SRTP_PROTECTION_PROFILE_push(st, val) SKM_sk_push(SRTP_PROTECTION_PROFILE, (st), (val))
		#define sk_SRTP_PROTECTION_PROFILE_unshift(st, val) SKM_sk_unshift(SRTP_PROTECTION_PROFILE, (st), (val))
		#define sk_SRTP_PROTECTION_PROFILE_find(st, val) SKM_sk_find(SRTP_PROTECTION_PROFILE, (st), (val))
		#define sk_SRTP_PROTECTION_PROFILE_find_ex(st, val) SKM_sk_find_ex(SRTP_PROTECTION_PROFILE, (st), (val))
		#define sk_SRTP_PROTECTION_PROFILE_delete(st, i) SKM_sk_delete(SRTP_PROTECTION_PROFILE, (st), (i))
		#define sk_SRTP_PROTECTION_PROFILE_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRTP_PROTECTION_PROFILE, (st), (ptr))
		#define sk_SRTP_PROTECTION_PROFILE_insert(st, val, i) SKM_sk_insert(SRTP_PROTECTION_PROFILE, (st), (val), (i))
		#define sk_SRTP_PROTECTION_PROFILE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRTP_PROTECTION_PROFILE, (st), (cmp))
		#define sk_SRTP_PROTECTION_PROFILE_dup(st) SKM_sk_dup(SRTP_PROTECTION_PROFILE, st)
		#define sk_SRTP_PROTECTION_PROFILE_pop_free(st, free_func) SKM_sk_pop_free(SRTP_PROTECTION_PROFILE, (st), (free_func))
		#define sk_SRTP_PROTECTION_PROFILE_shift(st) SKM_sk_shift(SRTP_PROTECTION_PROFILE, (st))
		#define sk_SRTP_PROTECTION_PROFILE_pop(st) SKM_sk_pop(SRTP_PROTECTION_PROFILE, (st))
		#define sk_SRTP_PROTECTION_PROFILE_sort(st) SKM_sk_sort(SRTP_PROTECTION_PROFILE, (st))
		#define sk_SRTP_PROTECTION_PROFILE_is_sorted(st) SKM_sk_is_sorted(SRTP_PROTECTION_PROFILE, (st))

		#define sk_SSL_CIPHER_new(cmp) SKM_sk_new(SSL_CIPHER, (cmp))
		#define sk_SSL_CIPHER_new_null() SKM_sk_new_null(SSL_CIPHER)
		#define sk_SSL_CIPHER_free(st) SKM_sk_free(SSL_CIPHER, (st))

ssl/Makefile

+3 −3

Original line number	Diff line number	Diff line
		@@ -26,7 +26,7 @@ LIBSRC= \
		s23_meth.c s23_srvr.c s23_clnt.c s23_lib.c s23_pkt.c \
		t1_meth.c t1_srvr.c t1_clnt.c t1_lib.c t1_enc.c \
		d1_meth.c d1_srvr.c d1_clnt.c d1_lib.c d1_pkt.c \
		d1_both.c d1_enc.c \
		d1_both.c d1_enc.c d1_srtp.c \
		ssl_lib.c ssl_err2.c ssl_cert.c ssl_sess.c \
		ssl_ciph.c ssl_stat.c ssl_rsa.c \
		ssl_asn1.c ssl_txt.c ssl_algs.c \
		@@ -37,7 +37,7 @@ LIBOBJ= \
		s23_meth.o s23_srvr.o s23_clnt.o s23_lib.o s23_pkt.o \
		t1_meth.o t1_srvr.o t1_clnt.o t1_lib.o t1_enc.o \
		d1_meth.o d1_srvr.o d1_clnt.o d1_lib.o d1_pkt.o \
		d1_both.o d1_enc.o \
		d1_both.o d1_enc.o d1_srtp.o\
		ssl_lib.o ssl_err2.o ssl_cert.o ssl_sess.o \
		ssl_ciph.o ssl_stat.o ssl_rsa.o \
		ssl_asn1.o ssl_txt.o ssl_algs.o \
		@@ -45,7 +45,7 @@ LIBOBJ= \

		SRC= $(LIBSRC)

		EXHEADER= ssl.h ssl2.h ssl3.h ssl23.h tls1.h dtls1.h kssl.h
		EXHEADER= ssl.h ssl2.h ssl3.h ssl23.h tls1.h dtls1.h kssl.h srtp.h
		HEADER= $(EXHEADER) ssl_locl.h kssl_lcl.h

		ALL= $(GENERAL) $(SRC) $(HEADER)