/* TODO:
* Useful stuff:
* - ROC profile thingy (multicast really needs this)
- * - replay protection
*
* Useless stuff (because nothing depends on it):
* - non-nul key derivation rate
{
gcry_cipher_hd_t cipher;
gcry_md_hd_t mac;
+ uint64_t window;
uint32_t salt[4];
} srtp_proto_t;
uint32_t rtcp_index;
uint32_t rtp_roc;
uint16_t rtp_seq;
+ uint16_t rtp_rcc;
uint8_t tag_len;
};
SRTCP_SALT
};
+
#ifdef WIN32
# include <winsock2.h>
#else
* internal cryptographic counters; it is however of course feasible to open
* multiple simultaneous sessions with the same master key.
*
- * @param name cipher-suite name
- * @param kdr key derivation rate
- * @param winsize anti-replay windows size (between 64 and 32767 inclusive)
- * 0 disable replay attack protection (OK for send only)
+ * @param encr encryption algorithm number
+ * @param auth authentication algortihm number
+ * @param tag_len authentication tag byte length (NOT including RCC)
* @param flags OR'ed optional flags.
*
* @return NULL in case of error
*/
srtp_session_t *
-srtp_create (const char *name, unsigned flags, unsigned kdr, uint16_t winsize)
+srtp_create (int encr, int auth, unsigned tag_len, int prf, unsigned flags)
{
- assert (name != NULL);
+ if ((flags & ~SRTP_FLAGS_MASK) || init_libgcrypt ())
+ return NULL;
- if (kdr != 0)
- return NULL; // FIXME: KDR not implemented yet
- if (winsize != 0)
- return NULL; // FIXME: replay protection not implemented yet
+ int cipher, md;
+ switch (encr)
+ {
+ case SRTP_ENCR_NULL:
+ cipher = GCRY_CIPHER_NONE;
+ break;
- uint8_t tag_len;
- int cipher = GCRY_CIPHER_AES, md = GCRY_MD_SHA1;
+ case SRTP_ENCR_AES_CM:
+ cipher = GCRY_CIPHER_AES;
+ break;
- if (strcmp (name, "AES_CM_128_HMAC_SHA1_80") == 0)
- tag_len = 10;
- else
- if (strcmp (name, "AES_CM_128_HMAC_SHA1_32") == 0)
- tag_len = 4;
- else
- // F8_128_HMAC_SHA1_80 is not implemented
+ default:
+ return NULL;
+ }
+
+ switch (auth)
+ {
+ case SRTP_AUTH_NULL:
+ md = GCRY_MD_NONE;
+ break;
+
+ case SRTP_AUTH_HMAC_SHA1:
+ md = GCRY_MD_SHA1;
+ break;
+
+ default:
+ return NULL;
+ }
+
+ if (tag_len > gcry_md_get_algo_dlen (auth))
return NULL;
- if ((flags & ~SRTP_FLAGS_MASK) || (winsize > 32767) || init_libgcrypt ())
+ if (prf != SRTP_PRF_AES_CM)
return NULL;
srtp_session_t *s = malloc (sizeof (*s));
memset (s, 0, sizeof (*s));
s->flags = flags;
- s->kdr = kdr;
s->tag_len = tag_len;
if (proto_create (&s->rtp, cipher, md) == 0)
}
+/**
+ * Sets Roll-over-Counter Carry (RCC) rate for the SRTP session. If not
+ * specified (through this function), the default rate of ONE is assumed
+ * (i.e. every RTP packets will carry the RoC). RCC rate is ignored if none
+ * of the RCC mode has been selected.
+ *
+ * The RCC mode is selected through one of these flags for srtp_create():
+ * SRTP_RCC_MODE1: integrity protection only for RoC carrying packets
+ * SRTP_RCC_MODE2: integrity protection for all packets
+ * SRTP_RCC_MODE3: no integrity protection
+ *
+ * RCC mode 3 is insecure. Compared to plain RTP, it provides confidentiality
+ * (through encryption) but is much more prone to DoS. It can only be used if
+ * anti-spoofing protection is provided by lower network layers (e.g. IPsec,
+ * or trusted routers and proper source address filtering).
+ *
+ * If RCC rate is 1, RCC mode 1 and 2 are functionally identical.
+ *
+ * @param rate RoC Carry rate (MUST NOT be zero)
+ */
+void srtp_setrcc_rate (srtp_session_t *s, uint16_t rate)
+{
+ assert (rate != 0);
+ s->rtp_rcc = rate;
+}
+
+
/** AES-CM encryption/decryption (ctr length = 16 bytes) */
static int
ctr_crypt (gcry_cipher_hd_t hd, uint32_t *ctr, uint8_t *data, size_t len)
}
+/** Determines SRTP Roll-Over-Counter (in host-byte order) */
+static uint32_t
+srtp_compute_roc (const srtp_session_t *s, uint16_t seq)
+{
+ uint32_t roc = s->rtp_roc;
+
+ if (((seq - s->rtp_seq) & 0xffff) < 0x8000)
+ {
+ /* Sequence is ahead, good */
+ if (seq < s->rtp_seq)
+ roc++; /* Sequence number wrap */
+ }
+ else
+ {
+ /* Sequence is late, bad */
+ if (seq > s->rtp_seq)
+ roc--; /* Wrap back */
+ }
+ return roc;
+}
+
+
+/** Returns RTP sequence (in host-byte order) */
+static inline uint16_t rtp_seq (const uint8_t *buf)
+{
+ return (buf[2] << 8) | buf[3];
+}
+
+
/** Message Authentication and Integrity for RTP */
static const uint8_t *
-rtp_digest (gcry_md_hd_t md, const void *data, size_t len, uint32_t roc)
+rtp_digest (srtp_session_t *s, const uint8_t *data, size_t len)
{
+ const gcry_md_hd_t md = s->rtp.mac;
+ uint32_t roc = htonl (srtp_compute_roc (s, rtp_seq (data)));
+
gcry_md_reset (md);
gcry_md_write (md, data, len);
- gcry_md_write (md, &(uint32_t){ htonl (roc) }, 4);
+ gcry_md_write (md, &roc, 4);
return gcry_md_read (md, 0);
}
*
* @return 0 on success, in case of error:
* EINVAL malformatted RTP packet
+ * EACCES replayed packet or out-of-window or sync lost
*/
static int srtp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
{
return EINVAL;
/* Determines RTP 48-bits counter and SSRC */
- uint32_t ssrc;
+ uint16_t seq = rtp_seq (buf);
+ uint32_t roc = srtp_compute_roc (s, seq), ssrc;
memcpy (&ssrc, buf + 8, 4);
- uint16_t seq = (buf[2] << 8) | buf[3];
- if (((seq - s->rtp_seq) & 0xffff) < 32768)
+ /* Updates ROC and sequence (it's safe now) */
+ int16_t diff = seq - s->rtp_seq;
+ if (diff > 0)
{
- if (seq < s->rtp_seq)
- s->rtp_roc++; /* Sequence number wrap */
+ /* Sequence in the future, good */
+ s->rtp.window = s->rtp.window << diff;
+ s->rtp.window |= 1;
+ s->rtp_seq = seq, s->rtp_roc = roc;
}
else
{
- if (seq > s->rtp_seq)
- s->rtp_roc--;
+ /* Sequence in the past/present, bad */
+ diff = -diff;
+ if ((diff >= 64) || ((s->rtp.window >> diff) & 1))
+ return EACCES; /* Replay attack */
+ s->rtp.window |= 1 << diff;
}
- s->rtp_seq = seq;
-
+ /* Encrypt/Decrypt */
if (s->flags & SRTP_UNENCRYPTED)
return 0;
- if (rtp_crypt (s->rtp.cipher, ssrc, s->rtp_roc, seq, s->rtp.salt,
+ if (rtp_crypt (s->rtp.cipher, ssrc, roc, seq, s->rtp.salt,
buf + offset, len - offset))
return EINVAL;
* @return 0 on success, in case of error:
* EINVAL malformatted RTP packet or internal error
* ENOSPC bufsize is too small (to add authentication tag)
+ * EACCES packet would trigger a replay error on receiver
*/
int
srtp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t bufsize)
if (val)
return val;
- if (s->flags & SRTP_UNAUTHENTICATED)
- return 0;
-
- if (bufsize < (len + s->tag_len))
- return ENOSPC;
+ if (!(s->flags & SRTP_UNAUTHENTICATED))
+ {
+ if (bufsize < (len + s->tag_len))
+ return ENOSPC;
- const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, s->rtp_roc);
- memcpy (buf + len, tag, s->tag_len);
- *lenp = len + s->tag_len;
+ const uint8_t *tag = rtp_digest (s, buf, len);
+ memcpy (buf + len, tag, s->tag_len);
+ *lenp = len + s->tag_len;
+ }
return 0;
}
srtp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
{
size_t len = *lenp;
- /* FIXME: anti-replay */
if (!(s->flags & SRTP_UNAUTHENTICATED))
{
- if (len < s->tag_len)
+ if (len < (12u + s->tag_len))
return EINVAL;
len -= s->tag_len;
- const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, s->rtp_roc);
+ const uint8_t *tag = rtp_digest (s, buf, len);
if (memcmp (buf + len, tag, s->tag_len))
return EACCES;
if ((len < 12) || ((buf[0] >> 6) != 2))
return EINVAL;
- uint32_t index = s->rtcp_index++;
- if (index == 0x7fffffff)
- s->rtcp_index = 0; /* 31-bit wrap */
+ uint32_t index;
+ memcpy (&index, buf + len, 4);
+ index = ntohl (index);
+ if (((index >> 31) != 0) != ((s->flags & SRTCP_UNENCRYPTED) == 0))
+ return EINVAL; // E-bit mismatch
+ index &= ~(1 << 31); // clear E-bit for counter
+
+ /* Updates SRTCP index (safe here) */
+ int32_t diff = index - s->rtcp_index;
+ if (diff > 0)
+ {
+ /* Packet in the future, good */
+ s->rtcp.window = s->rtcp.window << diff;
+ s->rtcp.window |= 1;
+ s->rtcp_index = index;
+ }
+ else
+ {
+ /* Packet in the past/present, bad */
+ diff = -diff;
+ if ((diff >= 64) || ((s->rtcp.window >> diff) & 1))
+ return EACCES; // replay attack!
+ s->rtp.window |= 1 << diff;
+ }
+
+ /* Crypts SRTCP */
if (s->flags & SRTCP_UNENCRYPTED)
return 0;
if (bufsize < (len + 4 + s->tag_len))
return ENOSPC;
- uint32_t index = s->rtcp_index;
+ uint32_t index = ++s->rtcp_index;
+ if (index >> 31)
+ s->rtcp_index = index = 0; /* 31-bit wrap */
+
if ((s->flags & SRTCP_UNENCRYPTED) == 0)
index |= 0x80000000; /* Set Encrypted bit */
memcpy (buf + len, &(uint32_t){ htonl (index) }, 4);
if (val)
return val;
- len += 4; /* Digest SRTCP index too */
+ len += 4; /* Digests SRTCP index too */
const uint8_t *tag = rtcp_digest (s->rtp.mac, buf, len);
memcpy (buf + len, tag, s->tag_len);
srtcp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
{
size_t len = *lenp;
- /* FIXME: anti-replay ?? */
if (len < (4u + s->tag_len))
return EINVAL;
if (memcmp (buf + len, tag, s->tag_len))
return EACCES;
- len -= 4; /* Remove SRTCP index befor decryption */
+ len -= 4; /* Remove SRTCP index before decryption */
*lenp = len;
-
return srtp_crypt (s, buf, len);
}
projects / vlc / blobdiff