#include <gcrypt.h>
+#define debug( ... ) (void)0
+
/* TODO:
* Useful stuff:
* - ROC profil thingy (multicast really needs this)
gcry_cipher_hd_t cipher;
gcry_md_hd_t mac;
uint32_t salt[4];
- uint8_t mac_len;
} srtp_proto_t;
struct srtp_session_t
uint32_t rtcp_index;
uint32_t rtp_roc;
uint16_t rtp_seq;
+ uint8_t tag_len;
};
enum
if (winsize != 0)
return NULL; // FIXME: replay protection not implemented yet
- uint8_t mac_len;
+ uint8_t tag_len;
int cipher = GCRY_CIPHER_AES, md = GCRY_MD_SHA1;
if (strcmp (name, "AES_CM_128_HMAC_SHA1_80") == 0)
- mac_len = 80;
+ tag_len = 10;
else
if (strcmp (name, "AES_CM_128_HMAC_SHA1_32") == 0)
- mac_len = 32;
+ tag_len = 4;
else
// F8_128_HMAC_SHA1_80 is not implemented
return NULL;
memset (s, 0, sizeof (*s));
s->flags = flags;
s->kdr = kdr;
+ s->tag_len = tag_len;
if (proto_create (&s->rtp, cipher, md) == 0)
{
return 0;
}
+#include <stdio.h>
static int
proto_derive (srtp_proto_t *p, gcry_cipher_hd_t prf,
if (saltlen != 14)
return -1;
- uint8_t cipherkey[16];
+ uint32_t cipherkey[4], authkey[5];
uint8_t label = rtcp ? SRTCP_CRYPT : SRTP_CRYPT;
if (derive (prf, salt, r, rlen, label++, cipherkey, 16)
|| gcry_cipher_setkey (p->cipher, cipherkey, 16)
- || derive (prf, salt, r, rlen, label++, NULL, 0) /* FIXME HMAC */
+ || derive (prf, salt, r, rlen, label++, authkey, 20)
+ || gcry_md_setkey (p->mac, authkey, 20)
|| derive (prf, salt, r, rlen, label++, p->salt, 14))
return -1;
+ debug (" cipher key: %08x%08x%08x%08x\n auth key: %08x%08x%08x%08x%08x\n",
+ ntohl (cipherkey[0]), ntohl (cipherkey[1]), ntohl (cipherkey[2]),
+ ntohl (cipherkey[3]), ntohl (authkey[0]), ntohl (authkey[1]),
+ ntohl (authkey[2]), ntohl (authkey[3]), ntohl (authkey[4]));
+
return 0;
}
}
+/** Message Authentication and Integrity for RTP */
+static const uint8_t *
+rtp_digest (gcry_md_hd_t md, const void *data, size_t len, uint32_t roc)
+{
+ gcry_md_reset (md);
+ gcry_md_write (md, data, len);
+ gcry_md_write (md, &(uint32_t){ htonl (roc) }, 4);
+ return gcry_md_read (md, 0);
+}
+
+
/**
* Encrypts/decrypts a RTP packet and updates SRTP context
* (CTR block cypher mode of operation has identical encryption and
* @return 0 on success, in case of error:
* EINVAL malformatted RTP packet
*/
-static int srtp_encrypt (srtp_session_t *s, uint8_t *buf, size_t len)
+static int srtp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
{
assert (s != NULL);
return EINVAL;
memcpy (&extlen, buf + offset - 2, 2);
- offset += htons (extlen);
+ offset += htons (extlen); // skips RTP extension header
}
if (len < offset)
* @param bufsize size (bytes) of the packet buffer
*
* @return 0 on success, in case of error:
- * EINVAL malformatted RTP packet
+ * EINVAL malformatted RTP packet or internal error
* ENOSPC bufsize is too small (to add authentication tag)
*/
int
srtp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t bufsize)
{
size_t len = *lenp;
- int val = srtp_encrypt (s, buf, len);
+ int val = srtp_crypt (s, buf, len);
if (val)
return val;
- if (bufsize < (len + s->rtp.mac_len))
+ if (s->flags & SRTP_UNAUTHENTICATED)
+ return 0;
+
+ if (bufsize < (len + s->tag_len))
return ENOSPC;
- /* FIXME: HMAC and anti-replay */
+ const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, s->rtp_roc);
+ memcpy (buf + len, tag, s->tag_len);
+ *lenp = len + s->tag_len;
+
return 0;
}
/**
- * Turns a RTP packet into a SRTP packet: encrypt it, then computes
- * the authentication tag and appends it.
- * Note that you can encrypt packet in disorder.
+ * Turns a SRTP packet into a RTP packet: authenticates the packet,
+ * then decrypts it.
*
- * @param buf RTP packet to be decrypted/digested
+ * @param buf RTP packet to be digested/decrypted
* @param lenp pointer to the RTP packet length on entry,
* set to the SRTP length on exit (undefined in case of error)
*
* @return 0 on success, in case of error:
- * EINVAL malformatted RTP packet
+ * EINVAL malformatted SRTP packet
* EACCES authentication failed (spoofed packet or out-of-sync)
*/
int
srtp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
{
size_t len = *lenp;
- int val = srtp_encrypt (s, buf, len);
- if (val)
- return val;
- /* FIXME: HMAC and anti-replay */
- return 0;
+ if (!(s->flags & SRTP_UNAUTHENTICATED))
+ {
+ if (len < s->tag_len)
+ return EINVAL;
+ len -= s->tag_len;
+ *lenp = len;
+
+ const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, s->rtp_roc);
+ debug (" Auth tag: %08x%08x%04x (wanted)\n"
+ " Auth tag: %08x%08x%04x (recv'd)\n",
+ ntohl (((uint32_t *)tag)[0]), ntohl (((uint32_t *)tag)[1]),
+ ntohs (((uint16_t *)tag)[4]),
+ ntohl (((uint32_t *)w)[0]), ntohl (((uint32_t *)w)[1]),
+ ntohs (((uint16_t *)w)[4]));
+ if (memcmp (buf + len, tag, s->tag_len))
+ return EACCES;
+ }
+
+ /* FIXME: anti-replay */
+
+ return srtp_crypt (s, buf, len);
}