sipwise
/
rtpengine
mirror of https://github.com/sipwise/rtpengine.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch 'aes256' of https://github.com/aalba6675/rtpengine

Browse Source
pull/332/head
Richard Fuchs 9 years ago
parent 7088e1586a d5cecc500f
commit 3930f7748e
6 changed files with 249 additions and 39 deletions
Show Stats Download Patch File Download Diff File

172
daemon/crypto.c
Unescape View File

@ -28,7 +28,9 @@ static int hmac_sha1_rtp(struct crypto_context *, char *out, str *in, u_int64_t)
static int hmac_sha1_rtcp(struct crypto_context *, char *out, str *in); static int hmac_sha1_rtcp(struct crypto_context *, char *out, str *in);
static int aes_f8_encrypt_rtp(struct crypto_context *c, struct rtp_header *r, str *s, u_int64_t idx); static int aes_f8_encrypt_rtp(struct crypto_context *c, struct rtp_header *r, str *s, u_int64_t idx);
static int aes_f8_encrypt_rtcp(struct crypto_context *c, struct rtcp_packet *r, str *s, u_int64_t idx); static int aes_f8_encrypt_rtcp(struct crypto_context *c, struct rtcp_packet *r, str *s, u_int64_t idx);
static int aes_cm_session_key_init(struct crypto_context *c); static int aes_cm_session_key_init_128(struct crypto_context *c);
static int aes_cm_session_key_init_192(struct crypto_context *c);
static int aes_cm_session_key_init_256(struct crypto_context *c);
static int aes_f8_session_key_init(struct crypto_context *c); static int aes_f8_session_key_init(struct crypto_context *c);
static int evp_session_key_cleanup(struct crypto_context *c); static int evp_session_key_cleanup(struct crypto_context *c);
static int null_crypt_rtp(struct crypto_context *c, struct rtp_header *r, str *s, u_int64_t idx); static int null_crypt_rtp(struct crypto_context *c, struct rtp_header *r, str *s, u_int64_t idx);
@ -45,7 +47,7 @@ const struct crypto_suite crypto_suites[] = {
.session_salt_len = 14, .session_salt_len = 14,
.srtp_lifetime = 1ULL << 48, .srtp_lifetime = 1ULL << 48,
.srtcp_lifetime = 1ULL << 31, .srtcp_lifetime = 1ULL << 31,
.kernel_cipher = REC_AES_CM, .kernel_cipher = REC_AES_CM_128,
.kernel_hmac = REH_HMAC_SHA1, .kernel_hmac = REH_HMAC_SHA1,
.srtp_auth_tag = 10, .srtp_auth_tag = 10,
.srtcp_auth_tag = 10, .srtcp_auth_tag = 10,
@ -57,7 +59,7 @@ const struct crypto_suite crypto_suites[] = {
.decrypt_rtcp = aes_cm_encrypt_rtcp, .decrypt_rtcp = aes_cm_encrypt_rtcp,
.hash_rtp = hmac_sha1_rtp, .hash_rtp = hmac_sha1_rtp,
.hash_rtcp = hmac_sha1_rtcp, .hash_rtcp = hmac_sha1_rtcp,
.session_key_init = aes_cm_session_key_init, .session_key_init = aes_cm_session_key_init_128,
.session_key_cleanup = evp_session_key_cleanup, .session_key_cleanup = evp_session_key_cleanup,
}, },
{ {
@ -69,7 +71,7 @@ const struct crypto_suite crypto_suites[] = {
.session_salt_len = 14, .session_salt_len = 14,
.srtp_lifetime = 1ULL << 48, .srtp_lifetime = 1ULL << 48,
.srtcp_lifetime = 1ULL << 31, .srtcp_lifetime = 1ULL << 31,
.kernel_cipher = REC_AES_CM, .kernel_cipher = REC_AES_CM_128,
.kernel_hmac = REH_HMAC_SHA1, .kernel_hmac = REH_HMAC_SHA1,
.srtp_auth_tag = 4, .srtp_auth_tag = 4,
.srtcp_auth_tag = 10, .srtcp_auth_tag = 10,
@ -81,7 +83,103 @@ const struct crypto_suite crypto_suites[] = {
.decrypt_rtcp = aes_cm_encrypt_rtcp, .decrypt_rtcp = aes_cm_encrypt_rtcp,
.hash_rtp = hmac_sha1_rtp, .hash_rtp = hmac_sha1_rtp,
.hash_rtcp = hmac_sha1_rtcp, .hash_rtcp = hmac_sha1_rtcp,
.session_key_init = aes_cm_session_key_init, .session_key_init = aes_cm_session_key_init_128,
.session_key_cleanup = evp_session_key_cleanup,
},
{
.name = "AES_CM_192_HMAC_SHA1_80",
//.dtls_name = "SRTP_AES128_CM_SHA1_80",
.master_key_len = 24,
.master_salt_len = 14,
.session_key_len = 24,
.session_salt_len = 14,
.srtp_lifetime = 1ULL << 48,
.srtcp_lifetime = 1ULL << 31,
.kernel_cipher = REC_AES_CM_192,
.kernel_hmac = REH_HMAC_SHA1,
.srtp_auth_tag = 10,
.srtcp_auth_tag = 10,
.srtp_auth_key_len = 20,
.srtcp_auth_key_len = 20,
.encrypt_rtp = aes_cm_encrypt_rtp,
.decrypt_rtp = aes_cm_encrypt_rtp,
.encrypt_rtcp = aes_cm_encrypt_rtcp,
.decrypt_rtcp = aes_cm_encrypt_rtcp,
.hash_rtp = hmac_sha1_rtp,
.hash_rtcp = hmac_sha1_rtcp,
.session_key_init = aes_cm_session_key_init_192,
.session_key_cleanup = evp_session_key_cleanup,
},
{
.name = "AES_CM_192_HMAC_SHA1_32",
//.dtls_name = "SRTP_AES128_CM_SHA1_32",
.master_key_len = 24,
.master_salt_len = 14,
.session_key_len = 24,
.session_salt_len = 14,
.srtp_lifetime = 1ULL << 48,
.srtcp_lifetime = 1ULL << 31,
.kernel_cipher = REC_AES_CM_192,
.kernel_hmac = REH_HMAC_SHA1,
.srtp_auth_tag = 4,
.srtcp_auth_tag = 10,
.srtp_auth_key_len = 20,
.srtcp_auth_key_len = 20,
.encrypt_rtp = aes_cm_encrypt_rtp,
.decrypt_rtp = aes_cm_encrypt_rtp,
.encrypt_rtcp = aes_cm_encrypt_rtcp,
.decrypt_rtcp = aes_cm_encrypt_rtcp,
.hash_rtp = hmac_sha1_rtp,
.hash_rtcp = hmac_sha1_rtcp,
.session_key_init = aes_cm_session_key_init_192,
.session_key_cleanup = evp_session_key_cleanup,
},
{
.name = "AES_CM_256_HMAC_SHA1_80",
//.dtls_name = "SRTP_AES128_CM_SHA1_80",
.master_key_len = 32,
.master_salt_len = 14,
.session_key_len = 32,
.session_salt_len = 14,
.srtp_lifetime = 1ULL << 48,
.srtcp_lifetime = 1ULL << 31,
.kernel_cipher = REC_AES_CM_256,
.kernel_hmac = REH_HMAC_SHA1,
.srtp_auth_tag = 10,
.srtcp_auth_tag = 10,
.srtp_auth_key_len = 20,
.srtcp_auth_key_len = 20,
.encrypt_rtp = aes_cm_encrypt_rtp,
.decrypt_rtp = aes_cm_encrypt_rtp,
.encrypt_rtcp = aes_cm_encrypt_rtcp,
.decrypt_rtcp = aes_cm_encrypt_rtcp,
.hash_rtp = hmac_sha1_rtp,
.hash_rtcp = hmac_sha1_rtcp,
.session_key_init = aes_cm_session_key_init_256,
.session_key_cleanup = evp_session_key_cleanup,
},
{
.name = "AES_CM_256_HMAC_SHA1_32",
//.dtls_name = "SRTP_AES128_CM_SHA1_32",
.master_key_len = 32,
.master_salt_len = 14,
.session_key_len = 32,
.session_salt_len = 14,
.srtp_lifetime = 1ULL << 48,
.srtcp_lifetime = 1ULL << 31,
.kernel_cipher = REC_AES_CM_256,
.kernel_hmac = REH_HMAC_SHA1,
.srtp_auth_tag = 4,
.srtcp_auth_tag = 10,
.srtp_auth_key_len = 20,
.srtcp_auth_key_len = 20,
.encrypt_rtp = aes_cm_encrypt_rtp,
.decrypt_rtp = aes_cm_encrypt_rtp,
.encrypt_rtcp = aes_cm_encrypt_rtcp,
.decrypt_rtcp = aes_cm_encrypt_rtcp,
.hash_rtp = hmac_sha1_rtp,
.hash_rtcp = hmac_sha1_rtcp,
.session_key_init = aes_cm_session_key_init_256,
.session_key_cleanup = evp_session_key_cleanup, .session_key_cleanup = evp_session_key_cleanup,
}, },
{ {
@ -211,7 +309,7 @@ const struct crypto_suite *crypto_find_suite(const str *s) {
/* rfc 3711 section 4.1 and 4.1.1 /* rfc 3711 section 4.1 and 4.1.1
* "in" and "out" MAY point to the same buffer */ * "in" and "out" MAY point to the same buffer */
static void aes_ctr_128(unsigned char *out, str *in, EVP_CIPHER_CTX *ecc, const unsigned char *iv) { static void aes_ctr(unsigned char *out, str *in, EVP_CIPHER_CTX *ecc, const unsigned char *iv) {
unsigned char ivx[16]; unsigned char ivx[16];
unsigned char key_block[16]; unsigned char key_block[16];
unsigned char *p, *q; unsigned char *p, *q;
@ -259,10 +357,11 @@ done:
; ;
} }
static void aes_ctr_128_no_ctx(unsigned char *out, str *in, const unsigned char *key, const unsigned char *iv) { static void aes_ctr_no_ctx(unsigned char *out, str *in, const unsigned char *key, int keylen, const unsigned char *iv) {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
unsigned char block[16]; unsigned char block[16];
int len; int len;
const EVP_CIPHER *ecb_cipher;
#if OPENSSL_VERSION_NUMBER >= 0x10100000L #if OPENSSL_VERSION_NUMBER >= 0x10100000L
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
@ -271,8 +370,23 @@ static void aes_ctr_128_no_ctx(unsigned char *out, str *in, const unsigned char
ctx = &ctx_s; ctx = &ctx_s;
EVP_CIPHER_CTX_init(ctx); EVP_CIPHER_CTX_init(ctx);
#endif #endif
EVP_EncryptInit_ex(ctx, EVP_aes_128_ecb(), NULL, key, NULL); switch(keylen) {
aes_ctr_128(out, in, ctx, iv); case 16:
ecb_cipher = EVP_aes_128_ecb();
break;
case 24:
ecb_cipher = EVP_aes_192_ecb();
break;
case 32:
ecb_cipher = EVP_aes_256_ecb();
break;
default:
// silence -Wmaybe-unintialized; must not end up here
assert(FALSE);
break;
}
EVP_EncryptInit_ex(ctx, ecb_cipher, NULL, key, NULL);
aes_ctr(out, in, ctx, iv);
EVP_EncryptFinal_ex(ctx, block, &len); EVP_EncryptFinal_ex(ctx, block, &len);
#if OPENSSL_VERSION_NUMBER >= 0x10100000L #if OPENSSL_VERSION_NUMBER >= 0x10100000L
@ -287,7 +401,7 @@ static void aes_ctr_128_no_ctx(unsigned char *out, str *in, const unsigned char
* x: 112 bits * x: 112 bits
* n <= 256 * n <= 256
* out->len := n / 8 */ * out->len := n / 8 */
static void prf_n(str *out, const unsigned char *key, const unsigned char *x) { static void prf_n(str *out, const unsigned char *key, int keylen, const unsigned char *x) {
unsigned char iv[16]; unsigned char iv[16];
unsigned char o[32]; unsigned char o[32];
unsigned char in[32]; unsigned char in[32];
@ -300,7 +414,7 @@ static void prf_n(str *out, const unsigned char *key, const unsigned char *x) {
/* iv[14] = iv[15] = 0; := x << 16 */ /* iv[14] = iv[15] = 0; := x << 16 */
ZERO(in); /* outputs the key stream */ ZERO(in); /* outputs the key stream */
str_init_len(&in_s, (void *) in, out->len > 16 ? 32 : 16); str_init_len(&in_s, (void *) in, out->len > 16 ? 32 : 16);
aes_ctr_128_no_ctx(o, &in_s, key, iv); aes_ctr_no_ctx(o, &in_s, key, keylen, iv);
memcpy(out->s, o, out->len); memcpy(out->s, o, out->len);
} }
@ -322,7 +436,7 @@ int crypto_gen_session_key(struct crypto_context *c, str *out, unsigned char lab
for (i = 13 - index_len; i < 14; i++) for (i = 13 - index_len; i < 14; i++)
x[i] = key_id[i - (13 - index_len)] ^ x[i]; x[i] = key_id[i - (13 - index_len)] ^ x[i];
prf_n(out, c->params.master_key, x); prf_n(out, c->params.master_key, c->params.crypto_suite->master_key_len, x);
#if CRYPTO_DEBUG #if CRYPTO_DEBUG
ilog(LOG_DEBUG, "Generated session key: master key " ilog(LOG_DEBUG, "Generated session key: master key "
@ -366,7 +480,7 @@ static int aes_cm_encrypt(struct crypto_context *c, u_int32_t ssrc, str *s, u_in
ivi[2] ^= idxh; ivi[2] ^= idxh;
ivi[3] ^= idxl; ivi[3] ^= idxl;
aes_ctr_128((void *) s->s, s, c->session_key_ctx[0], iv); aes_ctr((void *) s->s, s, c->session_key_ctx[0], iv);
return 0; return 0;
} }
@ -515,7 +629,7 @@ static int hmac_sha1_rtcp(struct crypto_context *c, char *out, str *in) {
return 0; return 0;
} }
static int aes_cm_session_key_init(struct crypto_context *c) { static int aes_cm_session_key_init_128(struct crypto_context *c) {
evp_session_key_cleanup(c); evp_session_key_cleanup(c);
#if OPENSSL_VERSION_NUMBER >= 0x10100000L #if OPENSSL_VERSION_NUMBER >= 0x10100000L
@ -529,13 +643,41 @@ static int aes_cm_session_key_init(struct crypto_context *c) {
return 0; return 0;
} }
static int aes_cm_session_key_init_192(struct crypto_context *c) {
evp_session_key_cleanup(c);
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
c->session_key_ctx[0] = EVP_CIPHER_CTX_new();
#else
c->session_key_ctx[0] = g_slice_alloc(sizeof(EVP_CIPHER_CTX));
EVP_CIPHER_CTX_init(c->session_key_ctx[0]);
#endif
EVP_EncryptInit_ex(c->session_key_ctx[0], EVP_aes_192_ecb(), NULL,
(unsigned char *) c->session_key, NULL);
return 0;
}
static int aes_cm_session_key_init_256(struct crypto_context *c) {
evp_session_key_cleanup(c);
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
c->session_key_ctx[0] = EVP_CIPHER_CTX_new();
#else
c->session_key_ctx[0] = g_slice_alloc(sizeof(EVP_CIPHER_CTX));
EVP_CIPHER_CTX_init(c->session_key_ctx[0]);
#endif
EVP_EncryptInit_ex(c->session_key_ctx[0], EVP_aes_256_ecb(), NULL,
(unsigned char *) c->session_key, NULL);
return 0;
}
static int aes_f8_session_key_init(struct crypto_context *c) { static int aes_f8_session_key_init(struct crypto_context *c) {
unsigned char m[16]; unsigned char m[16];
int i; int i;
int k_e_len, k_s_len; /* n_e, n_s */ int k_e_len, k_s_len; /* n_e, n_s */
unsigned char *key; unsigned char *key;
aes_cm_session_key_init(c); aes_cm_session_key_init_128(c);
k_e_len = c->params.crypto_suite->session_key_len; k_e_len = c->params.crypto_suite->session_key_len;
k_s_len = c->params.crypto_suite->session_salt_len; k_s_len = c->params.crypto_suite->session_salt_len;

4
daemon/crypto.h
Unescape View File

@ -11,9 +11,9 @@
#define SRTP_MAX_MASTER_KEY_LEN 16 #define SRTP_MAX_MASTER_KEY_LEN 32
#define SRTP_MAX_MASTER_SALT_LEN 14 #define SRTP_MAX_MASTER_SALT_LEN 14
#define SRTP_MAX_SESSION_KEY_LEN 16 #define SRTP_MAX_SESSION_KEY_LEN 32
#define SRTP_MAX_SESSION_SALT_LEN 14 #define SRTP_MAX_SESSION_SALT_LEN 14
#define SRTP_MAX_SESSION_AUTH_LEN 20 #define SRTP_MAX_SESSION_AUTH_LEN 20

2
daemon/media_socket.c
Unescape View File

@ -826,6 +826,8 @@ static int __k_srtp_crypt(struct rtpengine_srtp *s, struct crypto_context *c) {
if (c->params.mki_len) if (c->params.mki_len)
memcpy(s->mki, c->params.mki, c->params.mki_len); memcpy(s->mki, c->params.mki, c->params.mki_len);
memcpy(s->master_key, c->params.master_key, c->params.crypto_suite->master_key_len); memcpy(s->master_key, c->params.master_key, c->params.crypto_suite->master_key_len);
s->master_key_len = c->params.crypto_suite->master_key_len;
s->session_key_len = c->params.crypto_suite->session_key_len;
memcpy(s->master_salt, c->params.master_salt, c->params.crypto_suite->master_salt_len); memcpy(s->master_salt, c->params.master_salt, c->params.crypto_suite->master_salt_len);
if (c->params.session_params.unencrypted_srtp) if (c->params.session_params.unencrypted_srtp)

10
daemon/sdp.c
Unescape View File

@ -1,8 +1,8 @@
#include "sdp.h" #include "sdp.h"
#include <glib.h> #include <glib.h>
#include <netinet/in.h> #include <netinet/in.h>
#include <netinet/ip.h> #include <netinet/ip.h>
#include <arpa/inet.h> #include <arpa/inet.h>
#include <math.h> #include <math.h>
@ -274,7 +274,7 @@ INLINE int extract_token(char **sp, char *end, str *out) {
*sp = space + 1; *sp = space + 1;
} }
return 0; return 0;
} }
#define EXTRACT_TOKEN(field) if (extract_token(&start, end, &output->field)) return -1 #define EXTRACT_TOKEN(field) if (extract_token(&start, end, &output->field)) return -1
#define EXTRACT_NETWORK_ADDRESS_NP(field) \ #define EXTRACT_NETWORK_ADDRESS_NP(field) \
@ -978,10 +978,10 @@ int sdp_parse(str *body, GQueue *sessions) {
if (line_end - value < 4) if (line_end - value < 4)
break; break;
if (!memcmp(value, "RR:", 3)) if (!memcmp(value, "RR:", 3))
*(media ? &media->rr : &session->rr) = *(media ? &media->rr : &session->rr) =
(line_end - value == 4 && value[3] == '0') ? 0 : 1; (line_end - value == 4 && value[3] == '0') ? 0 : 1;
else if (!memcmp(value, "RS:", 3)) else if (!memcmp(value, "RS:", 3))
*(media ? &media->rs : &session->rs) = *(media ? &media->rs : &session->rs) =
(line_end - value == 4 && value[3] == '0') ? 0 : 1; (line_end - value == 4 && value[3] == '0') ? 0 : 1;
break; break;

92
kernel-module/xt_RTPENGINE.c
Unescape View File

@ -231,7 +231,7 @@ static inline int bitfield_clear(unsigned long *bf, unsigned int i);
struct re_crypto_context { struct re_crypto_context {
spinlock_t lock; /* protects roc and last_index */ spinlock_t lock; /* protects roc and last_index */
unsigned char session_key[16]; unsigned char session_key[32];
unsigned char session_salt[14]; unsigned char session_salt[14];
unsigned char session_auth_key[20]; unsigned char session_auth_key[20];
u_int32_t roc; u_int32_t roc;
@ -501,9 +501,9 @@ static const struct re_cipher re_ciphers[] = {
.id = REC_NULL, .id = REC_NULL,
.name = "NULL", .name = "NULL",
}, },
[REC_AES_CM] = { [REC_AES_CM_128] = {
.id = REC_AES_CM, .id = REC_AES_CM_128,
.name = "AES-CM", .name = "AES-CM-128",
.tfm_name = "aes", .tfm_name = "aes",
.decrypt = srtp_encrypt_aes_cm, .decrypt = srtp_encrypt_aes_cm,
.encrypt = srtp_encrypt_aes_cm, .encrypt = srtp_encrypt_aes_cm,
@ -516,6 +516,20 @@ static const struct re_cipher re_ciphers[] = {
.encrypt = srtp_encrypt_aes_f8, .encrypt = srtp_encrypt_aes_f8,
.session_key_init = aes_f8_session_key_init, .session_key_init = aes_f8_session_key_init,
}, },
[REC_AES_CM_192] = {
.id = REC_AES_CM_192,
.name = "AES-CM-192",
.tfm_name = "aes",
.decrypt = srtp_encrypt_aes_cm,
.encrypt = srtp_encrypt_aes_cm,
},
[REC_AES_CM_256] = {
.id = REC_AES_CM_256,
.name = "AES-CM-256",
.tfm_name = "aes",
.decrypt = srtp_encrypt_aes_cm,
.encrypt = srtp_encrypt_aes_cm,
},
}; };
static const struct re_hmac re_hmacs[] = { static const struct re_hmac re_hmacs[] = {
@ -1700,7 +1714,7 @@ static void aes_f8(unsigned char *in_out, int in_len,
u_int32_t *xu; u_int32_t *xu;
crypto_cipher_encrypt_one(iv_tfm, ivx, iv); crypto_cipher_encrypt_one(iv_tfm, ivx, iv);
pi = (void *) in_out; pi = (void *) in_out;
ki = (void *) key_block; ki = (void *) key_block;
lki = (void *) last_key_block; lki = (void *) last_key_block;
@ -1747,7 +1761,7 @@ done:
} }
static int aes_ctr_128_no_ctx(unsigned char *out, const char *in, int in_len, static int aes_ctr_128_no_ctx(unsigned char *out, const char *in, int in_len,
const unsigned char *key, const unsigned char *iv) const unsigned char *key, unsigned int key_len, const unsigned char *iv)
{ {
struct crypto_cipher *tfm; struct crypto_cipher *tfm;
@ -1755,14 +1769,14 @@ static int aes_ctr_128_no_ctx(unsigned char *out, const char *in, int in_len,
if (IS_ERR(tfm)) if (IS_ERR(tfm))
return PTR_ERR(tfm); return PTR_ERR(tfm);
crypto_cipher_setkey(tfm, key, 16); crypto_cipher_setkey(tfm, key, key_len);
aes_ctr_128(out, in, in_len, tfm, iv); aes_ctr_128(out, in, in_len, tfm, iv);
crypto_free_cipher(tfm); crypto_free_cipher(tfm);
return 0; return 0;
} }
static int prf_n(unsigned char *out, int len, const unsigned char *key, const unsigned char *x) { static int prf_n(unsigned char *out, int len, const unsigned char *key, unsigned int key_len, const unsigned char *x) {
unsigned char iv[16]; unsigned char iv[16];
unsigned char o[32]; unsigned char o[32];
unsigned char in[32]; unsigned char in[32];
@ -1773,7 +1787,7 @@ static int prf_n(unsigned char *out, int len, const unsigned char *key, const un
in_len = len > 16 ? 32 : 16; in_len = len > 16 ? 32 : 16;
memset(in, 0, in_len); memset(in, 0, in_len);
ret = aes_ctr_128_no_ctx(o, in, in_len, key, iv); ret = aes_ctr_128_no_ctx(o, in, in_len, key, key_len, iv);
if (ret) if (ret)
return ret; return ret;
@ -1795,7 +1809,7 @@ static int gen_session_key(unsigned char *out, int len, struct rtpengine_srtp *s
for (i = 13 - 6; i < 14; i++) for (i = 13 - 6; i < 14; i++)
x[i] = key_id[i - (13 - 6)] ^ x[i]; x[i] = key_id[i - (13 - 6)] ^ x[i];
ret = prf_n(out, len, s->master_key, x); ret = prf_n(out, len, s->master_key, s->master_key_len, x);
if (ret) if (ret)
return ret; return ret;
return 0; return 0;
@ -1836,7 +1850,7 @@ static int gen_session_keys(struct re_crypto_context *c, struct rtpengine_srtp *
if (s->cipher == REC_NULL && s->hmac == REH_NULL) if (s->cipher == REC_NULL && s->hmac == REH_NULL)
return 0; return 0;
err = "failed to generate session key"; err = "failed to generate session key";
ret = gen_session_key(c->session_key, 16, s, 0x00); ret = gen_session_key(c->session_key, s->session_key_len, s, 0x00);
if (ret) if (ret)
goto error; goto error;
ret = gen_session_key(c->session_auth_key, 20, s, 0x01); ret = gen_session_key(c->session_auth_key, 20, s, 0x01);
@ -1854,7 +1868,7 @@ static int gen_session_keys(struct re_crypto_context *c, struct rtpengine_srtp *
c->tfm[0] = NULL; c->tfm[0] = NULL;
goto error; goto error;
} }
crypto_cipher_setkey(c->tfm[0], c->session_key, 16); crypto_cipher_setkey(c->tfm[0], c->session_key, s->session_key_len);
} }
if (c->cipher->session_key_init) { if (c->cipher->session_key_init) {
@ -1874,21 +1888,69 @@ static int gen_session_keys(struct re_crypto_context *c, struct rtpengine_srtp *
crypto_shash_setkey(c->shash, c->session_auth_key, 20); crypto_shash_setkey(c->shash, c->session_auth_key, 20);
} }
DBG("master key %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", switch(s->master_key_len) {
case 16:
DBG("master key %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
s->master_key[0], s->master_key[1], s->master_key[2], s->master_key[3], s->master_key[0], s->master_key[1], s->master_key[2], s->master_key[3],
s->master_key[4], s->master_key[5], s->master_key[6], s->master_key[7], s->master_key[4], s->master_key[5], s->master_key[6], s->master_key[7],
s->master_key[8], s->master_key[9], s->master_key[10], s->master_key[11], s->master_key[8], s->master_key[9], s->master_key[10], s->master_key[11],
s->master_key[12], s->master_key[13], s->master_key[14], s->master_key[15]); s->master_key[12], s->master_key[13], s->master_key[14], s->master_key[15]);
break;
case 24:
DBG("master key %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
s->master_key[0], s->master_key[1], s->master_key[2], s->master_key[3],
s->master_key[4], s->master_key[5], s->master_key[6], s->master_key[7],
s->master_key[8], s->master_key[9], s->master_key[10], s->master_key[11],
s->master_key[12], s->master_key[13], s->master_key[14], s->master_key[15],
s->master_key[16], s->master_key[17], s->master_key[18], s->master_key[19],
s->master_key[20], s->master_key[21], s->master_key[22], s->master_key[23]);
break;
case 32:
DBG("master key %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
s->master_key[0], s->master_key[1], s->master_key[2], s->master_key[3],
s->master_key[4], s->master_key[5], s->master_key[6], s->master_key[7],
s->master_key[8], s->master_key[9], s->master_key[10], s->master_key[11],
s->master_key[12], s->master_key[13], s->master_key[14], s->master_key[15],
s->master_key[16], s->master_key[17], s->master_key[18], s->master_key[19],
s->master_key[20], s->master_key[21], s->master_key[22], s->master_key[23],
s->master_key[24], s->master_key[25], s->master_key[26], s->master_key[27],
s->master_key[28], s->master_key[29], s->master_key[30], s->master_key[21]);
break;
}
DBG("master salt %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", DBG("master salt %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
s->master_salt[0], s->master_salt[1], s->master_salt[2], s->master_salt[3], s->master_salt[0], s->master_salt[1], s->master_salt[2], s->master_salt[3],
s->master_salt[4], s->master_salt[5], s->master_salt[6], s->master_salt[7], s->master_salt[4], s->master_salt[5], s->master_salt[6], s->master_salt[7],
s->master_salt[8], s->master_salt[9], s->master_salt[10], s->master_salt[11], s->master_salt[8], s->master_salt[9], s->master_salt[10], s->master_salt[11],
s->master_salt[12], s->master_salt[13]); s->master_salt[12], s->master_salt[13]);
DBG("session key %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", switch(s->session_key_len) {
case 16:
DBG("session key %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
c->session_key[0], c->session_key[1], c->session_key[2], c->session_key[3], c->session_key[0], c->session_key[1], c->session_key[2], c->session_key[3],
c->session_key[4], c->session_key[5], c->session_key[6], c->session_key[7], c->session_key[4], c->session_key[5], c->session_key[6], c->session_key[7],
c->session_key[8], c->session_key[9], c->session_key[10], c->session_key[11], c->session_key[8], c->session_key[9], c->session_key[10], c->session_key[11],
c->session_key[12], c->session_key[13], c->session_key[14], c->session_key[15]); c->session_key[12], c->session_key[13], c->session_key[14], c->session_key[15]);
break;
case 24:
DBG("session key %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
c->session_key[0], c->session_key[1], c->session_key[2], c->session_key[3],
c->session_key[4], c->session_key[5], c->session_key[6], c->session_key[7],
c->session_key[8], c->session_key[9], c->session_key[10], c->session_key[11],
c->session_key[12], c->session_key[13], c->session_key[14], c->session_key[15],
c->session_key[16], c->session_key[17], c->session_key[18], c->session_key[19],
c->session_key[20], c->session_key[21], c->session_key[22], c->session_key[23]);
break;
case 32:
DBG("session key %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
c->session_key[0], c->session_key[1], c->session_key[2], c->session_key[3],
c->session_key[4], c->session_key[5], c->session_key[6], c->session_key[7],
c->session_key[8], c->session_key[9], c->session_key[10], c->session_key[11],
c->session_key[12], c->session_key[13], c->session_key[14], c->session_key[15],
c->session_key[16], c->session_key[17], c->session_key[18], c->session_key[19],
c->session_key[20], c->session_key[21], c->session_key[22], c->session_key[23],
c->session_key[24], c->session_key[25], c->session_key[26], c->session_key[27],
c->session_key[28], c->session_key[29], c->session_key[30], c->session_key[21]);
break;
}
DBG("session salt %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", DBG("session salt %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
c->session_salt[0], c->session_salt[1], c->session_salt[2], c->session_salt[3], c->session_salt[0], c->session_salt[1], c->session_salt[2], c->session_salt[3],
c->session_salt[4], c->session_salt[5], c->session_salt[6], c->session_salt[7], c->session_salt[4], c->session_salt[5], c->session_salt[6], c->session_salt[7],
@ -2014,7 +2076,7 @@ retry:
kfree(rda); kfree(rda);
goto retry; goto retry;
} }
t->dest_addr_hash.addrs[rh_it] = rda; t->dest_addr_hash.addrs[rh_it] = rda;
re_bitfield_set(&t->dest_addr_hash.addrs_bf, rh_it); re_bitfield_set(&t->dest_addr_hash.addrs_bf, rh_it);

8
kernel-module/xt_RTPENGINE.h
Unescape View File

@ -41,8 +41,10 @@ struct re_address {
enum rtpengine_cipher { enum rtpengine_cipher {
REC_INVALID = 0, REC_INVALID = 0,
REC_NULL, REC_NULL,
REC_AES_CM, REC_AES_CM_128,
REC_AES_F8, REC_AES_F8,
REC_AES_CM_192,
REC_AES_CM_256,
__REC_LAST __REC_LAST
}; };
@ -59,8 +61,10 @@ enum rtpengine_hmac {
struct rtpengine_srtp { struct rtpengine_srtp {
enum rtpengine_cipher cipher; enum rtpengine_cipher cipher;
enum rtpengine_hmac hmac; enum rtpengine_hmac hmac;
unsigned char master_key[16]; unsigned char master_key[32];
unsigned int master_key_len;
unsigned char master_salt[14]; unsigned char master_salt[14];
unsigned int session_key_len;
unsigned char mki[256]; /* XXX uses too much memory? */ unsigned char mki[256]; /* XXX uses too much memory? */
u_int64_t last_index; u_int64_t last_index;
unsigned int auth_tag_len; /* in bytes */ unsigned int auth_tag_len; /* in bytes */

Write Preview
Loading…
Cancel
Save