00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028 #include "asterisk.h"
00029
00030 ASTERISK_FILE_VERSION(__FILE__, "$Revision: 317474 $")
00031
00032 #include "asterisk/options.h"
00033 #include "asterisk/utils.h"
00034 #include "include/sdp_crypto.h"
00035
00036 #define SRTP_MASTER_LEN 30
00037 #define SRTP_MASTERKEY_LEN 16
00038 #define SRTP_MASTERSALT_LEN ((SRTP_MASTER_LEN) - (SRTP_MASTERKEY_LEN))
00039 #define SRTP_MASTER_LEN64 (((SRTP_MASTER_LEN) * 8 + 5) / 6 + 1)
00040
00041 extern struct ast_srtp_res *res_srtp;
00042 extern struct ast_srtp_policy_res *res_srtp_policy;
00043
00044 struct sdp_crypto {
00045 char *a_crypto;
00046 unsigned char local_key[SRTP_MASTER_LEN];
00047 char local_key64[SRTP_MASTER_LEN64];
00048 };
00049
00050 static int set_crypto_policy(struct ast_srtp_policy *policy, int suite_val, const unsigned char *master_key, unsigned long ssrc, int inbound);
00051
00052 static struct sdp_crypto *sdp_crypto_alloc(void)
00053 {
00054 struct sdp_crypto *crypto;
00055
00056 return crypto = ast_calloc(1, sizeof(*crypto));
00057 }
00058
00059 void sdp_crypto_destroy(struct sdp_crypto *crypto)
00060 {
00061 ast_free(crypto->a_crypto);
00062 crypto->a_crypto = NULL;
00063 ast_free(crypto);
00064 }
00065
00066 struct sdp_crypto *sdp_crypto_setup(void)
00067 {
00068 struct sdp_crypto *p;
00069 int key_len;
00070 unsigned char remote_key[SRTP_MASTER_LEN];
00071
00072 if (!ast_rtp_engine_srtp_is_registered()) {
00073 return NULL;
00074 }
00075
00076 if (!(p = sdp_crypto_alloc())) {
00077 return NULL;
00078 }
00079
00080 if (res_srtp->get_random(p->local_key, sizeof(p->local_key)) < 0) {
00081 sdp_crypto_destroy(p);
00082 return NULL;
00083 }
00084
00085 ast_base64encode(p->local_key64, p->local_key, SRTP_MASTER_LEN, sizeof(p->local_key64));
00086
00087 key_len = ast_base64decode(remote_key, p->local_key64, sizeof(remote_key));
00088
00089 if (key_len != SRTP_MASTER_LEN) {
00090 ast_log(LOG_ERROR, "base64 encode/decode bad len %d != %d\n", key_len, SRTP_MASTER_LEN);
00091 ast_free(p);
00092 return NULL;
00093 }
00094
00095 if (memcmp(remote_key, p->local_key, SRTP_MASTER_LEN)) {
00096 ast_log(LOG_ERROR, "base64 encode/decode bad key\n");
00097 ast_free(p);
00098 return NULL;
00099 }
00100
00101 ast_debug(1 , "local_key64 %s len %zu\n", p->local_key64, strlen(p->local_key64));
00102
00103 return p;
00104 }
00105
00106 static int set_crypto_policy(struct ast_srtp_policy *policy, int suite_val, const unsigned char *master_key, unsigned long ssrc, int inbound)
00107 {
00108 const unsigned char *master_salt = NULL;
00109
00110 if (!ast_rtp_engine_srtp_is_registered()) {
00111 return -1;
00112 }
00113
00114 master_salt = master_key + SRTP_MASTERKEY_LEN;
00115 if (res_srtp_policy->set_master_key(policy, master_key, SRTP_MASTERKEY_LEN, master_salt, SRTP_MASTERSALT_LEN) < 0) {
00116 return -1;
00117 }
00118
00119 if (res_srtp_policy->set_suite(policy, suite_val)) {
00120 ast_log(LOG_WARNING, "Could not set remote SRTP suite\n");
00121 return -1;
00122 }
00123
00124 res_srtp_policy->set_ssrc(policy, ssrc, inbound);
00125
00126 return 0;
00127 }
00128
00129 static int sdp_crypto_activate(struct sdp_crypto *p, int suite_val, unsigned char *remote_key, struct ast_rtp_instance *rtp)
00130 {
00131 struct ast_srtp_policy *local_policy = NULL;
00132 struct ast_srtp_policy *remote_policy = NULL;
00133 struct ast_rtp_instance_stats stats = {0,};
00134 int res = -1;
00135
00136 if (!ast_rtp_engine_srtp_is_registered()) {
00137 return -1;
00138 }
00139
00140 if (!p) {
00141 return -1;
00142 }
00143
00144 if (!(local_policy = res_srtp_policy->alloc())) {
00145 return -1;
00146 }
00147
00148 if (!(remote_policy = res_srtp_policy->alloc())) {
00149 goto err;
00150 }
00151
00152 if (ast_rtp_instance_get_stats(rtp, &stats, AST_RTP_INSTANCE_STAT_LOCAL_SSRC)) {
00153 goto err;
00154 }
00155
00156 if (set_crypto_policy(local_policy, suite_val, p->local_key, stats.local_ssrc, 0) < 0) {
00157 goto err;
00158 }
00159
00160 if (set_crypto_policy(remote_policy, suite_val, remote_key, 0, 1) < 0) {
00161 goto err;
00162 }
00163
00164
00165
00166 if (ast_rtp_instance_add_srtp_policy(rtp, local_policy)) {
00167 ast_log(LOG_WARNING, "Could not set local SRTP policy\n");
00168 goto err;
00169 }
00170
00171 if (ast_rtp_instance_add_srtp_policy(rtp, remote_policy)) {
00172 ast_log(LOG_WARNING, "Could not set remote SRTP policy\n");
00173 goto err;
00174 }
00175
00176 ast_debug(1 , "SRTP policy activated\n");
00177 res = 0;
00178
00179 err:
00180 if (local_policy) {
00181 res_srtp_policy->destroy(local_policy);
00182 }
00183
00184 if (remote_policy) {
00185 res_srtp_policy->destroy(remote_policy);
00186 }
00187
00188 return res;
00189 }
00190
00191 int sdp_crypto_process(struct sdp_crypto *p, const char *attr, struct ast_rtp_instance *rtp)
00192 {
00193 char *str = NULL;
00194 char *tag = NULL;
00195 char *suite = NULL;
00196 char *key_params = NULL;
00197 char *key_param = NULL;
00198 char *session_params = NULL;
00199 char *key_salt = NULL;
00200 char *lifetime = NULL;
00201 int found = 0;
00202 int attr_len = strlen(attr);
00203 int key_len = 0;
00204 int suite_val = 0;
00205 unsigned char remote_key[SRTP_MASTER_LEN];
00206
00207 if (!ast_rtp_engine_srtp_is_registered()) {
00208 return -1;
00209 }
00210
00211 str = ast_strdupa(attr);
00212
00213 strsep(&str, ":");
00214 tag = strsep(&str, " ");
00215 suite = strsep(&str, " ");
00216 key_params = strsep(&str, " ");
00217 session_params = strsep(&str, " ");
00218
00219 if (!tag || !suite) {
00220 ast_log(LOG_WARNING, "Unrecognized a=%s", attr);
00221 return -1;
00222 }
00223
00224 if (session_params) {
00225 ast_log(LOG_WARNING, "Unsupported crypto parameters: %s", session_params);
00226 return -1;
00227 }
00228
00229 if (!strcmp(suite, "AES_CM_128_HMAC_SHA1_80")) {
00230 suite_val = AST_AES_CM_128_HMAC_SHA1_80;
00231 } else if (!strcmp(suite, "AES_CM_128_HMAC_SHA1_32")) {
00232 suite_val = AST_AES_CM_128_HMAC_SHA1_32;
00233 } else {
00234 ast_log(LOG_WARNING, "Unsupported crypto suite: %s\n", suite);
00235 return -1;
00236 }
00237
00238 while ((key_param = strsep(&key_params, ";"))) {
00239 char *method = NULL;
00240 char *info = NULL;
00241
00242 method = strsep(&key_param, ":");
00243 info = strsep(&key_param, ";");
00244
00245 if (!strcmp(method, "inline")) {
00246 key_salt = strsep(&info, "|");
00247 lifetime = strsep(&info, "|");
00248
00249 if (lifetime) {
00250 ast_log(LOG_NOTICE, "Crypto life time unsupported: %s\n", attr);
00251 continue;
00252 }
00253
00254 found = 1;
00255 break;
00256 }
00257 }
00258
00259 if (!found) {
00260 ast_log(LOG_NOTICE, "SRTP crypto offer not acceptable\n");
00261 return -1;
00262 }
00263
00264
00265 if ((key_len = ast_base64decode(remote_key, key_salt, sizeof(remote_key))) != SRTP_MASTER_LEN) {
00266 ast_log(LOG_WARNING, "SRTP sdescriptions key %d != %d\n", key_len, SRTP_MASTER_LEN);
00267 return -1;
00268 }
00269
00270 if (sdp_crypto_activate(p, suite_val, remote_key, rtp) < 0) {
00271 return -1;
00272 }
00273
00274 if (!p->a_crypto) {
00275 if (!(p->a_crypto = ast_calloc(1, attr_len + 11))) {
00276 ast_log(LOG_ERROR, "Could not allocate memory for a_crypto\n");
00277 return -1;
00278 }
00279
00280 snprintf(p->a_crypto, attr_len + 10, "a=crypto:%s %s inline:%s\r\n", tag, suite, p->local_key64);
00281 }
00282
00283 return 0;
00284 }
00285
00286 int sdp_crypto_offer(struct sdp_crypto *p)
00287 {
00288 char crypto_buf[128];
00289 const char *crypto_suite = "AES_CM_128_HMAC_SHA1_80";
00290
00291 if (p->a_crypto) {
00292 ast_free(p->a_crypto);
00293 }
00294
00295 if (snprintf(crypto_buf, sizeof(crypto_buf), "a=crypto:1 %s inline:%s\r\n", crypto_suite, p->local_key64) < 1) {
00296 return -1;
00297 }
00298
00299 if (!(p->a_crypto = ast_strdup(crypto_buf))) {
00300 return -1;
00301 }
00302
00303 return 0;
00304 }
00305
00306 const char *sdp_crypto_attrib(struct sdp_crypto *p)
00307 {
00308 return p->a_crypto;
00309 }