Rewrite SRTP extension using CBB/CBS and the new extension framework.

input + ok beck@, jsing@

1 files changed, 6 insertions, 214 deletions

diff --git a/src/lib/libssl/d1_srtp.c b/src/lib/libssl/d1_srtp.c
index 26c14543fc..eb1877a12c 100644
--- a/src/lib/libssl/d1_srtp.c
+++ b/src/lib/libssl/d1_srtp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_srtp.c,v 1.21 2017/02/07 02:08:38 beck Exp $ */
+/* $OpenBSD: d1_srtp.c,v 1.22 2017/08/27 02:58:04 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -138,8 +138,8 @@ static SRTP_PROTECTION_PROFILE srtp_known_profiles[] = {
         {0}
 };
 
-static int
-find_profile_by_name(char *profile_name, SRTP_PROTECTION_PROFILE **pptr,
+int
+srtp_find_profile_by_name(char *profile_name, SRTP_PROTECTION_PROFILE **pptr,
     unsigned len)
 {
         SRTP_PROTECTION_PROFILE *p;
@@ -158,8 +158,8 @@ find_profile_by_name(char *profile_name, SRTP_PROTECTION_PROFILE **pptr,
         return 1;
 }
 
-static int
-find_profile_by_num(unsigned profile_num, SRTP_PROTECTION_PROFILE **pptr)
+int
+srtp_find_profile_by_num(unsigned profile_num, SRTP_PROTECTION_PROFILE **pptr)
 {
         SRTP_PROTECTION_PROFILE *p;
 
@@ -194,7 +194,7 @@ ssl_ctx_make_profiles(const char *profiles_string,
         do {
                 col = strchr(ptr, ':');
 
-                if (!find_profile_by_name(ptr, &p,
+                if (!srtp_find_profile_by_name(ptr, &p,
                     col ? col - ptr : (int)strlen(ptr))) {
                         sk_SRTP_PROTECTION_PROFILE_push(profiles, p);
                 } else {
@@ -246,212 +246,4 @@ SSL_get_selected_srtp_profile(SSL *s)
         return s->internal->srtp_profile;
 }
 
-/* Note: this function returns 0 length if there are no
-   profiles specified */
-int
-ssl_add_clienthello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen)
-{
-        int ct = 0;
-        int i;
-        STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = 0;
-        SRTP_PROTECTION_PROFILE *prof;
-
-        clnt = SSL_get_srtp_profiles(s);
-
-        ct = sk_SRTP_PROTECTION_PROFILE_num(clnt); /* -1 if clnt == 0 */
-
-        if (p) {
-                if (ct == 0) {
-                        SSLerror(s, SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST);
-                        return 1;
-                }
-
-                if ((2 + ct * 2 + 1) > maxlen) {
-                        SSLerror(s, SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
-                        return 1;
-                }
-
-                /* Add the length */
-                s2n(ct * 2, p);
-                for (i = 0; i < ct; i++) {
-                        prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
-                        s2n(prof->id, p);
-                }
-
-                /* Add an empty use_mki value */
-                *p++ = 0;
-        }
-
-        *len = 2 + ct*2 + 1;
-
-        return 0;
-}
-
-
-int
-ssl_parse_clienthello_use_srtp_ext(SSL *s, const unsigned char *d, int len,
-    int *al)
-{
-        SRTP_PROTECTION_PROFILE *cprof, *sprof;
-        STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = 0, *srvr;
-        int i, j;
-        int ret = 1;
-        uint16_t id;
-        CBS cbs, ciphers, mki;
-
-        if (len < 0) {
-                SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
-                *al = SSL_AD_DECODE_ERROR;
-                goto done;
-        }
-
-        CBS_init(&cbs, d, len);
-        /* Pull off the cipher suite list */
-        if (!CBS_get_u16_length_prefixed(&cbs, &ciphers) ||
-            CBS_len(&ciphers) % 2) {
-                SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
-                *al = SSL_AD_DECODE_ERROR;
-                goto done;
-        }
-
-        clnt = sk_SRTP_PROTECTION_PROFILE_new_null();
-
-        while (CBS_len(&ciphers) > 0) {
-                if (!CBS_get_u16(&ciphers, &id)) {
-                        SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
-                        *al = SSL_AD_DECODE_ERROR;
-                        goto done;
-                }
-
-                if (!find_profile_by_num(id, &cprof))
-                        sk_SRTP_PROTECTION_PROFILE_push(clnt, cprof);
-                else
-                        ; /* Ignore */
-        }
-
-        /* Extract the MKI value as a sanity check, but discard it for now. */
-        if (!CBS_get_u8_length_prefixed(&cbs, &mki) ||
-            CBS_len(&cbs) != 0) {
-                SSLerror(s, SSL_R_BAD_SRTP_MKI_VALUE);
-                *al = SSL_AD_DECODE_ERROR;
-                goto done;
-        }
-
-        srvr = SSL_get_srtp_profiles(s);
-
-        /*
-         * Pick our most preferred profile. If no profiles have been
-         * configured then the outer loop doesn't run
-         * (sk_SRTP_PROTECTION_PROFILE_num() = -1)
-         * and so we just return without doing anything.
-         */
-        for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(srvr); i++) {
-                sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
-
-                for (j = 0; j < sk_SRTP_PROTECTION_PROFILE_num(clnt); j++) {
-                        cprof = sk_SRTP_PROTECTION_PROFILE_value(clnt, j);
-
-                        if (cprof->id == sprof->id) {
-                                s->internal->srtp_profile = sprof;
-                                *al = 0;
-                                ret = 0;
-                                goto done;
-                        }
-                }
-        }
-
-        ret = 0;
-
-done:
-        sk_SRTP_PROTECTION_PROFILE_free(clnt);
-
-        return ret;
-}
-
-int
-ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen)
-{
-        if (p) {
-                if (maxlen < 5) {
-                        SSLerror(s, SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
-                        return 1;
-                }
-
-                if (s->internal->srtp_profile == 0) {
-                        SSLerror(s, SSL_R_USE_SRTP_NOT_NEGOTIATED);
-                        return 1;
-                }
-                s2n(2, p);
-                s2n(s->internal->srtp_profile->id, p);
-                *p++ = 0;
-        }
-        *len = 5;
-
-        return 0;
-}
-
-
-int
-ssl_parse_serverhello_use_srtp_ext(SSL *s, const unsigned char *d, int len, int *al)
-{
-        STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
-        SRTP_PROTECTION_PROFILE *prof;
-        int i;
-        uint16_t id;
-        CBS cbs, profile_ids, mki;
-
-        if (len < 0) {
-                SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
-                *al = SSL_AD_DECODE_ERROR;
-                return 1;
-        }
-
-        CBS_init(&cbs, d, len);
-
-        /*
-         * As per RFC 5764 section 4.1.1, server response MUST be a single
-         * profile id.
-         */
-        if (!CBS_get_u16_length_prefixed(&cbs, &profile_ids) ||
-            !CBS_get_u16(&profile_ids, &id) || CBS_len(&profile_ids) != 0) {
-                SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
-                *al = SSL_AD_DECODE_ERROR;
-                return 1;
-        }
-
-        /* Must be no MKI, since we never offer one. */
-        if (!CBS_get_u8_length_prefixed(&cbs, &mki) || CBS_len(&mki) != 0) {
-                SSLerror(s, SSL_R_BAD_SRTP_MKI_VALUE);
-                *al = SSL_AD_ILLEGAL_PARAMETER;
-                return 1;
-        }
-
-        clnt = SSL_get_srtp_profiles(s);
-
-        /* Throw an error if the server gave us an unsolicited extension. */
-        if (clnt == NULL) {
-                SSLerror(s, SSL_R_NO_SRTP_PROFILES);
-                *al = SSL_AD_DECODE_ERROR;
-                return 1;
-        }
-
-        /*
-         * Check to see if the server gave us something we support
-         * (and presumably offered).
-         */
-        for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) {
-                prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
-
-                if (prof->id == id) {
-                        s->internal->srtp_profile = prof;
-                        *al = 0;
-                        return 0;
-                }
-        }
-
-        SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
-        *al = SSL_AD_DECODE_ERROR;
-        return 1;
-}
-
 #endif