1 files changed, 223 insertions, 1 deletions

diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 405882c0e9..2438b90d04 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.11 2017/08/26 20:23:46 doug Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.12 2017/08/27 02:58:04 doug Exp $ */
 /*
  * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -704,6 +704,7 @@ tlsext_sni_serverhello_parse(SSL *s, CBS *cbs, int *alert)
         return 1;
 }
 
+
 /*
  *Certificate Status Request - RFC 6066 section 8.
  */
@@ -983,6 +984,216 @@ tlsext_sessionticket_serverhello_parse(SSL *s, CBS *cbs, int *alert)
         return 1;
 }
 
+/*
+ * DTLS extension for SRTP key establishment - RFC 5764
+ */
+
+#ifndef OPENSSL_NO_SRTP
+
+int
+tlsext_srtp_clienthello_needs(SSL *s)
+{
+        return SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s) != NULL;
+}
+
+int
+tlsext_srtp_clienthello_build(SSL *s, CBB *cbb)
+{
+        CBB profiles, mki;
+        int ct, i;
+        STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = NULL;
+        SRTP_PROTECTION_PROFILE *prof;
+
+        if ((clnt = SSL_get_srtp_profiles(s)) == NULL) {
+                SSLerror(s, SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST);
+                return 0;
+        }
+
+        if ((ct = sk_SRTP_PROTECTION_PROFILE_num(clnt)) < 1) {
+                SSLerror(s, SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST);
+                return 0;
+        }
+
+        if (!CBB_add_u16_length_prefixed(cbb, &profiles))
+                return 0;
+
+        for (i = 0; i < ct; i++) {
+                if ((prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i)) == NULL)
+                        return 0;
+                if (!CBB_add_u16(&profiles, prof->id))
+                        return 0;
+        }
+
+        if (!CBB_add_u8_length_prefixed(cbb, &mki))
+                return 0;
+
+        if (!CBB_flush(cbb))
+                return 0;
+
+        return 1;
+}
+
+int
+tlsext_srtp_clienthello_parse(SSL *s, CBS *cbs, int *alert)
+{
+        SRTP_PROTECTION_PROFILE *cprof, *sprof;
+        STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = NULL, *srvr;
+        int i, j;
+        int ret;
+        uint16_t id;
+        CBS profiles, mki;
+
+        ret = 0;
+
+        if (!CBS_get_u16_length_prefixed(cbs, &profiles))
+                goto err;
+        if (CBS_len(&profiles) == 0 || CBS_len(&profiles) % 2 != 0)
+                goto err;
+
+        if ((clnt = sk_SRTP_PROTECTION_PROFILE_new_null()) == NULL)
+                goto err;
+
+        while (CBS_len(&profiles) > 0) {
+                if (!CBS_get_u16(&profiles, &id))
+                        goto err;
+
+                if (!srtp_find_profile_by_num(id, &cprof)) {
+                        if (!sk_SRTP_PROTECTION_PROFILE_push(clnt, cprof))
+                                goto err;
+                }
+        }
+
+        if (!CBS_get_u8_length_prefixed(cbs, &mki) || CBS_len(&mki) != 0) {
+                SSLerror(s, SSL_R_BAD_SRTP_MKI_VALUE);
+                *alert = SSL_AD_DECODE_ERROR;
+                goto done;
+        }
+        if (CBS_len(cbs) != 0)
+                goto err;
+
+        /*
+         * Per RFC 5764 section 4.1.1
+         *
+         * Find the server preferred profile using the client's list.
+         *
+         * The server MUST send a profile if it sends the use_srtp
+         * extension.  If one is not found, it should fall back to the
+         * negotiated DTLS cipher suite or return a DTLS alert.
+         */
+        if ((srvr = SSL_get_srtp_profiles(s)) == NULL)
+                goto err;
+        for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(srvr); i++) {
+                if ((sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i))
+                    == NULL)
+                        goto err;
+
+                for (j = 0; j < sk_SRTP_PROTECTION_PROFILE_num(clnt); j++) {
+                        if ((cprof = sk_SRTP_PROTECTION_PROFILE_value(clnt, j))
+                            == NULL)
+                                goto err;
+
+                        if (cprof->id == sprof->id) {
+                                s->internal->srtp_profile = sprof;
+                                ret = 1;
+                                goto done;
+                        }
+                }
+        }
+
+        /* If we didn't find anything, fall back to the negotiated */
+        ret = 1;
+        goto done;
+
+ err:
+        SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+        *alert = SSL_AD_DECODE_ERROR;
+
+ done:
+        sk_SRTP_PROTECTION_PROFILE_free(clnt);
+        return ret;
+}
+
+int
+tlsext_srtp_serverhello_needs(SSL *s)
+{
+        return SSL_IS_DTLS(s) && SSL_get_selected_srtp_profile(s) != NULL;
+}
+
+int
+tlsext_srtp_serverhello_build(SSL *s, CBB *cbb)
+{
+        SRTP_PROTECTION_PROFILE *profile;
+        CBB srtp, mki;
+
+        if (!CBB_add_u16_length_prefixed(cbb, &srtp))
+                return 0;
+
+        if ((profile = SSL_get_selected_srtp_profile(s)) == NULL)
+                return 0;
+
+        if (!CBB_add_u16(&srtp, profile->id))
+                return 0;
+
+        if (!CBB_add_u8_length_prefixed(cbb, &mki))
+                return 0;
+
+        if (!CBB_flush(cbb))
+                return 0;
+
+        return 1;
+}
+
+int
+tlsext_srtp_serverhello_parse(SSL *s, CBS *cbs, int *alert)
+{
+        STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
+        SRTP_PROTECTION_PROFILE *prof;
+        int i;
+        uint16_t id;
+        CBS profile_ids, mki;
+
+        if (!CBS_get_u16_length_prefixed(cbs, &profile_ids)) {
+                SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+                goto err;
+        }
+
+        if (!CBS_get_u16(&profile_ids, &id) || CBS_len(&profile_ids) != 0) {
+                SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+                goto err;
+        }
+
+        if (!CBS_get_u8_length_prefixed(cbs, &mki) || CBS_len(&mki) != 0) {
+                SSLerror(s, SSL_R_BAD_SRTP_MKI_VALUE);
+                *alert = SSL_AD_ILLEGAL_PARAMETER;
+                return 0;
+        }
+
+        if ((clnt = SSL_get_srtp_profiles(s)) == NULL) {
+                SSLerror(s, SSL_R_NO_SRTP_PROFILES);
+                goto err;
+        }
+
+        for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) {
+                if ((prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i))
+                    == NULL) {
+                        SSLerror(s, SSL_R_NO_SRTP_PROFILES);
+                        goto err;
+                }
+
+                if (prof->id == id) {
+                        s->internal->srtp_profile = prof;
+                        return 1;
+                }
+        }
+
+        SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+ err:
+        *alert = SSL_AD_DECODE_ERROR;
+        return 0;
+}
+
+#endif /* OPENSSL_NO_SRTP */
+
 struct tls_extension {
         uint16_t type;
         int (*clienthello_needs)(SSL *s);
@@ -1066,6 +1277,17 @@ static struct tls_extension tls_extensions[] = {
                 .serverhello_build = tlsext_alpn_serverhello_build,
                 .serverhello_parse = tlsext_alpn_serverhello_parse,
         },
+#ifndef OPENSSL_NO_SRTP
+        {
+                .type = TLSEXT_TYPE_use_srtp,
+                .clienthello_needs = tlsext_srtp_clienthello_needs,
+                .clienthello_build = tlsext_srtp_clienthello_build,
+                .clienthello_parse = tlsext_srtp_clienthello_parse,
+                .serverhello_needs = tlsext_srtp_serverhello_needs,
+                .serverhello_build = tlsext_srtp_serverhello_build,
+                .serverhello_parse = tlsext_srtp_serverhello_parse,
+        }
+#endif /* OPENSSL_NO_SRTP */
 };
 
 #define N_TLS_EXTENSIONS (sizeof(tls_extensions) / sizeof(*tls_extensions))