Author: anthm Date: Wed Jan 16 01:01:53 2008 New Revision: 7244 Modified: freeswitch/trunk/src/include/switch_rtp.h freeswitch/trunk/src/include/switch_utils.h freeswitch/trunk/src/mod/applications/mod_esf/mod_esf.c freeswitch/trunk/src/mod/endpoints/mod_dingaling/mod_dingaling.c freeswitch/trunk/src/mod/endpoints/mod_sofia/mod_sofia.c freeswitch/trunk/src/mod/endpoints/mod_sofia/mod_sofia.h freeswitch/trunk/src/mod/endpoints/mod_sofia/sofia.c freeswitch/trunk/src/mod/endpoints/mod_sofia/sofia_glue.c freeswitch/trunk/src/switch_rtp.c freeswitch/trunk/src/switch_utils.c Log: RFC4568 support, you don't need the cone of silence anymore... Modified: freeswitch/trunk/src/include/switch_rtp.h ============================================================================== --- freeswitch/trunk/src/include/switch_rtp.h (original) +++ freeswitch/trunk/src/include/switch_rtp.h Wed Jan 16 01:01:53 2008 @@ -41,12 +41,50 @@ SWITCH_BEGIN_EXTERN_C #define SWITCH_RTP_MAX_BUF_LEN 16384 +#define SWITCH_RTP_MAX_CRYPTO_LEN 64 +#define SWITCH_RTP_KEY_LEN 30 +#define SWITCH_RTP_CRYPTO_KEY_32 "AES_CM_128_HMAC_SHA1_32" +#define SWITCH_RTP_CRYPTO_KEY_80 "AES_CM_128_HMAC_SHA1_80" + + +typedef enum { + SWITCH_RTP_CRYPTO_SEND, + SWITCH_RTP_CRYPTO_RECV, + SWITCH_RTP_CRYPTO_MAX +} switch_rtp_crypto_direction_t; + +typedef enum { + NO_CRYPTO, + AES_CM_128_HMAC_SHA1_80, + AES_CM_128_HMAC_SHA1_32 +} switch_rtp_crypto_key_type_t; + +struct switch_rtp_crypto_key { + uint32_t index; + switch_rtp_crypto_key_type_t type; + unsigned char key[SWITCH_RTP_MAX_CRYPTO_LEN]; + switch_size_t keylen; + struct switch_rtp_crypto_key *next; +}; +typedef struct switch_rtp_crypto_key switch_rtp_crypto_key_t; + + + +SWITCH_DECLARE(switch_status_t) switch_rtp_add_crypto_key(switch_rtp_t *rtp_session, + switch_rtp_crypto_direction_t direction, + uint32_t index, + switch_rtp_crypto_key_type_t type, + unsigned char *key, + switch_size_t keylen); + ///\defgroup rtp RTP (RealTime Transport Protocol) ///\ingroup core1 ///\{ typedef void (*switch_rtp_invalid_handler_t) (switch_rtp_t *rtp_session, switch_socket_t * sock, void *data, switch_size_t datalen, switch_sockaddr_t * from_addr); + +SWITCH_DECLARE(void) switch_rtp_get_random(void *buf, uint32_t len); /*! \brief Initilize the RTP System \param pool the memory pool to use for long term allocations @@ -83,7 +121,6 @@ \param samples_per_interval the default samples_per_interval \param ms_per_packet time in microseconds per packet \param flags flags to control behaviour - \param crypto_key optional crypto key \param timer_name timer interface to use \param err a pointer to resolve error messages \param pool a memory pool to use for the session @@ -93,7 +130,9 @@ switch_payload_t payload, uint32_t samples_per_interval, uint32_t ms_per_packet, - switch_rtp_flag_t flags, char *crypto_key, char *timer_name, const char **err, + switch_rtp_flag_t flags, + char *timer_name, + const char **err, switch_memory_pool_t *pool); @@ -107,7 +146,6 @@ \param samples_per_interval the default samples_per_interval \param ms_per_packet time in microseconds per packet \param flags flags to control behaviour - \param crypto_key optional crypto key \param timer_name timer interface to use \param err a pointer to resolve error messages \param pool a memory pool to use for the session @@ -120,7 +158,10 @@ switch_payload_t payload, uint32_t samples_per_interval, uint32_t ms_per_packet, - switch_rtp_flag_t flags, char *crypto_key, char *timer_name, const char **err, switch_memory_pool_t *pool); + switch_rtp_flag_t flags, + char *timer_name, + const char **err, + switch_memory_pool_t *pool); /*! Modified: freeswitch/trunk/src/include/switch_utils.h ============================================================================== --- freeswitch/trunk/src/include/switch_utils.h (original) +++ freeswitch/trunk/src/include/switch_utils.h Wed Jan 16 01:01:53 2008 @@ -56,7 +56,7 @@ #endif SWITCH_DECLARE(switch_status_t) switch_b64_encode(unsigned char *in, switch_size_t ilen, unsigned char *out, switch_size_t olen); -SWITCH_DECLARE(switch_status_t) switch_b64_decode(char *in, char *out, switch_size_t olen); +SWITCH_DECLARE(switch_size_t) switch_b64_decode(char *in, char *out, switch_size_t olen); SWITCH_DECLARE(char *) switch_amp_encode(char *s, char *buf, switch_size_t len); static inline switch_bool_t switch_is_digit_string(const char *s) { Modified: freeswitch/trunk/src/mod/applications/mod_esf/mod_esf.c ============================================================================== --- freeswitch/trunk/src/mod/applications/mod_esf/mod_esf.c (original) +++ freeswitch/trunk/src/mod/applications/mod_esf/mod_esf.c Wed Jan 16 01:01:53 2008 @@ -167,7 +167,7 @@ read_codec->implementation->samples_per_frame, read_codec->implementation->microseconds_per_frame, (switch_rtp_flag_t) flags, - NULL, "soft", &err, switch_core_session_get_pool(session)); + "soft", &err, switch_core_session_get_pool(session)); if (!switch_rtp_ready(rtp_session)) { switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "RTP Error\n"); Modified: freeswitch/trunk/src/mod/endpoints/mod_dingaling/mod_dingaling.c ============================================================================== --- freeswitch/trunk/src/mod/endpoints/mod_dingaling/mod_dingaling.c (original) +++ freeswitch/trunk/src/mod/endpoints/mod_dingaling/mod_dingaling.c Wed Jan 16 01:01:53 2008 @@ -877,7 +877,7 @@ tech_pvt->codec_num, tech_pvt->read_codec.implementation->samples_per_frame, tech_pvt->read_codec.implementation->microseconds_per_frame, - flags, NULL, tech_pvt->profile->timer_name, &err, switch_core_session_get_pool(tech_pvt->session)))) { + flags, tech_pvt->profile->timer_name, &err, switch_core_session_get_pool(tech_pvt->session)))) { switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "RTP ERROR %s\n", err); switch_channel_hangup(channel, SWITCH_CAUSE_DESTINATION_OUT_OF_ORDER); return 0; Modified: freeswitch/trunk/src/mod/endpoints/mod_sofia/mod_sofia.c ============================================================================== --- freeswitch/trunk/src/mod/endpoints/mod_sofia/mod_sofia.c (original) +++ freeswitch/trunk/src/mod/endpoints/mod_sofia/mod_sofia.c Wed Jan 16 01:01:53 2008 @@ -90,6 +90,19 @@ } if (switch_test_flag(tech_pvt, TFLAG_OUTBOUND)) { + const char *var; + + if ((var = switch_channel_get_variable(channel, SOFIA_SECURE_MEDIA_VARIABLE)) && !switch_strlen_zero(var)) { + if (switch_true(var) || !strcasecmp(var, SWITCH_RTP_CRYPTO_KEY_32)) { + switch_set_flag_locked(tech_pvt, TFLAG_SECURE); + sofia_glue_build_crypto(tech_pvt, 1, AES_CM_128_HMAC_SHA1_32, SWITCH_RTP_CRYPTO_SEND); + } else if (!strcasecmp(var, SWITCH_RTP_CRYPTO_KEY_80)) { + switch_set_flag_locked(tech_pvt, TFLAG_SECURE); + sofia_glue_build_crypto(tech_pvt, 1, AES_CM_128_HMAC_SHA1_80, SWITCH_RTP_CRYPTO_SEND); + } + } + + if (sofia_glue_do_invite(session) != SWITCH_STATUS_SUCCESS) { switch_channel_hangup(channel, SWITCH_CAUSE_DESTINATION_OUT_OF_ORDER); return SWITCH_STATUS_FALSE; @@ -786,6 +799,13 @@ tech_pvt = (private_object_t *) switch_core_session_get_private(session); switch_assert(tech_pvt != NULL); + if (msg->message_id == SWITCH_MESSAGE_INDICATE_ANSWER || msg->message_id == SWITCH_MESSAGE_INDICATE_PROGRESS) { + const char *var; + if ((var = switch_channel_get_variable(channel, SOFIA_SECURE_MEDIA_VARIABLE)) && switch_true(var)) { + switch_set_flag_locked(tech_pvt, TFLAG_SECURE); + } + } + switch (msg->message_id) { case SWITCH_MESSAGE_INDICATE_BROADCAST: { const char *ip = NULL, *port = NULL; @@ -1746,6 +1766,7 @@ *pool = NULL; done: + if (profile) { sofia_glue_release_profile(profile); } Modified: freeswitch/trunk/src/mod/endpoints/mod_sofia/mod_sofia.h ============================================================================== --- freeswitch/trunk/src/mod/endpoints/mod_sofia/mod_sofia.h (original) +++ freeswitch/trunk/src/mod/endpoints/mod_sofia/mod_sofia.h Wed Jan 16 01:01:53 2008 @@ -73,6 +73,9 @@ #define SOFIA_DEFAULT_PORT "5060" #define SOFIA_DEFAULT_TLS_PORT "5061" #define SOFIA_REFER_TO_VARIABLE "sip_refer_to" +#define SOFIA_SECURE_MEDIA_VARIABLE "sip_secure_media" +#define SOFIA_SECURE_MEDIA_CONFIRMED_VARIABLE "sip_secure_media_confirmed" +#define SOFIA_HAS_CRYPTO_VARIABLE "sip_has_crypto" #include <sofia-sip/nua.h> #include <sofia-sip/sip_status.h> @@ -124,7 +127,8 @@ PFLAG_MULTIREG = (1 << 11), PFLAG_SUPRESS_CNG = (1 << 12), PFLAG_TLS = (1 << 13), - PFLAG_CHECKUSER = (1 << 14) + PFLAG_CHECKUSER = (1 << 14), + PFLAG_SECURE = (1 << 15) } PFLAGS; typedef enum { @@ -339,6 +343,13 @@ char *invite_contact; char *local_url; char *gateway_name; + char *local_crypto_key; + char *remote_crypto_key; + unsigned char local_raw_key[SWITCH_RTP_MAX_CRYPTO_LEN]; + unsigned char remote_raw_key[SWITCH_RTP_MAX_CRYPTO_LEN]; + switch_rtp_crypto_key_type_t crypto_send_type; + switch_rtp_crypto_key_type_t crypto_recv_type; + switch_rtp_crypto_key_type_t crypto_type; unsigned long rm_rate; switch_payload_t pt; switch_mutex_t *flag_mutex; @@ -561,3 +572,4 @@ int sofia_glue_transport_has_tls(const sofia_transport_t tp); const char *sofia_glue_get_unknown_header(sip_t const *sip, const char *name); +switch_status_t sofia_glue_build_crypto(private_object_t *tech_pvt, int index, switch_rtp_crypto_key_type_t type, switch_rtp_crypto_direction_t direction); Modified: freeswitch/trunk/src/mod/endpoints/mod_sofia/sofia.c ============================================================================== --- freeswitch/trunk/src/mod/endpoints/mod_sofia/sofia.c (original) +++ freeswitch/trunk/src/mod/endpoints/mod_sofia/sofia.c Wed Jan 16 01:01:53 2008 @@ -1010,6 +1010,10 @@ if (switch_true(val)) { profile->pflags |= PFLAG_PRESENCE; } + } else if (!strcasecmp(var, "require-secure-rtp")) { + if (switch_true(val)) { + profile->pflags |= PFLAG_SECURE; + } } else if (!strcasecmp(var, "multiple-registrations")) { if (switch_true(val)) { profile->pflags |= PFLAG_MULTIREG; Modified: freeswitch/trunk/src/mod/endpoints/mod_sofia/sofia_glue.c ============================================================================== --- freeswitch/trunk/src/mod/endpoints/mod_sofia/sofia_glue.c (original) +++ freeswitch/trunk/src/mod/endpoints/mod_sofia/sofia_glue.c Wed Jan 16 01:01:53 2008 @@ -89,6 +89,8 @@ "a=%s\n" "m=audio %d RTP/AVP", tech_pvt->owner_id, tech_pvt->session_id, ip, ip, sr, port); + + if (tech_pvt->rm_encoding) { switch_snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), " %d", tech_pvt->pt); } else if (tech_pvt->num_codecs) { @@ -126,6 +128,7 @@ switch_snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), "\n"); + if (tech_pvt->rm_encoding) { rate = tech_pvt->rm_rate; switch_snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), "a=rtpmap:%d %s/%d\n", tech_pvt->pt, tech_pvt->rm_encoding, rate); @@ -181,6 +184,11 @@ switch_snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), "a=ptime:%d\n", ptime); } + if (!switch_strlen_zero(tech_pvt->local_crypto_key) && switch_test_flag(tech_pvt, TFLAG_SECURE)) { + switch_snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), "a=crypto:%s\n", tech_pvt->local_crypto_key); + switch_snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), "a=encryption:optional\n"); + } + if (switch_test_flag(tech_pvt, TFLAG_VIDEO) && tech_pvt->video_rm_encoding) { sofia_glue_tech_choose_video_port(tech_pvt); if ((v_port = tech_pvt->adv_sdp_video_port)) { @@ -928,7 +936,7 @@ void sofia_glue_deactivate_rtp(private_object_t *tech_pvt) { - int loops = 0; //, sock = -1; + int loops = 0; if (switch_rtp_ready(tech_pvt->rtp_session)) { while (loops < 10 && (switch_test_flag(tech_pvt, TFLAG_READING) || switch_test_flag(tech_pvt, TFLAG_WRITING))) { switch_yield(10000); @@ -1077,6 +1085,102 @@ return SWITCH_STATUS_SUCCESS; } + +switch_status_t sofia_glue_build_crypto(private_object_t *tech_pvt, int index, switch_rtp_crypto_key_type_t type, switch_rtp_crypto_direction_t direction) +{ + unsigned char b64_key[512] = ""; + const char *type_str; + unsigned char *key; + + char *p; + + if (type == AES_CM_128_HMAC_SHA1_80) { + type_str = SWITCH_RTP_CRYPTO_KEY_80; + } else { + type_str = SWITCH_RTP_CRYPTO_KEY_32; + } + + if (direction == SWITCH_RTP_CRYPTO_SEND) { + key = tech_pvt->local_raw_key; + } else { + key = tech_pvt->remote_raw_key; + + } + + switch_rtp_get_random(key, SWITCH_RTP_KEY_LEN); + switch_b64_encode(key, SWITCH_RTP_KEY_LEN, b64_key, sizeof(b64_key)); + p = strrchr((char *)b64_key, '='); + + while(p && *p && *p == '=') { + *p-- = '\0'; + } + + tech_pvt->local_crypto_key = switch_core_session_sprintf(tech_pvt->session, "%d %s inline:%s", index, type_str, b64_key); + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Set Local Key [%s]\n", tech_pvt->local_crypto_key); + tech_pvt->crypto_type = type; + + + return SWITCH_STATUS_SUCCESS; +} + +switch_status_t sofia_glue_add_crypto(private_object_t *tech_pvt, const char *key_str, switch_rtp_crypto_direction_t direction) +{ + unsigned char key[SWITCH_RTP_MAX_CRYPTO_LEN]; + int index; + switch_rtp_crypto_key_type_t type; + char *p; + + + if (!switch_rtp_ready(tech_pvt->rtp_session)) { + goto bad; + } + + index = atoi(key_str); + + p = strchr(key_str, ' '); + + if (p && *p && *(p+1)) { + p++; + if (!strncasecmp(p, SWITCH_RTP_CRYPTO_KEY_32, strlen(SWITCH_RTP_CRYPTO_KEY_32))) { + type = AES_CM_128_HMAC_SHA1_32; + } else if (!strncasecmp(p, SWITCH_RTP_CRYPTO_KEY_80, strlen(SWITCH_RTP_CRYPTO_KEY_80))) { + type = AES_CM_128_HMAC_SHA1_80; + } else { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Parse Error near [%s]\n", p); + goto bad; + } + + p = strchr(p, ' '); + if (p && *p && *(p+1)) { + p++; + if (strncasecmp(p, "inline:", 7)) { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Parse Error near [%s]\n", p); + goto bad; + } + + p += 7; + switch_b64_decode(p, (char *)key, sizeof(key)); + + if (direction == SWITCH_RTP_CRYPTO_SEND) { + tech_pvt->crypto_send_type = type; + memcpy(tech_pvt->local_raw_key, key, SWITCH_RTP_KEY_LEN); + } else { + tech_pvt->crypto_recv_type = type; + memcpy(tech_pvt->remote_raw_key, key, SWITCH_RTP_KEY_LEN); + } + return SWITCH_STATUS_SUCCESS; + } + + } + + bad: + + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Error!\n"); + return SWITCH_STATUS_FALSE; + +} + + switch_status_t sofia_glue_activate_rtp(private_object_t *tech_pvt, switch_rtp_flag_t myflags) { int bw, ms; @@ -1175,8 +1279,10 @@ tech_pvt->read_codec.implementation->samples_per_frame, tech_pvt->codec_ms * 1000, (switch_rtp_flag_t) flags, - NULL, tech_pvt->profile->timer_name, &err, switch_core_session_get_pool(tech_pvt->session)); - + tech_pvt->profile->timer_name, + &err, + switch_core_session_get_pool(tech_pvt->session)); + if (switch_rtp_ready(tech_pvt->rtp_session)) { uint8_t vad_in = switch_test_flag(tech_pvt, TFLAG_VAD_IN) ? 1 : 0; uint8_t vad_out = switch_test_flag(tech_pvt, TFLAG_VAD_OUT) ? 1 : 0; @@ -1243,6 +1349,14 @@ switch_rtp_set_cng_pt(tech_pvt->rtp_session, tech_pvt->cng_pt); } + if (tech_pvt->remote_crypto_key && switch_test_flag(tech_pvt, TFLAG_SECURE)) { + sofia_glue_add_crypto(tech_pvt, tech_pvt->remote_crypto_key, SWITCH_RTP_CRYPTO_RECV); + switch_rtp_add_crypto_key(tech_pvt->rtp_session, SWITCH_RTP_CRYPTO_SEND, 1, tech_pvt->crypto_type, tech_pvt->local_raw_key, SWITCH_RTP_KEY_LEN); + switch_rtp_add_crypto_key(tech_pvt->rtp_session, SWITCH_RTP_CRYPTO_RECV, 1, tech_pvt->crypto_type, tech_pvt->remote_raw_key, SWITCH_RTP_KEY_LEN); + switch_channel_set_variable(tech_pvt->channel, SOFIA_SECURE_MEDIA_CONFIRMED_VARIABLE, "true"); + } + + sofia_glue_check_video_codecs(tech_pvt); if (switch_test_flag(tech_pvt, TFLAG_VIDEO) && tech_pvt->video_rm_encoding) { @@ -1250,16 +1364,16 @@ sofia_glue_tech_set_video_codec(tech_pvt, 0); tech_pvt->video_rtp_session = switch_rtp_new(tech_pvt->local_sdp_audio_ip, - tech_pvt->local_sdp_video_port, - tech_pvt->remote_sdp_video_ip, - tech_pvt->remote_sdp_video_port, - tech_pvt->video_agreed_pt, - tech_pvt->video_read_codec.implementation->samples_per_frame, - 0, - (switch_rtp_flag_t) flags, - NULL, - NULL, - &err, switch_core_session_get_pool(tech_pvt->session)); + tech_pvt->local_sdp_video_port, + tech_pvt->remote_sdp_video_ip, + tech_pvt->remote_sdp_video_port, + tech_pvt->video_agreed_pt, + tech_pvt->video_read_codec.implementation->samples_per_frame, + 0, + (switch_rtp_flag_t) flags, + NULL, + &err, + switch_core_session_get_pool(tech_pvt->session)); switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "VIDEO RTP [%s] %s:%d->%s:%d codec: %u ms: %d [%s]\n", switch_channel_get_name(tech_pvt->channel), @@ -1396,7 +1510,6 @@ } if (stream) { - //switch_ivr_displace_session(tech_pvt->session, stream, 0, "rl"); switch_ivr_broadcast(switch_channel_get_variable(tech_pvt->channel, SWITCH_SIGNAL_BOND_VARIABLE), stream, SMF_ECHO_ALEG | SMF_LOOP); } } @@ -1405,8 +1518,6 @@ const char *uuid; switch_core_session_t *b_session; - //const char *stream; - if (tech_pvt->max_missed_packets) { switch_rtp_set_max_missed_packets(tech_pvt->rtp_session, tech_pvt->max_missed_packets); } @@ -1418,14 +1529,6 @@ switch_core_session_rwunlock(b_session); } - //if (!(stream = switch_channel_get_variable(tech_pvt->channel, SWITCH_HOLD_MUSIC_VARIABLE))) { - //stream = tech_pvt->profile->hold_music; - //} - - //if (stream) { - //switch_ivr_stop_displace_session(tech_pvt->session, stream); - //} - switch_clear_flag_locked(tech_pvt, TFLAG_SIP_HOLD); switch_channel_presence(tech_pvt->channel, "unknown", "unhold"); } @@ -1444,6 +1547,24 @@ ptime = atoi(a->a_value); } else if (!strcasecmp(a->a_name, "crypto") && a->a_value) { crypto = a->a_value; + if (tech_pvt->remote_crypto_key) { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Already have a key\n"); + } else { + tech_pvt->remote_crypto_key = switch_core_session_strdup(tech_pvt->session, crypto); + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Set Remote Key [%s]\n", tech_pvt->remote_crypto_key); + + if (switch_strlen_zero(tech_pvt->local_crypto_key)) { + if (switch_stristr(SWITCH_RTP_CRYPTO_KEY_32, crypto)) { + switch_channel_set_variable(tech_pvt->channel, SOFIA_HAS_CRYPTO_VARIABLE, SWITCH_RTP_CRYPTO_KEY_32); + sofia_glue_build_crypto(tech_pvt, atoi(crypto), AES_CM_128_HMAC_SHA1_32, SWITCH_RTP_CRYPTO_SEND); + } else if (switch_stristr(SWITCH_RTP_CRYPTO_KEY_80, crypto)) { + switch_channel_set_variable(tech_pvt->channel, SOFIA_HAS_CRYPTO_VARIABLE, SWITCH_RTP_CRYPTO_KEY_80); + sofia_glue_build_crypto(tech_pvt, atoi(crypto), AES_CM_128_HMAC_SHA1_80, SWITCH_RTP_CRYPTO_SEND); + } else { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Crypto Setup Failed!.\n"); + } + } + } } } @@ -1461,7 +1582,6 @@ greed: x = 0; - //xxxxxx if (tech_pvt->rm_encoding) { for (map = m->m_rtpmaps; map; map = map->rm_next) { if (map->rm_pt < 96) { @@ -1486,7 +1606,6 @@ const char *rm_encoding; if (x++ < skip) { - //printf("skip %s\n", map->rm_encoding); continue; } Modified: freeswitch/trunk/src/switch_rtp.c ============================================================================== --- freeswitch/trunk/src/switch_rtp.c (original) +++ freeswitch/trunk/src/switch_rtp.c Wed Jan 16 01:01:53 2008 @@ -43,14 +43,16 @@ #undef inline #include <datatypes.h> #include <srtp.h> + + #include "stfu.h" -#define MAX_KEY_LEN 64 + #define rtp_header_len 12 #define RTP_START_PORT 16384 #define RTP_END_PORT 32768 -#define MAX_KEY_LEN 64 #define MASTER_KEY_LEN 30 #define RTP_MAGIC_NUMBER 42 +#define MAX_SRTP_ERRS 10 static switch_port_t START_PORT = RTP_START_PORT; static switch_port_t END_PORT = RTP_END_PORT; @@ -121,14 +123,19 @@ switch_sockaddr_t *local_addr; rtp_msg_t send_msg; - srtp_ctx_t *send_ctx; switch_sockaddr_t *remote_addr; rtp_msg_t recv_msg; - srtp_ctx_t *recv_ctx; + uint32_t autoadj_window; uint32_t autoadj_tally; + srtp_ctx_t *send_ctx; + srtp_ctx_t *recv_ctx; + srtp_policy_t send_policy; + srtp_policy_t recv_policy; + uint32_t srtp_errs; + uint16_t seq; uint32_t ssrc; uint8_t sending_dtmf; @@ -168,6 +175,7 @@ uint32_t max_missed_packets; uint32_t missed_count; rtp_msg_t write_msg; + switch_rtp_crypto_key_t *crypto_keys[SWITCH_RTP_CRYPTO_MAX]; }; static int global_init = 0; @@ -277,6 +285,12 @@ global_init = 1; } +SWITCH_DECLARE(void) switch_rtp_get_random(void *buf, uint32_t len) +{ + crypto_get_random(buf, len); +} + + SWITCH_DECLARE(void) switch_rtp_shutdown(void) { switch_core_hash_destroy(&alloc_hash); @@ -470,16 +484,89 @@ return SWITCH_STATUS_SUCCESS; } +SWITCH_DECLARE(switch_status_t) switch_rtp_add_crypto_key(switch_rtp_t *rtp_session, + switch_rtp_crypto_direction_t direction, + uint32_t index, + switch_rtp_crypto_key_type_t type, + unsigned char *key, + switch_size_t keylen) +{ + + switch_rtp_crypto_key_t *crypto_key; + srtp_policy_t *policy; + err_status_t stat; + + crypto_key = switch_core_alloc(rtp_session->pool, sizeof(*crypto_key)); + + policy = direction == SWITCH_RTP_CRYPTO_RECV ? &rtp_session->recv_policy : &rtp_session->send_policy; + + + crypto_key->type = type; + crypto_key->index = index; + memcpy(crypto_key->key, key, keylen); + crypto_key->next = rtp_session->crypto_keys[direction]; + rtp_session->crypto_keys[direction] = crypto_key; + + + memset(policy, 0, sizeof(*policy)); + switch_set_flag_locked(rtp_session, SWITCH_RTP_FLAG_SECURE); + + switch(crypto_key->type) { + case AES_CM_128_HMAC_SHA1_80: + crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy->rtp); + break; + case AES_CM_128_HMAC_SHA1_32: + crypto_policy_set_aes_cm_128_hmac_sha1_32(&policy->rtp); + break; + default: + break; + } + + + policy->next = NULL; + policy->key = (uint8_t *) crypto_key->key; + crypto_policy_set_rtcp_default(&policy->rtcp); + policy->rtcp.sec_serv = sec_serv_none; + + policy->rtp.sec_serv = sec_serv_conf_and_auth; + switch(direction) { + case SWITCH_RTP_CRYPTO_RECV: + policy->ssrc.type = ssrc_any_inbound; + if ((stat = srtp_create(&rtp_session->recv_ctx, policy))) { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Error allocating srtp [%d]\n", stat); + return SWITCH_STATUS_FALSE; + } + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "Activating Secure RTP RECV\n"); + break; + case SWITCH_RTP_CRYPTO_SEND: + policy->ssrc.type = ssrc_specific; + policy->ssrc.value = rtp_session->ssrc; + + if ((stat = srtp_create(&rtp_session->send_ctx, policy))) { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Error allocating srtp [%d]\n", stat); + return SWITCH_STATUS_FALSE; + } + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "Activating Secure RTP SEND\n"); + break; + default: + abort(); + break; + } + + return SWITCH_STATUS_SUCCESS; + +} + SWITCH_DECLARE(switch_status_t) switch_rtp_create(switch_rtp_t **new_rtp_session, switch_payload_t payload, uint32_t samples_per_interval, uint32_t ms_per_packet, - switch_rtp_flag_t flags, char *crypto_key, char *timer_name, const char **err, + switch_rtp_flag_t flags, + char *timer_name, + const char **err, switch_memory_pool_t *pool) { switch_rtp_t *rtp_session = NULL; - srtp_policy_t policy; - char key[MAX_KEY_LEN]; uint32_t ssrc = rand() & 0xffff; *new_rtp_session = NULL; @@ -507,44 +594,10 @@ /* for from address on recvfrom calls */ switch_sockaddr_info_get(&rtp_session->from_addr, NULL, SWITCH_UNSPEC, 0, 0, pool); - memset(&policy, 0, sizeof(policy)); - if (crypto_key) { - int len; - - switch_set_flag_locked(rtp_session, SWITCH_RTP_FLAG_SECURE); - crypto_policy_set_rtp_default(&policy.rtp); - crypto_policy_set_rtcp_default(&policy.rtcp); - policy.ssrc.type = ssrc_any_inbound; - policy.ssrc.value = ssrc; - policy.key = (uint8_t *) key; - policy.next = NULL; - policy.rtp.sec_serv = sec_serv_conf_and_auth; - policy.rtcp.sec_serv = sec_serv_none; - - /* read key from hexadecimal on command line into an octet string */ - len = hex_string_to_octet_string(key, crypto_key, MASTER_KEY_LEN * 2); - - /* check that hex string is the right length */ - if (len < MASTER_KEY_LEN * 2) { - switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, - "error: too few digits in key/salt " "(should be %d hexadecimal digits, found %d)\n", MASTER_KEY_LEN * 2, len); - *err = "Crypt Error"; - return SWITCH_STATUS_FALSE; - } - if (strlen(crypto_key) > MASTER_KEY_LEN * 2) { - switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, - "error: too many digits in key/salt " - "(should be %d hexadecimal digits, found %u)\n", MASTER_KEY_LEN * 2, (unsigned) strlen(crypto_key)); - *err = "Crypt Error"; - return SWITCH_STATUS_FALSE; - } - - switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "Activating Secure RTP!\n"); - } rtp_session->seq = (uint16_t) rand(); rtp_session->ssrc = ssrc; - rtp_session->send_msg.header.ssrc = htonl(ssrc); + rtp_session->send_msg.header.ssrc = htonl(rtp_session->ssrc); rtp_session->send_msg.header.ts = 0; rtp_session->send_msg.header.m = 0; rtp_session->send_msg.header.pt = (switch_payload_t) htonl(payload); @@ -553,7 +606,7 @@ rtp_session->send_msg.header.x = 0; rtp_session->send_msg.header.cc = 0; - rtp_session->recv_msg.header.ssrc = htonl(ssrc); + rtp_session->recv_msg.header.ssrc = 0; rtp_session->recv_msg.header.ts = 0; rtp_session->recv_msg.header.seq = 0; rtp_session->recv_msg.header.m = 0; @@ -568,20 +621,6 @@ rtp_session->samples_per_interval = rtp_session->conf_samples_per_interval = samples_per_interval; rtp_session->timer_name = switch_core_strdup(pool, timer_name); - if (switch_test_flag(rtp_session, SWITCH_RTP_FLAG_SECURE)) { - err_status_t stat; - - if ((stat = srtp_create(&rtp_session->recv_ctx, &policy))) { - switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Error allocating srtp [%d]\n", stat); - *err = "Crypt Error"; - return SWITCH_STATUS_FALSE; - } - if ((stat = srtp_create(&rtp_session->send_ctx, &policy))) { - switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Error allocating srtp [%d]\n", stat); - *err = "Crypt Error"; - return SWITCH_STATUS_FALSE; - } - } if (!switch_strlen_zero(timer_name)) { switch_set_flag_locked(rtp_session, SWITCH_RTP_FLAG_USE_TIMER); @@ -615,11 +654,14 @@ switch_payload_t payload, uint32_t samples_per_interval, uint32_t ms_per_packet, - switch_rtp_flag_t flags, char *crypto_key, char *timer_name, const char **err, switch_memory_pool_t *pool) + switch_rtp_flag_t flags, + char *timer_name, + const char **err, + switch_memory_pool_t *pool) { switch_rtp_t *rtp_session = NULL; - if (switch_rtp_create(&rtp_session, payload, samples_per_interval, ms_per_packet, flags, crypto_key, timer_name, err, pool) != SWITCH_STATUS_SUCCESS) { + if (switch_rtp_create(&rtp_session, payload, samples_per_interval, ms_per_packet, flags, timer_name, err, pool) != SWITCH_STATUS_SUCCESS) { goto end; } @@ -928,6 +970,29 @@ return -1; } + if (bytes && switch_test_flag(rtp_session, SWITCH_RTP_FLAG_SECURE)) { + int sbytes = (int) bytes; + err_status_t stat; + + + stat = srtp_unprotect(rtp_session->recv_ctx, &rtp_session->recv_msg.header, &sbytes); + if (stat && rtp_session->recv_msg.header.pt != rtp_session->te && rtp_session->recv_msg.header.pt != rtp_session->cng_pt) { + if (++rtp_session->srtp_errs >= MAX_SRTP_ERRS) { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, + "error: srtp unprotection failed with code %d%s\n", stat, + stat == err_status_replay_fail ? " (replay check failed)" : stat == err_status_auth_fail ? " (auth check failed)" : ""); + return -1; + } else { + sbytes = 0; + } + } else { + rtp_session->srtp_errs = 0; + } + + bytes = sbytes; + + } + if (rtp_session->jb && bytes && rtp_session->recv_msg.header.pt == rtp_session->payload) { if (rtp_session->recv_msg.header.m) { stfu_n_reset(rtp_session->jb); @@ -1028,20 +1093,6 @@ return 2 + rtp_header_len; } - if (bytes && switch_test_flag(rtp_session, SWITCH_RTP_FLAG_SECURE)) { - int sbytes = (int) bytes; - err_status_t stat; - - stat = srtp_unprotect(rtp_session->recv_ctx, &rtp_session->recv_msg.header, &sbytes); - if (stat) { - switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, - "error: srtp unprotection failed with code %d%s\n", stat, - stat == err_status_replay_fail ? " (replay check failed)" : stat == err_status_auth_fail ? " (auth check failed)" : ""); - return -1; - } - bytes = sbytes; - } - if (bytes > 0) { rtp_session->missed_count = 0; } @@ -1356,7 +1407,6 @@ if (flags && *flags & SFF_RFC2833) { send_msg->header.pt = rtp_session->te; } - send_msg->header.ssrc = htonl(rtp_session->ssrc); } else { uint8_t m = 0; @@ -1392,17 +1442,7 @@ bytes = datalen + rtp_header_len; } - if (switch_test_flag(rtp_session, SWITCH_RTP_FLAG_SECURE)) { - int sbytes = (int) bytes; - err_status_t stat; - - stat = srtp_protect(rtp_session->send_ctx, &send_msg->header, &sbytes); - if (stat) { - switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "error: srtp protection failed with code %d\n", stat); - } - - bytes = sbytes; - } + send_msg->header.ssrc = htonl(rtp_session->ssrc); if (switch_test_flag(rtp_session, SWITCH_RTP_FLAG_GOOGLEHACK) && rtp_session->send_msg.header.pt == 97) { rtp_session->recv_msg.header.pt = 102; @@ -1517,6 +1557,19 @@ if (send) { send_msg->header.seq = htons(++rtp_session->seq); + + if (switch_test_flag(rtp_session, SWITCH_RTP_FLAG_SECURE)) { + int sbytes = (int) bytes; + err_status_t stat; + + stat = srtp_protect(rtp_session->send_ctx, &send_msg->header, &sbytes); + if (stat) { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "error: srtp protection failed with code %d\n", stat); + } + + bytes = sbytes; + } + if (switch_socket_sendto(rtp_session->sock, rtp_session->remote_addr, 0, (void *) send_msg, &bytes) != SWITCH_STATUS_SUCCESS) { rtp_session->seq--; return -1; Modified: freeswitch/trunk/src/switch_utils.c ============================================================================== --- freeswitch/trunk/src/switch_utils.c (original) +++ freeswitch/trunk/src/switch_utils.c Wed Jan 16 01:01:53 2008 @@ -166,7 +166,7 @@ } -SWITCH_DECLARE(switch_status_t) switch_b64_decode(char *in, char *out, switch_size_t olen) +SWITCH_DECLARE(switch_size_t) switch_b64_decode(char *in, char *out, switch_size_t olen) { char l64[256]; @@ -203,7 +203,7 @@ op[ol++] = '\0'; - return SWITCH_STATUS_SUCCESS; + return ol; }