Copyright (C) 2011, RTFM, Inc.
*/
-#ifndef OPENSSL_NO_SRTP
-
#include <stdio.h>
#include <openssl/objects.h>
#include "ssl_locl.h"
+
+#ifndef OPENSSL_NO_SRTP
+
#include "srtp.h"
return 1;
}
- if((ct*2) > maxlen)
+ if((2 + ct*2 + 1) > maxlen)
{
SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT,SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
return 1;
}
+ /* Add the length */
+ s2n(ct * 2, p);
for(i=0;i<ct;i++)
{
prof=sk_SRTP_PROTECTION_PROFILE_value(clnt,i);
s2n(prof->id,p);
}
+
+ /* Add an empty use_mki value */
+ *p++ = 0;
}
- *len=ct*2;
+
+ *len=2 + ct*2 + 1;
return 0;
}
{
SRTP_PROTECTION_PROFILE *cprof,*sprof;
STACK_OF(SRTP_PROTECTION_PROFILE) *clnt=0,*srvr;
+ int ct;
+ int mki_len;
int i,j;
int id;
int ret;
-
- if(len%2)
+
+ /* Length value + the MKI length */
+ if(len < 3)
+ {
+ SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+ *al=SSL_AD_DECODE_ERROR;
+ return 1;
+ }
+
+ /* Pull off the length of the cipher suite list */
+ n2s(d, ct);
+ len -= 2;
+
+ /* Check that it is even */
+ if(ct%2)
+ {
+ SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+ *al=SSL_AD_DECODE_ERROR;
+ return 1;
+ }
+
+ /* Check that lengths are consistent */
+ if(len < (ct + 1))
{
SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
*al=SSL_AD_DECODE_ERROR;
return 1;
}
+
clnt=sk_SRTP_PROTECTION_PROFILE_new_null();
- while(len)
+ while(ct)
{
n2s(d,id);
- len-=2;
+ ct-=2;
+ len-=2;
if(!find_profile_by_num(id,&cprof))
{
}
}
+ /* Now extract the MKI value as a sanity check, but discard it for now */
+ mki_len = *d;
+ d++; len--;
+
+ if (mki_len != len)
+ {
+ SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_MKI_VALUE);
+ *al=SSL_AD_DECODE_ERROR;
+ return 1;
+ }
+
srvr=SSL_get_srtp_profiles(s);
/* Pick our most preferred profile. If no profiles have been
{
if(p)
{
- if(maxlen < 2)
+ if(maxlen < 5)
{
SSLerr(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT,SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
return 1;
SSLerr(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT,SSL_R_USE_SRTP_NOT_NEGOTIATED);
return 1;
}
-
+ s2n(2, p);
s2n(s->srtp_profile->id,p);
- }
- *len=2;
+ *p++ = 0;
+ }
+ *len=5;
return 0;
}
{
unsigned id;
int i;
+ int ct;
+
STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
SRTP_PROTECTION_PROFILE *prof;
- if(len!=2)
+ if(len!=5)
+ {
+ SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+ *al=SSL_AD_DECODE_ERROR;
+ return 1;
+ }
+
+ n2s(d, ct);
+ if(ct!=2)
{
SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
*al=SSL_AD_DECODE_ERROR;
}
n2s(d,id);
+ if (*d) /* Must be no MKI, since we never offer one */
+ {
+ SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_MKI_VALUE);
+ *al=SSL_AD_ILLEGAL_PARAMETER;
+ return 1;
+ }
clnt=SSL_get_srtp_profiles(s);