From 9b1a36a294342fc418d9a359a4cf06bd90c4acb9 Mon Sep 17 00:00:00 2001 From: twilson Date: Tue, 8 Jun 2010 05:29:08 +0000 Subject: Add SRTP support for Asterisk After 5 years in mantis and over a year on reviewboard, SRTP support is finally being comitted. This includes generic CHANNEL dialplan functions that work for getting the status of whether a call has secure media or signaling as defined by the underlying channel technology and for setting whether or not a new channel being bridged to a calling channel should have secure signaling or media. See doc/tex/secure-calls.tex for examples. Original patch by mikma, updated for trunk and revised by me. (closes issue #5413) Reported by: mikma Tested by: twilson, notthematrix, hemanshurpatel Review: https://reviewboard.asterisk.org/r/191/ git-svn-id: http://svn.digium.com/svn/asterisk/trunk@268894 f38db490-d61c-443f-a65b-d21fe96a405b --- channels/sip/dialplan_functions.c | 4 + channels/sip/include/sdp_crypto.h | 82 ++++++++++ channels/sip/include/sip.h | 9 +- channels/sip/include/srtp.h | 57 +++++++ channels/sip/sdp_crypto.c | 310 ++++++++++++++++++++++++++++++++++++++ channels/sip/srtp.c | 51 +++++++ 6 files changed, 510 insertions(+), 3 deletions(-) create mode 100644 channels/sip/include/sdp_crypto.h create mode 100644 channels/sip/include/srtp.h create mode 100644 channels/sip/sdp_crypto.c create mode 100644 channels/sip/srtp.c (limited to 'channels/sip') diff --git a/channels/sip/dialplan_functions.c b/channels/sip/dialplan_functions.c index d39a2779e..d09627ed8 100644 --- a/channels/sip/dialplan_functions.c +++ b/channels/sip/dialplan_functions.c @@ -214,6 +214,10 @@ int sip_acf_channel_read(struct ast_channel *chan, const char *funcname, char *p ast_log(LOG_WARNING, "Unrecognized argument '%s' to %s\n", preparse, funcname); return -1; } + } else if (!strcasecmp(args.param, "secure_signaling")) { + snprintf(buf, buflen, "%s", p->socket.type == SIP_TRANSPORT_TLS ? "1" : ""); + } else if (!strcasecmp(args.param, "secure_media")) { + snprintf(buf, buflen, "%s", p->srtp ? "1" : ""); } else { res = -1; } diff --git a/channels/sip/include/sdp_crypto.h b/channels/sip/include/sdp_crypto.h new file mode 100644 index 000000000..b1c153438 --- /dev/null +++ b/channels/sip/include/sdp_crypto.h @@ -0,0 +1,82 @@ +/* + * Asterisk -- An open source telephony toolkit. + * + * Copyright (C) 2006 - 2007, Mikael Magnusson + * + * Mikael Magnusson + * + * See http://www.asterisk.org for more information about + * the Asterisk project. Please do not directly contact + * any of the maintainers of this project for assistance; + * the project provides a web site, mailing lists and IRC + * channels for your use. + * + * This program is free software, distributed under the terms of + * the GNU General Public License Version 2. See the LICENSE file + * at the top of the source tree. + */ + +/*! \file sdp_crypto.h + * + * \brief SDP Security descriptions + * + * Specified in RFC 4568 + * + * \author Mikael Magnusson + */ + +#ifndef _SDP_CRYPTO_H +#define _SDP_CRYPTO_H + +#include + +struct sdp_crypto; + +/*! \brief Initialize an return an sdp_crypto struct + * + * \details + * This function allocates a new sdp_crypto struct and initializes its values + * + * \retval NULL on failure + * \retval a pointer to a new sdp_crypto structure + */ +struct sdp_crypto *sdp_crypto_setup(void); + +/*! \brief Destroy a previously allocated sdp_crypto struct */ +void sdp_crypto_destroy(struct sdp_crypto *crypto); + +/*! \brief Parse the a=crypto line from SDP and set appropriate values on the + * sdp_crypto struct. + * + * \param p A valid sdp_crypto struct + * \param attr the a:crypto line from SDP + * \param rtp The rtp instance associated with the SDP being parsed + * + * \retval 0 success + * \retval nonzero failure + */ +int sdp_crypto_process(struct sdp_crypto *p, const char *attr, struct ast_rtp_instance *rtp); + + +/*! \brief Generate an SRTP a=crypto offer + * + * \details + * The offer is stored on the sdp_crypto struct in a_crypto + * + * \param A valid sdp_crypto struct + * + * \retval 0 success + * \retval nonzero failure + */ +int sdp_crypto_offer(struct sdp_crypto *p); + + +/*! \brief Return the a_crypto value of the sdp_crypto struct + * + * \param p An sdp_crypto struct that has had sdp_crypto_offer called + * + * \retval The value of the a_crypto for p + */ +const char *sdp_crypto_attrib(struct sdp_crypto *p); + +#endif /* _SDP_CRYPTO_H */ diff --git a/channels/sip/include/sip.h b/channels/sip/include/sip.h index 9017d7e6b..8d6d0abcb 100644 --- a/channels/sip/include/sip.h +++ b/channels/sip/include/sip.h @@ -307,10 +307,8 @@ #define SIP_PAGE2_RTAUTOCLEAR (1 << 1) /*!< GP: Should we clean memory from peers after expiry? */ #define SIP_PAGE2_RPID_UPDATE (1 << 2) #define SIP_PAGE2_Q850_REASON (1 << 3) /*!< DP: Get/send cause code via Reason header */ - #define SIP_PAGE2_SYMMETRICRTP (1 << 4) /*!< GDP: Whether symmetric RTP is enabled or not */ #define SIP_PAGE2_STATECHANGEQUEUE (1 << 5) /*!< D: Unsent state pending change exists */ - #define SIP_PAGE2_CONNECTLINEUPDATE_PEND (1 << 6) #define SIP_PAGE2_RPID_IMMEDIATE (1 << 7) #define SIP_PAGE2_RPORT_PRESENT (1 << 8) /*!< Was rport received in the Via header? */ @@ -345,6 +343,7 @@ #define SIP_PAGE2_UDPTL_DESTINATION (1 << 25) /*!< DP: Use source IP of RTP as destination if NAT is enabled */ #define SIP_PAGE2_VIDEOSUPPORT_ALWAYS (1 << 26) /*!< DP: Always set up video, even if endpoints don't support it */ #define SIP_PAGE2_HAVEPEERCONTEXT (1 << 27) /*< Are we associated with a configured peer context? */ +#define SIP_PAGE2_USE_SRTP (1 << 28) /*!< DP: Whether we should offer (only) SRTP */ #define SIP_PAGE2_FLAGS_TO_COPY \ (SIP_PAGE2_ALLOWSUBSCRIBE | SIP_PAGE2_ALLOWOVERLAP | SIP_PAGE2_IGNORESDPVERSION | \ @@ -352,7 +351,7 @@ SIP_PAGE2_BUGGY_MWI | SIP_PAGE2_TEXTSUPPORT | SIP_PAGE2_FAX_DETECT | \ SIP_PAGE2_UDPTL_DESTINATION | SIP_PAGE2_VIDEOSUPPORT_ALWAYS | SIP_PAGE2_PREFERRED_CODEC | \ SIP_PAGE2_RPID_IMMEDIATE | SIP_PAGE2_RPID_UPDATE | SIP_PAGE2_SYMMETRICRTP |\ - SIP_PAGE2_Q850_REASON | SIP_PAGE2_HAVEPEERCONTEXT) + SIP_PAGE2_Q850_REASON | SIP_PAGE2_HAVEPEERCONTEXT | SIP_PAGE2_USE_SRTP) #define SIP_PAGE3_SNOM_AOC (1 << 0) /*!< DPG: Allow snom aoc messages */ @@ -965,6 +964,7 @@ struct sip_pvt { * or respect the other endpoint's request for frame sizes (on) * for incoming calls */ + unsigned short req_secure_signaling:1;/*!< Whether we are required to have secure signaling or not */ char tag[11]; /*!< Our tag for this session */ int timer_t1; /*!< SIP timer T1, ms rtt */ int timer_b; /*!< SIP timer B, ms */ @@ -1048,6 +1048,9 @@ struct sip_pvt { AST_LIST_HEAD_NOLOCK(request_queue, sip_request) request_queue; /*!< Requests that arrived but could not be processed immediately */ struct sip_invite_param *options; /*!< Options for INVITE */ struct sip_st_dlg *stimer; /*!< SIP Session-Timers */ + struct sip_srtp *srtp; /*!< Structure to hold Secure RTP session data for audio */ + struct sip_srtp *vsrtp; /*!< Structure to hold Secure RTP session data for video */ + struct sip_srtp *tsrtp; /*!< Structure to hold Secure RTP session data for text */ int red; /*!< T.140 RTP Redundancy */ int hangupcause; /*!< Storage of hangupcause copied from our owner before we disconnect from the AST channel (only used at hangup) */ diff --git a/channels/sip/include/srtp.h b/channels/sip/include/srtp.h new file mode 100644 index 000000000..b7a3fc30b --- /dev/null +++ b/channels/sip/include/srtp.h @@ -0,0 +1,57 @@ +/* + * Asterisk -- An open source telephony toolkit. + * + * Copyright (C) 2006 - 2007, Mikael Magnusson + * + * Mikael Magnusson + * + * See http://www.asterisk.org for more information about + * the Asterisk project. Please do not directly contact + * any of the maintainers of this project for assistance; + * the project provides a web site, mailing lists and IRC + * channels for your use. + * + * This program is free software, distributed under the terms of + * the GNU General Public License Version 2. See the LICENSE file + * at the top of the source tree. + */ + +/*! \file sip_srtp.h + * + * \brief SIP Secure RTP (SRTP) + * + * Specified in RFC 3711 + * + * \author Mikael Magnusson + */ + +#ifndef _SIP_SRTP_H +#define _SIP_SRTP_H + +#include "sdp_crypto.h" + +/* SRTP flags */ +#define SRTP_ENCR_OPTIONAL (1 << 1) /* SRTP encryption optional */ +#define SRTP_CRYPTO_ENABLE (1 << 2) +#define SRTP_CRYPTO_OFFER_OK (1 << 3) + +/*! \brief structure for secure RTP audio */ +struct sip_srtp { + unsigned int flags; + struct sdp_crypto *crypto; +}; + +/*! + * \brief allocate a sip_srtp structure + * \retval a new malloc'd sip_srtp structure on success + * \retval NULL on failure +*/ +struct sip_srtp *sip_srtp_alloc(void); + +/*! + * \brief free a sip_srtp structure + * \param srtp a sip_srtp structure +*/ +void sip_srtp_destroy(struct sip_srtp *srtp); + +#endif /* _SIP_SRTP_H */ diff --git a/channels/sip/sdp_crypto.c b/channels/sip/sdp_crypto.c new file mode 100644 index 000000000..94bf85619 --- /dev/null +++ b/channels/sip/sdp_crypto.c @@ -0,0 +1,310 @@ +/* + * Asterisk -- An open source telephony toolkit. + * + * Copyright (C) 2006 - 2007, Mikael Magnusson + * + * Mikael Magnusson + * + * See http://www.asterisk.org for more information about + * the Asterisk project. Please do not directly contact + * any of the maintainers of this project for assistance; + * the project provides a web site, mailing lists and IRC + * channels for your use. + * + * This program is free software, distributed under the terms of + * the GNU General Public License Version 2. See the LICENSE file + * at the top of the source tree. + */ + +/*! \file sdp_crypto.c + * + * \brief SDP Security descriptions + * + * Specified in RFC 4568 + * + * \author Mikael Magnusson + */ + +#include "asterisk.h" + +ASTERISK_FILE_VERSION(__FILE__, "$Revision$") + +#include "asterisk/options.h" +#include "asterisk/utils.h" +#include "include/sdp_crypto.h" + +#define SRTP_MASTER_LEN 30 +#define SRTP_MASTERKEY_LEN 16 +#define SRTP_MASTERSALT_LEN ((SRTP_MASTER_LEN) - (SRTP_MASTERKEY_LEN)) +#define SRTP_MASTER_LEN64 (((SRTP_MASTER_LEN) * 8 + 5) / 6 + 1) + +extern struct ast_srtp_res *res_srtp; +extern struct ast_srtp_policy_res *res_srtp_policy; + +struct sdp_crypto { + char *a_crypto; + unsigned char local_key[SRTP_MASTER_LEN]; + char local_key64[SRTP_MASTER_LEN64]; +}; + +static int set_crypto_policy(struct ast_srtp_policy *policy, int suite_val, const unsigned char *master_key, unsigned long ssrc, int inbound); + +static struct sdp_crypto *sdp_crypto_alloc(void) +{ + struct sdp_crypto *crypto; + + return crypto = ast_calloc(1, sizeof(*crypto)); +} + +void sdp_crypto_destroy(struct sdp_crypto *crypto) +{ + ast_free(crypto->a_crypto); + crypto->a_crypto = NULL; + ast_free(crypto); +} + +struct sdp_crypto *sdp_crypto_setup(void) +{ + struct sdp_crypto *p; + int key_len; + unsigned char remote_key[SRTP_MASTER_LEN]; + + if (!ast_rtp_engine_srtp_is_registered()) { + return NULL; + } + + if (!(p = sdp_crypto_alloc())) { + return NULL; + } + + if (res_srtp->get_random(p->local_key, sizeof(p->local_key)) < 0) { + sdp_crypto_destroy(p); + return NULL; + } + + ast_base64encode(p->local_key64, p->local_key, SRTP_MASTER_LEN, sizeof(p->local_key64)); + + key_len = ast_base64decode(remote_key, p->local_key64, sizeof(remote_key)); + + if (key_len != SRTP_MASTER_LEN) { + ast_log(LOG_ERROR, "base64 encode/decode bad len %d != %d\n", key_len, SRTP_MASTER_LEN); + ast_free(p); + return NULL; + } + + if (memcmp(remote_key, p->local_key, SRTP_MASTER_LEN)) { + ast_log(LOG_ERROR, "base64 encode/decode bad key\n"); + ast_free(p); + return NULL; + } + + ast_debug(1 , "local_key64 %s len %zu\n", p->local_key64, strlen(p->local_key64)); + + return p; +} + +static int set_crypto_policy(struct ast_srtp_policy *policy, int suite_val, const unsigned char *master_key, unsigned long ssrc, int inbound) +{ + const unsigned char *master_salt = NULL; + + if (!ast_rtp_engine_srtp_is_registered()) { + return -1; + } + + master_salt = master_key + SRTP_MASTERKEY_LEN; + if (res_srtp_policy->set_master_key(policy, master_key, SRTP_MASTERKEY_LEN, master_salt, SRTP_MASTERSALT_LEN) < 0) { + return -1; + } + + if (res_srtp_policy->set_suite(policy, suite_val)) { + ast_log(LOG_WARNING, "Could not set remote SRTP suite\n"); + return -1; + } + + res_srtp_policy->set_ssrc(policy, ssrc, inbound); + + return 0; +} + +static int sdp_crypto_activate(struct sdp_crypto *p, int suite_val, unsigned char *remote_key, struct ast_rtp_instance *rtp) +{ + struct ast_srtp_policy *local_policy = NULL; + struct ast_srtp_policy *remote_policy = NULL; + struct ast_rtp_instance_stats stats = {0,}; + int res = -1; + + if (!ast_rtp_engine_srtp_is_registered()) { + return -1; + } + + if (!p) { + return -1; + } + + if (!(local_policy = res_srtp_policy->alloc())) { + return -1; + } + + if (!(remote_policy = res_srtp_policy->alloc())) { + goto err; + } + + if (ast_rtp_instance_get_stats(rtp, &stats, AST_RTP_INSTANCE_STAT_LOCAL_SSRC)) { + goto err; + } + + if (set_crypto_policy(local_policy, suite_val, p->local_key, stats.local_ssrc, 0) < 0) { + goto err; + } + + if (set_crypto_policy(remote_policy, suite_val, remote_key, 0, 1) < 0) { + goto err; + } + + /* FIXME MIKMA */ + /* ^^^ I wish I knew what needed fixing... */ + if (ast_rtp_instance_add_srtp_policy(rtp, local_policy)) { + ast_log(LOG_WARNING, "Could not set local SRTP policy\n"); + goto err; + } + + if (ast_rtp_instance_add_srtp_policy(rtp, remote_policy)) { + ast_log(LOG_WARNING, "Could not set remote SRTP policy\n"); + goto err; + } + + ast_debug(1 , "SRTP policy activated\n"); + res = 0; + +err: + if (local_policy) { + res_srtp_policy->destroy(local_policy); + } + + if (remote_policy) { + res_srtp_policy->destroy(remote_policy); + } + + return res; +} + +int sdp_crypto_process(struct sdp_crypto *p, const char *attr, struct ast_rtp_instance *rtp) +{ + char *str = NULL; + char *name = NULL; + char *tag = NULL; + char *suite = NULL; + char *key_params = NULL; + char *key_param = NULL; + char *session_params = NULL; + char *key_salt = NULL; + char *lifetime = NULL; + int found = 0; + int attr_len = strlen(attr); + int key_len = 0; + int suite_val = 0; + unsigned char remote_key[SRTP_MASTER_LEN]; + + if (!ast_rtp_engine_srtp_is_registered()) { + return -1; + } + + str = ast_strdupa(attr); + + name = strsep(&str, ":"); + tag = strsep(&str, " "); + suite = strsep(&str, " "); + key_params = strsep(&str, " "); + session_params = strsep(&str, " "); + + if (!tag || !suite) { + ast_log(LOG_WARNING, "Unrecognized a=%s", attr); + return -1; + } + + if (session_params) { + ast_log(LOG_WARNING, "Unsupported crypto parameters: %s", session_params); + return -1; + } + + if (!strcmp(suite, "AES_CM_128_HMAC_SHA1_80")) { + suite_val = AST_AES_CM_128_HMAC_SHA1_80; + } else if (!strcmp(suite, "AES_CM_128_HMAC_SHA1_32")) { + suite_val = AST_AES_CM_128_HMAC_SHA1_32; + } else { + ast_log(LOG_WARNING, "Unsupported crypto suite: %s\n", suite); + return -1; + } + + while ((key_param = strsep(&key_params, ";"))) { + char *method = NULL; + char *info = NULL; + + method = strsep(&key_param, ":"); + info = strsep(&key_param, ";"); + + if (!strcmp(method, "inline")) { + key_salt = strsep(&info, "|"); + lifetime = strsep(&info, "|"); + + if (lifetime) { + ast_log(LOG_NOTICE, "Crypto life time unsupported: %s\n", attr); + continue; + } + + found = 1; + break; + } + } + + if (!found) { + ast_log(LOG_NOTICE, "SRTP crypto offer not acceptable\n"); + return -1; + } + + + if ((key_len = ast_base64decode(remote_key, key_salt, sizeof(remote_key))) != SRTP_MASTER_LEN) { + ast_log(LOG_WARNING, "SRTP sdescriptions key %d != %d\n", key_len, SRTP_MASTER_LEN); + return -1; + } + + if (sdp_crypto_activate(p, suite_val, remote_key, rtp) < 0) { + return -1; + } + + if (!p->a_crypto) { + if (!(p->a_crypto = ast_calloc(1, attr_len + 11))) { + ast_log(LOG_ERROR, "Could not allocate memory for a_crypto\n"); + return -1; + } + + snprintf(p->a_crypto, attr_len + 10, "a=crypto:%s %s inline:%s\r\n", tag, suite, p->local_key64); + } + + return 0; +} + +int sdp_crypto_offer(struct sdp_crypto *p) +{ + char crypto_buf[128]; + const char *crypto_suite = "AES_CM_128_HMAC_SHA1_80"; /* Crypto offer */ + + if (p->a_crypto) { + ast_free(p->a_crypto); + } + + if (snprintf(crypto_buf, sizeof(crypto_buf), "a=crypto:1 %s inline:%s\r\n", crypto_suite, p->local_key64) < 1) { + return -1; + } + + if (!(p->a_crypto = ast_strdup(crypto_buf))) { + return -1; + } + + return 0; +} + +const char *sdp_crypto_attrib(struct sdp_crypto *p) +{ + return p->a_crypto; +} diff --git a/channels/sip/srtp.c b/channels/sip/srtp.c new file mode 100644 index 000000000..3b55106ab --- /dev/null +++ b/channels/sip/srtp.c @@ -0,0 +1,51 @@ +/* + * Asterisk -- An open source telephony toolkit. + * + * Copyright (C) 2006 - 2007, Mikael Magnusson + * + * Mikael Magnusson + * + * See http://www.asterisk.org for more information about + * the Asterisk project. Please do not directly contact + * any of the maintainers of this project for assistance; + * the project provides a web site, mailing lists and IRC + * channels for your use. + * + * This program is free software, distributed under the terms of + * the GNU General Public License Version 2. See the LICENSE file + * at the top of the source tree. + */ + +/*! \file sip_srtp.c + * + * \brief SIP Secure RTP (SRTP) + * + * Specified in RFC 3711 + * + * \author Mikael Magnusson + */ + +#include "asterisk.h" + +ASTERISK_FILE_VERSION(__FILE__, "$Revision$") + +#include "asterisk/utils.h" +#include "include/srtp.h" + +struct sip_srtp *sip_srtp_alloc(void) +{ + struct sip_srtp *srtp; + + srtp = ast_calloc(1, sizeof(*srtp)); + + return srtp; +} + +void sip_srtp_destroy(struct sip_srtp *srtp) +{ + if (srtp->crypto) { + sdp_crypto_destroy(srtp->crypto); + } + srtp->crypto = NULL; + ast_free(srtp); +} -- cgit v1.2.3