OLD | NEW |
---|---|
1 /* | 1 /* |
2 * Copyright 2009 The WebRTC project authors. All Rights Reserved. | 2 * Copyright 2009 The WebRTC project authors. All Rights Reserved. |
3 * | 3 * |
4 * Use of this source code is governed by a BSD-style license | 4 * Use of this source code is governed by a BSD-style license |
5 * that can be found in the LICENSE file in the root of the source | 5 * that can be found in the LICENSE file in the root of the source |
6 * tree. An additional intellectual property rights grant can be found | 6 * tree. An additional intellectual property rights grant can be found |
7 * in the file PATENTS. All contributing project authors may | 7 * in the file PATENTS. All contributing project authors may |
8 * be found in the AUTHORS file in the root of the source tree. | 8 * be found in the AUTHORS file in the root of the source tree. |
9 */ | 9 */ |
10 | 10 |
11 #ifndef WEBRTC_PC_SRTPFILTER_H_ | 11 #ifndef WEBRTC_PC_SRTPFILTER_H_ |
12 #define WEBRTC_PC_SRTPFILTER_H_ | 12 #define WEBRTC_PC_SRTPFILTER_H_ |
13 | 13 |
14 #include <list> | 14 #include <list> |
15 #include <map> | 15 #include <map> |
16 #include <memory> | 16 #include <memory> |
17 #include <string> | 17 #include <string> |
18 #include <vector> | 18 #include <vector> |
19 | 19 |
20 #include "webrtc/media/base/cryptoparams.h" | 20 #include "webrtc/media/base/cryptoparams.h" |
21 #include "webrtc/p2p/base/sessiondescription.h" | 21 #include "webrtc/p2p/base/sessiondescription.h" |
22 #include "webrtc/rtc_base/basictypes.h" | 22 #include "webrtc/rtc_base/basictypes.h" |
23 #include "webrtc/rtc_base/buffer.h" | |
23 #include "webrtc/rtc_base/constructormagic.h" | 24 #include "webrtc/rtc_base/constructormagic.h" |
24 #include "webrtc/rtc_base/criticalsection.h" | 25 #include "webrtc/rtc_base/criticalsection.h" |
26 #include "webrtc/rtc_base/optional.h" | |
25 #include "webrtc/rtc_base/sslstreamadapter.h" | 27 #include "webrtc/rtc_base/sslstreamadapter.h" |
26 #include "webrtc/rtc_base/thread_checker.h" | 28 #include "webrtc/rtc_base/thread_checker.h" |
27 | 29 |
28 // Forward declaration to avoid pulling in libsrtp headers here | 30 // Forward declaration to avoid pulling in libsrtp headers here |
29 struct srtp_event_data_t; | 31 struct srtp_event_data_t; |
30 struct srtp_ctx_t_; | 32 struct srtp_ctx_t_; |
31 | 33 |
34 // TODO(zstein): Remove once client interacts with SrtpTransport directly. | |
35 namespace webrtc { | |
36 class SrtpTransport; | |
37 } | |
38 | |
32 namespace cricket { | 39 namespace cricket { |
33 | 40 |
34 class SrtpSession; | 41 class SrtpSession; |
35 | 42 |
36 void ShutdownSrtp(); | 43 void ShutdownSrtp(); |
37 | 44 |
38 // Class to transform SRTP to/from RTP. | 45 // A helper class used to negotiate SDES crypto params. |
39 // Initialize by calling SetSend with the local security params, then call | 46 // TODO(zhihuang): Find a better name for this class, like "SdesNegotiator". |
Taylor Brandstetter
2017/08/23 22:13:29
That name sounds fine to me.
Zhi Huang
2017/08/24 23:38:07
I think it would be better to do that in a separat
| |
40 // SetRecv once the remote security params are received. At that point | |
41 // Protect/UnprotectRt(c)p can be called to encrypt/decrypt data. | |
42 // TODO: Figure out concurrency policy for SrtpFilter. | |
43 class SrtpFilter { | 47 class SrtpFilter { |
44 public: | 48 public: |
45 enum Mode { | 49 enum Mode { |
46 PROTECT, | 50 PROTECT, |
47 UNPROTECT | 51 UNPROTECT |
48 }; | 52 }; |
49 enum Error { | 53 enum Error { |
50 ERROR_NONE, | 54 ERROR_NONE, |
51 ERROR_FAIL, | 55 ERROR_FAIL, |
52 ERROR_AUTH, | 56 ERROR_AUTH, |
(...skipping 16 matching lines...) Expand all Loading... | |
69 bool SetProvisionalAnswer(const std::vector<CryptoParams>& answer_params, | 73 bool SetProvisionalAnswer(const std::vector<CryptoParams>& answer_params, |
70 ContentSource source); | 74 ContentSource source); |
71 // Indicates which crypto algorithms and keys were contained in the answer. | 75 // Indicates which crypto algorithms and keys were contained in the answer. |
72 // answer_params should contain the negotiated parameters, which may be none, | 76 // answer_params should contain the negotiated parameters, which may be none, |
73 // if crypto was not desired or could not be negotiated (and not required). | 77 // if crypto was not desired or could not be negotiated (and not required). |
74 // This must be called after SetOffer. If crypto negotiation completes | 78 // This must be called after SetOffer. If crypto negotiation completes |
75 // successfully, this will advance the filter to the active state. | 79 // successfully, this will advance the filter to the active state. |
76 bool SetAnswer(const std::vector<CryptoParams>& answer_params, | 80 bool SetAnswer(const std::vector<CryptoParams>& answer_params, |
77 ContentSource source); | 81 ContentSource source); |
78 | 82 |
79 // Set the header extension ids that should be encrypted for the given source. | 83 // The SrtpFilter becomes active without offer answer negotiation if DTLS is |
80 void SetEncryptedHeaderExtensionIds(ContentSource source, | 84 // enabled. |
81 const std::vector<int>& extension_ids); | 85 void EnableDtlsSrtp(); |
Taylor Brandstetter
2017/08/23 22:13:29
Like I mentioned in another comment, I don't think
Zhi Huang
2017/08/24 23:38:07
Done. Removed.
| |
82 | |
83 // Just set up both sets of keys directly. | |
84 // Used with DTLS-SRTP. | |
85 bool SetRtpParams(int send_cs, | |
86 const uint8_t* send_key, | |
87 int send_key_len, | |
88 int recv_cs, | |
89 const uint8_t* recv_key, | |
90 int recv_key_len); | |
91 bool UpdateRtpParams(int send_cs, | |
92 const uint8_t* send_key, | |
93 int send_key_len, | |
94 int recv_cs, | |
95 const uint8_t* recv_key, | |
96 int recv_key_len); | |
97 bool SetRtcpParams(int send_cs, | |
98 const uint8_t* send_key, | |
99 int send_key_len, | |
100 int recv_cs, | |
101 const uint8_t* recv_key, | |
102 int recv_key_len); | |
103 | |
104 // Encrypts/signs an individual RTP/RTCP packet, in-place. | |
105 // If an HMAC is used, this will increase the packet size. | |
106 bool ProtectRtp(void* data, int in_len, int max_len, int* out_len); | |
107 // Overloaded version, outputs packet index. | |
108 bool ProtectRtp(void* data, | |
109 int in_len, | |
110 int max_len, | |
111 int* out_len, | |
112 int64_t* index); | |
113 bool ProtectRtcp(void* data, int in_len, int max_len, int* out_len); | |
114 // Decrypts/verifies an invidiual RTP/RTCP packet. | |
115 // If an HMAC is used, this will decrease the packet size. | |
116 bool UnprotectRtp(void* data, int in_len, int* out_len); | |
117 bool UnprotectRtcp(void* data, int in_len, int* out_len); | |
118 | |
119 // Returns rtp auth params from srtp context. | |
120 bool GetRtpAuthParams(uint8_t** key, int* key_len, int* tag_len); | |
121 | |
122 // Returns srtp overhead for rtp packets. | |
123 bool GetSrtpOverhead(int* srtp_overhead) const; | |
124 | |
125 // If external auth is enabled, SRTP will write a dummy auth tag that then | |
126 // later must get replaced before the packet is sent out. Only supported for | |
127 // non-GCM cipher suites and can be checked through "IsExternalAuthActive" | |
128 // if it is actually used. This method is only valid before the RTP params | |
129 // have been set. | |
130 void EnableExternalAuth(); | |
131 bool IsExternalAuthEnabled() const; | |
132 | |
133 // A SRTP filter supports external creation of the auth tag if a non-GCM | |
134 // cipher is used. This method is only valid after the RTP params have | |
135 // been set. | |
136 bool IsExternalAuthActive() const; | |
137 | 86 |
138 bool ResetParams(); | 87 bool ResetParams(); |
139 | 88 |
89 rtc::Optional<int> send_cipher_suite() { return send_cipher_suite_; } | |
90 rtc::Optional<int> recv_cipher_suite() { return recv_cipher_suite_; } | |
91 | |
92 const std::vector<unsigned char>* send_key() { return &send_key_; } | |
93 const std::vector<unsigned char>* recv_key() { return &recv_key_; } | |
94 | |
140 protected: | 95 protected: |
141 bool ExpectOffer(ContentSource source); | 96 bool ExpectOffer(ContentSource source); |
97 | |
142 bool StoreParams(const std::vector<CryptoParams>& params, | 98 bool StoreParams(const std::vector<CryptoParams>& params, |
143 ContentSource source); | 99 ContentSource source); |
100 | |
144 bool ExpectAnswer(ContentSource source); | 101 bool ExpectAnswer(ContentSource source); |
102 | |
145 bool DoSetAnswer(const std::vector<CryptoParams>& answer_params, | 103 bool DoSetAnswer(const std::vector<CryptoParams>& answer_params, |
146 ContentSource source, | 104 ContentSource source, |
147 bool final); | 105 bool final); |
148 void CreateSrtpSessions(); | 106 |
149 bool NegotiateParams(const std::vector<CryptoParams>& answer_params, | 107 bool NegotiateParams(const std::vector<CryptoParams>& answer_params, |
150 CryptoParams* selected_params); | 108 CryptoParams* selected_params); |
151 bool ApplyParams(const CryptoParams& send_params, | 109 |
152 const CryptoParams& recv_params); | 110 private: |
111 bool ParseSendParams(const CryptoParams& send_params); | |
112 | |
113 bool ParseRecvParams(const CryptoParams& recv_params); | |
114 | |
153 static bool ParseKeyParams(const std::string& params, | 115 static bool ParseKeyParams(const std::string& params, |
154 uint8_t* key, | 116 std::vector<unsigned char>* key, |
155 size_t len); | 117 size_t len); |
156 | 118 |
157 private: | |
158 enum State { | 119 enum State { |
159 ST_INIT, // SRTP filter unused. | 120 ST_INIT, // SRTP filter unused. |
160 ST_SENTOFFER, // Offer with SRTP parameters sent. | 121 ST_SENTOFFER, // Offer with SRTP parameters sent. |
161 ST_RECEIVEDOFFER, // Offer with SRTP parameters received. | 122 ST_RECEIVEDOFFER, // Offer with SRTP parameters received. |
162 ST_SENTPRANSWER_NO_CRYPTO, // Sent provisional answer without crypto. | 123 ST_SENTPRANSWER_NO_CRYPTO, // Sent provisional answer without crypto. |
163 // Received provisional answer without crypto. | 124 // Received provisional answer without crypto. |
164 ST_RECEIVEDPRANSWER_NO_CRYPTO, | 125 ST_RECEIVEDPRANSWER_NO_CRYPTO, |
165 ST_ACTIVE, // Offer and answer set. | 126 ST_ACTIVE, // Offer and answer set. |
166 // SRTP filter is active but new parameters are offered. | 127 // SRTP filter is active but new parameters are offered. |
167 // When the answer is set, the state transitions to ST_ACTIVE or ST_INIT. | 128 // When the answer is set, the state transitions to ST_ACTIVE or ST_INIT. |
168 ST_SENTUPDATEDOFFER, | 129 ST_SENTUPDATEDOFFER, |
169 // SRTP filter is active but new parameters are received. | 130 // SRTP filter is active but new parameters are received. |
170 // When the answer is set, the state transitions back to ST_ACTIVE. | 131 // When the answer is set, the state transitions back to ST_ACTIVE. |
171 ST_RECEIVEDUPDATEDOFFER, | 132 ST_RECEIVEDUPDATEDOFFER, |
172 // SRTP filter is active but the sent answer is only provisional. | 133 // SRTP filter is active but the sent answer is only provisional. |
173 // When the final answer is set, the state transitions to ST_ACTIVE or | 134 // When the final answer is set, the state transitions to ST_ACTIVE or |
174 // ST_INIT. | 135 // ST_INIT. |
175 ST_SENTPRANSWER, | 136 ST_SENTPRANSWER, |
176 // SRTP filter is active but the received answer is only provisional. | 137 // SRTP filter is active but the received answer is only provisional. |
177 // When the final answer is set, the state transitions to ST_ACTIVE or | 138 // When the final answer is set, the state transitions to ST_ACTIVE or |
178 // ST_INIT. | 139 // ST_INIT. |
179 ST_RECEIVEDPRANSWER | 140 ST_RECEIVEDPRANSWER |
180 }; | 141 }; |
181 State state_ = ST_INIT; | 142 State state_ = ST_INIT; |
182 bool external_auth_enabled_ = false; | |
183 std::vector<CryptoParams> offer_params_; | 143 std::vector<CryptoParams> offer_params_; |
184 std::unique_ptr<SrtpSession> send_session_; | 144 |
185 std::unique_ptr<SrtpSession> recv_session_; | 145 CryptoParams send_params_; |
186 std::unique_ptr<SrtpSession> send_rtcp_session_; | 146 CryptoParams recv_params_; |
187 std::unique_ptr<SrtpSession> recv_rtcp_session_; | 147 rtc::Optional<int> send_cipher_suite_; |
188 CryptoParams applied_send_params_; | 148 rtc::Optional<int> recv_cipher_suite_; |
189 CryptoParams applied_recv_params_; | 149 |
190 std::vector<int> send_encrypted_header_extension_ids_; | 150 std::vector<unsigned char> send_key_; |
191 std::vector<int> recv_encrypted_header_extension_ids_; | 151 std::vector<unsigned char> recv_key_; |
192 }; | 152 }; |
193 | 153 |
194 } // namespace cricket | 154 } // namespace cricket |
195 | 155 |
196 #endif // WEBRTC_PC_SRTPFILTER_H_ | 156 #endif // WEBRTC_PC_SRTPFILTER_H_ |
OLD | NEW |