lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-28 00:21:48 +03:00
Code Activity

Enforce SRTP mandatory HS messages

Browse Source 
Enforce CertificateRequest, client and server Certificates, and
CertificateVerify messages, which are mandatory in DTLS-SRTP,
as defined in RFC 5764 section 4.1

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
This commit is contained in:
Ron Eldor
2018-04-02 18:25:16 +03:00
committed by Johan Pascal
parent 9e9096476e
commit 57cc70ec81
3 changed files with 75 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
library/ssl_cli.c
View File

@ -3454,8 +3454,20 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
if( ssl->client_auth == 0 )
{
/* Current message is probably the ServerHelloDone */
ssl->keep_current_message = 1;
#if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
}
else
{
#endif
/* MBEDTLS_SSL_DTLS_SRTP */
/* Current message is probably the ServerHelloDone */
ssl->keep_current_message = 1;
#if defined(MBEDTLS_SSL_DTLS_SRTP)
}
#endif
goto exit;
}
@ -4102,9 +4114,19 @@ static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
ssl->state++;
return( 0 );
#if defined(MBEDTLS_SSL_DTLS_SRTP)
/* check if we have a chosen srtp protection profile */
if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
}
else
{
#endif /* MBEDTLS_SSL_DTLS_SRTP */
ssl->state++;
return( 0 );
#if defined(MBEDTLS_SSL_DTLS_SRTP)
}
#endif
}
if( mbedtls_ssl_own_key( ssl ) == NULL )