commit 3adb9928f32a1b94f012591f869ec60cd4188e73
author Ron Eldor <Ron.Eldor@arm.com> Thu Dec 21 10:15:08 2017 +0200
committer Johan Pascal <johan.pascal@belledonne-communications.com> Thu Oct 29 01:14:49 2020 +0100
tree a70fd6ac103b0895e6fbe658bb5bd2c275b7e67e
parent 34790789b67e0724b296130c85fde03ff1654afd

Add mki value and some review comments

1. Add check for prerequisites in check_config.h
2. Add mki value to use_srtp extension
3. address some review comments

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>

library/ssl_srv.c

diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index caefaa5..68afcba 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -780,12 +780,12 @@
 static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl,
                                const unsigned char *buf, size_t len )
 {
-    mbedtls_dtls_srtp_protection_profiles client_protection = MBEDTLS_SRTP_UNSET_PROFILE;
+    mbedtls_ssl_srtp_profile client_protection = MBEDTLS_SRTP_UNSET_PROFILE;
     size_t i,j;
     uint16_t profile_length;
 
     /* If use_srtp is not configured, just ignore the extension */
-    if( ( ssl->conf->dtls_srtp_profiles_list == NULL ) || ( ssl->conf->dtls_srtp_profiles_list_len == 0 ) )
+    if( ( ssl->conf->dtls_srtp_profile_list == NULL ) || ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
         return( 0 );
 
     /* RFC5764 section 4.1.1
@@ -809,7 +809,7 @@
      * Use our order of preference
      */
     profile_length = buf[0]<<8|buf[1]; /* first 2 bytes are protection profile length(in bytes) */
-    for( i=0; i < ssl->conf->dtls_srtp_profiles_list_len; i++)
+    for( i=0; i < ssl->conf->dtls_srtp_profile_list_len; i++)
     {
         /* parse the extension list values are defined in http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml */
         for (j=0; j<profile_length; j+=2) { /* parse only the protection profile, srtp_mki is not supported and ignored */
@@ -833,18 +833,18 @@
                     break;
             }
 
-            if (client_protection == ssl->conf->dtls_srtp_profiles_list[i]) {
-                ssl->chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profiles_list[i];
+            if (client_protection == ssl->conf->dtls_srtp_profile_list[i]) {
+                ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i];
                 return 0;
             }
         }
     }
 
     /* If we get there, no match was found */
-    ssl->chosen_dtls_srtp_profile = MBEDTLS_SRTP_UNSET_PROFILE;
-    mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
-                            MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-    return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_SRTP_UNSET_PROFILE;
+  //  mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+  //                          MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
+    return( 0 );
 }
 #endif /* MBEDTLS_SSL_DTLS_SRTP */
 
@@ -2581,11 +2581,11 @@
 }
 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
 
-#if defined(MBEDTLS_SSL_DTLS_SRTP )
+#if defined(MBEDTLS_SSL_DTLS_SRTP ) && defined(MBEDTLS_SSL_PROTO_DTLS)
 static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
                                 unsigned char *buf, size_t *olen )
 {
-    if( ssl->chosen_dtls_srtp_profile == MBEDTLS_SRTP_UNSET_PROFILE )
+    if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_SRTP_UNSET_PROFILE )
     {
         *olen = 0;
         return;
@@ -2603,7 +2603,7 @@
     /* protection profile length: 2 */
     buf[4] = 0x00;
     buf[5] = 0x02;
-    switch (ssl->chosen_dtls_srtp_profile) {
+    switch (ssl->dtls_srtp_info.chosen_dtls_srtp_profile) {
         case MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80:
             buf[6] = (unsigned char)( ( MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80_IANA_VALUE >> 8) & 0xFF );
             buf[7] = (unsigned char)( ( MBEDTLS_SRTP_AES128_CM_HMAC_SHA1_80_IANA_VALUE     ) & 0xFF );