[asterisk-commits] kmoore: branch kmoore/pimp_sip_srtp r386566 - in /team/kmoore/pimp_sip_srtp: ...

SVN commits to the Asterisk project asterisk-commits at lists.digium.com
Thu Apr 25 14:48:08 CDT 2013


Author: kmoore
Date: Thu Apr 25 14:48:04 2013
New Revision: 386566

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=386566
Log:
Recommit work up to this point

Added:
    team/kmoore/pimp_sip_srtp/include/asterisk/sdp_srtp.h   (with props)
    team/kmoore/pimp_sip_srtp/main/sdp_srtp.c   (with props)
Removed:
    team/kmoore/pimp_sip_srtp/channels/sip/include/sdp_crypto.h
    team/kmoore/pimp_sip_srtp/channels/sip/include/srtp.h
    team/kmoore/pimp_sip_srtp/channels/sip/sdp_crypto.c
    team/kmoore/pimp_sip_srtp/channels/sip/srtp.c
Modified:
    team/kmoore/pimp_sip_srtp/   (props changed)
    team/kmoore/pimp_sip_srtp/channels/chan_sip.c
    team/kmoore/pimp_sip_srtp/channels/sip/include/sip.h
    team/kmoore/pimp_sip_srtp/configs/res_sip.conf.sample
    team/kmoore/pimp_sip_srtp/include/asterisk/res_sip.h
    team/kmoore/pimp_sip_srtp/include/asterisk/res_sip_session.h
    team/kmoore/pimp_sip_srtp/res/res_sip/sip_configuration.c
    team/kmoore/pimp_sip_srtp/res/res_sip_sdp_rtp.c
    team/kmoore/pimp_sip_srtp/res/res_sip_session.c

Propchange: team/kmoore/pimp_sip_srtp/
------------------------------------------------------------------------------
--- svnmerge-integrated (original)
+++ svnmerge-integrated Thu Apr 25 14:48:04 2013
@@ -1,1 +1,1 @@
-/team/group/pimp_my_sip:1-386563 /trunk:1-386489
+/team/group/pimp_my_sip:1-386563

Modified: team/kmoore/pimp_sip_srtp/channels/chan_sip.c
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/channels/chan_sip.c?view=diff&rev=386566&r1=386565&r2=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/channels/chan_sip.c (original)
+++ team/kmoore/pimp_sip_srtp/channels/chan_sip.c Thu Apr 25 14:48:04 2013
@@ -286,8 +286,7 @@
 #include "sip/include/config_parser.h"
 #include "sip/include/reqresp_parser.h"
 #include "sip/include/sip_utils.h"
-#include "sip/include/srtp.h"
-#include "sip/include/sdp_crypto.h"
+#include "asterisk/sdp_srtp.h"
 #include "asterisk/ccss.h"
 #include "asterisk/xml.h"
 #include "sip/include/dialog.h"
@@ -1487,8 +1486,7 @@
 static void handle_response(struct sip_pvt *p, int resp, const char *rest, struct sip_request *req, uint32_t seqno);
 
 /*------ SRTP Support -------- */
-static int setup_srtp(struct sip_srtp **srtp);
-static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct sip_srtp **srtp, const char *a);
+static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp, const char *a);
 
 /*------ T38 Support --------- */
 static int transmit_response_with_t38_sdp(struct sip_pvt *p, char *msg, struct sip_request *req, int retrans);
@@ -5913,7 +5911,7 @@
 }
 
 /*! \brief Initialize DTLS-SRTP support on an RTP instance */
-static int dialog_initialize_dtls_srtp(const struct sip_pvt *dialog, struct ast_rtp_instance *rtp, struct sip_srtp **srtp)
+static int dialog_initialize_dtls_srtp(const struct sip_pvt *dialog, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp)
 {
 	struct ast_rtp_engine_dtls *dtls;
 
@@ -5938,7 +5936,7 @@
 		return -1;
 	}
 
-	if (!(*srtp = sip_srtp_alloc())) {
+	if (!(*srtp = ast_sdp_srtp_alloc())) {
 		ast_log(LOG_ERROR, "Failed to create required SRTP structure on RTP instance '%p'\n",
 			rtp);
 		return -1;
@@ -6413,17 +6411,17 @@
 			ast_clear_flag(&p->flags[0], SIP_REINVITE);
 		}
 
-		if (p->rtp && !p->srtp && setup_srtp(&p->srtp) < 0) {
+		if (p->rtp && !p->srtp && !(p->srtp = ast_sdp_srtp_alloc())) {
 			ast_log(LOG_WARNING, "SRTP audio setup failed\n");
 			return -1;
 		}
 
-		if (p->vrtp && !p->vsrtp && setup_srtp(&p->vsrtp) < 0) {
+		if (p->vrtp && !p->vsrtp && !(p->vsrtp = ast_sdp_srtp_alloc())) {
 			ast_log(LOG_WARNING, "SRTP video setup failed\n");
 			return -1;
 		}
 
-		if (p->trtp && !p->tsrtp && setup_srtp(&p->tsrtp) < 0) {
+		if (p->trtp && !p->tsrtp && !(p->tsrtp = ast_sdp_srtp_alloc())) {
 			ast_log(LOG_WARNING, "SRTP text setup failed\n");
 			return -1;
 		}
@@ -6688,17 +6686,17 @@
 	destroy_msg_headers(p);
 
 	if (p->srtp) {
-		sip_srtp_destroy(p->srtp);
+		ast_sdp_srtp_destroy(p->srtp);
 		p->srtp = NULL;
 	}
 
 	if (p->vsrtp) {
-		sip_srtp_destroy(p->vsrtp);
+		ast_sdp_srtp_destroy(p->vsrtp);
 		p->vsrtp = NULL;
 	}
 
 	if (p->tsrtp) {
-		sip_srtp_destroy(p->tsrtp);
+		ast_sdp_srtp_destroy(p->tsrtp);
 		p->tsrtp = NULL;
 	}
 
@@ -10151,7 +10149,7 @@
 					secure_audio = 1;
 
 					if (p->srtp) {
-						ast_set_flag(p->srtp, SRTP_CRYPTO_OFFER_OK);
+						ast_set_flag(p->srtp, AST_SRTP_CRYPTO_OFFER_OK);
 					}
 				} else if (!strcmp(protocol, "RTP/SAVP") || !strcmp(protocol, "RTP/SAVPF")) {
 					secure_audio = 1;
@@ -10232,8 +10230,8 @@
 				} else if (!strcmp(protocol, "UDP/TLS/RTP/SAVP") || !strcmp(protocol, "UDP/TLS/RTP/SAVPF")) {
 					secure_video = 1;
 
-					if (p->vsrtp || (p->vsrtp = sip_srtp_alloc())) {
-						ast_set_flag(p->vsrtp, SRTP_CRYPTO_OFFER_OK);
+					if (p->vsrtp || (p->vsrtp = ast_sdp_srtp_alloc())) {
+						ast_set_flag(p->vsrtp, AST_SRTP_CRYPTO_OFFER_OK);
 					}
 				} else if (!strcmp(protocol, "RTP/SAVP") || !strcmp(protocol, "RTP/SAVPF")) {
 					secure_video = 1;
@@ -10513,7 +10511,7 @@
 		goto process_sdp_cleanup;
 	}
 
-	if (secure_audio && !(p->srtp && (ast_test_flag(p->srtp, SRTP_CRYPTO_OFFER_OK)))) {
+	if (secure_audio && !(p->srtp && (ast_test_flag(p->srtp, AST_SRTP_CRYPTO_OFFER_OK)))) {
 		ast_log(LOG_WARNING, "Can't provide secure audio requested in SDP offer\n");
 		res = -1;
 		goto process_sdp_cleanup;
@@ -10525,7 +10523,7 @@
 		goto process_sdp_cleanup;
 	}
 
-	if (secure_video && !(p->vsrtp && (ast_test_flag(p->vsrtp, SRTP_CRYPTO_OFFER_OK)))) {
+	if (secure_video && !(p->vsrtp && (ast_test_flag(p->vsrtp, AST_SRTP_CRYPTO_OFFER_OK)))) {
 		ast_log(LOG_WARNING, "Can't provide secure video requested in SDP offer\n");
 		res = -1;
 		goto process_sdp_cleanup;
@@ -12992,52 +12990,14 @@
 	}
 }
 
-static void get_crypto_attrib(struct sip_pvt *p, struct sip_srtp *srtp, const char **a_crypto)
-{
-	int taglen = 80;
-
-	/* Set encryption properties */
-	if (srtp) {
-		if (!srtp->crypto) {
-			srtp->crypto = sdp_crypto_setup();
-		}
-
-		if (p->dtls_cfg.enabled) {
-			/* If DTLS-SRTP is enabled the key details will be pulled from TLS */
-			return;
-		}
-
-		/* set the key length based on INVITE or settings */
-		if (ast_test_flag(srtp, SRTP_CRYPTO_TAG_80)) {
-			taglen = 80;
-		} else if (ast_test_flag(&p->flags[2], SIP_PAGE3_SRTP_TAG_32) ||
-		    ast_test_flag(srtp, SRTP_CRYPTO_TAG_32)) {
-			taglen = 32;
-		}
-
-		if (srtp->crypto && (sdp_crypto_offer(srtp->crypto, taglen) >= 0)) {
-			*a_crypto = sdp_crypto_attrib(srtp->crypto);
-		}
-
-		if (!*a_crypto) {
-			ast_log(LOG_WARNING, "No SRTP key management enabled\n");
-		}
-	}
-}
-
-static char *get_sdp_rtp_profile(const struct sip_pvt *p, unsigned int secure, struct ast_rtp_instance *instance)
-{
-	struct ast_rtp_engine_dtls *dtls;
-
-	if ((dtls = ast_rtp_instance_get_dtls(instance)) && dtls->active(instance)) {
-		return ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF) ? "UDP/TLS/RTP/SAVPF" : "UDP/TLS/RTP/SAVP";
-	} else {
-		if (ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)) {
-			return secure ? "RTP/SAVPF" : "RTP/AVPF";
-		} else {
-			return secure ? "RTP/SAVP" : "RTP/AVP";
-		}
-	}
+static char *crypto_get_attrib(struct ast_sdp_srtp *srtp, int dtls_enabled, int default_taglen_32)
+{
+	char *a_crypto;
+	char *orig_crypto = ast_strdupa(ast_sdp_srtp_get_attrib(srtp, dtls_enabled, default_taglen_32));
+	if (ast_asprintf(&a_crypto, "a=crypto:%s\r\n", orig_crypto) == -1) {
+		return NULL;
+	}
+	return a_crypto;
 }
 
 /*! \brief Add Session Description Protocol message
@@ -13078,9 +13038,9 @@
 	struct ast_str *a_video = ast_str_create(256); /* Attributes for video */
 	struct ast_str *a_text = ast_str_create(256);  /* Attributes for text */
 	struct ast_str *a_modem = ast_str_alloca(1024); /* Attributes for modem */
-	const char *a_crypto = NULL;
-	const char *v_a_crypto = NULL;
-	const char *t_a_crypto = NULL;
+	RAII_VAR(char *, a_crypto, NULL, ast_free);
+	RAII_VAR(char *, v_a_crypto, NULL, ast_free);
+	RAII_VAR(char *, t_a_crypto, NULL, ast_free);
 
 	int x;
 	struct ast_format tmp_fmt;
@@ -13198,9 +13158,11 @@
 		/* Ok, we need video. Let's add what we need for video and set codecs.
 		   Video is handled differently than audio since we can not transcode. */
 		if (needvideo) {
-			get_crypto_attrib(p, p->vsrtp, &v_a_crypto);
+			v_a_crypto = crypto_get_attrib(p->vsrtp, p->dtls_cfg.enabled,
+				ast_test_flag(&p->flags[2], SIP_PAGE3_SRTP_TAG_32));
 			ast_str_append(&m_video, 0, "m=video %d %s", ast_sockaddr_port(&vdest),
-				       get_sdp_rtp_profile(p, v_a_crypto ? 1 : 0, p->vrtp));
+				ast_sdp_get_rtp_profile(v_a_crypto ? 1 : 0, p->vrtp,
+					ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)));
 
 			/* Build max bitrate string */
 			if (p->maxcallbitrate)
@@ -13223,9 +13185,11 @@
 		if (needtext) {
 			if (sipdebug_text)
 				ast_verbose("Lets set up the text sdp\n");
-			get_crypto_attrib(p, p->tsrtp, &t_a_crypto);
+			t_a_crypto = crypto_get_attrib(p->tsrtp, p->dtls_cfg.enabled,
+				ast_test_flag(&p->flags[2], SIP_PAGE3_SRTP_TAG_32));
 			ast_str_append(&m_text, 0, "m=text %d %s", ast_sockaddr_port(&tdest),
-				       get_sdp_rtp_profile(p, t_a_crypto ? 1 : 0, p->trtp));
+				ast_sdp_get_rtp_profile(t_a_crypto ? 1 : 0, p->trtp,
+					ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)));
 			if (debug) {  /* XXX should I use tdest below ? */
 				ast_verbose("Text is at %s\n", ast_sockaddr_stringify(&taddr));
 			}
@@ -13244,9 +13208,11 @@
 		/* We break with the "recommendation" and send our IP, in order that our
 		   peer doesn't have to ast_gethostbyname() us */
 
-		get_crypto_attrib(p, p->srtp, &a_crypto);
+		a_crypto = crypto_get_attrib(p->srtp, p->dtls_cfg.enabled,
+			ast_test_flag(&p->flags[2], SIP_PAGE3_SRTP_TAG_32));
 		ast_str_append(&m_audio, 0, "m=audio %d %s", ast_sockaddr_port(&dest),
-			       get_sdp_rtp_profile(p, a_crypto ? 1 : 0, p->rtp));
+			ast_sdp_get_rtp_profile(a_crypto ? 1 : 0, p->rtp,
+				ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)));
 
 		/* Now, start adding audio codecs. These are added in this order:
 		   - First what was requested by the calling channel
@@ -26017,7 +25983,7 @@
 				transmit_response_with_t38_sdp(p, "200 OK", req, (reinvite ? XMIT_RELIABLE : (req->ignore ?  XMIT_UNRELIABLE : XMIT_CRITICAL)));
 			} else if ((p->t38.state == T38_DISABLED) || (p->t38.state == T38_REJECTED)) {
 				/* If this is not a re-invite or something to ignore - it's critical */
-				if (p->srtp && !ast_test_flag(p->srtp, SRTP_CRYPTO_OFFER_OK)) {
+				if (p->srtp && !ast_test_flag(p->srtp, AST_SRTP_CRYPTO_OFFER_OK)) {
 					ast_log(LOG_WARNING, "Target does not support required crypto\n");
 					transmit_response_reliable(p, "488 Not Acceptable Here (crypto)", req);
 				} else {
@@ -33300,22 +33266,7 @@
 	} while (0));
 }
 
-/* SRTP */
-static int setup_srtp(struct sip_srtp **srtp)
-{
-	if (!ast_rtp_engine_srtp_is_registered()) {
-		ast_debug(1, "No SRTP module loaded, can't setup SRTP session.\n");
-		return -1;
-	}
-
-	if (!(*srtp = sip_srtp_alloc())) { /* Allocate SRTP data structure */
-		return -1;
-	}
-
-	return 0;
-}
-
-static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct sip_srtp **srtp, const char *a)
+static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp, const char *a)
 {
 	struct ast_rtp_engine_dtls *dtls;
 
@@ -33328,26 +33279,27 @@
 	if (strncasecmp(a, "crypto:", 7)) {
 		return FALSE;
 	}
+	/* skip "crypto:" */
+	a += strlen("crypto:");
+
 	if (!*srtp) {
 		if (ast_test_flag(&p->flags[0], SIP_OUTGOING)) {
 			ast_log(LOG_WARNING, "Ignoring unexpected crypto attribute in SDP answer\n");
 			return FALSE;
 		}
 
-		if (setup_srtp(srtp) < 0) {
+		if (!(*srtp = ast_sdp_srtp_alloc())) {
 			return FALSE;
 		}
 	}
 
-	if (!(*srtp)->crypto && !((*srtp)->crypto = sdp_crypto_setup())) {
+	if (!(*srtp)->crypto && !((*srtp)->crypto = ast_sdp_crypto_alloc())) {
 		return FALSE;
 	}
 
-	if (sdp_crypto_process((*srtp)->crypto, a, rtp, *srtp) < 0) {
+	if (ast_sdp_crypto_process(rtp, *srtp, a) < 0) {
 		return FALSE;
 	}
-
-	ast_set_flag(*srtp, SRTP_CRYPTO_OFFER_OK);
 
 	if ((dtls = ast_rtp_instance_get_dtls(rtp))) {
 		dtls->stop(rtp);

Modified: team/kmoore/pimp_sip_srtp/channels/sip/include/sip.h
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/channels/sip/include/sip.h?view=diff&rev=386566&r1=386565&r2=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/channels/sip/include/sip.h (original)
+++ team/kmoore/pimp_sip_srtp/channels/sip/include/sip.h Thu Apr 25 14:48:04 2013
@@ -1189,9 +1189,9 @@
 	AST_LIST_HEAD_NOLOCK(request_queue, sip_request) request_queue; /*!< Requests that arrived but could not be processed immediately */
 	struct sip_invite_param *options;   /*!< Options for INVITE */
 	struct sip_st_dlg *stimer;          /*!< SIP Session-Timers */
-	struct sip_srtp *srtp;              /*!< Structure to hold Secure RTP session data for audio */
-	struct sip_srtp *vsrtp;             /*!< Structure to hold Secure RTP session data for video */
-	struct sip_srtp *tsrtp;             /*!< Structure to hold Secure RTP session data for text */
+	struct ast_sdp_srtp *srtp;              /*!< Structure to hold Secure RTP session data for audio */
+	struct ast_sdp_srtp *vsrtp;             /*!< Structure to hold Secure RTP session data for video */
+	struct ast_sdp_srtp *tsrtp;             /*!< Structure to hold Secure RTP session data for text */
 
 	int red;                            /*!< T.140 RTP Redundancy */
 	int hangupcause;                    /*!< Storage of hangupcause copied from our owner before we disconnect from the AST channel (only used at hangup) */

Modified: team/kmoore/pimp_sip_srtp/configs/res_sip.conf.sample
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/configs/res_sip.conf.sample?view=diff&rev=386566&r1=386565&r2=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/configs/res_sip.conf.sample (original)
+++ team/kmoore/pimp_sip_srtp/configs/res_sip.conf.sample Thu Apr 25 14:48:04 2013
@@ -22,3 +22,5 @@
 ;rtp_ipv6=yes             ; Force IPv6 for RTP transport
 ;rtp_symmetric=yes        ; Enable symmetric RTP support
 ;use_ptime=yes            ; Whether to use the ptime value received from the endpoint or not
+;media_encryption=no      ; Options for media encryption are deny, no, and sdes
+;use_avpf=no              ; Whether to force usage of AVPF transport for this endpoint

Modified: team/kmoore/pimp_sip_srtp/include/asterisk/res_sip.h
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/include/asterisk/res_sip.h?view=diff&rev=386566&r1=386565&r2=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/include/asterisk/res_sip.h (original)
+++ team/kmoore/pimp_sip_srtp/include/asterisk/res_sip.h Thu Apr 25 14:48:04 2013
@@ -251,6 +251,17 @@
 	 * Subsequent session refreshes will be sent no matter the session direction
 	 */
 	AST_SIP_DIRECT_MEDIA_GLARE_MITIGATION_INCOMING,
+};
+
+enum ast_sip_session_media_encryption {
+	/*! Invalid media encryption configuration */
+	AST_SIP_MEDIA_TRANSPORT_INVALID = 0,
+	/*! Do not allow any encryption of session media */
+	AST_SIP_MEDIA_ENCRYPT_NONE,
+	/*! Offer SDES-encrypted session media */
+	AST_SIP_MEDIA_ENCRYPT_SDES,
+	/*! Offer encrypted session media with datagram TLS key exchange */
+	AST_SIP_MEDIA_ENCRYPT_DTLS,
 };
 
 /*!
@@ -336,6 +347,10 @@
 	unsigned int send_rpid;
 	/*! Should unsolicited MWI be aggregated into a single NOTIFY? */
 	unsigned int aggregate_mwi;
+	/*! Do we use media encryption? what type? */
+	enum ast_sip_session_media_encryption media_encryption;
+	/*! Do we use AVPF exclusively for this endpoint? */
+	unsigned int use_avpf;
 };
 
 /*!

Modified: team/kmoore/pimp_sip_srtp/include/asterisk/res_sip_session.h
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/include/asterisk/res_sip_session.h?view=diff&rev=386566&r1=386565&r2=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/include/asterisk/res_sip_session.h (original)
+++ team/kmoore/pimp_sip_srtp/include/asterisk/res_sip_session.h Thu Apr 25 14:48:04 2013
@@ -26,6 +26,8 @@
 #include "asterisk/channel.h"
 /* Needed for ast_sockaddr struct */
 #include "asterisk/netsock.h"
+/* Neeed for ast_sdp_srtp struct */
+#include "asterisk/sdp_srtp.h"
 
 /* Forward declarations */
 struct ast_sip_endpoint;
@@ -54,6 +56,8 @@
 	struct ast_sockaddr direct_media_addr;
 	/*! \brief SDP handler that setup the RTP */
 	struct ast_sip_session_sdp_handler *handler;
+	/*! \brief Holds SRTP information */
+	struct ast_sdp_srtp *srtp;
 	/*! \brief Stream is on hold */
 	unsigned int held:1;
 	/*! \brief Stream type this session media handles */

Added: team/kmoore/pimp_sip_srtp/include/asterisk/sdp_srtp.h
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/include/asterisk/sdp_srtp.h?view=auto&rev=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/include/asterisk/sdp_srtp.h (added)
+++ team/kmoore/pimp_sip_srtp/include/asterisk/sdp_srtp.h Thu Apr 25 14:48:04 2013
@@ -1,0 +1,125 @@
+/*
+ * Asterisk -- An open source telephony toolkit.
+ *
+ * Copyright (C) 2006 - 2007, Mikael Magnusson
+ *
+ * Mikael Magnusson <mikma at users.sourceforge.net>
+ *
+ * See http://www.asterisk.org for more information about
+ * the Asterisk project. Please do not directly contact
+ * any of the maintainers of this project for assistance;
+ * the project provides a web site, mailing lists and IRC
+ * channels for your use.
+ *
+ * This program is free software, distributed under the terms of
+ * the GNU General Public License Version 2. See the LICENSE file
+ * at the top of the source tree.
+ */
+
+/*! \file sdp_srtp.h
+ *
+ * \brief SRTP and SDP Security descriptions
+ *
+ * Specified in RFC 4568
+ * Specified in RFC 3711
+ *
+ * \author Mikael Magnusson <mikma at users.sourceforge.net>
+ */
+
+#ifndef _SDP_SRTP_H
+#define _SDP_SRTP_H
+
+#include <asterisk/rtp_engine.h>
+
+struct ast_sdp_crypto;
+
+/*! \brief structure for secure RTP audio */
+struct ast_sdp_srtp {
+	unsigned int flags;
+	struct ast_sdp_crypto *crypto;
+};
+
+/* SRTP flags */
+#define AST_SRTP_CRYPTO_OFFER_OK	(1 << 1)
+#define AST_SRTP_CRYPTO_TAG_32		(1 << 2)
+#define AST_SRTP_CRYPTO_TAG_80		(1 << 3)
+
+/*!
+ * \brief allocate a ast_sdp_srtp structure
+ * \retval a new malloc'd ast_sdp_srtp structure on success
+ * \retval NULL on failure
+*/
+struct ast_sdp_srtp *ast_sdp_srtp_alloc(void);
+
+/*!
+ * \brief free a ast_sdp_srtp structure
+ * \param srtp a ast_sdp_srtp structure
+*/
+void ast_sdp_srtp_destroy(struct ast_sdp_srtp *srtp);
+
+/*! \brief Initialize an return an ast_sdp_crypto struct
+ *
+ * \details
+ * This function allocates a new ast_sdp_crypto struct and initializes its values
+ *
+ * \retval NULL on failure
+ * \retval a pointer to a  new ast_sdp_crypto structure
+ */
+struct ast_sdp_crypto *ast_sdp_crypto_alloc(void);
+
+/*! \brief Destroy a previously allocated ast_sdp_crypto struct */
+void ast_sdp_crypto_destroy(struct ast_sdp_crypto *crypto);
+
+/*! \brief Parse the a=crypto line from SDP and set appropriate values on the
+ * ast_sdp_crypto struct.
+ *
+ * The attribute line should already have "a=crypto:" removed.
+ *
+ * \param p A valid ast_sdp_crypto struct
+ * \param attr the a:crypto line from SDP
+ * \param rtp The rtp instance associated with the SDP being parsed
+ * \param srtp SRTP structure
+ *
+ * \retval 0 success
+ * \retval nonzero failure
+ */
+int ast_sdp_crypto_process(struct ast_rtp_instance *rtp, struct ast_sdp_srtp *srtp, const char *attr);
+
+/*! \brief Generate an SRTP a=crypto offer
+ *
+ * \details
+ * The offer is stored on the ast_sdp_crypto struct in a_crypto
+ *
+ * \param p A valid ast_sdp_crypto struct
+ * \param taglen Length
+ *
+ * \retval 0 success
+ * \retval nonzero failure
+ */
+int ast_sdp_crypto_build_offer(struct ast_sdp_crypto *p, int taglen);
+
+
+/*! \brief Get the crypto attribute line for the srtp structure
+ *
+ * The attribute line does not contain the initial "a=crypto:" and does
+ * not terminate with "\r\n".
+ *
+ * \param srtp The ast_sdp_srtp structure for which to get an attribute line
+ * \param dtls_enabled Whether this connection is encrypted with datagram TLS
+ * \param default_taglen_32 Whether to default to a tag length of 32 instead of 80
+ *
+ * \retval An attribute line containing cryptographic information
+ * \retval NULL if the srtp structure does not require an attribute line containing crypto information
+ */
+const char *ast_sdp_srtp_get_attrib(struct ast_sdp_srtp *srtp, int dtls_enabled, int default_taglen_32);
+
+/*! \brief Get the RTP profile in use by a media session
+ *
+ * \param sdes_active Whether the media session is using SDES-SRTP
+ * \param instance The RTP instance associated with this media session
+ * \param using_avpf Whether the media session is using early feedback (AVPF)
+ *
+ * \retval A non-allocated string describing the profile in use (does not need to be freed)
+ */
+char *ast_sdp_get_rtp_profile(unsigned int sdes_active, struct ast_rtp_instance *instance, unsigned int using_avpf);
+#endif	/* _SDP_CRYPTO_H */

Propchange: team/kmoore/pimp_sip_srtp/include/asterisk/sdp_srtp.h
------------------------------------------------------------------------------
    svn:eol-style = native

Propchange: team/kmoore/pimp_sip_srtp/include/asterisk/sdp_srtp.h
------------------------------------------------------------------------------
    svn:keywords = Author Date Id Revision

Propchange: team/kmoore/pimp_sip_srtp/include/asterisk/sdp_srtp.h
------------------------------------------------------------------------------
    svn:mime-type = text/plain

Added: team/kmoore/pimp_sip_srtp/main/sdp_srtp.c
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/main/sdp_srtp.c?view=auto&rev=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/main/sdp_srtp.c (added)
+++ team/kmoore/pimp_sip_srtp/main/sdp_srtp.c Thu Apr 25 14:48:04 2013
@@ -1,0 +1,382 @@
+/*
+ * Asterisk -- An open source telephony toolkit.
+ *
+ * Copyright (C) 2006 - 2007, Mikael Magnusson
+ *
+ * Mikael Magnusson <mikma at users.sourceforge.net>
+ *
+ * See http://www.asterisk.org for more information about
+ * the Asterisk project. Please do not directly contact
+ * any of the maintainers of this project for assistance;
+ * the project provides a web site, mailing lists and IRC
+ * channels for your use.
+ *
+ * This program is free software, distributed under the terms of
+ * the GNU General Public License Version 2. See the LICENSE file
+ * at the top of the source tree.
+ */
+
+/*! \file ast_sdp_crypto.c
+ *
+ * \brief SRTP and SDP Security descriptions
+ *
+ * Specified in RFC 3711
+ * Specified in RFC 4568
+ *
+ * \author Mikael Magnusson <mikma at users.sourceforge.net>
+ */
+
+/*** MODULEINFO
+	<support_level>core</support_level>
+ ***/
+
+#include "asterisk.h"
+
+ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
+
+#include "asterisk/options.h"
+#include "asterisk/utils.h"
+#include "asterisk/sdp_srtp.h"
+
+#define SRTP_MASTER_LEN 30
+#define SRTP_MASTERKEY_LEN 16
+#define SRTP_MASTERSALT_LEN ((SRTP_MASTER_LEN) - (SRTP_MASTERKEY_LEN))
+#define SRTP_MASTER_LEN64 (((SRTP_MASTER_LEN) * 8 + 5) / 6 + 1)
+
+extern struct ast_srtp_res *res_srtp;
+extern struct ast_srtp_policy_res *res_srtp_policy;
+
+struct ast_sdp_srtp *ast_sdp_srtp_alloc(void)
+{
+	if (!ast_rtp_engine_srtp_is_registered()) {
+	       ast_debug(1, "No SRTP module loaded, can't setup SRTP session.\n");
+	       return NULL;
+	}
+
+	return ast_calloc(1, sizeof(struct ast_sdp_srtp));
+}
+
+void ast_sdp_srtp_destroy(struct ast_sdp_srtp *srtp)
+{
+	if (srtp->crypto) {
+		ast_sdp_crypto_destroy(srtp->crypto);
+	}
+	srtp->crypto = NULL;
+	ast_free(srtp);
+}
+
+struct ast_sdp_crypto {
+	char *a_crypto;
+	unsigned char local_key[SRTP_MASTER_LEN];
+	char *tag;
+	char local_key64[SRTP_MASTER_LEN64];
+	unsigned char remote_key[SRTP_MASTER_LEN];
+};
+
+static int set_crypto_policy(struct ast_srtp_policy *policy, int suite_val, const unsigned char *master_key, unsigned long ssrc, int inbound);
+
+void ast_sdp_crypto_destroy(struct ast_sdp_crypto *crypto)
+{
+	ast_free(crypto->a_crypto);
+	crypto->a_crypto = NULL;
+	ast_free(crypto->tag);
+	crypto->tag = NULL;
+	ast_free(crypto);
+}
+
+struct ast_sdp_crypto *ast_sdp_crypto_alloc(void)
+{
+	struct ast_sdp_crypto *p;
+	int key_len;
+	unsigned char remote_key[SRTP_MASTER_LEN];
+
+	if (!ast_rtp_engine_srtp_is_registered()) {
+		return NULL;
+	}
+
+	if (!(p = ast_calloc(1, sizeof(*p)))) {
+		return NULL;
+	}
+
+	if (res_srtp->get_random(p->local_key, sizeof(p->local_key)) < 0) {
+		ast_sdp_crypto_destroy(p);
+		return NULL;
+	}
+
+	ast_base64encode(p->local_key64, p->local_key, SRTP_MASTER_LEN, sizeof(p->local_key64));
+
+	key_len = ast_base64decode(remote_key, p->local_key64, sizeof(remote_key));
+
+	if (key_len != SRTP_MASTER_LEN) {
+		ast_log(LOG_ERROR, "base64 encode/decode bad len %d != %d\n", key_len, SRTP_MASTER_LEN);
+		ast_free(p);
+		return NULL;
+	}
+
+	if (memcmp(remote_key, p->local_key, SRTP_MASTER_LEN)) {
+		ast_log(LOG_ERROR, "base64 encode/decode bad key\n");
+		ast_free(p);
+		return NULL;
+	}
+
+	ast_debug(1 , "local_key64 %s len %zu\n", p->local_key64, strlen(p->local_key64));
+
+	return p;
+}
+
+static int set_crypto_policy(struct ast_srtp_policy *policy, int suite_val, const unsigned char *master_key, unsigned long ssrc, int inbound)
+{
+	const unsigned char *master_salt = NULL;
+
+	if (!ast_rtp_engine_srtp_is_registered()) {
+		return -1;
+	}
+
+	master_salt = master_key + SRTP_MASTERKEY_LEN;
+	if (res_srtp_policy->set_master_key(policy, master_key, SRTP_MASTERKEY_LEN, master_salt, SRTP_MASTERSALT_LEN) < 0) {
+		return -1;
+	}
+
+	if (res_srtp_policy->set_suite(policy, suite_val)) {
+		ast_log(LOG_WARNING, "Could not set remote SRTP suite\n");
+		return -1;
+	}
+
+	res_srtp_policy->set_ssrc(policy, ssrc, inbound);
+
+	return 0;
+}
+
+static int crypto_activate(struct ast_sdp_crypto *p, int suite_val, unsigned char *remote_key, struct ast_rtp_instance *rtp)
+{
+	struct ast_srtp_policy *local_policy = NULL;
+	struct ast_srtp_policy *remote_policy = NULL;
+	struct ast_rtp_instance_stats stats = {0,};
+	int res = -1;
+
+	if (!ast_rtp_engine_srtp_is_registered()) {
+		return -1;
+	}
+
+	if (!p) {
+		return -1;
+	}
+
+	if (!(local_policy = res_srtp_policy->alloc())) {
+		return -1;
+	}
+
+	if (!(remote_policy = res_srtp_policy->alloc())) {
+		goto err;
+	}
+
+	if (ast_rtp_instance_get_stats(rtp, &stats, AST_RTP_INSTANCE_STAT_LOCAL_SSRC)) {
+		goto err;
+	}
+
+	if (set_crypto_policy(local_policy, suite_val, p->local_key, stats.local_ssrc, 0) < 0) {
+		goto err;
+	}
+
+	if (set_crypto_policy(remote_policy, suite_val, remote_key, 0, 1) < 0) {
+		goto err;
+	}
+
+	/* Add the SRTP policies */
+	if (ast_rtp_instance_add_srtp_policy(rtp, remote_policy, local_policy)) {
+		ast_log(LOG_WARNING, "Could not set SRTP policies\n");
+		goto err;
+	}
+
+	ast_debug(1 , "SRTP policy activated\n");
+	res = 0;
+
+err:
+	if (local_policy) {
+		res_srtp_policy->destroy(local_policy);
+	}
+
+	if (remote_policy) {
+		res_srtp_policy->destroy(remote_policy);
+	}
+
+	return res;
+}
+
+int ast_sdp_crypto_process(struct ast_rtp_instance *rtp, struct ast_sdp_srtp *srtp, const char *attr)
+{
+	char *str = NULL;
+	char *tag = NULL;
+	char *suite = NULL;
+	char *key_params = NULL;
+	char *key_param = NULL;
+	char *session_params = NULL;
+	char *key_salt = NULL;
+	char *lifetime = NULL;
+	int found = 0;
+	int key_len = 0;
+	int suite_val = 0;
+	unsigned char remote_key[SRTP_MASTER_LEN];
+	int taglen = 0;
+	struct ast_sdp_crypto *crypto = srtp->crypto;
+
+	if (!ast_rtp_engine_srtp_is_registered()) {
+		return -1;
+	}
+
+	str = ast_strdupa(attr);
+
+	tag = strsep(&str, " ");
+	suite = strsep(&str, " ");
+	key_params = strsep(&str, " ");
+	session_params = strsep(&str, " ");
+
+	if (!tag || !suite) {
+		ast_log(LOG_WARNING, "Unrecognized a=%s", attr);
+		return -1;
+	}
+
+	if (!ast_strlen_zero(session_params)) {
+		ast_log(LOG_WARNING, "Unsupported crypto parameters: %s", session_params);
+		return -1;
+	}
+
+	if (!strcmp(suite, "AES_CM_128_HMAC_SHA1_80")) {
+		suite_val = AST_AES_CM_128_HMAC_SHA1_80;
+		ast_set_flag(srtp, AST_SRTP_CRYPTO_TAG_80);
+		taglen = 80;
+	} else if (!strcmp(suite, "AES_CM_128_HMAC_SHA1_32")) {
+		suite_val = AST_AES_CM_128_HMAC_SHA1_32;
+		ast_set_flag(srtp, AST_SRTP_CRYPTO_TAG_32);
+		taglen = 32;
+	} else {
+		ast_log(LOG_WARNING, "Unsupported crypto suite: %s\n", suite);
+		return -1;
+	}
+
+	while ((key_param = strsep(&key_params, ";"))) {
+		char *method = NULL;
+		char *info = NULL;
+
+		method = strsep(&key_param, ":");
+		info = strsep(&key_param, ";");
+
+		if (!strcmp(method, "inline")) {
+			key_salt = strsep(&info, "|");
+			lifetime = strsep(&info, "|");
+
+			if (lifetime) {
+				ast_log(LOG_NOTICE, "Crypto life time unsupported: %s\n", attr);
+				continue;
+			}
+
+			found = 1;
+			break;
+		}
+	}
+
+	if (!found) {
+		ast_log(LOG_NOTICE, "SRTP crypto offer not acceptable\n");
+		return -1;
+	}
+
+	if ((key_len = ast_base64decode(remote_key, key_salt, sizeof(remote_key))) != SRTP_MASTER_LEN) {
+		ast_log(LOG_WARNING, "SRTP descriptions key %d != %d\n", key_len, SRTP_MASTER_LEN);
+		return -1;
+	}
+
+	if (!memcmp(crypto->remote_key, remote_key, sizeof(crypto->remote_key))) {
+		ast_debug(1, "SRTP remote key unchanged; maintaining current policy\n");
+		ast_set_flag(srtp, AST_SRTP_CRYPTO_OFFER_OK);
+		return 0;
+	}
+	memcpy(crypto->remote_key, remote_key, sizeof(crypto->remote_key));
+
+	if (crypto_activate(crypto, suite_val, remote_key, rtp) < 0) {
+		return -1;
+	}
+
+	if (!crypto->tag) {
+		ast_log(LOG_DEBUG, "Accepting crypto tag %s\n", tag);
+		crypto->tag = ast_strdup(tag);
+		if (!crypto->tag) {
+			ast_log(LOG_ERROR, "Could not allocate memory for tag\n");
+			return -1;
+		}
+	}
+
+	/* Finally, rebuild the crypto line */
+	if (ast_sdp_crypto_build_offer(crypto, taglen)) {
+		return -1;
+	}
+
+	ast_set_flag(srtp, AST_SRTP_CRYPTO_OFFER_OK);
+	return 0;
+}
+
+int ast_sdp_crypto_build_offer(struct ast_sdp_crypto *p, int taglen)
+{
+	/* Rebuild the crypto line */
+	if (p->a_crypto) {
+		ast_free(p->a_crypto);
+	}
+
+	if (ast_asprintf(&p->a_crypto, "%s AES_CM_128_HMAC_SHA1_%i inline:%s",
+			 p->tag ? p->tag : "1", taglen, p->local_key64) == -1) {
+			ast_log(LOG_ERROR, "Could not allocate memory for crypto line\n");
+		return -1;
+	}
+
+	ast_log(LOG_DEBUG, "Crypto line: a=crypto:%s\n", p->a_crypto);
+
+	return 0;
+}
+
+const char *ast_sdp_srtp_get_attrib(struct ast_sdp_srtp *srtp, int dtls_enabled, int default_taglen_32)
+{
+	int taglen = default_taglen_32 ? 32 : 80;
+
+	if (!srtp) {
+		return NULL;
+	}
+
+	/* Set encryption properties */
+	if (!srtp->crypto) {
+		srtp->crypto = ast_sdp_crypto_alloc();
+	}
+
+	if (dtls_enabled) {
+		/* If DTLS-SRTP is enabled the key details will be pulled from TLS */
+		return NULL;
+	}
+
+	/* set the key length based on INVITE or settings */
+	if (ast_test_flag(srtp, AST_SRTP_CRYPTO_TAG_80)) {
+		taglen = 80;
+	} else if (ast_test_flag(srtp, AST_SRTP_CRYPTO_TAG_32)) {
+		taglen = 32;
+	}
+
+	if (srtp->crypto && (ast_sdp_crypto_build_offer(srtp->crypto, taglen) >= 0)) {
+		return srtp->crypto->a_crypto;
+	}
+
+	ast_log(LOG_WARNING, "No SRTP key management enabled\n");
+	return NULL;
+}
+
+char *ast_sdp_get_rtp_profile(unsigned int sdes_active, struct ast_rtp_instance *instance, unsigned int using_avpf)
+{
+	struct ast_rtp_engine_dtls *dtls;
+
+	if ((dtls = ast_rtp_instance_get_dtls(instance)) && dtls->active(instance)) {
+		return using_avpf ? "UDP/TLS/RTP/SAVPF" : "UDP/TLS/RTP/SAVP";
+	} else {
+		if (using_avpf) {
+			return sdes_active ? "RTP/SAVPF" : "RTP/AVPF";
+		} else {
+			return sdes_active ? "RTP/SAVP" : "RTP/AVP";
+		}
+	}
+}
+

Propchange: team/kmoore/pimp_sip_srtp/main/sdp_srtp.c
------------------------------------------------------------------------------
    svn:eol-style = native

Propchange: team/kmoore/pimp_sip_srtp/main/sdp_srtp.c
------------------------------------------------------------------------------
    svn:keywords = Author Date Id Revision

Propchange: team/kmoore/pimp_sip_srtp/main/sdp_srtp.c
------------------------------------------------------------------------------
    svn:mime-type = text/plain

Modified: team/kmoore/pimp_sip_srtp/res/res_sip/sip_configuration.c
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/res/res_sip/sip_configuration.c?view=diff&rev=386566&r1=386565&r2=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/res/res_sip/sip_configuration.c (original)
+++ team/kmoore/pimp_sip_srtp/res/res_sip/sip_configuration.c Thu Apr 25 14:48:04 2013
@@ -274,6 +274,23 @@
 	struct ast_sip_endpoint *endpoint = obj;
 	endpoint->id.tag = ast_strdup(var->value);
 	return endpoint->id.tag ? 0 : -1;
+}
+
+static int media_encryption_handler(const struct aco_option *opt, struct ast_variable *var, void *obj)
+{
+	struct ast_sip_endpoint *endpoint = obj;
+
+	if (!strcasecmp("no", var->value)) {
+		endpoint->media_encryption = AST_SIP_MEDIA_ENCRYPT_NONE;
+	} else if (!strcasecmp("sdes", var->value)) {
+		endpoint->media_encryption = AST_SIP_MEDIA_ENCRYPT_SDES;
+	/*} else if (!strcasecmp("dtls", var->value)) {
+		endpoint->media_encryption = AST_SIP_MEDIA_ENCRYPT_DTLS;*/
+	} else {
+		return -1;
+	}
+
+	return 0;
 }
 
 static void *sip_nat_hook_alloc(const char *name)
@@ -351,6 +368,8 @@
 	ast_sorcery_object_field_register(sip_sorcery, "endpoint", "send_rpid", "no", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, send_rpid));
 	ast_sorcery_object_field_register(sip_sorcery, "endpoint", "mailboxes", "", OPT_STRINGFIELD_T, 0, STRFLDSET(struct ast_sip_endpoint, mailboxes));
 	ast_sorcery_object_field_register(sip_sorcery, "endpoint", "aggregate_mwi", "yes", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, aggregate_mwi));
+	ast_sorcery_object_field_register_custom(sip_sorcery, "endpoint", "media_encryption", "no", media_encryption_handler, NULL, 0, 0);
+	ast_sorcery_object_field_register(sip_sorcery, "endpoint", "use_avpf", "no", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, use_avpf));
 
 	if (ast_sip_initialize_sorcery_transport(sip_sorcery)) {
 		ast_log(LOG_ERROR, "Failed to register SIP transport support with sorcery\n");

Modified: team/kmoore/pimp_sip_srtp/res/res_sip_sdp_rtp.c
URL: http://svnview.digium.com/svn/asterisk/team/kmoore/pimp_sip_srtp/res/res_sip_sdp_rtp.c?view=diff&rev=386566&r1=386565&r2=386566
==============================================================================
--- team/kmoore/pimp_sip_srtp/res/res_sip_sdp_rtp.c (original)
+++ team/kmoore/pimp_sip_srtp/res/res_sip_sdp_rtp.c Thu Apr 25 14:48:04 2013
@@ -47,6 +47,7 @@
 #include "asterisk/causes.h"
 #include "asterisk/sched.h"
 #include "asterisk/acl.h"
+#include "asterisk/sdp_srtp.h"
 
 #include "asterisk/res_sip.h"
 #include "asterisk/res_sip_session.h"
@@ -454,6 +455,93 @@
 					 session_media->rtp, pref);
 }
 
+/*! \brief figure out media transport encryption type from the media transport string */
+static enum ast_sip_session_media_encryption get_media_encryption_type(pj_str_t transport)
+{
+	RAII_VAR(char *, transport_str, ast_strndup(transport.ptr, transport.slen), ast_free);
+	if (strstr(transport_str, "UDP/TLS")) {
+		return AST_SIP_MEDIA_ENCRYPT_DTLS;
+	} else if (strstr(transport_str, "SAVP")) {
+		return AST_SIP_MEDIA_ENCRYPT_SDES;
+	} else {
+		return AST_SIP_MEDIA_ENCRYPT_NONE;
+	}
+}
+
+/*!
+ * \brief Checks whether the encryption offered in SDP is compatible with the endpoint's configuration
+ * \internal
+ *
+ * \param endpoint_encryption Media encryption configured for the endpoint
+ * \param stream pjmedia_sdp_media stream description
+ *
+ * \retval AST_SIP_MEDIA_TRANSPORT_INVALID on encryption mismatch
+ * \retval The encryption requested in the SDP
+ */
+static enum ast_sip_session_media_encryption check_endpoint_media_transport(
+	struct ast_sip_endpoint *endpoint,
+	const struct pjmedia_sdp_media *stream)
+{
+	enum ast_sip_session_media_encryption incoming_encryption;
+
+	if (endpoint->use_avpf) {
+		char transport_end = stream->desc.transport.ptr[stream->desc.transport.slen - 1];
+		if (transport_end != 'F') {
+			return AST_SIP_MEDIA_TRANSPORT_INVALID;
+		}
+	}
+
+	incoming_encryption = get_media_encryption_type(stream->desc.transport);
+	if (incoming_encryption == AST_SIP_MEDIA_ENCRYPT_DTLS) {
+		/* DTLS not yet supported */
+		return AST_SIP_MEDIA_TRANSPORT_INVALID;
+	}
+
+	if (incoming_encryption == endpoint->media_encryption) {
+		return incoming_encryption;
+	}
+
+	return AST_SIP_MEDIA_TRANSPORT_INVALID;
+}
+
+static int setup_sdes_srtp(struct ast_sip_session_media *session_media,
+	const struct pjmedia_sdp_media *stream)
+{
+	pjmedia_sdp_attr *attr;
+	RAII_VAR(char *, crypto_str, NULL, ast_free);
+
+	/* check the stream for the required crypto attribute */
+	attr = pjmedia_sdp_media_find_attr2(stream, "crypto", NULL);
+	if (!attr) {
+		return -1;
+	}
+
+	crypto_str = ast_strndup(attr->value.ptr, attr->value.slen);
+	if (!crypto_str) {
+		return -1;
+	}
+
+	if (!session_media->srtp) {
+		session_media->srtp = ast_sdp_srtp_alloc();
+		if (!session_media->srtp) {
+			return -1;
+		}
+	}
+
+	if (!session_media->srtp->crypto) {
+		session_media->srtp->crypto = ast_sdp_crypto_alloc();
+		if (!session_media->srtp->crypto) {
+			return -1;
+		}
+	}
+
+	if (ast_sdp_crypto_process(session_media->rtp, session_media->srtp, crypto_str)) {
+		return -1;
+	}
+
+	return 0;
+}
+
 /*! \brief Function which negotiates an incoming media stream */
 static int negotiate_incoming_sdp_stream(struct ast_sip_session *session, struct ast_sip_session_media *session_media,
 					 const struct pjmedia_sdp_session *sdp, const struct pjmedia_sdp_media *stream)
@@ -461,12 +549,19 @@
 	char host[NI_MAXHOST];
 	RAII_VAR(struct ast_sockaddr *, addrs, NULL, ast_free_ptr);
 	enum ast_format_type media_type = stream_to_media_type(session_media->stream_type);
+	enum ast_sip_session_media_encryption incoming_encryption;
 
 	/* If no type formats have been configured reject this stream */
 	if (!ast_format_cap_has_type(session->endpoint->codecs, media_type)) {
 		return 0;
 	}
 
+	/* Ensure incoming transport is compatible with the endpoint's configuration */
+	incoming_encryption = check_endpoint_media_transport(session->endpoint, stream);
+	if (incoming_encryption == AST_SIP_MEDIA_TRANSPORT_INVALID) {
+		return -1;
+	}
+
 	ast_copy_pj_str(host, stream->conn ? &stream->conn->addr : &sdp->conn->addr, sizeof(host));
 
 	/* Ensure that the address provided is valid */
@@ -480,7 +575,40 @@
 		return -1;
 	}
 
+	if (incoming_encryption == AST_SIP_MEDIA_ENCRYPT_SDES
+			&& setup_sdes_srtp(session_media, stream)) {
+		return -1;
+	}
+
 	return set_caps(session, session_media, stream);
+}
+
+static int add_crypto_to_stream(struct ast_sip_session *session,
+	struct ast_sip_session_media *session_media,
+	pj_pool_t *pool, pjmedia_sdp_media *media)
+{
+	pj_str_t stmp;
+	pjmedia_sdp_attr *attr;
+	const char *crypto_attribute;
+
+	if (!session_media->srtp && session->endpoint->media_encryption != AST_SIP_MEDIA_ENCRYPT_NONE) {
+		session_media->srtp = ast_sdp_srtp_alloc();
+		if (!session_media->srtp) {
+			return -1;
+		}
+	}
+
+	crypto_attribute = ast_sdp_srtp_get_attrib(session_media->srtp,
+		0 /* DTLS can not be enabled for res_sip */,
+		0 /* don't prefer 32byte tag length */);
+	if (!crypto_attribute) {

[... 109 lines stripped ...]



More information about the asterisk-commits mailing list