Skip to content

F
freeswitch
提交 1fdd58f5 authored 作者: Piotr Gregor's avatar Piotr Gregor 提交者： Muteesa Fred
浏览文件
操作

FS-10778: Add support for MKI to SRTP 

MKI support for SRTP has been tested on calls to/from
Telnyx's Skype for Business from/to local extension registered to FS
and between Skype for Business clients connected to FreeSWITCH.

SfB -> FreeSWITCH -> User 1004
   SRTP           RTP
   with
   MKI

SfB <- FreeSWITCH <- User 1004
   SRTP           RTP

SfB <-> FreeSWITCH <-> SfB
 SRTP/MKI      SRTP/MKI

Channel variable "rtp_secure_media_mki" was added to drive offering
of MKI on outbound SRTP from FS.

How to use rtp_secure_media_mki

Set rtp_secure_media_mki=true to offer MKI for outgoing SRTP (if SRTP is used) in inbound call.
Export rtp_secure_media=true to offer MKI for outgoing SRTP (if SRTP is used) on outbound call.
... or set it in the codec string for bridged calls

<action application="set" data="rtp_secure_media_mki=true"/>

<action application="export" data="rtp_secure_media_mki=true"/>

<action application="bridge" data="[absolute_codec_string=^^:PCMU:PCMA:G729,rtp_secure_media=true,rtp_secure_media_mki=true]sofia/external/+12404373253@169.55.36.24:5060;transport=tls"/>

EXAMPLES

1. Set example

 57     <extension name="telnyx_test_1_2">
 58         <condition field="destination_number" expression="^(0012404373253)$">
 59             <action application="set" data="rtp_secure_media=true"/>
 60             <action application="set" data="rtp_secure_media_mki=true"/>
 61             <action application="answer"/>
 62             <action application="bridge" data="user/1004@${domain_name}"/>
 63       </condition>
 64   </extension>

Description: SRTP will be used on outbound leg in incoming call due to rtp_secure_media=true
set and MKI will be offered in SDP. SRTP will not be used on a bridged call to extension 1004.

2. Export example

 75   <extension name="to_skype_for_business">
 76       <condition field="destination_number" expression="^(840531022)$">
 77           <action application="set" data="rtp_secure_media=optional"/>
 78           <action application="export" data="rtp_secure_media_mki=true"/>
 79           <action application="bridge" data="[absolute_codec_string=^^:PCMU:PCMA:G729,rtp_secure_media=true]sofia/external/+12404373728@169.55.36.24:5060;transport=tls"/>
 80       </condition>
 81   </extension>

Description: SRTP on inbound call has been set to optional therefore MKI will be used
on outbound SRTP in this call if SRTP is used at all. SRTP will be used on a bridged call
due to rtp_secure_media=true set in codec string and MKI will be used in offering SDP.

3. Bridging between Skype for Business clients: set

 97     <extension name="S4B_fs_S4B">
 98         <condition field="destination_number" expression="^(0012404373254)$">
 99             <action application="set" data="rtp_secure_media=true"/>
100             <action application="set" data="rtp_secure_media_mki=true"/>
101             <action application="bridge" data="[absolute_codec_string=^^:PCMU:PCMA:G729,rtp_secure_media=true]sofia/external/+12404373253@169.55.36.$
102       </condition>
103   </extension>

Result:
2017-11-27 19:00:26.977704 [NOTICE] switch_ivr_originate.c:527 Ring Ready sofia/external/+12404373728@telnyxlab.com!
2017-11-27 19:00:32.657687 [NOTICE] switch_core_media.c:1534 Skipping MKI due to empty index
2017-11-27 19:00:32.657687 [INFO] switch_rtp.c:4079 Activating audio Secure RTP SEND
2017-11-27 19:00:32.657687 [INFO] switch_rtp.c:4057 Activating audio Secure RTP RECV
2017-11-27 19:00:32.657687 [NOTICE] sofia.c:8419 Channel [sofia/external/%2B12404373253@169.55.36.24:5060] has been answered
2017-11-27 19:00:35.317702 [INFO] switch_rtp.c:4079 Activating audio Secure RTP SEND (with MKI)
2017-11-27 19:00:35.317702 [INFO] switch_rtp.c:4057 Activating audio Secure RTP RECV (with MKI)
2017-11-27 19:00:35.317702 [NOTICE] sofia_media.c:92 Pre-Answer sofia/external/+12404373728@telnyxlab.com!

Description: SRTP with MKI is used on outbound leg of inbound call (due to use on inbound leg of this call and "set").
Standard SRTP is used in both legs of outbound call, because rtp_secure_media_mki wasn't exported
or set in codec string for the outbound call.

4. Bridging between Skype for Business clients: Set and export

 97     <extension name="S4B_fs_S4B">
 98         <condition field="destination_number" expression="^(0012404373254)$">
 99             <action application="set" data="rtp_secure_media=true"/>
100             <action application="set" data="rtp_secure_media_mki=true"/>
101             <action application="export" data="rtp_secure_media_mki=true"/>
102             <action application="bridge" data="[absolute_codec_string=^^:PCMU:PCMA:G729,rtp_secure_media=true]sofia/external/+12404373253@169.55.36.24:5060;transport=tls"/>
103       </condition>
104   </extension>

Result:
2017-11-27 18:51:29.017689 [NOTICE] switch_ivr_originate.c:527 Ring Ready sofia/external/+12404373728@telnyxlab.com!
2017-11-27 18:51:35.097729 [INFO] switch_rtp.c:4079 Activating audio Secure RTP SEND (with MKI)
2017-11-27 18:51:35.097729 [INFO] switch_rtp.c:4057 Activating audio Secure RTP RECV (with MKI)
2017-11-27 18:51:35.097729 [NOTICE] sofia.c:8419 Channel [sofia/external/%2B12404373253@169.55.36.24:5060] has been answered
2017-11-27 18:51:37.797706 [INFO] switch_rtp.c:4079 Activating audio Secure RTP SEND (with MKI)
2017-11-27 18:51:37.797706 [INFO] switch_rtp.c:4057 Activating audio Secure RTP RECV (with MKI)

Description: Connecting Skype For Business client to Skype for Business client.
Send SRTP with MKI in both outbound streams:
	- for inbound call: MKI was offered in incoming call and enabled for outbound leg with "set"
	- for outbound call: MKI was enabled with "export"

5. Other examples

Setup to use SRTP with MKI only on the inbound SRTP on incoming call from Telnyx SfB
Tested dialing 0012404373253 from SfB to FS, leg SfB <-> FS uses SRTP with MKI
on inbound SRTP only

57     <extension name="telnyx_test_1_2">
58         <condition field="destination_number" expression="^(0012404373253)$">
59              <action application="set" data="rtp_secure_media=true"/>
61              <action application="answer"/>
62              <action application="bridge" data="user/1004@${domain_name}"/>
63       </condition>
64   </extension>

Result:
2017-11-23 20:44:35.406026 [INFO] mod_dialplan_xml.c:637 Processing Test02 <+12404373728>->0012404373253 in context public
2017-11-23 20:44:38.566022 [INFO] switch_rtp.c:4107 Activating audio Secure RTP SEND
2017-11-23 20:44:38.566022 [INFO] switch_rtp.c:4085 Activating audio Secure RTP RECV (with MKI)

Setup to send and receive SRTP with MKI on incoming call from Telnyx SfB
Tested dialing 0012404373253 from SfB to FS, leg SfB <-> FS uses SRTP with MKI
in both directions

57     <extension name="telnyx_test_1_2">
58         <condition field="destination_number" expression="^(0012404373253)$">
59     		<action application="set" data="rtp_secure_media=true"/>
60     		<action application="set" data="rtp_secure_media_mki"/>
61     		<action application="answer"/>
62     		<action application="bridge" data="user/1004@${domain_name}"/>
63       </condition>
64   </extension>

Result:
2017-11-23 20:42:06.026034 [INFO] mod_dialplan_xml.c:637 Processing Test02 <+12404373728>->0012404373253 in context public
2017-11-23 20:42:09.526034 [INFO] switch_rtp.c:4107 Activating audio Secure RTP SEND (with MKI)
2017-11-23 20:42:09.526034 [INFO] switch_rtp.c:4085 Activating audio Secure RTP RECV (with MKI)

Setup to offer MKI on outbound call to extension 1001 (X-Lite -> FS -> linphone)
Tested dialing 0012404373253 from user 1004, leg FS <-> 1001 uses SRTP with MKI

782     <extension name="telnyx_test_1_2">
783         <condition field="destination_number" expression="^(0012404373253)$">
784             <action application="export" data="rtp_secure_media_outbound=true"/>
785             <action application="export" data="rtp_secure_media_mki"/>
786             <action application="answer"/>
797             <action application="bridge" data="user/1001@${domain_name}"/>
798       </condition>
799   </extension>

Result:
2017-11-23 20:23:26.266034 [INFO] mod_dialplan_xml.c:637 Processing 1000 windows <1000>->0012404373253 in context default
2017-11-23 20:23:26.366035 [INFO] switch_rtp.c:4107 Activating audio Secure RTP SEND (with MKI)
2017-11-23 20:23:26.366035 [INFO] switch_rtp.c:4085 Activating audio Secure RTP RECV

SfB sometimes offers crypto with LIFETIME but no MKI index, e.g.:
a=crypto:5 AES_CM_128_HMAC_SHA1_80 inline:9OtFWi17H9E8ywlm0iazemjAqXu2RhJ3DZyo+VLJ|2^31

Defaulting to no-mki SRTP in case key material doesn't contain MKI index.
上级 180d427c
全部展开 隐藏空白字符变更
内嵌 并排
正在显示 包含 621 行增加 和 135 行删除
src/include/switch_rtp.h
浏览文件 @ 1fdd58f5
......@@ -44,7 +44,6 @@ SWITCH_BEGIN_EXTERN_C
#define SWITCH_RTP_MAX_BUF_LEN 16384
#define SWITCH_RTCP_MAX_BUF_LEN 16384
#define SWITCH_RTP_MAX_BUF_LEN_WORDS 4094 /* (max / 4) - 2 */
#define SWITCH_RTP_MAX_CRYPTO_LEN 64
//#define SWITCH_RTP_KEY_LEN 30
//#define SWITCH_RTP_CRYPTO_KEY_32 "AES_CM_128_HMAC_SHA1_32"
#define SWITCH_RTP_CRYPTO_KEY_80 "AES_CM_128_HMAC_SHA1_80"
......@@ -67,14 +66,16 @@ typedef enum {
typedef struct switch_srtp_crypto_suite_s {
char *name;
switch_rtp_crypto_key_type_t type;
int keylen;
int keysalt_len;
int salt_len;
} switch_srtp_crypto_suite_t;
extern switch_srtp_crypto_suite_t SUITES[CRYPTO_INVALID];
struct switch_rtp_crypto_key {
uint32_t index;
switch_rtp_crypto_key_type_t type;
unsigned char key[SWITCH_RTP_MAX_CRYPTO_LEN];
unsigned char keysalt[SWITCH_RTP_MAX_CRYPTO_LEN];
switch_size_t keylen;
struct switch_rtp_crypto_key *next;
};
......@@ -170,9 +171,7 @@ typedef enum { /* FMT Values for PSFB Payload Types http://www.iana.org/assignme
SWITCH_DECLARE(switch_status_t) switch_rtp_add_crypto_key(switch_rtp_t *rtp_session,
switch_rtp_crypto_direction_t direction,
uint32_t index, switch_rtp_crypto_key_type_t type, unsigned char *key, switch_size_t keylen);
SWITCH_DECLARE(switch_status_t) switch_rtp_add_crypto_key(switch_rtp_t *rtp_session, switch_rtp_crypto_direction_t direction, uint32_t index, switch_secure_settings_t *ssec);
///\defgroup rtp RTP (RealTime Transport Protocol)
///\ingroup core1
......
src/include/switch_types.h
浏览文件 @ 1fdd58f5
......@@ -779,6 +779,8 @@ typedef enum {
SWITCH_RTP_FLAG_TEXT,
SWITCH_RTP_FLAG_OLD_FIR,
SWITCH_RTP_FLAG_PASSTHRU,
SWITCH_RTP_FLAG_SECURE_SEND_MKI,
SWITCH_RTP_FLAG_SECURE_RECV_MKI,
SWITCH_RTP_FLAG_INVALID
} switch_rtp_flag_t;
......@@ -2566,6 +2568,12 @@ typedef enum {
CRYPTO_INVALID
} switch_rtp_crypto_key_type_t;
/* Keep in sync with CRYPTO_KEY_PARAM_METHOD table. */
typedef enum {
CRYPTO_KEY_PARAM_METHOD_INLINE, /* identified by "inline" chars in SRTP key parameter */
CRYPTO_KEY_PARAM_METHOD_INVALID
} switch_rtp_crypto_key_param_method_type_t;
typedef struct payload_map_s {
switch_media_type_t type;
switch_sdp_type_t sdp_type;
......@@ -2709,6 +2717,56 @@ typedef struct switch_mm_s {
char *auth_password;
} switch_mm_t;
#define SWITCH_RTP_MAX_CRYPTO_LEN 64
/* If MKI is used, then one or more key-materials are present in the <key-params> section of the crypto attribute.
* This struct describes the single MKI entry (key-material) within <key-params> section of crypto attribute.
* Key-material follows the format:
* "inline:" <key||salt> ["|" lifetime] ["|" MKI ":" length]
* which translates to
* "inline: KEYSALT|MKI_ID:MKI_SZ" or "inline: KEYSALT|LIFETIME|MKI_ID:MKI_SZ" */
typedef struct switch_crypto_key_material_s {
switch_rtp_crypto_key_param_method_type_t method;
unsigned char raw_key[SWITCH_RTP_MAX_CRYPTO_LEN]; /* Key-salt. Master key appended with salt. Sizes determined by crypto suite. */
char *crypto_key; /* Complete key material string ("method:keysalt[|lifetime]|mki"). */
uint64_t lifetime; /* OPTIONAL. The lifetime value MAY be written as a non-zero, positive decimal integer or as a power of 2. Must be less than max lifetime of RTP and RTCP packets in given crypto suite. */
unsigned int mki_id; /* OPTIONAL. */
unsigned int mki_size; /* OPTIONAL. Byte length of the master key field in the RTP packet. */
struct switch_crypto_key_material_s *next; /* NULL if this is the last master key in crypto attribute set. */
} switch_crypto_key_material_t;
typedef struct secure_settings_s {
int crypto_tag;
unsigned char local_raw_key[SWITCH_RTP_MAX_CRYPTO_LEN];
unsigned char remote_raw_key[SWITCH_RTP_MAX_CRYPTO_LEN];
switch_rtp_crypto_key_type_t crypto_type;
char *local_crypto_key;
char *remote_crypto_key;
/*
* MKI support (as per rfc4568).
* Normally single crypto attribute contains one key-material in a <key-params> section, e.g. "inline: KEYSALT" or "inline: KEYSALT|2^LIFETIME_BITS".
* But if MKI is used, then one or more key-materials are present in the <key-params> section of the crypto attribute. Each key-material follows the format:
*
* "inline:" <key||salt> ["|" lifetime] ["|" MKI ":" length]
*
* "inline: KEYSALT|MKI_ID:MKI_SZ"
* or
* "inline: KEYSALT|2^LIFETIME_BITS|MKI_ID:MKI_SZ"
*
* This points to singly linked list of key-material descriptions if there is more than one key-material present in this crypto attribute (this key is inserted as the head of the list in that case), or to NULL otherwise.
*/
struct switch_crypto_key_material_s *local_key_material_next; /* NULL if MKI not used for crypto set on outbound SRTP. */
unsigned long local_key_material_n; /* number of key_materials in the linked list for outbound SRTP */
struct switch_crypto_key_material_s *remote_key_material_next; /* NULL if MKI not used for crypto set on inbound SRTP. */
unsigned long remote_key_material_n; /* number of key_materials in the linked list for inbound SRTP */
} switch_secure_settings_t;
/* Default MKI index used for packets send from FS. We always use first key if multiple master keys are present in the crypto attribute. */
#define SWITCH_CRYPTO_MKI_INDEX 0
/* max number of MKI in a single crypto line supported */
#define SWITCH_CRYPTO_MKI_MAX 20
SWITCH_END_EXTERN_C
#endif
......
src/include/switch_utils.h
浏览文件 @ 1fdd58f5
......@@ -391,7 +391,7 @@ static inline int switch_string_has_escaped_data(const char *in)
#endif
SWITCH_DECLARE(switch_status_t) switch_b64_encode(unsigned char *in, switch_size_t ilen, unsigned char *out, switch_size_t olen);
SWITCH_DECLARE(switch_size_t) switch_b64_decode(char *in, char *out, switch_size_t olen);
SWITCH_DECLARE(switch_size_t) switch_b64_decode(const char *in, char *out, switch_size_t olen);
SWITCH_DECLARE(char *) switch_amp_encode(char *s, char *buf, switch_size_t len);
......
src/switch_core_media.c
浏览文件 @ 1fdd58f5
差异被折叠。
src/switch_rtp.c
浏览文件 @ 1fdd58f5
差异被折叠。
src/switch_utils.c
浏览文件 @ 1fdd58f5
......@@ -955,12 +955,13 @@ SWITCH_DECLARE(switch_status_t) switch_b64_encode(unsigned char *in, switch_size
return SWITCH_STATUS_SUCCESS;
}
SWITCH_DECLARE(switch_size_t) switch_b64_decode(char *in, char *out, switch_size_t olen)
SWITCH_DECLARE(switch_size_t) switch_b64_decode(const char *in, char *out, switch_size_t olen)
{
char l64[256];
int b = 0, c, l = 0, i;
char *ip, *op = out;
const char *ip;
char *op = out;
size_t ol = 0;
for (i = 0; i < 256; i++) {
......
Markdown 格式
0% 或
您添加了 0 人 到此讨论。请谨慎行事。
请先完成此评论的编辑！
请 注册 或者 后发表评论