RFC4568 support, you don't need the cone of silence anymore...

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@7244 d0543943-73ff-0310-b7d9-9358b9ac24b2

src/include/switch_rtp.h

@@ -41,12 +41,50 @@
 
 SWITCH_BEGIN_EXTERN_C
 #define SWITCH_RTP_MAX_BUF_LEN 16384
+#define SWITCH_RTP_MAX_CRYPTO_LEN 64
+#define SWITCH_RTP_KEY_LEN 30
+#define SWITCH_RTP_CRYPTO_KEY_32 "AES_CM_128_HMAC_SHA1_32"
+#define SWITCH_RTP_CRYPTO_KEY_80 "AES_CM_128_HMAC_SHA1_80"
+
+
+typedef enum {
+	SWITCH_RTP_CRYPTO_SEND,
+	SWITCH_RTP_CRYPTO_RECV,
+	SWITCH_RTP_CRYPTO_MAX
+} switch_rtp_crypto_direction_t;
+
+typedef enum {
+	NO_CRYPTO,
+	AES_CM_128_HMAC_SHA1_80,
+	AES_CM_128_HMAC_SHA1_32
+} switch_rtp_crypto_key_type_t;
+
+struct switch_rtp_crypto_key {
+	uint32_t index;
+	switch_rtp_crypto_key_type_t type;
+	unsigned char key[SWITCH_RTP_MAX_CRYPTO_LEN];
+	switch_size_t keylen;
+	struct switch_rtp_crypto_key *next;
+};
+typedef struct switch_rtp_crypto_key switch_rtp_crypto_key_t;
+
+
+
+SWITCH_DECLARE(switch_status_t) switch_rtp_add_crypto_key(switch_rtp_t *rtp_session,
+														  switch_rtp_crypto_direction_t direction,
+														  uint32_t index,
+														  switch_rtp_crypto_key_type_t type,
+														  unsigned char *key,
+														  switch_size_t keylen);
+
 ///\defgroup rtp RTP (RealTime Transport Protocol)
 ///\ingroup core1
 ///\{
 typedef void (*switch_rtp_invalid_handler_t) (switch_rtp_t *rtp_session,
 											  switch_socket_t * sock, void *data, switch_size_t datalen, switch_sockaddr_t * from_addr);
 
+
+SWITCH_DECLARE(void) switch_rtp_get_random(void *buf, uint32_t len);
 /*! 
   \brief Initilize the RTP System
   \param pool the memory pool to use for long term allocations
@@ -83,7 +121,6 @@ SWITCH_DECLARE(void) switch_rtp_release_port(const char *ip, switch_port_t port)
   \param samples_per_interval the default samples_per_interval
   \param ms_per_packet time in microseconds per packet
   \param flags flags to control behaviour
-  \param crypto_key optional crypto key
   \param timer_name timer interface to use
   \param err a pointer to resolve error messages
   \param pool a memory pool to use for the session
@@ -93,7 +130,9 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_create(switch_rtp_t **new_rtp_session
 												  switch_payload_t payload,
 												  uint32_t samples_per_interval,
 												  uint32_t ms_per_packet,
-												  switch_rtp_flag_t flags, char *crypto_key, char *timer_name, const char **err,
+												  switch_rtp_flag_t flags,
+												  char *timer_name, 
+												  const char **err,
 												  switch_memory_pool_t *pool);
 
 
@@ -107,7 +146,6 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_create(switch_rtp_t **new_rtp_session
   \param samples_per_interval the default samples_per_interval
   \param ms_per_packet time in microseconds per packet
   \param flags flags to control behaviour
-  \param crypto_key optional crypto key
   \param timer_name timer interface to use
   \param err a pointer to resolve error messages
   \param pool a memory pool to use for the session
@@ -120,7 +158,10 @@ SWITCH_DECLARE(switch_rtp_t *) switch_rtp_new(const char *rx_host,
 											  switch_payload_t payload,
 											  uint32_t samples_per_interval,
 											  uint32_t ms_per_packet,
-											  switch_rtp_flag_t flags, char *crypto_key, char *timer_name, const char **err, switch_memory_pool_t *pool);
+											  switch_rtp_flag_t flags,
+											  char *timer_name,
+											  const char **err,
+											  switch_memory_pool_t *pool);
 
 
 /*! 

src/include/switch_utils.h

@@ -56,7 +56,7 @@ SWITCH_BEGIN_EXTERN_C
 #endif
 
 SWITCH_DECLARE(switch_status_t) switch_b64_encode(unsigned char *in, switch_size_t ilen, unsigned char *out, switch_size_t olen);
-SWITCH_DECLARE(switch_status_t) switch_b64_decode(char *in, char *out, switch_size_t olen);
+SWITCH_DECLARE(switch_size_t) switch_b64_decode(char *in, char *out, switch_size_t olen);
 SWITCH_DECLARE(char *) switch_amp_encode(char *s, char *buf, switch_size_t len);
 
 static inline switch_bool_t switch_is_digit_string(const char *s) {

src/mod/applications/mod_esf/mod_esf.c

@@ -167,7 +167,7 @@ SWITCH_STANDARD_APP(bcast_function)
 									 read_codec->implementation->samples_per_frame,
 									 read_codec->implementation->microseconds_per_frame,
 									 (switch_rtp_flag_t) flags,
-									 NULL, "soft", &err, switch_core_session_get_pool(session));
+									 "soft", &err, switch_core_session_get_pool(session));
 	
 		if (!switch_rtp_ready(rtp_session)) {
 			switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "RTP Error\n");

src/mod/endpoints/mod_dingaling/mod_dingaling.c

@@ -877,7 +877,7 @@ static int activate_rtp(struct private_object *tech_pvt)
 												 tech_pvt->codec_num,
 												 tech_pvt->read_codec.implementation->samples_per_frame,
 												 tech_pvt->read_codec.implementation->microseconds_per_frame,
-												 flags, NULL, tech_pvt->profile->timer_name, &err, switch_core_session_get_pool(tech_pvt->session)))) {
+												 flags, tech_pvt->profile->timer_name, &err, switch_core_session_get_pool(tech_pvt->session)))) {
 		switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "RTP ERROR %s\n", err);
 		switch_channel_hangup(channel, SWITCH_CAUSE_DESTINATION_OUT_OF_ORDER);
 		return 0;

src/mod/endpoints/mod_sofia/mod_sofia.c

@@ -90,6 +90,19 @@ static switch_status_t sofia_on_init(switch_core_session_t *session)
 	}
 
 	if (switch_test_flag(tech_pvt, TFLAG_OUTBOUND)) {
+		const char *var;
+
+		if ((var = switch_channel_get_variable(channel, SOFIA_SECURE_MEDIA_VARIABLE)) && !switch_strlen_zero(var)) {
+			if (switch_true(var) || !strcasecmp(var, SWITCH_RTP_CRYPTO_KEY_32)) {
+				switch_set_flag_locked(tech_pvt, TFLAG_SECURE);
+				sofia_glue_build_crypto(tech_pvt, 1, AES_CM_128_HMAC_SHA1_32, SWITCH_RTP_CRYPTO_SEND);
+			} else if (!strcasecmp(var, SWITCH_RTP_CRYPTO_KEY_80)) {
+				switch_set_flag_locked(tech_pvt, TFLAG_SECURE);
+				sofia_glue_build_crypto(tech_pvt, 1, AES_CM_128_HMAC_SHA1_80, SWITCH_RTP_CRYPTO_SEND);
+			}
+		}
+
+
 		if (sofia_glue_do_invite(session) != SWITCH_STATUS_SUCCESS) {
 			switch_channel_hangup(channel, SWITCH_CAUSE_DESTINATION_OUT_OF_ORDER);
 			return SWITCH_STATUS_FALSE;
@@ -786,6 +799,13 @@ static switch_status_t sofia_receive_message(switch_core_session_t *session, swi
 	tech_pvt = (private_object_t *) switch_core_session_get_private(session);
 	switch_assert(tech_pvt != NULL);
 
+	if (msg->message_id == SWITCH_MESSAGE_INDICATE_ANSWER || msg->message_id == SWITCH_MESSAGE_INDICATE_PROGRESS) {
+		const char *var;
+		if ((var = switch_channel_get_variable(channel, SOFIA_SECURE_MEDIA_VARIABLE)) && switch_true(var)) {
+			switch_set_flag_locked(tech_pvt, TFLAG_SECURE);
+		}
+	}
+
 	switch (msg->message_id) {
 	case SWITCH_MESSAGE_INDICATE_BROADCAST: {
 		const char *ip = NULL, *port = NULL;
@@ -1746,6 +1766,7 @@ static switch_call_cause_t sofia_outgoing_channel(switch_core_session_t *session
 	*pool = NULL;
 
   done:
+
 	if (profile) {
 		sofia_glue_release_profile(profile);
 	}

src/mod/endpoints/mod_sofia/mod_sofia.h

@@ -73,6 +73,9 @@ typedef struct private_object private_object_t;
 #define SOFIA_DEFAULT_PORT "5060"
 #define SOFIA_DEFAULT_TLS_PORT "5061"
 #define SOFIA_REFER_TO_VARIABLE "sip_refer_to"
+#define SOFIA_SECURE_MEDIA_VARIABLE "sip_secure_media"
+#define SOFIA_SECURE_MEDIA_CONFIRMED_VARIABLE "sip_secure_media_confirmed"
+#define SOFIA_HAS_CRYPTO_VARIABLE "sip_has_crypto"
 
 #include <sofia-sip/nua.h>
 #include <sofia-sip/sip_status.h>
@@ -124,7 +127,8 @@ typedef enum {
 	PFLAG_MULTIREG = (1 << 11),
 	PFLAG_SUPRESS_CNG = (1 << 12),
 	PFLAG_TLS = (1 << 13),
-	PFLAG_CHECKUSER = (1 << 14)
+	PFLAG_CHECKUSER = (1 << 14),
+	PFLAG_SECURE = (1 << 15)
 } PFLAGS;
 
 typedef enum {
@@ -339,6 +343,13 @@ struct private_object {
 	char *invite_contact;
 	char *local_url;
 	char *gateway_name;
+	char *local_crypto_key;
+	char *remote_crypto_key;
+	unsigned char local_raw_key[SWITCH_RTP_MAX_CRYPTO_LEN];
+	unsigned char remote_raw_key[SWITCH_RTP_MAX_CRYPTO_LEN];
+	switch_rtp_crypto_key_type_t crypto_send_type;
+	switch_rtp_crypto_key_type_t crypto_recv_type;
+	switch_rtp_crypto_key_type_t crypto_type;
 	unsigned long rm_rate;
 	switch_payload_t pt;
 	switch_mutex_t *flag_mutex;
@@ -561,3 +572,4 @@ const char *sofia_glue_transport2str(const sofia_transport_t tp);
 
 int sofia_glue_transport_has_tls(const sofia_transport_t tp);
 const char *sofia_glue_get_unknown_header(sip_t const *sip, const char *name);
+switch_status_t sofia_glue_build_crypto(private_object_t *tech_pvt, int index, switch_rtp_crypto_key_type_t type, switch_rtp_crypto_direction_t direction);

src/mod/endpoints/mod_sofia/sofia.c

@@ -1010,6 +1010,10 @@ switch_status_t config_sofia(int reload, char *profile_name)
 						if (switch_true(val)) {
 							profile->pflags |= PFLAG_PRESENCE;
 						}
+					} else if (!strcasecmp(var, "require-secure-rtp")) {
+						if (switch_true(val)) {
+							profile->pflags |= PFLAG_SECURE;
+						}
 					} else if (!strcasecmp(var, "multiple-registrations")) {
 						if (switch_true(val)) {
 							profile->pflags |= PFLAG_MULTIREG;

src/switch_utils.c

@@ -166,7 +166,7 @@ SWITCH_DECLARE(switch_status_t) switch_b64_encode(unsigned char *in, switch_size
 }
 
 
-SWITCH_DECLARE(switch_status_t) switch_b64_decode(char *in, char *out, switch_size_t olen)
+SWITCH_DECLARE(switch_size_t) switch_b64_decode(char *in, char *out, switch_size_t olen)
 {
 
 	char l64[256];
@@ -203,7 +203,7 @@ SWITCH_DECLARE(switch_status_t) switch_b64_decode(char *in, char *out, switch_si
 
 	op[ol++] = '\0';
 
-	return SWITCH_STATUS_SUCCESS;
+	return ol;
 }