kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-03 03:20:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

rtp: Enable srtp replay protection

Browse Source 
Add option "srtpreplayprotection" rtp.conf to enable srtp
replay protection.

ASTERISK-29260
Reported by: Alexander Traud

Change-Id: I5cd346e3c6b6812039d1901aa4b7be688173b458
This commit is contained in:
Alexander Traud
2021-01-26 10:09:53 -07:00
committed by George Joseph
parent 7d15655f9d
commit 389b8b0774
5 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
res/res_rtp_asterisk.c
View File

@@ -181,6 +181,7 @@ enum strict_rtp_mode {
#define STRICT_RTP_LEARN_TIMEOUT 5000
#define DEFAULT_STRICT_RTP STRICT_RTP_YES /*!< Enabled by default */
#define DEFAULT_SRTP_REPLAY_PROTECTION 1
#define DEFAULT_ICESUPPORT 1
#define DEFAULT_DTLS_MTU 1200
@@ -203,6 +204,7 @@ static int nochecksums;
static int strictrtp = DEFAULT_STRICT_RTP; /*!< Only accept RTP frames from a defined source. If we receive an indication of a changing source, enter learning mode. */
static int learning_min_sequential = DEFAULT_LEARNING_MIN_SEQUENTIAL; /*!< Number of sequential RTP frames needed from a single source during learning mode to accept new source. */
static int learning_min_duration = DEFAULT_LEARNING_MIN_DURATION; /*!< Lowest acceptable timeout between the first and the last sequential RTP frame. */
static int srtp_replay_protection = DEFAULT_SRTP_REPLAY_PROTECTION;
#if defined(HAVE_OPENSSL) && (OPENSSL_VERSION_NUMBER >= 0x10001000L) && !defined(OPENSSL_NO_SRTP)
static int dtls_mtu = DEFAULT_DTLS_MTU;
#endif
@@ -6082,7 +6084,7 @@ static struct ast_frame *ast_rtcp_interpret(struct ast_rtp_instance *instance, s
/* If this is encrypted then decrypt the payload */
if ((*rtcpheader & 0xC0) && res_srtp && srtp && res_srtp->unprotect(
srtp, rtcpheader, &len, 1) < 0) {
srtp, rtcpheader, &len, 1 | (srtp_replay_protection << 1)) < 0) {
return &ast_null_frame;
}
@@ -7170,7 +7172,7 @@ static struct ast_frame *ast_rtp_interpret(struct ast_rtp_instance *instance, st
/* If this payload is encrypted then decrypt it using the given SRTP instance */
if ((*read_area & 0xC0) && res_srtp && srtp && res_srtp->unprotect(
srtp, read_area, &res, 0) < 0) {
srtp, read_area, &res, 0 | (srtp_replay_protection << 1)) < 0) {
return &ast_null_frame;
}
@@ -8958,6 +8960,8 @@ static char *handle_cli_rtp_settings(struct ast_cli_entry *e, int cmd, struct as
if (strictrtp) {
ast_cli(a->fd, " Probation: %d frames\n", learning_min_sequential);
}
ast_cli(a->fd, " Replay Protect: %s\n", AST_CLI_YESNO(srtp_replay_protection));
#ifdef HAVE_PJPROJECT
ast_cli(a->fd, " ICE support: %s\n", AST_CLI_YESNO(icesupport));
#endif
@@ -9060,6 +9064,7 @@ static int rtp_reload(int reload, int by_external_config)
strictrtp = DEFAULT_STRICT_RTP;
learning_min_sequential = DEFAULT_LEARNING_MIN_SEQUENTIAL;
learning_min_duration = DEFAULT_LEARNING_MIN_DURATION;
srtp_replay_protection = DEFAULT_SRTP_REPLAY_PROTECTION;
/** This resource is not "reloaded" so much as unloaded and loaded again.
* In the case of the TURN related variables, the memory referenced by a
@@ -9139,6 +9144,9 @@ static int rtp_reload(int reload, int by_external_config)
}
learning_min_duration = CALC_LEARNING_MIN_DURATION(learning_min_sequential);
}
if ((s = ast_variable_retrieve(cfg, "general", "srtpreplayprotection"))) {
srtp_replay_protection = ast_true(s);
}
#ifdef HAVE_PJPROJECT
if ((s = ast_variable_retrieve(cfg, "general", "icesupport"))) {
icesupport = ast_true(s);