- {
- return s->srtp_profile;
- }
-
-/* Note: this function returns 0 length if there are no
- profiles specified */
-int ssl_add_clienthello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen)
- {
- int ct=0;
- int i;
- STACK_OF(SRTP_PROTECTION_PROFILE) *clnt=0;
- SRTP_PROTECTION_PROFILE *prof;
-
- clnt=SSL_get_srtp_profiles(s);
- ct=sk_SRTP_PROTECTION_PROFILE_num(clnt); /* -1 if clnt == 0 */
-
- if(p)
- {
- if(ct==0)
- {
- SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT,SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST);
- return 1;
- }
-
- if((2 + ct*2 + 1) > maxlen)
- {
- SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT,SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
- return 1;
- }
-
- /* Add the length */
- s2n(ct * 2, p);
- for(i=0;i<ct;i++)
- {
- prof=sk_SRTP_PROTECTION_PROFILE_value(clnt,i);
- s2n(prof->id,p);
- }
-
- /* Add an empty use_mki value */
- *p++ = 0;
- }
-
- *len=2 + ct*2 + 1;
-
- return 0;
- }
-
-
-int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al)
- {
- SRTP_PROTECTION_PROFILE *cprof,*sprof;
- STACK_OF(SRTP_PROTECTION_PROFILE) *clnt=0,*srvr;
- int ct;
- int mki_len;
- int i,j;
- int id;
- int ret;
-
- /* Length value + the MKI length */
- if(len < 3)
- {
- SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
- *al=SSL_AD_DECODE_ERROR;
- return 1;
- }
-
- /* Pull off the length of the cipher suite list */
- n2s(d, ct);
- len -= 2;
-
- /* Check that it is even */
- if(ct%2)
- {
- SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
- *al=SSL_AD_DECODE_ERROR;
- return 1;
- }
-
- /* Check that lengths are consistent */
- if(len < (ct + 1))
- {
- SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
- *al=SSL_AD_DECODE_ERROR;
- return 1;
- }
-
-
- clnt=sk_SRTP_PROTECTION_PROFILE_new_null();
-
- while(ct)
- {
- n2s(d,id);
- ct-=2;
- len-=2;
-
- if(!find_profile_by_num(id,&cprof))
- {
- sk_SRTP_PROTECTION_PROFILE_push(clnt,cprof);
- }
- else
- {
- ; /* Ignore */
- }
- }
-
- /* Now extract the MKI value as a sanity check, but discard it for now */
- mki_len = *d;
- d++; len--;
-
- if (mki_len != len)
- {
- SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_MKI_VALUE);
- *al=SSL_AD_DECODE_ERROR;
- return 1;
- }
-
- srvr=SSL_get_srtp_profiles(s);
-
- /* Pick our most preferred profile. If no profiles have been
- configured then the outer loop doesn't run
- (sk_SRTP_PROTECTION_PROFILE_num() = -1)
- and so we just return without doing anything */
- for(i=0;i<sk_SRTP_PROTECTION_PROFILE_num(srvr);i++)
- {
- sprof=sk_SRTP_PROTECTION_PROFILE_value(srvr,i);
-
- for(j=0;j<sk_SRTP_PROTECTION_PROFILE_num(clnt);j++)
- {
- cprof=sk_SRTP_PROTECTION_PROFILE_value(clnt,j);
-
- if(cprof->id==sprof->id)
- {
- s->srtp_profile=sprof;
- *al=0;
- ret=0;
- goto done;
- }
- }
- }
-
- ret=0;
-
-done:
- if(clnt) sk_SRTP_PROTECTION_PROFILE_free(clnt);
-
- return ret;
- }
-
-int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen)
- {
- if(p)
- {
- if(maxlen < 3)
- {
- SSLerr(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT,SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
- return 1;
- }
-
- if(s->srtp_profile==0)
- {
- SSLerr(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT,SSL_R_USE_SRTP_NOT_NEGOTIATED);
- return 1;
- }
-
- s2n(s->srtp_profile->id,p);
- *p++ = 0;
- }
- *len=3;
-
- return 0;
- }
-
-
-int ssl_parse_serverhello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al)
- {
- unsigned id;
- int i;
- STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
- SRTP_PROTECTION_PROFILE *prof;
-
- if(len!=3)
- {
- SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
- *al=SSL_AD_DECODE_ERROR;
- return 1;
- }
-
- n2s(d,id);
- if (*d) /* Must be no MKI, since we never offer one */
- {
- SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_MKI_VALUE);
- *al=SSL_AD_ILLEGAL_PARAMETER;
- return 1;
- }
-
- clnt=SSL_get_srtp_profiles(s);
-
- /* Throw an error if the server gave us an unsolicited extension */
- if (clnt == NULL)
- {
- SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,SSL_R_NO_SRTP_PROFILES);
- *al=SSL_AD_DECODE_ERROR;
- return 1;
- }
-
- /* Check to see if the server gave us something we support
- (and presumably offered)
- */
- for(i=0;i<sk_SRTP_PROTECTION_PROFILE_num(clnt);i++)
- {
- prof=sk_SRTP_PROTECTION_PROFILE_value(clnt,i);
-
- if(prof->id == id)
- {
- s->srtp_profile=prof;
- *al=0;
- return 0;
- }
- }
-
- SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
- *al=SSL_AD_DECODE_ERROR;
- return 1;
- }
-
-