Skip to content

Commit b2932b3

Browse files
pabuhlerpabuhler
committed
Merge remote-tracking branch 'origin/main' into pr/mildsunrise/612
2 parents 0bc8b9b + dac9ee2 commit b2932b3

20 files changed

+183
-75
lines changed

‎.github/workflows/android.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Android CI
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
9+
jobs:
10+
build:
11+
strategy:
12+
fail-fast: false
13+
14+
runs-on: ubuntu-20.04
15+
16+
steps:
17+
18+
- uses: actions/checkout@v2
19+
20+
- name: Create Build Environment
21+
run: cmake -E make_directory ${{github.workspace}}/build
22+
23+
- name: Configure CMake
24+
working-directory: ${{github.workspace}}/build
25+
shell: bash
26+
run: cmake $GITHUB_WORKSPACE -DCMAKE_TOOLCHAIN_FILE=$ANDROID_NDK/build/cmake/android.toolchain.cmake -DANDROID_ABI=arm64-v8a
27+
28+
- name: Build
29+
working-directory: ${{github.workspace}}/build
30+
shell: bash
31+
run: cmake --build .
32+
33+
- name: Create Build Environment (Shared Library)
34+
run: cmake -E make_directory ${{github.workspace}}/build_shared
35+
36+
- name: Configure CMake (Shared Library)
37+
working-directory: ${{github.workspace}}/build_shared
38+
shell: bash
39+
run: cmake $GITHUB_WORKSPACE -DBUILD_SHARED_LIBS=ON -DCMAKE_TOOLCHAIN_FILE=$ANDROID_NDK/build/cmake/android.toolchain.cmake -DANDROID_ABI=arm64-v8a
40+
41+
- name: Build (Shared Library)
42+
working-directory: ${{github.workspace}}/build_shared
43+
shell: bash
44+
run: cmake --build .

‎.github/workflows/autotools.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
strategy:
1212
fail-fast: false
1313
matrix:
14-
os: [ubuntu-latest, macos-latest]
14+
os: [ubuntu-20.04, macos-latest]
1515
crypto: [internal, openssl, nss]
1616
include:
1717
- crypto: internal
@@ -25,11 +25,11 @@ jobs:
2525

2626
steps:
2727
- name: Setup Ubuntu
28-
if: matrix.os == 'ubuntu-latest'
28+
if: matrix.os == 'ubuntu-20.04'
2929
run: sudo apt-get install valgrind
3030

3131
- name: Setup Ubuntu NSS
32-
if: matrix.os == 'ubuntu-latest' && matrix.crypto == 'nss'
32+
if: matrix.os == 'ubuntu-20.04' && matrix.crypto == 'nss'
3333
run: |
3434
sudo apt-get update
3535
sudo apt-get install libnss3-dev
@@ -54,5 +54,5 @@ jobs:
5454
run: make runtest
5555

5656
- name: Test Valgrind
57-
if: matrix.os == 'ubuntu-latest'
57+
if: matrix.os == 'ubuntu-20.04'
5858
run: make runtest-valgrind

‎.github/workflows/cifuzz.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: CIFuzz
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
9+
jobs:
10+
Fuzzing:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Build Fuzzers
14+
id: build
15+
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
16+
with:
17+
oss-fuzz-project-name: 'libsrtp'
18+
language: c++
19+
- name: Run Fuzzers
20+
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
21+
with:
22+
oss-fuzz-project-name: 'libsrtp'
23+
fuzz-seconds: 300
24+
language: c++
25+
- name: Upload Crash
26+
uses: actions/upload-artifact@v3
27+
if: failure() && steps.build.outcome == 'success'
28+
with:
29+
name: artifacts
30+
path: ./out/artifacts

‎.github/workflows/cmake.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
strategy:
1212
fail-fast: false
1313
matrix:
14-
os: [ubuntu-latest, macos-latest, windows-latest]
14+
os: [ubuntu-20.04, macos-latest, windows-latest]
1515
crypto: [internal, openssl, nss, mbedtls]
1616
exclude:
1717
- os: windows-latest
@@ -37,13 +37,13 @@ jobs:
3737

3838
steps:
3939
- name: Setup Ubuntu NSS
40-
if: matrix.os == 'ubuntu-latest' && matrix.crypto == 'nss'
40+
if: matrix.os == 'ubuntu-20.04' && matrix.crypto == 'nss'
4141
run: |
4242
sudo apt-get update
4343
sudo apt-get install libnss3-dev
4444
4545
- name: Setup Ubuntu MbedTLS
46-
if: matrix.os == 'ubuntu-latest' && matrix.crypto == 'mbedtls'
46+
if: matrix.os == 'ubuntu-20.04' && matrix.crypto == 'mbedtls'
4747
run: sudo apt-get install libmbedtls-dev
4848

4949
- name: Setup macOS OpenSSL

‎.github/workflows/coverity_scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66

77
jobs:
88
coverity:
9-
runs-on: ubuntu-latest
9+
runs-on: ubuntu-20.04
1010
steps:
1111
- uses: actions/checkout@v2
1212

‎.github/workflows/format_check.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ on:
88

99
jobs:
1010
format-check:
11-
runs-on: ubuntu-latest
11+
runs-on: ubuntu-20.04
1212
steps:
1313
- uses: actions/checkout@v2
1414
- name: Install Clang Format
15-
run: sudo apt install clang-format-10
15+
run: sudo apt install clang-format-12
1616
- name: Run clang format
1717
run: ./format.sh -d

‎.github/workflows/fuzzer_build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ on:
1010

1111
jobs:
1212
fuzz:
13-
runs-on: ubuntu-latest
13+
runs-on: ubuntu-20.04
1414
steps:
1515
- uses: actions/checkout@v2
1616

‎CMakeLists.txt‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,10 +120,12 @@ endif()
120120

121121
if(BUILD_WITH_WARNINGS)
122122
if(CMAKE_C_COMPILER_ID MATCHES "Clang" OR CMAKE_C_COMPILER_ID MATCHES "GNU")
123-
add_compile_options(-Wall -pedantic -Wextra -Werror)
123+
set(WARNINGS -Wall -pedantic -Wextra -Werror)
124124
elseif(MSVC)
125-
add_compile_options(/W4 /WX)
125+
set(WARNINGS /W4 /WX)
126126
endif()
127+
message(STATUS "Using warnings: ${WARNINGS}")
128+
add_compile_options(${WARNINGS})
127129
endif()
128130

129131
set(SOURCES_C
@@ -248,6 +250,7 @@ add_library(srtp2
248250
${REPLAY_SOURCES_C}
249251
${SOURCES_H}
250252
)
253+
add_library(libSRTP::srtp2 ALIAS srtp2)
251254

252255
set_target_properties(srtp2 PROPERTIES VERSION ${CMAKE_PROJECT_VERSION})
253256

‎README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,11 +220,21 @@ will want to read the Security Considerations section of [RFC 3711](https://tool
220220
In addition, it is important that you read and understand the
221221
terms outlined in the [License and Disclaimer](#license-and-disclaimer) section.
222222

223+
This library also supports the AES-GCM Authenticated Encryption methods
224+
described in [RFC 7714](https://tools.ietf.org/html/rfc7714)
225+
223226
--------------------------------------------------------------------------------
224227

225228
<a name="implementation-notes"></a>
226229
## Implementation Notes
227230

231+
* It is possible to configure which 3rd party (ie openssl/nss/etc) crypto backend
232+
libSRTP will be built with. If no 3rd party backend is set then libSRTP provides
233+
an internal implementation of AES and Sha1. The internal implementation only
234+
supports AES-128 & AES-256, so to use AES-192 or the AES-GCM group of ciphers a
235+
3rd party crypto backend must be configured. For this and performance reasons it
236+
is highly recommended to use a 3rd party crypto backend.
237+
228238
* The `srtp_protect()` function assumes that the buffer holding the
229239
rtp packet has enough storage allocated that the authentication
230240
tag can be written to the end of that packet. If this assumption

‎crypto/cipher/cipher.c‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -632,24 +632,47 @@ uint64_t srtp_cipher_bits_per_second(srtp_cipher_t *c,
632632
clock_t timer;
633633
unsigned char *enc_buf;
634634
unsigned int len = octets_in_buffer;
635+
uint32_t tag_len = SRTP_MAX_TAG_LEN;
636+
unsigned char aad[4] = { 0, 0, 0, 0 };
637+
uint32_t aad_len = 4;
635638

636-
enc_buf = (unsigned char *)srtp_crypto_alloc(octets_in_buffer);
639+
enc_buf = (unsigned char *)srtp_crypto_alloc(octets_in_buffer + tag_len);
637640
if (enc_buf == NULL) {
638641
return 0; /* indicate bad parameters by returning null */
639642
}
640643
/* time repeated trials */
641644
v128_set_to_zero(&nonce);
642645
timer = clock();
643646
for (i = 0; i < num_trials; i++, nonce.v32[3] = i) {
647+
// Set IV
644648
if (srtp_cipher_set_iv(c, (uint8_t *)&nonce, srtp_direction_encrypt) !=
645649
srtp_err_status_ok) {
646650
srtp_crypto_free(enc_buf);
647651
return 0;
648652
}
653+
654+
// Set (empty) AAD if supported by the cipher
655+
if (c->type->set_aad) {
656+
if (srtp_cipher_set_aad(c, aad, aad_len) != srtp_err_status_ok) {
657+
srtp_crypto_free(enc_buf);
658+
return 0;
659+
}
660+
}
661+
662+
// Encrypt the buffer
649663
if (srtp_cipher_encrypt(c, enc_buf, &len) != srtp_err_status_ok) {
650664
srtp_crypto_free(enc_buf);
651665
return 0;
652666
}
667+
668+
// Get tag if supported by the cipher
669+
if (c->type->get_tag) {
670+
if (srtp_cipher_get_tag(c, (uint8_t *)(enc_buf + len), &tag_len) !=
671+
srtp_err_status_ok) {
672+
srtp_crypto_free(enc_buf);
673+
return 0;
674+
}
675+
}
653676
}
654677
timer = clock() - timer;
655678

0 commit comments

Comments
 (0)