OLD | NEW |
---|---|
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <assert.h> | 5 #include <assert.h> |
6 #include <netinet/in.h> | |
mmoroz
2016/10/21 09:40:41
Is it needed?
mattdr-at-chromium
2016/10/21 16:25:48
Hm. No, it doesn't seem like this is needed and I
| |
6 #include <stddef.h> | 7 #include <stddef.h> |
7 #include <stdint.h> | 8 #include <stdint.h> |
8 | 9 |
9 #include <algorithm> | 10 #include <algorithm> |
10 #include <vector> | 11 #include <vector> |
11 | 12 |
12 #include "third_party/libsrtp/srtp/include/rtp.h" | 13 #include "third_party/libsrtp/include/rtp.h" |
13 #include "third_party/libsrtp/srtp/include/rtp_priv.h" | 14 #include "third_party/libsrtp/include/rtp_priv.h" |
14 #include "third_party/libsrtp/srtp/include/srtp.h" | 15 #include "third_party/libsrtp/include/srtp.h" |
15 | 16 |
16 // TODO(katrielc) Also test the authenticated path, which is what | 17 // TODO(katrielc) Also test the authenticated path, which is what |
17 // WebRTC uses. This is nontrivial because you need to bypass the MAC | 18 // WebRTC uses. This is nontrivial because you need to bypass the MAC |
18 // check. Two options: add a UNSAFE_FUZZER_MODE flag to libsrtp (or | 19 // check. Two options: add a UNSAFE_FUZZER_MODE flag to libsrtp (or |
19 // the chromium fork of it), or compute the HMAC of whatever gibberish | 20 // the chromium fork of it), or compute the HMAC of whatever gibberish |
20 // the fuzzer produces and write it into the packet manually. | 21 // the fuzzer produces and write it into the packet manually. |
21 | 22 |
22 namespace LibSrtpFuzzer { | 23 namespace LibSrtpFuzzer { |
23 enum CryptoPolicy { | 24 enum CryptoPolicy { |
24 NONE, | 25 NONE, |
25 LIKE_WEBRTC, | 26 LIKE_WEBRTC, |
26 LIKE_WEBRTC_WITHOUT_AUTH, | 27 LIKE_WEBRTC_WITHOUT_AUTH, |
27 AES_GCM, | 28 AES_GCM, |
28 NUMBER_OF_POLICIES, | 29 NUMBER_OF_POLICIES, |
29 }; | 30 }; |
30 } | 31 } |
31 | 32 |
32 struct Environment { | 33 struct Environment { |
33 srtp_policy_t GetCryptoPolicy(LibSrtpFuzzer::CryptoPolicy crypto_policy, | 34 srtp_policy_t GetCryptoPolicy(LibSrtpFuzzer::CryptoPolicy crypto_policy, |
34 const unsigned char* replacement_key) { | 35 const unsigned char* replacement_key) { |
35 switch (crypto_policy) { | 36 switch (crypto_policy) { |
36 case LibSrtpFuzzer::NUMBER_OF_POLICIES: | 37 case LibSrtpFuzzer::NUMBER_OF_POLICIES: |
37 case LibSrtpFuzzer::NONE: | 38 case LibSrtpFuzzer::NONE: |
38 crypto_policy_set_null_cipher_null_auth(&policy.rtp); | 39 srtp_crypto_policy_set_null_cipher_null_auth(&policy.rtp); |
39 crypto_policy_set_null_cipher_null_auth(&policy.rtcp); | 40 srtp_crypto_policy_set_null_cipher_null_auth(&policy.rtcp); |
40 break; | 41 break; |
41 case LibSrtpFuzzer::LIKE_WEBRTC: | 42 case LibSrtpFuzzer::LIKE_WEBRTC: |
42 crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtp); | 43 srtp_crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtp); |
43 crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtcp); | 44 srtp_crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtcp); |
44 break; | 45 break; |
45 case LibSrtpFuzzer::LIKE_WEBRTC_WITHOUT_AUTH: | 46 case LibSrtpFuzzer::LIKE_WEBRTC_WITHOUT_AUTH: |
46 crypto_policy_set_aes_cm_128_null_auth(&policy.rtp); | 47 srtp_crypto_policy_set_aes_cm_128_null_auth(&policy.rtp); |
47 crypto_policy_set_aes_cm_128_null_auth(&policy.rtcp); | 48 srtp_crypto_policy_set_aes_cm_128_null_auth(&policy.rtcp); |
48 break; | 49 break; |
49 case LibSrtpFuzzer::AES_GCM: | 50 case LibSrtpFuzzer::AES_GCM: |
50 // There was a security bug in the GCM mode in libsrtp 1.5.2. | 51 // There was a security bug in the GCM mode in libsrtp 1.5.2. |
51 crypto_policy_set_aes_gcm_128_8_auth(&policy.rtp); | 52 srtp_crypto_policy_set_aes_gcm_128_8_auth(&policy.rtp); |
52 crypto_policy_set_aes_gcm_128_8_auth(&policy.rtcp); | 53 srtp_crypto_policy_set_aes_gcm_128_8_auth(&policy.rtcp); |
53 break; | 54 break; |
54 } | 55 } |
55 | 56 |
56 memcpy(key, replacement_key, SRTP_MASTER_KEY_LEN); | 57 memcpy(key, replacement_key, SRTP_MASTER_KEY_LEN); |
57 return policy; | 58 return policy; |
58 }; | 59 }; |
59 | 60 |
60 Environment() { | 61 Environment() { |
61 srtp_init(); | 62 srtp_init(); |
62 | 63 |
63 memset(&policy, 0, sizeof(policy)); | 64 memset(&policy, 0, sizeof(policy)); |
64 policy.allow_repeat_tx = 1; | 65 policy.allow_repeat_tx = 1; |
65 policy.ekt = nullptr; | 66 policy.ekt = nullptr; |
66 policy.key = key; | 67 policy.key = key; |
67 policy.next = nullptr; | 68 policy.next = nullptr; |
68 policy.ssrc.type = ssrc_any_inbound; | 69 policy.ssrc.type = ssrc_any_inbound; |
69 policy.ssrc.value = 0xdeadbeef; | 70 policy.ssrc.value = 0xdeadbeef; |
70 policy.window_size = 1024; | 71 policy.window_size = 1024; |
71 } | 72 } |
72 | 73 |
73 private: | 74 private: |
74 srtp_policy_t policy; | 75 srtp_policy_t policy; |
75 unsigned char key[SRTP_MASTER_KEY_LEN] = {0}; | 76 unsigned char key[SRTP_MASTER_KEY_LEN] = {0}; |
76 | 77 |
77 static void crypto_policy_set_null_cipher_null_auth(crypto_policy_t* p) { | 78 static void srtp_crypto_policy_set_null_cipher_null_auth( |
78 p->cipher_type = NULL_CIPHER; | 79 srtp_crypto_policy_t* p) { |
80 p->cipher_type = SRTP_NULL_CIPHER; | |
79 p->cipher_key_len = 0; | 81 p->cipher_key_len = 0; |
80 p->auth_type = NULL_AUTH; | 82 p->auth_type = SRTP_NULL_AUTH; |
81 p->auth_key_len = 0; | 83 p->auth_key_len = 0; |
82 p->auth_tag_len = 0; | 84 p->auth_tag_len = 0; |
83 p->sec_serv = sec_serv_none; | 85 p->sec_serv = sec_serv_none; |
84 }; | 86 }; |
85 }; | 87 }; |
86 | 88 |
87 size_t ReadLength(const uint8_t* data, size_t size) { | 89 size_t ReadLength(const uint8_t* data, size_t size) { |
88 // Read one byte of input and interpret it as a length to read from | 90 // Read one byte of input and interpret it as a length to read from |
89 // data. Don't return more bytes than are available. | 91 // data. Don't return more bytes than are available. |
90 size_t n = static_cast<size_t>(data[0]); | 92 size_t n = static_cast<size_t>(data[0]); |
(...skipping 12 matching lines...) Expand all Loading... | |
103 size -= 1; | 105 size -= 1; |
104 | 106 |
105 // Read some more bytes to use as a key. | 107 // Read some more bytes to use as a key. |
106 if (size <= SRTP_MASTER_KEY_LEN) | 108 if (size <= SRTP_MASTER_KEY_LEN) |
107 return 0; | 109 return 0; |
108 srtp_policy_t srtp_policy = env->GetCryptoPolicy(policy, data); | 110 srtp_policy_t srtp_policy = env->GetCryptoPolicy(policy, data); |
109 data += SRTP_MASTER_KEY_LEN; | 111 data += SRTP_MASTER_KEY_LEN; |
110 size -= SRTP_MASTER_KEY_LEN; | 112 size -= SRTP_MASTER_KEY_LEN; |
111 | 113 |
112 srtp_t session; | 114 srtp_t session; |
113 err_status_t error = srtp_create(&session, &srtp_policy); | 115 srtp_err_status_t error = srtp_create(&session, &srtp_policy); |
114 if (error != err_status_ok) { | 116 if (error != srtp_err_status_ok) { |
115 assert(false); | 117 assert(false); |
116 return 0; | 118 return 0; |
117 } | 119 } |
118 | 120 |
119 // Read one byte as a packet length N, then feed the next N bytes | 121 // Read one byte as a packet length N, then feed the next N bytes |
120 // into srtp_unprotect. Keep going until we run out of data. | 122 // into srtp_unprotect. Keep going until we run out of data. |
121 size_t packet_size; | 123 size_t packet_size; |
122 while (size > 0 && (packet_size = ReadLength(data, size)) > 0) { | 124 while (size > 0 && (packet_size = ReadLength(data, size)) > 0) { |
123 // One byte was used by ReadLength. | 125 // One byte was used by ReadLength. |
124 data++; | 126 data++; |
(...skipping 12 matching lines...) Expand all Loading... | |
137 srtp_unprotect(session, &message, &out_len); | 139 srtp_unprotect(session, &message, &out_len); |
138 | 140 |
139 // |packet_size| bytes were used above. | 141 // |packet_size| bytes were used above. |
140 data += packet_size; | 142 data += packet_size; |
141 size -= packet_size; | 143 size -= packet_size; |
142 } | 144 } |
143 | 145 |
144 srtp_dealloc(session); | 146 srtp_dealloc(session); |
145 return 0; | 147 return 0; |
146 } | 148 } |
OLD | NEW |