diff options
Diffstat (limited to 'third_party/libsrtp/src/crypto/replay')
| -rw-r--r-- | third_party/libsrtp/src/crypto/replay/rdb.c | 139 | ||||
| -rw-r--r-- | third_party/libsrtp/src/crypto/replay/rdbx.c | 386 |
2 files changed, 525 insertions, 0 deletions
diff --git a/third_party/libsrtp/src/crypto/replay/rdb.c b/third_party/libsrtp/src/crypto/replay/rdb.c new file mode 100644 index 0000000000..d8c2b3838e --- /dev/null +++ b/third_party/libsrtp/src/crypto/replay/rdb.c @@ -0,0 +1,139 @@ +/* + * rdb.c + * + * Implements a replay database for packet security + * + * David A. McGrew + * Cisco Systems, Inc. + */ + +/* + * + * Copyright (c) 2001-2017, Cisco Systems, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials provided + * with the distribution. + * + * Neither the name of the Cisco Systems, Inc. nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include "rdb.h" + +#define rdb_bits_in_bitmask (8 * sizeof(v128_t)) + +/* + * this implementation of a replay database works as follows: + * + * window_start is the index of the first packet in the window + * bitmask a bit-buffer, containing the most recently entered + * index as the leftmost bit + * + */ + +/* srtp_rdb_init initalizes rdb */ +srtp_err_status_t srtp_rdb_init(srtp_rdb_t *rdb) +{ + v128_set_to_zero(&rdb->bitmask); + rdb->window_start = 0; + return srtp_err_status_ok; +} + +/* + * srtp_rdb_check checks to see if index appears in rdb + */ +srtp_err_status_t srtp_rdb_check(const srtp_rdb_t *rdb, uint32_t p_index) +{ + /* if the index appears after (or at very end of) the window, its good */ + if (p_index >= rdb->window_start + rdb_bits_in_bitmask) { + return srtp_err_status_ok; + } + + /* if the index appears before the window, its bad */ + if (p_index < rdb->window_start) { + return srtp_err_status_replay_old; + } + + /* otherwise, the index appears within the window, so check the bitmask */ + if (v128_get_bit(&rdb->bitmask, (p_index - rdb->window_start)) == 1) { + return srtp_err_status_replay_fail; + } + + /* otherwise, the index is okay */ + return srtp_err_status_ok; +} + +/* + * srtp_rdb_add_index adds index to srtp_rdb_t (and does *not* check if + * index appears in db) + * + * this function should be called only after srtp_rdb_check has + * indicated that the index does not appear in the rdb, e.g., a mutex + * should protect the rdb between these calls + */ +srtp_err_status_t srtp_rdb_add_index(srtp_rdb_t *rdb, uint32_t p_index) +{ + unsigned int delta; + + if (p_index < rdb->window_start) + return srtp_err_status_replay_fail; + + delta = (p_index - rdb->window_start); + if (delta < rdb_bits_in_bitmask) { + /* if the p_index is within the window, set the appropriate bit */ + v128_set_bit(&rdb->bitmask, delta); + + } else { + delta -= rdb_bits_in_bitmask - 1; + + /* shift the window forward by delta bits*/ + v128_left_shift(&rdb->bitmask, delta); + v128_set_bit(&rdb->bitmask, rdb_bits_in_bitmask - 1); + rdb->window_start += delta; + } + + return srtp_err_status_ok; +} + +srtp_err_status_t srtp_rdb_increment(srtp_rdb_t *rdb) +{ + if (rdb->window_start >= 0x7fffffff) { + return srtp_err_status_key_expired; + } + ++rdb->window_start; + return srtp_err_status_ok; +} + +uint32_t srtp_rdb_get_value(const srtp_rdb_t *rdb) +{ + return rdb->window_start; +} diff --git a/third_party/libsrtp/src/crypto/replay/rdbx.c b/third_party/libsrtp/src/crypto/replay/rdbx.c new file mode 100644 index 0000000000..40cba01a1f --- /dev/null +++ b/third_party/libsrtp/src/crypto/replay/rdbx.c @@ -0,0 +1,386 @@ +/* + * rdbx.c + * + * a replay database with extended range, using a rollover counter + * + * David A. McGrew + * Cisco Systems, Inc. + */ + +/* + * + * Copyright (c) 2001-2017, Cisco Systems, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials provided + * with the distribution. + * + * Neither the name of the Cisco Systems, Inc. nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include "rdbx.h" + +/* + * from RFC 3711: + * + * A receiver reconstructs the index i of a packet with sequence + * number SEQ using the estimate + * + * i = 2^16 * v + SEQ, + * + * where v is chosen from the set { ROC-1, ROC, ROC+1 } such that i is + * closest to the value 2^16 * ROC + s_l. If the value r+1 is used, + * then the rollover counter r in the cryptographic context is + * incremented by one (if the packet containing s is authentic). + */ + +/* + * rdbx implementation notes + * + * A srtp_xtd_seq_num_t is essentially a sequence number for which some of + * the data on the wire are implicit. It logically consists of a + * rollover counter and a sequence number; the sequence number is the + * explicit part, and the rollover counter is the implicit part. + * + * Upon receiving a sequence_number (e.g. in a newly received SRTP + * packet), the complete srtp_xtd_seq_num_t can be estimated by using a + * local srtp_xtd_seq_num_t as a basis. This is done using the function + * srtp_index_guess(&local, &guess, seq_from_packet). This function + * returns the difference of the guess and the local value. The local + * srtp_xtd_seq_num_t can be moved forward to the guess using the function + * srtp_index_advance(&guess, delta), where delta is the difference. + * + * + * A srtp_rdbx_t consists of a srtp_xtd_seq_num_t and a bitmask. The index is + * highest sequence number that has been received, and the bitmask indicates + * which of the recent indicies have been received as well. The + * highest bit in the bitmask corresponds to the index in the bitmask. + */ + +void srtp_index_init(srtp_xtd_seq_num_t *pi) +{ +#ifdef NO_64BIT_MATH + *pi = make64(0, 0); +#else + *pi = 0; +#endif +} + +void srtp_index_advance(srtp_xtd_seq_num_t *pi, srtp_sequence_number_t s) +{ +#ifdef NO_64BIT_MATH + /* a > ~b means a+b will generate a carry */ + /* s is uint16 here */ + *pi = make64(high32(*pi) + (s > ~low32(*pi) ? 1 : 0), low32(*pi) + s); +#else + *pi += s; +#endif +} + +/* + * srtp_index_guess(local, guess, s) + * + * given a srtp_xtd_seq_num_t local (which represents the last + * known-to-be-good received srtp_xtd_seq_num_t) and a sequence number s + * (from a newly arrived packet), sets the contents of *guess to + * contain the best guess of the packet index to which s corresponds, + * and returns the difference between *guess and *local + * + * nota bene - the output is a signed integer, DON'T cast it to a + * unsigned integer! + */ + +int32_t srtp_index_guess(const srtp_xtd_seq_num_t *local, + srtp_xtd_seq_num_t *guess, + srtp_sequence_number_t s) +{ +#ifdef NO_64BIT_MATH + uint32_t local_roc = ((high32(*local) << 16) | (low32(*local) >> 16)); + uint16_t local_seq = (uint16_t)(low32(*local)); +#else + uint32_t local_roc = (uint32_t)(*local >> 16); + uint16_t local_seq = (uint16_t)*local; +#endif + uint32_t guess_roc; + uint16_t guess_seq; + int32_t difference; + + if (local_seq < seq_num_median) { + if (s - local_seq > seq_num_median) { + guess_roc = local_roc - 1; + difference = s - local_seq - seq_num_max; + } else { + guess_roc = local_roc; + difference = s - local_seq; + } + } else { + if (local_seq - seq_num_median > s) { + guess_roc = local_roc + 1; + difference = s - local_seq + seq_num_max; + } else { + guess_roc = local_roc; + difference = s - local_seq; + } + } + guess_seq = s; + +/* Note: guess_roc is 32 bits, so this generates a 48-bit result! */ +#ifdef NO_64BIT_MATH + *guess = make64(guess_roc >> 16, (guess_roc << 16) | guess_seq); +#else + *guess = (((uint64_t)guess_roc) << 16) | guess_seq; +#endif + + return difference; +} + +/* + * rdbx + * + */ + +/* + * srtp_rdbx_init(&r, ws) initializes the srtp_rdbx_t pointed to by r with + * window size ws + */ +srtp_err_status_t srtp_rdbx_init(srtp_rdbx_t *rdbx, unsigned long ws) +{ + if (ws == 0) { + return srtp_err_status_bad_param; + } + + if (bitvector_alloc(&rdbx->bitmask, ws) != 0) { + return srtp_err_status_alloc_fail; + } + + srtp_index_init(&rdbx->index); + + return srtp_err_status_ok; +} + +/* + * srtp_rdbx_dealloc(&r) frees memory for the srtp_rdbx_t pointed to by r + */ +srtp_err_status_t srtp_rdbx_dealloc(srtp_rdbx_t *rdbx) +{ + bitvector_dealloc(&rdbx->bitmask); + + return srtp_err_status_ok; +} + +/* + * srtp_rdbx_set_roc(rdbx, roc) initalizes the srtp_rdbx_t at the location rdbx + * to have the rollover counter value roc. If that value is less than + * the current rollover counter value, then the function returns + * srtp_err_status_replay_old; otherwise, srtp_err_status_ok is returned. + * + */ +srtp_err_status_t srtp_rdbx_set_roc(srtp_rdbx_t *rdbx, uint32_t roc) +{ + bitvector_set_to_zero(&rdbx->bitmask); + +#ifdef NO_64BIT_MATH +#error not yet implemented +#else + + /* make sure that we're not moving backwards */ + if (roc < (rdbx->index >> 16)) { + return srtp_err_status_replay_old; + } + + rdbx->index &= 0xffff; /* retain lowest 16 bits */ + rdbx->index |= ((uint64_t)roc) << 16; /* set ROC */ +#endif + + return srtp_err_status_ok; +} + +/* + * srtp_rdbx_get_packet_index(rdbx) returns the value of the packet index + * for the srtp_rdbx_t pointed to by rdbx + * + */ +srtp_xtd_seq_num_t srtp_rdbx_get_packet_index(const srtp_rdbx_t *rdbx) +{ + return rdbx->index; +} + +/* + * srtp_rdbx_get_window_size(rdbx) returns the value of the window size + * for the srtp_rdbx_t pointed to by rdbx + * + */ +unsigned long srtp_rdbx_get_window_size(const srtp_rdbx_t *rdbx) +{ + return bitvector_get_length(&rdbx->bitmask); +} + +/* + * srtp_rdbx_check(&r, delta) checks to see if the srtp_xtd_seq_num_t + * which is at rdbx->index + delta is in the rdb + */ +srtp_err_status_t srtp_rdbx_check(const srtp_rdbx_t *rdbx, int delta) +{ + if (delta > 0) { /* if delta is positive, it's good */ + return srtp_err_status_ok; + } else if ((int)(bitvector_get_length(&rdbx->bitmask) - 1) + delta < 0) { + /* if delta is lower than the bitmask, it's bad */ + return srtp_err_status_replay_old; + } else if (bitvector_get_bit( + &rdbx->bitmask, + (int)(bitvector_get_length(&rdbx->bitmask) - 1) + delta) == + 1) { + /* delta is within the window, so check the bitmask */ + return srtp_err_status_replay_fail; + } + /* otherwise, the index is okay */ + + return srtp_err_status_ok; +} + +/* + * srtp_rdbx_add_index adds the srtp_xtd_seq_num_t at rdbx->window_start + d to + * replay_db (and does *not* check if that srtp_xtd_seq_num_t appears in db) + * + * this function should be called only after replay_check has + * indicated that the index does not appear in the rdbx, e.g., a mutex + * should protect the rdbx between these calls if need be + */ +srtp_err_status_t srtp_rdbx_add_index(srtp_rdbx_t *rdbx, int delta) +{ + if (delta > 0) { + /* shift forward by delta */ + srtp_index_advance(&rdbx->index, delta); + bitvector_left_shift(&rdbx->bitmask, delta); + bitvector_set_bit(&rdbx->bitmask, + bitvector_get_length(&rdbx->bitmask) - 1); + } else { + /* delta is in window */ + bitvector_set_bit(&rdbx->bitmask, + bitvector_get_length(&rdbx->bitmask) - 1 + delta); + } + + /* note that we need not consider the case that delta == 0 */ + + return srtp_err_status_ok; +} + +/* + * srtp_rdbx_estimate_index(rdbx, guess, s) + * + * given an rdbx and a sequence number s (from a newly arrived packet), + * sets the contents of *guess to contain the best guess of the packet + * index to which s corresponds, and returns the difference between + * *guess and the locally stored synch info + */ +int32_t srtp_rdbx_estimate_index(const srtp_rdbx_t *rdbx, + srtp_xtd_seq_num_t *guess, + srtp_sequence_number_t s) +{ +/* + * if the sequence number and rollover counter in the rdbx are + * non-zero, then use the srtp_index_guess(...) function, otherwise, just + * set the rollover counter to zero (since the srtp_index_guess(...) + * function might incorrectly guess that the rollover counter is + * 0xffffffff) + */ + +#ifdef NO_64BIT_MATH + /* seq_num_median = 0x8000 */ + if (high32(rdbx->index) > 0 || low32(rdbx->index) > seq_num_median) +#else + if (rdbx->index > seq_num_median) +#endif + { + return srtp_index_guess(&rdbx->index, guess, s); + } + +#ifdef NO_64BIT_MATH + *guess = make64(0, (uint32_t)s); +#else + *guess = s; +#endif + +#ifdef NO_64BIT_MATH + return s - (uint16_t)low32(rdbx->index); +#else + return s - (uint16_t)rdbx->index; +#endif +} + +/* + * srtp_rdbx_get_roc(rdbx) + * + * Get the current rollover counter + * + */ +uint32_t srtp_rdbx_get_roc(const srtp_rdbx_t *rdbx) +{ + uint32_t roc; + +#ifdef NO_64BIT_MATH + roc = ((high32(rdbx->index) << 16) | (low32(rdbx->index) >> 16)); +#else + roc = (uint32_t)(rdbx->index >> 16); +#endif + + return roc; +} + +/* + * srtp_rdbx_set_roc_seq(rdbx, roc, seq) initalizes the srtp_rdbx_t at the + * location rdbx to have the rollover counter value roc and packet sequence + * number seq. If the new rollover counter value is less than the current + * rollover counter value, then the function returns + * srtp_err_status_replay_old, otherwise, srtp_err_status_ok is returned. + */ +srtp_err_status_t srtp_rdbx_set_roc_seq(srtp_rdbx_t *rdbx, + uint32_t roc, + uint16_t seq) +{ +#ifdef NO_64BIT_MATH +#error not yet implemented +#else + + /* make sure that we're not moving backwards */ + if (roc < (rdbx->index >> 16)) { + return srtp_err_status_replay_old; + } + + rdbx->index = seq; + rdbx->index |= ((uint64_t)roc) << 16; /* set ROC */ +#endif + + bitvector_set_to_zero(&rdbx->bitmask); + + return srtp_err_status_ok; +} |