commit 57cc70ec8193ee7a118d852c425b2551c0b22588
author Ron Eldor <Ron.Eldor@arm.com> Mon Apr 02 18:25:16 2018 +0300
committer Johan Pascal <johan.pascal@belledonne-communications.com> Thu Oct 29 01:14:49 2020 +0100
tree a41c8071756cb58cc95db8a214a372c3f173dfdb
parent 9e9096476e96226549468b9dc632609f74190675

Enforce SRTP mandatory HS messages

Enforce CertificateRequest, client and server Certificates, and
CertificateVerify messages, which are mandatory in DTLS-SRTP,
as defined in RFC 5764 section 4.1

Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 8b9f2f0..c7798eb 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -3454,8 +3454,20 @@
 
     if( ssl->client_auth == 0 )
     {
-        /* Current message is probably the ServerHelloDone */
-        ssl->keep_current_message = 1;
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+    /* check if we have a chosen srtp protection profile */
+        if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+            ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
+        }
+        else
+        {
+#endif
+            /* MBEDTLS_SSL_DTLS_SRTP */
+            /* Current message is probably the ServerHelloDone */
+            ssl->keep_current_message = 1;
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+        }
+#endif
         goto exit;
     }
 
@@ -4102,9 +4114,19 @@
 
     if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
-        ssl->state++;
-        return( 0 );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+    /* check if we have a chosen srtp protection profile */
+        if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+            return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
+        }
+        else
+        {
+#endif /* MBEDTLS_SSL_DTLS_SRTP */
+            ssl->state++;
+            return( 0 );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+        }
+#endif
     }
 
     if( mbedtls_ssl_own_key( ssl ) == NULL )