Enforce SRTP mandatory HS messages
Enforce CertificateRequest, client and server Certificates, and
CertificateVerify messages, which are mandatory in DTLS-SRTP,
as defined in RFC 5764 section 4.1
Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 8b9f2f0..c7798eb 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -3454,8 +3454,20 @@
if( ssl->client_auth == 0 )
{
- /* Current message is probably the ServerHelloDone */
- ssl->keep_current_message = 1;
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+ /* check if we have a chosen srtp protection profile */
+ if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+ ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
+ }
+ else
+ {
+#endif
+ /* MBEDTLS_SSL_DTLS_SRTP */
+ /* Current message is probably the ServerHelloDone */
+ ssl->keep_current_message = 1;
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+ }
+#endif
goto exit;
}
@@ -4102,9 +4114,19 @@
if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
{
- MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
- ssl->state++;
- return( 0 );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+ /* check if we have a chosen srtp protection profile */
+ if ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_SRTP_UNSET_PROFILE ) {
+ return ( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
+ }
+ else
+ {
+#endif /* MBEDTLS_SSL_DTLS_SRTP */
+ ssl->state++;
+ return( 0 );
+#if defined(MBEDTLS_SSL_DTLS_SRTP)
+ }
+#endif
}
if( mbedtls_ssl_own_key( ssl ) == NULL )