Skip to content

allow negotiation of all use_srtp profile values currently listed by IANA #10372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: development
Choose a base branch
from
Open

allow negotiation of all use_srtp profile values currently listed by IANA #10372

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
076e39c
allow negotiation of all use_srtp profile values currently listed by …
Aug 25, 2025
038b114
fixed incorrect values for srtp_force_profile usage text, added all u…
Aug 25, 2025
085ec8f
Merge branch 'development' of https://github.com/dc6jgk/mbedtls into …
Aug 25, 2025
f0af5da
added SRTP_AEAD_AES_128_GCM and SRTP_AEAD_AES_256_GCM to test scripts
Aug 25, 2025
f45e8e0
add ChangeLog
Aug 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ChangeLog.d/new-dtls-use_srtp-modes.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
API changes
* allow negotiation of all use_srtp profile values currently listed by IANA
43 changes: 37 additions & 6 deletions include/mbedtls/ssl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1101,7 +1101,7 @@ typedef struct {
#if defined(MBEDTLS_SSL_DTLS_SRTP)

#define MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH 255
#define MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH 4
#define MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH 14
/*
* For code readability use a typedef for DTLS-SRTP profiles
*
Expand All @@ -1111,12 +1111,23 @@ typedef struct {
* Reminder: if this list is expanded mbedtls_ssl_check_srtp_profile_value
* must be updated too.
*/
#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80 ((uint16_t) 0x0001)
#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32 ((uint16_t) 0x0002)
#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80 ((uint16_t) 0x0005)
#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32 ((uint16_t) 0x0006)
#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80 ((uint16_t) 0x0001) /* RFC5764 foundation for DTLS+SRTP */
#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32 ((uint16_t) 0x0002) /* RFC5764 foundation for DTLS+SRTP */
/* 0x0003-0x0004 are listed as "Unassigned" */
#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80 ((uint16_t) 0x0005) /* RFC5764 foundation for DTLS+SRTP */
#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32 ((uint16_t) 0x0006) /* RFC5764 foundation for DTLS+SRTP */
#define MBEDTLS_TLS_SRTP_AEAD_AES_128_GCM ((uint16_t) 0x0007) /* RFC7714 AES-GCM for SRTP */
#define MBEDTLS_TLS_SRTP_AEAD_AES_256_GCM ((uint16_t) 0x0008) /* RFC7714 AES-GCM for SRTP */
#define MBEDTLS_TLS_DOUBLE_AEAD_AES_128_GCM_AEAD_AES_128_GCM ((uint16_t) 0x0009) /* RFC8723 double encryption for SRTP */
#define MBEDTLS_TLS_DOUBLE_AEAD_AES_256_GCM_AEAD_AES_256_GCM ((uint16_t) 0x000A) /* RFC8723 double encryption for SRTP */
#define MBEDTLS_TLS_SRTP_ARIA_128_CTR_HMAC_SHA1_80 ((uint16_t) 0x000B) /* RFC8269 ARIA+SRTP */
#define MBEDTLS_TLS_SRTP_ARIA_128_CTR_HMAC_SHA1_32 ((uint16_t) 0x000C) /* RFC8269 ARIA+SRTP */
#define MBEDTLS_TLS_SRTP_ARIA_256_CTR_HMAC_SHA1_80 ((uint16_t) 0x000D) /* RFC8269 ARIA+SRTP */
#define MBEDTLS_TLS_SRTP_ARIA_256_CTR_HMAC_SHA1_32 ((uint16_t) 0x000E) /* RFC8269 ARIA+SRTP */
#define MBEDTLS_TLS_SRTP_AEAD_ARIA_128_GCM ((uint16_t) 0x000F) /* RFC8269 ARIA+SRTP */
#define MBEDTLS_TLS_SRTP_AEAD_ARIA_256_GCM ((uint16_t) 0x0010) /* RFC8269 ARIA+SRTP */
/* This one is not iana defined, but for code readability. */
#define MBEDTLS_TLS_SRTP_UNSET ((uint16_t) 0x0000)
#define MBEDTLS_TLS_SRTP_UNSET ((uint16_t) 0x0000) /* end of list marker */

typedef uint16_t mbedtls_ssl_srtp_profile;

Expand Down Expand Up @@ -3964,6 +3975,26 @@ static inline const char *mbedtls_ssl_get_srtp_profile_as_string(mbedtls_ssl_srt
return "MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80";
case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32:
return "MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32";
case MBEDTLS_TLS_SRTP_AEAD_AES_128_GCM:
return "MBEDTLS_TLS_SRTP_AEAD_AES_128_GCM";
case MBEDTLS_TLS_SRTP_AEAD_AES_256_GCM:
return "MBEDTLS_TLS_SRTP_AEAD_AES_256_GCM";
case MBEDTLS_TLS_DOUBLE_AEAD_AES_128_GCM_AEAD_AES_128_GCM:
return "MBEDTLS_TLS_DOUBLE_AEAD_AES_128_GCM_AEAD_AES_128_GCM";
case MBEDTLS_TLS_DOUBLE_AEAD_AES_256_GCM_AEAD_AES_256_GCM:
return "MBEDTLS_TLS_DOUBLE_AEAD_AES_256_GCM_AEAD_AES_256_GCM";
case MBEDTLS_TLS_SRTP_ARIA_128_CTR_HMAC_SHA1_80:
return "MBEDTLS_TLS_SRTP_ARIA_128_CTR_HMAC_SHA1_80";
case MBEDTLS_TLS_SRTP_ARIA_128_CTR_HMAC_SHA1_32:
return "MBEDTLS_TLS_SRTP_ARIA_128_CTR_HMAC_SHA1_32";
case MBEDTLS_TLS_SRTP_ARIA_256_CTR_HMAC_SHA1_80:
return "MBEDTLS_TLS_SRTP_ARIA_256_CTR_HMAC_SHA1_80";
case MBEDTLS_TLS_SRTP_ARIA_256_CTR_HMAC_SHA1_32:
return "MBEDTLS_TLS_SRTP_ARIA_256_CTR_HMAC_SHA1_32";
case MBEDTLS_TLS_SRTP_AEAD_ARIA_128_GCM:
return "MBEDTLS_TLS_SRTP_AEAD_ARIA_128_GCM";
case MBEDTLS_TLS_SRTP_AEAD_ARIA_256_GCM:
return "MBEDTLS_TLS_SRTP_AEAD_ARIA_256_GCM";
default: break;
}
return "";
Expand Down
10 changes: 10 additions & 0 deletions library/ssl_misc.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1597,6 +1597,16 @@ static inline mbedtls_ssl_srtp_profile mbedtls_ssl_check_srtp_profile_value
case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32:
case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80:
case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32:
case MBEDTLS_TLS_SRTP_AEAD_AES_128_GCM:
case MBEDTLS_TLS_SRTP_AEAD_AES_256_GCM:
case MBEDTLS_TLS_DOUBLE_AEAD_AES_128_GCM_AEAD_AES_128_GCM:
case MBEDTLS_TLS_DOUBLE_AEAD_AES_256_GCM_AEAD_AES_256_GCM:
case MBEDTLS_TLS_SRTP_ARIA_128_CTR_HMAC_SHA1_80:
case MBEDTLS_TLS_SRTP_ARIA_128_CTR_HMAC_SHA1_32:
case MBEDTLS_TLS_SRTP_ARIA_256_CTR_HMAC_SHA1_80:
case MBEDTLS_TLS_SRTP_ARIA_256_CTR_HMAC_SHA1_32:
case MBEDTLS_TLS_SRTP_AEAD_ARIA_128_GCM:
case MBEDTLS_TLS_SRTP_AEAD_ARIA_256_GCM:
return srtp_profile_value;
default: break;
}
Expand Down
22 changes: 17 additions & 5 deletions programs/ssl/ssl_client2.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,12 +212,22 @@ int main(void)
" use_srtp=%%d default: 0 (disabled)\n" \
" This cannot be used with eap_tls=1 or " \
" nss_keylog=1\n" \
" srtp_force_profile=%%d default: 0 (all enabled)\n" \
" srtp_force_profile=%%d default: 0 (all RFC5764+RFC7714 modes enabled)\n" \
" available profiles:\n" \
" 1 - SRTP_AES128_CM_HMAC_SHA1_80\n" \
" 2 - SRTP_AES128_CM_HMAC_SHA1_32\n" \
" 3 - SRTP_NULL_HMAC_SHA1_80\n" \
" 4 - SRTP_NULL_HMAC_SHA1_32\n" \
" 1 - SRTP_AES128_CM_HMAC_SHA1_80\n" \
" 2 - SRTP_AES128_CM_HMAC_SHA1_32\n" \
" 5 - SRTP_NULL_HMAC_SHA1_80\n" \
" 6 - SRTP_NULL_HMAC_SHA1_32\n" \
" 7 - SRTP_AEAD_AES_128_GCM\n" \
" 8 - SRTP_AEAD_AES_256_GCM\n" \
" 9 - DOUBLE_AEAD_AES_128_GCM_AEAD_AES_128_GCM\n" \
" 10 - DOUBLE_AEAD_AES_256_GCM_AEAD_AES_256_GCM\n" \
" 11 - SRTP_ARIA_128_CTR_HMAC_SHA1_80\n" \
" 12 - SRTP_ARIA_128_CTR_HMAC_SHA1_32\n" \
" 13 - SRTP_ARIA_256_CTR_HMAC_SHA1_80\n" \
" 14 - SRTP_ARIA_256_CTR_HMAC_SHA1_32\n" \
" 15 - SRTP_AEAD_ARIA_128_GCM\n" \
" 16 - SRTP_AEAD_ARIA_256_GCM\n" \
" mki=%%s default: \"\" (in hex, without 0x)\n"
#else /* MBEDTLS_SSL_DTLS_SRTP */
#define USAGE_SRTP ""
Expand Down Expand Up @@ -853,6 +863,8 @@ int main(int argc, char *argv[])
MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32,
MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80,
MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32,
MBEDTLS_TLS_SRTP_AEAD_AES_128_GCM,
MBEDTLS_TLS_SRTP_AEAD_AES_256_GCM,
MBEDTLS_TLS_SRTP_UNSET
};
#endif /* MBEDTLS_SSL_DTLS_SRTP */
Expand Down
22 changes: 17 additions & 5 deletions programs/ssl/ssl_server2.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,12 +298,22 @@ int main(void)
#if defined(MBEDTLS_SSL_DTLS_SRTP)
#define USAGE_SRTP \
" use_srtp=%%d default: 0 (disabled)\n" \
" srtp_force_profile=%%d default: 0 (all enabled)\n" \
" srtp_force_profile=%%d default: 0 (all RFC5764+RFC7714 modes enabled)\n" \
" available profiles:\n" \
" 1 - SRTP_AES128_CM_HMAC_SHA1_80\n" \
" 2 - SRTP_AES128_CM_HMAC_SHA1_32\n" \
" 3 - SRTP_NULL_HMAC_SHA1_80\n" \
" 4 - SRTP_NULL_HMAC_SHA1_32\n" \
" 1 - SRTP_AES128_CM_HMAC_SHA1_80\n" \
" 2 - SRTP_AES128_CM_HMAC_SHA1_32\n" \
" 5 - SRTP_NULL_HMAC_SHA1_80\n" \
" 6 - SRTP_NULL_HMAC_SHA1_32\n" \
" 7 - SRTP_AEAD_AES_128_GCM\n" \
" 8 - SRTP_AEAD_AES_256_GCM\n" \
" 9 - DOUBLE_AEAD_AES_128_GCM_AEAD_AES_128_GCM\n" \
" 10 - DOUBLE_AEAD_AES_256_GCM_AEAD_AES_256_GCM\n" \
" 11 - SRTP_ARIA_128_CTR_HMAC_SHA1_80\n" \
" 12 - SRTP_ARIA_128_CTR_HMAC_SHA1_32\n" \
" 13 - SRTP_ARIA_256_CTR_HMAC_SHA1_80\n" \
" 14 - SRTP_ARIA_256_CTR_HMAC_SHA1_32\n" \
" 15 - SRTP_AEAD_ARIA_128_GCM\n" \
" 16 - SRTP_AEAD_ARIA_256_GCM\n" \
" support_mki=%%d default: 0 (not supported)\n"
#else /* MBEDTLS_SSL_DTLS_SRTP */
#define USAGE_SRTP ""
Expand Down Expand Up @@ -1609,6 +1619,8 @@ int main(int argc, char *argv[])
MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32,
MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80,
MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32,
MBEDTLS_TLS_SRTP_AEAD_AES_128_GCM,
MBEDTLS_TLS_SRTP_AEAD_AES_256_GCM,
MBEDTLS_TLS_SRTP_UNSET
};
#endif /* MBEDTLS_SSL_DTLS_SRTP */
Expand Down
Loading