1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
|
#!/usr/bin/env bash
# Test WolfSSL/OpenSSL srtp interoperability
#
# TODO: add OpenSSL client with WolfSSL server
set -e
if ! test -n "$WOLFSSL_OPENSSL_TEST"; then
echo "WOLFSSL_OPENSSL_TEST NOT set, won't run"
exit 0
fi
OPENSSL=${OPENSSL:="openssl"}
WOLFSSL_CLIENT=${WOLFSSL_CLIENT:="./examples/client/client"}
# need a unique port since may run the same time as testsuite
generate_port() {
#-------------------------------------------------------------------------#
# Generate a random port number
#-------------------------------------------------------------------------#
if [[ "$OSTYPE" == "linux"* ]]; then
port=$(($(od -An -N2 /dev/urandom) % (65535-49512) + 49512))
elif [[ "$OSTYPE" == "darwin"* ]]; then
port=$(($(od -An -N2 /dev/random) % (65535-49512) + 49512))
else
echo "Unknown OS TYPE"
exit 1
fi
}
# get size of key material based on the profile
# $1 srtp profile
get_key_material_size() {
case "$1" in
"SRTP_AES128_CM_SHA1_80")
ekm_size=60 ;;
"SRTP_AES128_CM_SHA1_32")
ekm_size=60 ;;
"SRTP_NULL_SHA1_80")
ekm_size=28 ;;
"SRTP_NULL_SHA1_32")
ekm_size=27 ;;
"SRTP_AEAD_AES_128_GCM")
ekm_size=56;;
"SRTP_AEAD_AES_256_GCM")
ekm_size=88;;
*)
echo "SRTP profile $1 unsupported"
exit 1
esac
}
# Start an OpenSSL server dtls with srtp
# $1: dtsl version [1.0, 1.2]
# $2: srtp profile string
start_openssl_server() {
generate_port
server_port=$port
srtp_profile=$2
if [ "$1" = "1.0" ]; then
dtls_version=dtls1
elif [ "$1" = "1.2" ]; then
dtls_version=dtls1_2
fi
get_key_material_size "$srtp_profile"
server_output_file=/tmp/openssl_srtp_out
# hackish but OpenSSL doesn't work if input is fed before handshaking and
# the wolfSSL client needs a reply to stop
(sleep 1;echo -n "I hear you fa shizzle...") | \
${OPENSSL} s_server \
-${dtls_version} \
-port ${server_port} \
-debug \
-use_srtp ${srtp_profile} \
-keymatexport EXTRACTOR-dtls_srtp \
-keymatexportlen $ekm_size \
-cert ./certs/server-cert.pem \
-key ./certs/server-key.pem >$server_output_file &
# make sure the server is up
sleep 0.1
}
# Start an wolfssl client dtls with srtp
# $1: dtsl version [1.0, 1.2]
# $2: srtp profile string
start_wolfssl_client() {
srtp_profile=$2
if [ "$1" = "1.0" ]; then
dtls_version=2
elif [ "$1" = "1.2" ]; then
dtls_version=3
fi
client_output_file=/tmp/wolfssl_srtp_out
${WOLFSSL_CLIENT} -u\
-x \
-v${dtls_version} \
--srtp ${srtp_profile} \
-p${server_port} >$client_output_file
}
# $1 openssl file
# $2 wolfssl file
check_ekm() {
openssl_ekm=$(cat "$1" | grep "Keying material: " | cut -d ':' -f 2)
echo "OPENSSL EKM: $openssl_ekm"
wolfssl_ekm=$(cat "$2" | grep "DTLS SRTP: Exported key material: " | cut -d ':' -f 3)
echo "WOLFSSL EKM: $wolfssl_ekm"
if [ "$openssl_ekm" = "$wolfssl_ekm" ];then
check_ret=0
else
check_ret=1
fi
}
# $1 dtsl version
# $2 srtp profile
check_dtls_srtp() {
start_openssl_server $1 $2
start_wolfssl_client $1 $2
check_ekm $server_output_file $client_output_file
echo -n "check dtls $1 $2... "
if [ $check_ret -ne 0 ];then
echo "failed"
exit 1
else
echo "ok"
fi
}
# SRTP_NULL_SHA1_80" and SRTP_NULL_SHA1_32 aren't supported by OpenSSL
PROFILES="SRTP_AES128_CM_SHA1_80 \
SRTP_AES128_CM_SHA1_32 \
SRTP_AEAD_AES_128_GCM \
SRTP_AEAD_AES_256_GCM"
for DTLS in 1.0 1.2;do
for SRTP_PROF in $PROFILES;do
check_dtls_srtp $DTLS $SRTP_PROF
done
done
|
