[PATCH v2] Add media encryption support
David Woodhouse
dwmw2 at infradead.org
Wed Mar 11 20:19:48 EDT 2015
v2: In response to review feedback, drop the PurpleMediaCipher and
PurpleMediaAuthentication enums and just pass strings directly through
to GStreamer. This means we don't artificially limit the ciphers and
auth methods we support.
It does mean that we can't easily pretend that our API isn't
fundamentally tied to that of GStreamer... but they're just strings, so
in theory we *could* do a translation for some other backend just as
easily as we can today.
I've written code which interprets OpenSSL-specific ciphersuite strings
and implements them with GnuTLS. It's not hard :)
diff --git a/libpurple/media.c b/libpurple/media.c
index 431ec16..c50e348 100644
--- a/libpurple/media.c
+++ b/libpurple/media.c
@@ -1256,6 +1256,30 @@ purple_media_set_send_codec(PurpleMedia *media, const gchar *sess_id, PurpleMedi
#endif
}
+void
+purple_media_set_encryption_parameters(PurpleMedia *media, const gchar *sess_id,
+ const gchar *cipher, const gchar *auth,
+ const gchar *key, gsize key_len)
+{
+#ifdef USE_VV
+ g_return_if_fail(PURPLE_IS_MEDIA(media));
+ return purple_media_backend_set_encryption_parameters(media->priv->backend,
+ sess_id, cipher, auth, key, key_len);
+#endif
+}
+
+void
+purple_media_set_decryption_parameters(PurpleMedia *media, const gchar *sess_id,
+ const gchar *participant, const gchar *cipher,
+ const gchar *auth, const gchar *key, gsize key_len)
+{
+#ifdef USE_VV
+ g_return_if_fail(PURPLE_IS_MEDIA(media));
+ return purple_media_backend_set_decryption_parameters(media->priv->backend,
+ sess_id, participant, cipher, auth, key, key_len);
+#endif
+}
+
gboolean
purple_media_codecs_ready(PurpleMedia *media, const gchar *sess_id)
{
diff --git a/libpurple/media.h b/libpurple/media.h
index 5df1e65..8400c60 100644
--- a/libpurple/media.h
+++ b/libpurple/media.h
@@ -360,6 +360,41 @@ gboolean purple_media_candidates_prepared(PurpleMedia *media,
gboolean purple_media_set_send_codec(PurpleMedia *media, const gchar *sess_id, PurpleMediaCodec *codec);
/**
+ * purple_media_set_encryption_parameters:
+ * @media: The media object to find the session in.
+ * @sess_id: The session id of the session to set parameters of.
+ * @cipher: The cipher to use to encrypt our media in the session.
+ * @auth: The algorithm to use to compute authentication codes for our media
+ * frames.
+ * @key: The encryption key.
+ * @key_len: Byte length of the encryption key.
+ *
+ * Sets the encryption parameters of our media in the session.
+ */
+void purple_media_set_encryption_parameters(PurpleMedia *media,
+ const gchar *sess_id, const gchar *cipher,
+ const gchar *auth, const gchar *key, gsize key_len);
+
+/**
+ * purple_media_set_decryption_parameters:
+ * @media: The media object to find the session in.
+ * @sess_id: The session id of the session to set parameters of.
+ * @participant: The participant of the session to set parameters of.
+ * @cipher: The cipher to use to decrypt media coming from this session's
+ * participant.
+ * @auth: The algorithm to use for authentication of the media coming from
+ * the session's participant.
+ * @key: The decryption key.
+ * @key_len: Byte length of the decryption key.
+ *
+ * Sets the decryption parameters for a session participant's media.
+ */
+void purple_media_set_decryption_parameters(PurpleMedia *media,
+ const gchar *sess_id, const gchar *participant,
+ const gchar *cipher, const gchar *auth,
+ const gchar *key, gsize key_len);
+
+/**
* purple_media_codecs_ready:
* @media: The media object to find the session in.
* @sess_id: The session id of the session to check.
diff --git a/libpurple/media/backend-fs2.c b/libpurple/media/backend-fs2.c
index b5b3194..dca263e 100644
--- a/libpurple/media/backend-fs2.c
+++ b/libpurple/media/backend-fs2.c
@@ -81,6 +81,13 @@ static GList *purple_media_backend_fs2_get_codecs(PurpleMediaBackend *self,
static GList *purple_media_backend_fs2_get_local_candidates(
PurpleMediaBackend *self,
const gchar *sess_id, const gchar *participant);
+static void purple_media_backend_fs2_set_encryption_parameters (
+ PurpleMediaBackend *self, const gchar *sess_id, const gchar *cipher,
+ const gchar *auth, const gchar *key, gsize key_len);
+static void purple_media_backend_fs2_set_decryption_parameters(
+ PurpleMediaBackend *self, const gchar *sess_id,
+ const gchar *participant, const gchar *cipher,
+ const gchar *auth, const gchar *key, gsize key_len);
static gboolean purple_media_backend_fs2_set_remote_codecs(
PurpleMediaBackend *self,
const gchar *sess_id, const gchar *participant,
@@ -546,6 +553,10 @@ purple_media_backend_iface_init(PurpleMediaBackendIface *iface)
purple_media_backend_fs2_get_local_candidates;
iface->set_remote_codecs = purple_media_backend_fs2_set_remote_codecs;
iface->set_send_codec = purple_media_backend_fs2_set_send_codec;
+ iface->set_encryption_parameters =
+ purple_media_backend_fs2_set_encryption_parameters;
+ iface->set_decryption_parameters =
+ purple_media_backend_fs2_set_decryption_parameters;
iface->set_params = purple_media_backend_fs2_set_params;
iface->get_available_params = purple_media_backend_fs2_get_available_params;
iface->send_dtmf = purple_media_backend_fs2_send_dtmf;
@@ -2472,6 +2483,98 @@ purple_media_backend_fs2_set_remote_codecs(PurpleMediaBackend *self,
return TRUE;
}
+#if GST_CHECK_VERSION(1,0,0)
+static GstStructure *
+create_fs2_srtp_structure(const gchar *cipher, const gchar *auth,
+ const gchar *key, gsize key_len)
+{
+ GstStructure *result;
+ GstBuffer *buffer;
+ GstMapInfo info;
+
+ buffer = gst_buffer_new_allocate(NULL, key_len, NULL);
+ gst_buffer_map(buffer, &info, GST_MAP_WRITE);
+ memcpy(info.data, key, key_len);
+ gst_buffer_unmap(buffer, &info);
+
+ result = gst_structure_new("FarstreamSRTP",
+ "cipher", G_TYPE_STRING, cipher,
+ "auth", G_TYPE_STRING, auth,
+ "key", GST_TYPE_BUFFER, buffer,
+ NULL);
+ gst_buffer_unref(buffer);
+
+ return result;
+}
+#endif
+
+static void
+purple_media_backend_fs2_set_encryption_parameters (PurpleMediaBackend *self,
+ const gchar *sess_id, const gchar *cipher, const gchar *auth,
+ const gchar *key, gsize key_len)
+{
+#if !GST_CHECK_VERSION(1,0,0)
+ purple_debug_error("backend-fs2",
+ "Media decryption not supported with GStreamer 0.x\n");
+#else
+ PurpleMediaBackendFs2Session *session;
+ GstStructure *srtp;
+ GError *err = NULL;
+
+ g_return_if_fail(PURPLE_IS_MEDIA_BACKEND_FS2(self));
+
+ session = get_session(PURPLE_MEDIA_BACKEND_FS2(self), sess_id);
+ if (!session)
+ return;
+
+ srtp = create_fs2_srtp_structure(cipher, auth, key, key_len);
+ if (!srtp)
+ return;
+
+ if (!fs_session_set_encryption_parameters(session->session, srtp, &err)) {
+ purple_debug_error("backend-fs2",
+ "Error setting encryption parameters: %s\n", err->message);
+ g_error_free(err);
+ }
+
+ gst_structure_free(srtp);
+#endif
+}
+
+static void
+purple_media_backend_fs2_set_decryption_parameters (PurpleMediaBackend *self,
+ const gchar *sess_id, const gchar *participant,
+ const gchar *cipher, const gchar *auth,
+ const gchar *key, gsize key_len)
+{
+#if !GST_CHECK_VERSION(1,0,0)
+ purple_debug_error("backend-fs2",
+ "Media decryption not supported with GStreamer 0.x\n");
+#else
+ PurpleMediaBackendFs2Stream *stream;
+ GstStructure *srtp;
+ GError *err = NULL;
+
+ g_return_if_fail(PURPLE_IS_MEDIA_BACKEND_FS2(self));
+ stream = get_stream(PURPLE_MEDIA_BACKEND_FS2(self), sess_id, participant);
+ if (!stream)
+ return;
+
+ srtp = create_fs2_srtp_structure(cipher, auth, key, key_len);
+ if (!srtp)
+ return;
+
+ fs_stream_set_decryption_parameters(stream->stream, srtp, &err);
+ if (err) {
+ purple_debug_error("backend-fs2",
+ "Error setting decryption parameters: %s\n", err->message);
+ g_error_free(err);
+ }
+
+ gst_structure_free(srtp);
+#endif
+}
+
static gboolean
purple_media_backend_fs2_set_send_codec(PurpleMediaBackend *self,
const gchar *sess_id, PurpleMediaCodec *codec)
diff --git a/libpurple/media/backend-iface.c b/libpurple/media/backend-iface.c
index 618f521..375d9a5 100644
--- a/libpurple/media/backend-iface.c
+++ b/libpurple/media/backend-iface.c
@@ -190,6 +190,26 @@ purple_media_backend_set_send_codec(PurpleMediaBackend *self,
sess_id, codec);
}
+void purple_media_backend_set_encryption_parameters(PurpleMediaBackend *self,
+ const gchar *sess_id, const gchar *cipher,
+ const gchar *auth, const gchar *key, gsize key_len)
+{
+ g_return_if_fail(PURPLE_IS_MEDIA_BACKEND(self));
+ return PURPLE_MEDIA_BACKEND_GET_INTERFACE(self)->set_encryption_parameters(self,
+ sess_id, cipher, auth, key, key_len);
+}
+
+void
+purple_media_backend_set_decryption_parameters(PurpleMediaBackend *self,
+ const gchar *sess_id, const gchar *participant,
+ const gchar *cipher, const gchar *auth,
+ const gchar *key, gsize key_len)
+{
+ g_return_if_fail(PURPLE_IS_MEDIA_BACKEND(self));
+ return PURPLE_MEDIA_BACKEND_GET_INTERFACE(self)->set_decryption_parameters(self,
+ sess_id, participant, cipher, auth, key, key_len);
+}
+
void
purple_media_backend_set_params(PurpleMediaBackend *self,
guint num_params, GParameter *params)
diff --git a/libpurple/media/backend-iface.h b/libpurple/media/backend-iface.h
index 604ad0f..7d3c757 100644
--- a/libpurple/media/backend-iface.h
+++ b/libpurple/media/backend-iface.h
@@ -80,6 +80,13 @@ struct _PurpleMediaBackendIface
GList *codecs);
gboolean (*set_send_codec) (PurpleMediaBackend *self,
const gchar *sess_id, PurpleMediaCodec *codec);
+ void (*set_encryption_parameters) (PurpleMediaBackend *self,
+ const gchar *sess_id, const gchar *cipher,
+ const gchar *auth, const gchar *key, gsize key_len);
+ void (*set_decryption_parameters) (PurpleMediaBackend *self,
+ const gchar *sess_id, const gchar *participant,
+ const gchar *cipher, const gchar *auth,
+ const gchar *key, gsize key_len);
void (*set_params) (PurpleMediaBackend *self,
guint num_params, GParameter *params);
const gchar **(*get_available_params) (void);
@@ -203,6 +210,41 @@ gboolean purple_media_backend_set_send_codec(PurpleMediaBackend *self,
const gchar *sess_id, PurpleMediaCodec *codec);
/**
+ * purple_media_backend_set_encryption_parameters:
+ * @self: The media backend the session is in.
+ * @sess_id: The session id of the session to set parameters of.
+ * @cipher: The cipher to use to encrypt our media in the session.
+ * @auth: The algorithm to use to compute authentication codes for our media
+ * frames.
+ * @key: The encryption key.
+ * @key_len: Byte length of the encryption key.
+ *
+ * Sets the encryption parameters of our media in the session.
+ */
+void purple_media_backend_set_encryption_parameters(PurpleMediaBackend *self,
+ const gchar *sess_id, const gchar *cipher,
+ const gchar *auth, const gchar *key, gsize key_len);
+
+/**
+ * purple_media_backend_set_decryption_parameters:
+ * @self: The media backend the session is in.
+ * @sess_id: The session id of the session to set parameters of.
+ * @participant: The participant of the session to set parameters of.
+ * @cipher: The cipher to use to decrypt media coming from this session's
+ * participant.
+ * @auth: The algorithm to use for authentication of the media coming from
+ * the session's participant.
+ * @key: The decryption key.
+ * @key_len: Byte length of the decryption key.
+ *
+ * Sets the decryption parameters for a session participant's media.
+ */
+void purple_media_backend_set_decryption_parameters(PurpleMediaBackend *self,
+ const gchar *sess_id, const gchar *participant,
+ const gchar *cipher, const gchar *auth,
+ const gchar *key, gsize key_len);
+
+/**
* purple_media_backend_set_params:
* @self: The media backend to set the parameters on.
* @num_params: The number of parameters to pass to backend
--
dwmw2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5745 bytes
Desc: not available
URL: <https://pidgin.im/pipermail/devel/attachments/20150312/33993e09/attachment-0001.bin>
More information about the Devel
mailing list