RFC 4771 ROC in-band support

CMakeLists.txt

@@ -483,6 +483,18 @@ if(LIBSRTP_TEST_APPS)
             ${ENABLE_WARNINGS_AS_ERRORS})
     target_link_libraries(test_srtp_policy srtp3)
     add_test(test_srtp_policy test_srtp_policy)
+
+    add_executable(rcc_test test/rcc_test.c test/util.c)
+    target_set_warnings(
+            TARGET
+            rcc_test
+            ENABLE
+            ${ENABLE_WARNINGS}
+            AS_ERRORS
+            ${ENABLE_WARNINGS_AS_ERRORS})
+    target_include_directories(rcc_test PRIVATE test)
+    target_link_libraries(rcc_test srtp3)
+    add_test(rcc_test rcc_test)
   endif()
 
   find_program(BASH_PROGRAM bash)

Makefile.in

@@ -48,6 +48,7 @@ runtest: test
 	$(FIND_LIBRARIES) crypto/test/kernel_driver$(EXE) -v >/dev/null
 	$(FIND_LIBRARIES) test/test_srtp$(EXE) >/dev/null
 	$(FIND_LIBRARIES) test/test_srtp_policy$(EXE) >/dev/null
+	$(FIND_LIBRARIES) test/rcc_test$(EXE) >/dev/null
 	$(FIND_LIBRARIES) test/rdbx_driver$(EXE) -v >/dev/null
 	$(FIND_LIBRARIES) test/srtp_driver$(EXE) -v >/dev/null
 	$(FIND_LIBRARIES) test/roc_driver$(EXE) -v >/dev/null
@@ -63,6 +64,7 @@ runtest-valgrind: test
 	@echo "running libsrtp3 test applications... (valgrind)"
 	valgrind --error-exitcode=1 --leak-check=full --suppressions=./valgrind.supp test/test_srtp$(EXE) -v >/dev/null
 	valgrind --error-exitcode=1 --leak-check=full --suppressions=./valgrind.supp test/test_srtp_policy$(EXE) -v >/dev/null
+	valgrind --error-exitcode=1 --leak-check=full --suppressions=./valgrind.supp test/rcc_test$(EXE) -v >/dev/null
 	valgrind --error-exitcode=1 --leak-check=full --suppressions=./valgrind.supp test/srtp_driver$(EXE) -v >/dev/null
 	@echo "libsrtp3 test applications passed. (valgrind)"
 
@@ -189,7 +191,7 @@ crypto_testapp = $(AES_CALC) crypto/test/cipher_driver$(EXE) \
 
 testapp = $(crypto_testapp) test/srtp_driver$(EXE) test/replay_driver$(EXE) \
 	  test/roc_driver$(EXE) test/rdbx_driver$(EXE) test/rtpw$(EXE) \
-	  test/test_srtp$(EXE) test/test_srtp_policy$(EXE)
+	  test/test_srtp$(EXE) test/test_srtp_policy$(EXE) test/rcc_test$(EXE)
 
 ifeq (1, $(HAVE_PCAP))
 testapp += test/rtp_decoder$(EXE)
@@ -216,6 +218,9 @@ test/test_srtp$(EXE): test/test_srtp.c
 test/test_srtp_policy$(EXE): test/test_srtp_policy.c  test/util.c
 	$(COMPILE) -I$(srcdir)/test $(LDFLAGS) -o $@ $^ $(LIBS) $(SRTPLIB)
 
+test/rcc_test$(EXE): test/rcc_test.c test/util.c
+	$(COMPILE) -I$(srcdir)/test $(LDFLAGS) -o $@ $^ $(LIBS) $(SRTPLIB)
+
 crypto/test/datatypes_driver$(EXE): crypto/test/datatypes_driver.c test/util.c
 	$(COMPILE) -I$(srcdir)/test $(LDFLAGS) -o $@ $^ $(LIBS) $(SRTPLIB)
 

include/srtp.h

@@ -385,6 +385,37 @@ srtp_err_status_t srtp_policy_get_profile(srtp_policy_t policy,
  *    - srtp_err_status_ok if flags were applied.
  *    - srtp_err_status_bad_param if policy is NULL or profile is unset.
  */
+
+/**
+ * @brief srtp_rcc_mode_t selects the RFC 4771 Roll-over Counter Carrying
+ * (RCC) integrity transform mode for an SRTP stream.
+ *
+ * RFC 4771 allows the sender's ROC to be carried inside the SRTP
+ * authentication tag of selected packets (those whose RTP sequence number
+ * is congruent to 0 modulo the transmission rate @c roc_tx_rate, "R").
+ * For a packet that carries the ROC the tag is built as
+ * @c TAG @c = @c ROC(4 @c octets) @c || @c MAC_tr, where @c MAC_tr is the
+ * @c (auth_tag_len @c - @c 4) most significant octets of the HMAC.
+ *
+ * Modes 1 and 2 use the HMAC-SHA1 integrity transform and are defined only
+ * for the AES-CM ciphers.  Mode 3 is the RFC 4771 NULL-MAC variant: it
+ * carries only the 4-octet ROC with no MAC of its own.  Mode 3 is supported
+ * here on top of AES-GCM (RFC 7714); the AEAD tag authenticates the packet
+ * and the ROC is appended immediately after the GCM tag.
+ */
+typedef enum {
+    srtp_rcc_mode_none = 0, /**< RCC disabled (default RFC 3711 transform). */
+    srtp_rcc_mode_1 = 1,    /**< RFC 4771 mode 1: only ROC-carrying packets  */
+                            /**< are integrity protected; other packets     */
+                            /**< carry no authentication tag.               */
+    srtp_rcc_mode_2 = 2,    /**< RFC 4771 mode 2: ROC-carrying packets use   */
+                            /**< the RCC tag, all other packets use the     */
+                            /**< default integrity transform.               */
+    srtp_rcc_mode_3 = 3     /**< RFC 4771 mode 3: NULL-MAC, ROC only.        */
+                            /**< Supported with AES-GCM, where the ROC is   */
+                            /**< appended after the GCM tag.                */
+} srtp_rcc_mode_t;
+
 srtp_err_status_t srtp_policy_set_sec_serv(srtp_policy_t policy,
                                            srtp_sec_serv_t rtp_sec_serv,
                                            srtp_sec_serv_t rtcp_sec_serv);
@@ -418,6 +449,31 @@ srtp_err_status_t srtp_policy_use_mki(srtp_policy_t policy, size_t mki_len);
 srtp_err_status_t srtp_policy_get_mki_length(srtp_policy_t policy,
                                              size_t *mki_len);
 
+/**
+ * @brief Enable RFC 4771 Roll-over Counter Carrying (RCC) for this policy.
+ *
+ * @param policy policy handle.
+ * @param rcc_mode RCC integrity-transform mode (see srtp_rcc_mode_t). Pass
+ *        srtp_rcc_mode_none to disable RCC and use the default RFC 3711
+ *        transform.
+ * @param roc_tx_rate ROC transmission rate R: the sender embeds its ROC in
+ *        every packet whose RTP sequence number is congruent to 0 modulo R
+ *        (R == 1 carries the ROC in every packet). Ignored when rcc_mode is
+ *        srtp_rcc_mode_none; must be >= 1 otherwise.
+ *
+ * Modes 1 and 2 are defined only for the AES-CM ciphers; mode 3 (NULL-MAC) is
+ * supported only with AES-GCM. The mode must be consistent with the policy's
+ * profile or srtp_create()/srtp_policy_validate() rejects it. Both peers must
+ * derive the same mode and rate so they agree on the packet layout.
+ *
+ * @return
+ *    - srtp_err_status_ok if the RCC settings were applied.
+ *    - srtp_err_status_bad_param if policy is NULL or the rate is invalid.
+ */
+srtp_err_status_t srtp_policy_set_rcc_mode_tx_rate(srtp_policy_t policy,
+                                                   srtp_rcc_mode_t rcc_mode,
+                                                   uint16_t roc_tx_rate);
+
 /**
  * @brief Add a master key and salt to a policy handle.
  *

include/srtp_priv.h

@@ -113,6 +113,12 @@ typedef struct srtp_policy_ctx_t_ {
                               /**<  ids.                               */
     bool use_cryptex;         /**< Encrypt header block and CSRCs with */
                               /**< cryptex, RFC 9335.                  */
+    srtp_rcc_mode_t rcc_mode; /**< RFC 4771 RCC integrity transform     */
+                              /**< mode for SRTP (default none).        */
+    uint16_t roc_tx_rate;     /**< RFC 4771 ROC transmission rate R:    */
+                              /**< the ROC is carried in packets whose  */
+                              /**< sequence number is 0 modulo R. A     */
+                              /**< value of 0 is treated as 1.          */
 } srtp_policy_ctx_t_;
 
 static inline bool srtp_policy_is_null_cipher_null_auth(
@@ -188,6 +194,8 @@ typedef struct srtp_stream_ctx_t_ {
     size_t enc_xtn_hdr_count;
     uint32_t pending_roc;
     bool use_cryptex;
+    srtp_rcc_mode_t rcc_mode; /* RFC 4771 RCC integrity transform mode      */
+    uint16_t roc_tx_rate;     /* RFC 4771 ROC transmission rate R (>= 1)    */
 } strp_stream_ctx_t_;
 
 /*