Support encrypted RTP extensions (RFC 6904)

webrtc/pc/channel.cc

 /*
  *  Copyright 2004 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 25 matching lines @@
                        std::unique_ptr<webrtc::AudioSinkInterface>* sink) {
   channel->SetRawAudioSink(ssrc, std::move(*sink));
   return true;
 }
 
 struct SendPacketMessageData : public rtc::MessageData {
   rtc::CopyOnWriteBuffer packet;
   rtc::PacketOptions options;
 };
 
-#if defined(ENABLE_EXTERNAL_AUTH)
-// Returns the named header extension if found among all extensions,
-// nullptr otherwise.
-const webrtc::RtpExtension* FindHeaderExtension(
-    const std::vector<webrtc::RtpExtension>& extensions,
-    const std::string& uri) {
-  for (const auto& extension : extensions) {
-    if (extension.uri == uri)
-      return &extension;
-  }
-  return nullptr;
-}
-#endif
-
 }  // namespace
 
 enum {
   MSG_EARLYMEDIATIMEOUT = 1,
   MSG_SEND_RTP_PACKET,
   MSG_SEND_RTCP_PACKET,
   MSG_CHANNEL_ERROR,
   MSG_READYTOSENDDATA,
   MSG_DATARECEIVED,
   MSG_FIRSTPACKETRECEIVED,
@@ skipping 56 matching lines @@
 static const MediaContentDescription* GetContentDescription(
     const ContentInfo* cinfo) {
   if (cinfo == NULL)
     return NULL;
   return static_cast<const MediaContentDescription*>(cinfo->description);
 }
 
 template <class Codec>
 void RtpParametersFromMediaDescription(
     const MediaContentDescriptionImpl<Codec>* desc,
+    const RtpHeaderExtensions& extensions,

[Taylor Brandstetter, 2017/04/01 00:28:59]

I'd just set params->extensions outside of this method, then there'd be no
reason to pass the extensions into it.

[joachim, 2017/04/17 10:46:09]

The method is called from different locations, so params->extensions would have
to be set in all of them including the "if ..." condition - I wanted to avoid
this code duplication.

[Taylor Brandstetter, 2017/04/19 06:48:39]

Acknowledged.

     RtpParameters<Codec>* params) {
   // TODO(pthatcher): Remove this once we're sure no one will give us
   // a description without codecs (currently a CA_UPDATE with just
   // streams can).
   if (desc->has_codecs()) {
     params->codecs = desc->codecs();
   }
   // TODO(pthatcher): See if we really need
   // rtp_header_extensions_set() and remove it if we don't.
   if (desc->rtp_header_extensions_set()) {
-    params->extensions = desc->rtp_header_extensions();
+    params->extensions = extensions;
   }
   params->rtcp.reduced_size = desc->rtcp_reduced_size();
 }
 
 template <class Codec>
 void RtpSendParametersFromMediaDescription(
     const MediaContentDescriptionImpl<Codec>* desc,
+    const RtpHeaderExtensions& extensions,

[Taylor Brandstetter, 2017/04/01 00:28:59]

Same here.

[joachim, 2017/04/17 10:46:09]

See comment above.

     RtpSendParameters<Codec>* send_params) {
-  RtpParametersFromMediaDescription(desc, send_params);
+  RtpParametersFromMediaDescription(desc, extensions, send_params);
   send_params->max_bandwidth_bps = desc->bandwidth();
 }
 
 BaseChannel::BaseChannel(rtc::Thread* worker_thread,
                          rtc::Thread* network_thread,
                          rtc::Thread* signaling_thread,
                          MediaChannel* media_channel,
                          const std::string& content_name,
                          bool rtcp_mux_required,
                          bool srtp_required)
@@ skipping 920 matching lines @@
   }
 
   if (role == rtc::SSL_SERVER) {
     send_key = &server_write_key;
     recv_key = &client_write_key;
   } else {
     send_key = &client_write_key;
     recv_key = &server_write_key;
   }
 
-  if (rtcp) {
-    ret = srtp_filter_.SetRtcpParams(selected_crypto_suite, &(*send_key)[0],
-                                     static_cast<int>(send_key->size()),
-                                     selected_crypto_suite, &(*recv_key)[0],
-                                     static_cast<int>(recv_key->size()));
+  if (!dtls_keyed_) {

[Taylor Brandstetter, 2017/04/01 00:28:59]

I don't think this works in all cases... If the transport changes, the
SrtpFilter will be reset, but dtls_keyed_ won't be. So, should just check
"srtp_filter_.IsActive()" here.

[joachim, 2017/04/17 10:46:09]

Done.

+    if (rtcp) {
+      ret = srtp_filter_.SetRtcpParams(selected_crypto_suite, &(*send_key)[0],
+                                       static_cast<int>(send_key->size()),
+                                       selected_crypto_suite, &(*recv_key)[0],
+                                       static_cast<int>(recv_key->size()));
+    } else {
+      ret = srtp_filter_.SetRtpParams(selected_crypto_suite, &(*send_key)[0],
+                                      static_cast<int>(send_key->size()),
+                                      selected_crypto_suite, &(*recv_key)[0],
+                                      static_cast<int>(recv_key->size()));
+    }
   } else {
-    ret = srtp_filter_.SetRtpParams(selected_crypto_suite, &(*send_key)[0],
-                                    static_cast<int>(send_key->size()),
-                                    selected_crypto_suite, &(*recv_key)[0],
-                                    static_cast<int>(recv_key->size()));
+    if (rtcp) {
+      // RTCP doesn't need to be updated.
+      ret = true;
+    } else {
+      ret = srtp_filter_.UpdateRtpParams(

[Taylor Brandstetter, 2017/04/01 00:28:59]

If UpdateRtpParams is *always* called with the same keying information (right
now), I'd suggest just removing the arguments for simplicity.

In fact: is there a reason why this couldn't just happen automatically inside
"SetEncryptedHeaderExtensions"?

[joachim, 2017/04/17 10:46:09]

"srtp_update" in the srtp filter requires the complete keying information,
that's why they are passed from here. Another option would be to save them in
the srtp filter which I wanted to avoid.

[Taylor Brandstetter, 2017/04/19 06:48:39]

Oh, I assumed they already were saved in the SRTP filter. If they're not, this
is fine.

+          selected_crypto_suite,
+          &(*send_key)[0], static_cast<int>(send_key->size()),
+          selected_crypto_suite,
+          &(*recv_key)[0], static_cast<int>(recv_key->size()));
+    }
   }
 
   if (!ret) {
     LOG(LS_WARNING) << "DTLS-SRTP key installation failed";
   } else {
     dtls_keyed_ = true;
     UpdateTransportOverhead();
   }
   return ret;
 }
@@ skipping 27 matching lines @@
 
   LOG(LS_INFO) << "Channel not writable (" << content_name_ << ")";
   writable_ = false;
   UpdateMediaSendRecvState();
 }
 
 bool BaseChannel::SetRtpTransportParameters(
     const MediaContentDescription* content,
     ContentAction action,
     ContentSource src,
+    const RtpHeaderExtensions& extensions,
     std::string* error_desc) {
   if (action == CA_UPDATE) {
     // These parameters never get changed by a CA_UDPATE.
     return true;
   }
 
+  RtpHeaderExtensions encrypted_extensions;
+  for (const webrtc::RtpExtension& extension : extensions) {
+    if (extension.encrypt) {
+      LOG(LS_INFO) << "Using " << (src == CS_LOCAL ? "local" : "remote")
+          << " encrypted extension: " << extension.ToString();
+      encrypted_extensions.push_back(extension);
+    }
+  }
+
   // Cache srtp_required_ for belt and suspenders check on SendPacket
   return network_thread_->Invoke<bool>(
       RTC_FROM_HERE, Bind(&BaseChannel::SetRtpTransportParameters_n, this,
-                          content, action, src, error_desc));
+                          content, action, src, encrypted_extensions,
+                          error_desc));
 }
 
 bool BaseChannel::SetRtpTransportParameters_n(
     const MediaContentDescription* content,
     ContentAction action,
     ContentSource src,
+    const RtpHeaderExtensions& encrypted_extensions,
     std::string* error_desc) {
   RTC_DCHECK(network_thread_->IsCurrent());
 
-  if (!SetSrtp_n(content->cryptos(), action, src, error_desc)) {
+  if (!SetSrtp_n(content->cryptos(), action, src, encrypted_extensions,
+      error_desc)) {
     return false;
   }
 
   if (!SetRtcpMux_n(content->rtcp_mux(), action, src, error_desc)) {
     return false;
   }
 
   return true;
 }
 
 // |dtls| will be set to true if DTLS is active for transport and crypto is
 // empty.
 bool BaseChannel::CheckSrtpConfig_n(const std::vector<CryptoParams>& cryptos,
                                     bool* dtls,
                                     std::string* error_desc) {
   *dtls = rtp_dtls_transport_ && rtp_dtls_transport_->IsDtlsActive();
   if (*dtls && !cryptos.empty()) {
     SafeSetError("Cryptos must be empty when DTLS is active.", error_desc);
     return false;
   }
   return true;
 }
 
 bool BaseChannel::SetSrtp_n(const std::vector<CryptoParams>& cryptos,
                             ContentAction action,
                             ContentSource src,
+                            const RtpHeaderExtensions& encrypted_extensions,
                             std::string* error_desc) {
   TRACE_EVENT0("webrtc", "BaseChannel::SetSrtp_w");
   if (action == CA_UPDATE) {
     // no crypto params.
     return true;
   }
   bool ret = false;
   bool dtls = false;
   ret = CheckSrtpConfig_n(cryptos, &dtls, error_desc);
   if (!ret) {
     return false;
   }
+  srtp_filter_.SetEncryptedHeaderExtensions(src, encrypted_extensions);
   switch (action) {
     case CA_OFFER:
       // If DTLS is already active on the channel, we could be renegotiating
       // here. We don't update the srtp filter.
       if (!dtls) {
         ret = srtp_filter_.SetOffer(cryptos, src);
       }
+      // The encrypted header extensions might have changed, update SRTP
+      // filter with new settings when the answer gets processed.
+      srtp_update_on_answer_ = true;

[Taylor Brandstetter, 2017/04/01 00:28:59]

I'm not sure this variable buys anything; an answer will always be set after an
offer, so won't it always be true when it's checked below?

[joachim, 2017/04/17 10:46:09]

You're right - removed it.

       break;
     case CA_PRANSWER:
       // If we're doing DTLS-SRTP, we don't want to update the filter
       // with an answer, because we already have SRTP parameters.
       if (!dtls) {
         ret = srtp_filter_.SetProvisionalAnswer(cryptos, src);
       }
       break;
     case CA_ANSWER:
       // If we're doing DTLS-SRTP, we don't want to update the filter
       // with an answer, because we already have SRTP parameters.
       if (!dtls) {
         ret = srtp_filter_.SetAnswer(cryptos, src);
       }
+      if (srtp_update_on_answer_) {
+        srtp_update_on_answer_ = false;
+        // Only update SRTP filter if using DTLS. SDES is handled internally
+        // by the SRTP filter.
+        if (dtls_keyed_) {
+          bool rtcp = false;
+          ret = SetupDtlsSrtp_n(rtcp);
+        }
+      }
       break;
     default:
       break;
   }
   if (!ret) {
     SafeSetError("Failed to setup SRTP filter.", error_desc);
     return false;
   }
   return true;
 }
@@ skipping 214 matching lines @@
         desc << "Failed to add remote stream ssrc: " << it->first_ssrc();
         SafeSetError(desc.str(), error_desc);
         ret = false;
       }
     }
   }
   remote_streams_ = streams;
   return ret;
 }
 
+RtpHeaderExtensions BaseChannel::GetFilteredRtpHeaderExtensions(
+    const RtpHeaderExtensions& extensions) {
+  if (!crypto_options_.enable_encrypted_rtp_header_extensions) {
+    return extensions;
+  }
+
+  return webrtc::RtpExtension::FilterDuplicateNonEncrypted(extensions);
+}
+
 void BaseChannel::MaybeCacheRtpAbsSendTimeHeaderExtension_w(
     const std::vector<webrtc::RtpExtension>& extensions) {
 // Absolute Send Time extension id is used only with external auth,
 // so do not bother searching for it and making asyncronious call to set
 // something that is not used.
 #if defined(ENABLE_EXTERNAL_AUTH)
   const webrtc::RtpExtension* send_time_extension =
-      FindHeaderExtension(extensions, webrtc::RtpExtension::kAbsSendTimeUri);
+      webrtc::RtpExtension::FindHeaderExtensionByUri(
+          extensions, webrtc::RtpExtension::kAbsSendTimeUri);
   int rtp_abs_sendtime_extn_id =
       send_time_extension ? send_time_extension->id : -1;
   invoker_.AsyncInvoke<void>(
       RTC_FROM_HERE, network_thread_,
       Bind(&BaseChannel::CacheRtpAbsSendTimeHeaderExtension_n, this,
            rtp_abs_sendtime_extn_id));
 #endif
 }
 
 void BaseChannel::CacheRtpAbsSendTimeHeaderExtension_n(
@@ skipping 313 matching lines @@
   LOG(LS_INFO) << "Setting local voice description";
 
   const AudioContentDescription* audio =
       static_cast<const AudioContentDescription*>(content);
   RTC_DCHECK(audio != NULL);
   if (!audio) {
     SafeSetError("Can't find audio content in local description.", error_desc);
     return false;
   }
 
-  if (!SetRtpTransportParameters(content, action, CS_LOCAL, error_desc)) {
+  RtpHeaderExtensions rtp_header_extensions =
+      GetFilteredRtpHeaderExtensions(audio->rtp_header_extensions());
+
+  if (!SetRtpTransportParameters(content, action, CS_LOCAL,
+      rtp_header_extensions, error_desc)) {
     return false;
   }
 
   AudioRecvParameters recv_params = last_recv_params_;
-  RtpParametersFromMediaDescription(audio, &recv_params);
+  RtpParametersFromMediaDescription(audio, rtp_header_extensions, &recv_params);
   if (!media_channel()->SetRecvParameters(recv_params)) {
     SafeSetError("Failed to set local audio description recv parameters.",
                  error_desc);
     return false;
   }
   for (const AudioCodec& codec : audio->codecs()) {
     bundle_filter()->AddPayloadType(codec.id);
   }
   last_recv_params_ = recv_params;
 
@@ skipping 19 matching lines @@
   LOG(LS_INFO) << "Setting remote voice description";
 
   const AudioContentDescription* audio =
       static_cast<const AudioContentDescription*>(content);
   RTC_DCHECK(audio != NULL);
   if (!audio) {
     SafeSetError("Can't find audio content in remote description.", error_desc);
     return false;
   }
 
-  if (!SetRtpTransportParameters(content, action, CS_REMOTE, error_desc)) {
+  RtpHeaderExtensions rtp_header_extensions =
+      GetFilteredRtpHeaderExtensions(audio->rtp_header_extensions());
+
+  if (!SetRtpTransportParameters(content, action, CS_REMOTE,
+      rtp_header_extensions, error_desc)) {
     return false;
   }
 
   AudioSendParameters send_params = last_send_params_;
-  RtpSendParametersFromMediaDescription(audio, &send_params);
+  RtpSendParametersFromMediaDescription(audio, rtp_header_extensions,
+      &send_params);
   if (audio->agc_minus_10db()) {
     send_params.options.adjust_agc_delta = rtc::Optional<int>(kAgcMinus10db);
   }
 
   bool parameters_applied = media_channel()->SetSendParameters(send_params);
   if (!parameters_applied) {
     SafeSetError("Failed to set remote audio description send parameters.",
                  error_desc);
     return false;
   }
   last_send_params_ = send_params;
 
   // TODO(pthatcher): Move remote streams into AudioRecvParameters,
   // and only give it to the media channel once we have a local
   // description too (without a local description, we won't be able to
   // recv them anyway).
   if (!UpdateRemoteStreams_w(audio->streams(), action, error_desc)) {
     SafeSetError("Failed to set remote audio description streams.", error_desc);
     return false;
   }
 
   if (audio->rtp_header_extensions_set()) {
-    MaybeCacheRtpAbsSendTimeHeaderExtension_w(audio->rtp_header_extensions());
+    MaybeCacheRtpAbsSendTimeHeaderExtension_w(rtp_header_extensions);
   }
 
   set_remote_content_direction(content->direction());
   UpdateMediaSendRecvState_w();
   return true;
 }
 
 void VoiceChannel::HandleEarlyMediaTimeout() {
   // This occurs on the main thread, not the worker thread.
   if (!received_media_) {
@@ skipping 184 matching lines @@
   LOG(LS_INFO) << "Setting local video description";
 
   const VideoContentDescription* video =
       static_cast<const VideoContentDescription*>(content);
   RTC_DCHECK(video != NULL);
   if (!video) {
     SafeSetError("Can't find video content in local description.", error_desc);
     return false;
   }
 
-  if (!SetRtpTransportParameters(content, action, CS_LOCAL, error_desc)) {
+  RtpHeaderExtensions rtp_header_extensions =
+      GetFilteredRtpHeaderExtensions(video->rtp_header_extensions());
+
+  if (!SetRtpTransportParameters(content, action, CS_LOCAL,
+      rtp_header_extensions, error_desc)) {
     return false;
   }
 
   VideoRecvParameters recv_params = last_recv_params_;
-  RtpParametersFromMediaDescription(video, &recv_params);
+  RtpParametersFromMediaDescription(video, rtp_header_extensions, &recv_params);
   if (!media_channel()->SetRecvParameters(recv_params)) {
     SafeSetError("Failed to set local video description recv parameters.",
                  error_desc);
     return false;
   }
   for (const VideoCodec& codec : video->codecs()) {
     bundle_filter()->AddPayloadType(codec.id);
   }
   last_recv_params_ = recv_params;
 
@@ skipping 19 matching lines @@
   LOG(LS_INFO) << "Setting remote video description";
 
   const VideoContentDescription* video =
       static_cast<const VideoContentDescription*>(content);
   RTC_DCHECK(video != NULL);
   if (!video) {
     SafeSetError("Can't find video content in remote description.", error_desc);
     return false;
   }
 
-  if (!SetRtpTransportParameters(content, action, CS_REMOTE, error_desc)) {
+  RtpHeaderExtensions rtp_header_extensions =
+      GetFilteredRtpHeaderExtensions(video->rtp_header_extensions());
+
+  if (!SetRtpTransportParameters(content, action, CS_REMOTE,
+      rtp_header_extensions, error_desc)) {
     return false;
   }
 
   VideoSendParameters send_params = last_send_params_;
-  RtpSendParametersFromMediaDescription(video, &send_params);
+  RtpSendParametersFromMediaDescription(video, rtp_header_extensions,
+      &send_params);
   if (video->conference_mode()) {
     send_params.conference_mode = true;
   }
 
   bool parameters_applied = media_channel()->SetSendParameters(send_params);
 
   if (!parameters_applied) {
     SafeSetError("Failed to set remote video description send parameters.",
                  error_desc);
     return false;
   }
   last_send_params_ = send_params;
 
   // TODO(pthatcher): Move remote streams into VideoRecvParameters,
   // and only give it to the media channel once we have a local
   // description too (without a local description, we won't be able to
   // recv them anyway).
   if (!UpdateRemoteStreams_w(video->streams(), action, error_desc)) {
     SafeSetError("Failed to set remote video description streams.", error_desc);
     return false;
   }
 
   if (video->rtp_header_extensions_set()) {
-    MaybeCacheRtpAbsSendTimeHeaderExtension_w(video->rtp_header_extensions());
+    MaybeCacheRtpAbsSendTimeHeaderExtension_w(rtp_header_extensions);
   }
 
   set_remote_content_direction(content->direction());
   UpdateMediaSendRecvState_w();
   return true;
 }
 
 void VideoChannel::OnMessage(rtc::Message *pmsg) {
   switch (pmsg->message_id) {
     case MSG_CHANNEL_ERROR: {
@@ skipping 105 matching lines @@
   RTC_DCHECK(data != NULL);
   if (!data) {
     SafeSetError("Can't find data content in local description.", error_desc);
     return false;
   }
 
   if (!CheckDataChannelTypeFromContent(data, error_desc)) {
     return false;
   }
 
-  if (!SetRtpTransportParameters(content, action, CS_LOCAL, error_desc)) {
+  RtpHeaderExtensions rtp_header_extensions =
+      GetFilteredRtpHeaderExtensions(data->rtp_header_extensions());
+
+  if (!SetRtpTransportParameters(content, action, CS_LOCAL,
+      rtp_header_extensions, error_desc)) {
     return false;
   }
 
   DataRecvParameters recv_params = last_recv_params_;
-  RtpParametersFromMediaDescription(data, &recv_params);
+  RtpParametersFromMediaDescription(data, rtp_header_extensions, &recv_params);
   if (!media_channel()->SetRecvParameters(recv_params)) {
     SafeSetError("Failed to set remote data description recv parameters.",
                  error_desc);
     return false;
   }
   for (const DataCodec& codec : data->codecs()) {
     bundle_filter()->AddPayloadType(codec.id);
   }
   last_recv_params_ = recv_params;
 
@@ skipping 28 matching lines @@
   // If the remote data doesn't have codecs and isn't an update, it
   // must be empty, so ignore it.
   if (!data->has_codecs() && action != CA_UPDATE) {
     return true;
   }
 
   if (!CheckDataChannelTypeFromContent(data, error_desc)) {
     return false;
   }
 
+  RtpHeaderExtensions rtp_header_extensions =
+      GetFilteredRtpHeaderExtensions(data->rtp_header_extensions());
+
   LOG(LS_INFO) << "Setting remote data description";
-  if (!SetRtpTransportParameters(content, action, CS_REMOTE, error_desc)) {
+  if (!SetRtpTransportParameters(content, action, CS_REMOTE,
+      rtp_header_extensions, error_desc)) {
     return false;
   }
 
   DataSendParameters send_params = last_send_params_;
-  RtpSendParametersFromMediaDescription<DataCodec>(data, &send_params);
+  RtpSendParametersFromMediaDescription<DataCodec>(data, rtp_header_extensions,
+      &send_params);
   if (!media_channel()->SetSendParameters(send_params)) {
     SafeSetError("Failed to set remote data description send parameters.",
                  error_desc);
     return false;
   }
   last_send_params_ = send_params;
 
   // TODO(pthatcher): Move remote streams into DataRecvParameters,
   // and only give it to the media channel once we have a local
   // description too (without a local description, we won't be able to
@@ skipping 109 matching lines @@
   signaling_thread()->Post(RTC_FROM_HERE, this, MSG_READYTOSENDDATA,
                            new DataChannelReadyToSendMessageData(writable));
 }
 
 void RtpDataChannel::GetSrtpCryptoSuites_n(
     std::vector<int>* crypto_suites) const {
   GetSupportedDataCryptoSuites(crypto_options(), crypto_suites);
 }
 
 }  // namespace cricket