Support for parsing encrypted WebM streams by src.

media/filters/ffmpeg_demuxer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/ffmpeg_demuxer.h"
 
 #include <algorithm>
 #include <string>
 
+#include "base/base64.h"
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop.h"
 #include "base/stl_util.h"
 #include "base/string_util.h"
+#include "base/sys_byteorder.h"
 #include "base/time.h"
 #include "media/base/audio_decoder_config.h"
 #include "media/base/decoder_buffer.h"
 #include "media/base/limits.h"
 #include "media/base/media_switches.h"
 #include "media/base/video_decoder_config.h"
 #include "media/ffmpeg/ffmpeg_common.h"
 #include "media/filters/ffmpeg_glue.h"
 #include "media/filters/ffmpeg_h264_to_annex_b_bitstream_converter.h"
+#include "media/webm/webm_constants.h"
 
 namespace media {
 
+// Generates a 16 byte CTR counter block. The CTR counter block format is a

[ddorwin, 2012/08/22 23:20:29]

We seem to do this a lot. Can we put it in media/base or something?

[fgalligan1, 2012/08/23 02:39:11]

Sure is there a convention where it should go?

[xhwang, 2012/08/23 19:04:53]

media/crypto/decryptor_helpers.* ?

[ddorwin, 2012/08/24 00:20:30]

and/or webm_helpers.* depending on what it is.

[fgalligan1, 2012/08/24 20:01:26]

Done.

+// CTR IV appended with a CTR block counter. |iv| is an 8 byte CTR IV.
+// Always returns a valid pointer to a buffer of kDecryptionKeySize bytes.
+static scoped_array<uint8> GenerateCounterBlock(uint64 iv) {
+  scoped_array<uint8> counter_block_data(
+      new uint8[DecryptConfig::kDecryptionKeySize]);
+
+  // Set the IV.
+  memcpy(counter_block_data.get(), &iv, sizeof(iv));
+
+  // Set block counter to all 0's.
+  memset(counter_block_data.get() + sizeof(iv),
+         0,
+         DecryptConfig::kDecryptionKeySize - sizeof(iv));
+
+  return counter_block_data.Pass();
+}
+
 //
 // FFmpegDemuxerStream
 //
 FFmpegDemuxerStream::FFmpegDemuxerStream(
     FFmpegDemuxer* demuxer,
     AVStream* stream)
     : demuxer_(demuxer),
       stream_(stream),
       type_(UNKNOWN),
       stopped_(false),
-      last_packet_timestamp_(kNoTimestamp()) {
+      last_packet_timestamp_(kNoTimestamp()),
+      need_decryption_key_(false) {
   DCHECK(demuxer_);
 
   // Determine our media format.
   switch (stream->codec->codec_type) {
     case AVMEDIA_TYPE_AUDIO:
       type_ = AUDIO;
       AVCodecContextToAudioDecoderConfig(stream->codec, &audio_config_);
       break;
     case AVMEDIA_TYPE_VIDEO:
       type_ = VIDEO;
       AVStreamToVideoDecoderConfig(stream, &video_config_);
       break;
     default:
       NOTREACHED();
       break;
   }
 
   // Calculate the duration.
   duration_ = ConvertStreamTimestamp(stream->time_base, stream->duration);
+
+  AVDictionaryEntry *key = av_dict_get(stream->metadata, "enc_key_id", NULL, 0);
+  if (key) {
+    DCHECK(key->value);
+    base::StringPiece base64_key_id(key->value);
+    base::Base64Decode(base64_key_id, &enc_key_id_);
+    CHECK(!enc_key_id_.empty());

[ddorwin, 2012/08/22 23:20:29]

DCHECK? Do we prevent this in FFmpeg?

[fgalligan1, 2012/08/23 02:39:11]

In the current code in FFmpeg we will only ads an enc_key_id metadata if
ContentEncKeyID's size is > 0. If you want me to not have the DCHECK I can
remove it.

[ddorwin, 2012/08/24 00:20:30]

I was just wondering whether DCHECK was sufficient or whether we really need the
check in opt.

[fgalligan1, 2012/08/24 20:01:26]

I had it as a DCHECK because at one point in time key_id was optional. But all
of the code will fail if the value is NULL so made it a check. 

+    need_decryption_key_ = true;

[ddorwin, 2012/08/22 23:20:29]

The lifetime of this object is the entire media stream, right? Does it support
more than one Track (and whatever holds PSSHs for ISO)? I worry about holding
onto this data when more may come in.

Does this class all run on the same thread?

[fgalligan1, 2012/08/23 02:39:11]

I don't think FFmpegDemuxerStream supports more than one Track. Currently WebM
has one key_id per stream. We can always change this when ISO support is added
or WebM can changes keys within the same Track.

[ddorwin, 2012/08/24 00:20:30]

We should find out how acolwell's changes to handle changes work. Anyway,
hopefully we can just eliminate this since xhwang has fixed blocking for the key
inside Chrome.

+    demuxer_->NeedKey(enc_key_id_);
+  }
+
+  // *** DEBUG Until FFmpeg metadata "enck_key_id" is added for windows. ***
+  //enc_key_id_ = "DEBUG_KEY_REMOVE";

[ddorwin, 2012/08/22 23:20:29]

Could you av_dict_set() at 81 instead and thus exercise the above code?

[fgalligan1, 2012/08/23 02:39:11]

Done.

+  //need_decryption_key_ = true;
+  //demuxer_->NeedKey(enc_key_id_);
+  // *** DEBUG Until FFmpeg metadata "enck_key_id" is added for windows. ***
 }

[ddorwin, 2012/08/22 23:20:29]

I think the use of enc_key_id_ for both reporting needkey AND creating the
DecryptConfig is confusing. I propose current_key_id_, which works for ISO and
WebM.
Then here:
1) base64 decode "initData" into a local string
2) Report it via NeedKey
3) Container-specific extraction of "current key" into current_key_id_

[fgalligan1, 2012/08/23 02:39:11]

PTAL and let me if what I did is what you were asking for.

 
 bool FFmpegDemuxerStream::HasPendingReads() {
   DCHECK(demuxer_->message_loop()->BelongsToCurrentThread());
   base::AutoLock auto_lock(lock_);
   DCHECK(!stopped_ || read_queue_.empty())
       << "Read queue should have been emptied if demuxing stream is stopped";
   return !read_queue_.empty();
 }
 
 void FFmpegDemuxerStream::EnqueuePacket(
     scoped_ptr_malloc<AVPacket, ScopedPtrAVFreePacket> packet) {
   DCHECK(demuxer_->message_loop()->BelongsToCurrentThread());
 
   base::AutoLock auto_lock(lock_);
   if (stopped_) {
     NOTREACHED() << "Attempted to enqueue packet on a stopped stream";
     return;
   }
 
   scoped_refptr<DecoderBuffer> buffer;
   if (!packet.get()) {
     buffer = DecoderBuffer::CreateEOSBuffer();
   } else {
     // Convert the packet if there is a bitstream filter.
     if (packet->data && bitstream_converter_.get() &&
         !bitstream_converter_->ConvertPacket(packet.get())) {
       LOG(ERROR) << "Format converstion failed.";
     }
 
+    // Every encrypted Block has an HMAC and IV prepended to it. Current

[ddorwin, 2012/08/22 23:20:29]

We seem to do this a lot. Can we put it in media/base or something?

[fgalligan1, 2012/08/23 02:39:11]

You want me to remove the comment?

[ddorwin, 2012/08/24 00:20:30]

No. Move the code like line 32.

[fgalligan1, 2012/08/24 20:01:26]

Done.

+    // encrypted WebM request for comments specification is here
+    // http://wiki.webmproject.org/encryption/webm-encryption-rfc
+    // If encrypted skip past the HMAC. Encrypted buffers must include the IV

[ddorwin, 2012/08/22 23:20:29]

If encrypted, skip past the HMAC to get the buffer.

[fgalligan1, 2012/08/23 02:39:11]

Done.

+    // and the encrypted frame because the decryptor will verify this data
+    // before decryption. The HMAC and IV will be copied into DecryptConfig.
+    int offset = (enc_key_id_.empty()) ? 0 : kWebMHmacSize;
+
     // If a packet is returned by FFmpeg's av_parser_parse2() the packet will
     // reference inner memory of FFmpeg.  As such we should transfer the packet
     // into memory we control.
-    buffer = DecoderBuffer::CopyFrom(packet->data, packet->size);
+    buffer = DecoderBuffer::CopyFrom(packet->data + offset,
+                                     packet->size - offset);
+    if (!enc_key_id_.empty()) {

[ddorwin, 2012/08/22 23:20:29]

We now have WebM code in the middle of the generic demuxer. Can we avoid that?

[fgalligan1, 2012/08/23 02:39:11]

Added a TODO, which can be done before the CL is submitted so we don't lose
this.

+      uint64 network_iv;
+      memcpy(&network_iv, packet->data + kWebMHmacSize, sizeof(network_iv));
+      const uint64 iv = base::NetToHost64(network_iv);
+
+      scoped_array<uint8> counter_block(GenerateCounterBlock(iv));
+      buffer->SetDecryptConfig(scoped_ptr<DecryptConfig>(new DecryptConfig(
+          enc_key_id_,
+          std::string(reinterpret_cast<const char*>(counter_block.get()),
+                      DecryptConfig::kDecryptionKeySize),
+          std::string(reinterpret_cast<const char*>(packet->data),
+                      kWebMHmacSize),
+          sizeof(iv),
+          std::vector<SubsampleEntry>())));
+    }
+
     buffer->SetTimestamp(ConvertStreamTimestamp(
         stream_->time_base, packet->pts));
     buffer->SetDuration(ConvertStreamTimestamp(
         stream_->time_base, packet->duration));
     if (buffer->GetTimestamp() != kNoTimestamp() &&
         last_packet_timestamp_ != kNoTimestamp() &&
         last_packet_timestamp_ < buffer->GetTimestamp()) {
       buffered_ranges_.Add(last_packet_timestamp_, buffer->GetTimestamp());
       demuxer_->message_loop()->PostTask(FROM_HERE, base::Bind(
           &FFmpegDemuxer::NotifyBufferingChanged, demuxer_));
@@ skipping 75 matching lines @@
     read_cb.Run(DemuxerStream::kOk,
                 scoped_refptr<DecoderBuffer>(DecoderBuffer::CreateEOSBuffer()));
     return;
   }
 
   // Enqueue the callback and attempt to satisfy it immediately.
   read_queue_.push_back(read_cb);
   FulfillPendingRead();
 
   // Check if there are still pending reads, demux some more.
-  if (!read_queue_.empty()) {
+  if (!read_queue_.empty() && !need_decryption_key_) {

[ddorwin, 2012/08/22 23:20:29]

Why not post if need a decryption key? It's up to the decoder to stall.
If we don't need to check this, I don't think we need need_decryption_key_ .

[fgalligan1, 2012/08/23 02:39:11]

I thought this was a pretty clean break point in waiting for the key. There is
not much code in the demux_task between reading a frame and decoding it. 

So you would want the decoder (which currently contains the decryptor) to block
until we have the key? That would mean decoder would then have to know that the
stream is encrypted also.

I wanted to keep as much of the encryption handling code out of the decoder. I
don't think the decoder should know anything about decryption. That should be
handled before it even gets to the decoder. 

[ddorwin, 2012/08/24 00:20:30]

As xhwang mentioned, I think this is already handled. You could try removing it
and confirm it works. Then you can remove AddKey(), etc.

[fgalligan1, 2012/08/24 20:01:26]

Done. Works with xhwang changes.

     demuxer_->PostDemuxTask();
   }
 }
 
 void FFmpegDemuxerStream::FulfillPendingRead() {
   DCHECK(demuxer_->message_loop()->BelongsToCurrentThread());
   lock_.AssertAcquired();
   if (buffer_queue_.empty() || read_queue_.empty()) {
     return;
   }
@@ skipping 32 matching lines @@
   base::AutoLock auto_lock(lock_);
   DCHECK(stopped_);
   DCHECK(read_queue_.empty());
   DCHECK(buffer_queue_.empty());
 }
 
 base::TimeDelta FFmpegDemuxerStream::GetElapsedTime() const {
   return ConvertStreamTimestamp(stream_->time_base, stream_->cur_dts);
 }
 
+void FFmpegDemuxerStream::KeyAdded() {
+  need_decryption_key_ = false;
+}
+
 Ranges<base::TimeDelta> FFmpegDemuxerStream::GetBufferedRanges() const {
   base::AutoLock auto_lock(lock_);
   return buffered_ranges_;
 }
 
 // static
 base::TimeDelta FFmpegDemuxerStream::ConvertStreamTimestamp(
     const AVRational& time_base, int64 timestamp) {
   if (timestamp == static_cast<int64>(AV_NOPTS_VALUE))
     return kNoTimestamp();
 
   return ConvertFromTimeBase(time_base, timestamp);
 }
 
 //
 // FFmpegDemuxer
 //
 FFmpegDemuxer::FFmpegDemuxer(
     const scoped_refptr<base::MessageLoopProxy>& message_loop,
-    const scoped_refptr<DataSource>& data_source)
+    const scoped_refptr<DataSource>& data_source,
+    const FFmpegNeedKeyCB& need_key_cb)
     : host_(NULL),
       message_loop_(message_loop),
       format_context_(NULL),
       data_source_(data_source),
       read_event_(false, false),
       read_has_failed_(false),
       last_read_bytes_(0),
       read_position_(0),
       bitrate_(0),
       start_time_(kNoTimestamp()),
       audio_disabled_(false),
-      duration_known_(false) {
+      duration_known_(false),
+      need_key_cb_(need_key_cb) {
   DCHECK(message_loop_);
   DCHECK(data_source_);
 }
 
 FFmpegDemuxer::~FFmpegDemuxer() {
   // In this destructor, we clean up resources held by FFmpeg. It is ugly to
   // close the codec contexts here because the corresponding codecs are opened
   // in the decoder filters. By reaching this point, all filters should have
   // stopped, so this is the only safe place to do the global clean up.
   // TODO(hclam): close the codecs in the corresponding decoders.
@@ skipping 26 matching lines @@
 void FFmpegDemuxer::SetPlaybackRate(float playback_rate) {
   DCHECK(data_source_.get());
   data_source_->SetPlaybackRate(playback_rate);
 }
 
 void FFmpegDemuxer::OnAudioRendererDisabled() {
   message_loop_->PostTask(FROM_HERE, base::Bind(
       &FFmpegDemuxer::DisableAudioStreamTask, this));
 }
 
+void FFmpegDemuxer::KeyAdded() {
+  message_loop_->PostTask(FROM_HERE,
+                          base::Bind(&FFmpegDemuxer::KeyAddedTask, this));
+}
+
+void FFmpegDemuxer::NeedKey(const std::string& key_id) {
+  int key_id_size = key_id.size();
+  scoped_array<uint8> key_id_local(new uint8[key_id_size]);
+  memcpy(key_id_local.get(), key_id.data(), key_id_size);
+  need_key_cb_.Run(key_id_local.Pass(), key_id_size);
+}
+
 void FFmpegDemuxer::Initialize(DemuxerHost* host,
                                const PipelineStatusCB& status_cb) {
   message_loop_->PostTask(FROM_HERE, base::Bind(
       &FFmpegDemuxer::InitializeTask, this, host, status_cb));
 }
 
 scoped_refptr<DemuxerStream> FFmpegDemuxer::GetStream(
     DemuxerStream::Type type) {
   return GetFFmpegStream(type);
 }
@@ skipping 344 matching lines @@
   DCHECK(message_loop_->BelongsToCurrentThread());
   audio_disabled_ = true;
   StreamVector::iterator iter;
   for (iter = streams_.begin(); iter != streams_.end(); ++iter) {
     if (*iter && (*iter)->type() == DemuxerStream::AUDIO) {
       (*iter)->Stop();
     }
   }
 }
 
+void FFmpegDemuxer::KeyAddedTask() {
+  DCHECK(message_loop_->BelongsToCurrentThread());
+
+  StreamVector::iterator iter;
+  for (iter = streams_.begin(); iter != streams_.end(); ++iter) {
+    if (*iter && (*iter)->type() == DemuxerStream::VIDEO) {
+      (*iter)->KeyAdded();
+    }
+  }
+
+  PostDemuxTask();
+}
+
 bool FFmpegDemuxer::StreamsHavePendingReads() {
   DCHECK(message_loop_->BelongsToCurrentThread());
   StreamVector::iterator iter;
   for (iter = streams_.begin(); iter != streams_.end(); ++iter) {
     if (*iter && (*iter)->HasPendingReads()) {
       return true;
     }
   }
   return false;
 }
@@ skipping 34 matching lines @@
   } else if (audio) {
     buffered = audio->GetBufferedRanges();
   } else if (video) {
     buffered = video->GetBufferedRanges();
   }
   for (size_t i = 0; i < buffered.size(); ++i)
     host_->AddBufferedTimeRange(buffered.start(i), buffered.end(i));
 }
 
 }  // namespace media