| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/renderer_host/p2p/socket_host.h" | 5 #include "content/browser/renderer_host/p2p/socket_host.h" |
| 6 | 6 |
| 7 #include "base/sys_byteorder.h" | 7 #include "base/sys_byteorder.h" |
| 8 #include "content/browser/renderer_host/p2p/socket_host_tcp.h" | 8 #include "content/browser/renderer_host/p2p/socket_host_tcp.h" |
| 9 #include "content/browser/renderer_host/p2p/socket_host_tcp_server.h" | 9 #include "content/browser/renderer_host/p2p/socket_host_tcp_server.h" |
| 10 #include "content/browser/renderer_host/p2p/socket_host_udp.h" | 10 #include "content/browser/renderer_host/p2p/socket_host_udp.h" |
| 11 #include "crypto/hmac.h" | |
| 12 #include "third_party/libjingle/source/talk/base/asyncpacketsocket.h" | |
| 13 #include "third_party/libjingle/source/talk/base/byteorder.h" | |
| 14 #include "third_party/libjingle/source/talk/base/messagedigest.h" | |
| 15 #include "third_party/libjingle/source/talk/p2p/base/stun.h" | |
| 16 | 11 |
| 17 namespace { | 12 namespace { |
| 18 | |
| 19 const uint32 kStunMagicCookie = 0x2112A442; | 13 const uint32 kStunMagicCookie = 0x2112A442; |
| 20 const int kMinRtpHdrLen = 12; | |
| 21 const int kRtpExtnHdrLen = 4; | |
| 22 const int kDtlsRecordHeaderLen = 13; | |
| 23 const int kTurnChannelHdrLen = 4; | |
| 24 const int kAbsSendTimeExtnLen = 3; | |
| 25 const int kOneByteHdrLen = 1; | |
| 26 | |
| 27 // Fake auth tag written by the render process if external authentication is | |
| 28 // enabled. HMAC in packet will be compared against this value before updating | |
| 29 // packet with actual HMAC value. | |
| 30 static const unsigned char kFakeAuthTag[10] = { | |
| 31 0xba, 0xdd, 0xba, 0xdd, 0xba, 0xdd, 0xba, 0xdd, 0xba, 0xdd | |
| 32 }; | |
| 33 | |
| 34 bool IsTurnChannelData(const char* data) { | |
| 35 return ((*data & 0xC0) == 0x40); | |
| 36 } | |
| 37 | |
| 38 bool IsDtlsPacket(const char* data, int len) { | |
| 39 const uint8* u = reinterpret_cast<const uint8*>(data); | |
| 40 return (len >= kDtlsRecordHeaderLen && (u[0] > 19 && u[0] < 64)); | |
| 41 } | |
| 42 | |
| 43 bool IsRtcpPacket(const char* data) { | |
| 44 int type = (static_cast<uint8>(data[1]) & 0x7F); | |
| 45 return (type >= 64 && type < 96); | |
| 46 } | |
| 47 | |
| 48 bool IsTurnSendIndicationPacket(const char* data) { | |
| 49 uint16 type = talk_base::GetBE16(data); | |
| 50 return (type == cricket::TURN_SEND_INDICATION); | |
| 51 } | |
| 52 | |
| 53 bool IsRtpPacket(const char* data, int len) { | |
| 54 return ((*data & 0xC0) == 0x80); | |
| 55 } | |
| 56 | |
| 57 // Verifies rtp header and message length. | |
| 58 bool ValidateRtpHeader(char* rtp, int length) { | |
| 59 int cc_count = rtp[0] & 0x0F; | |
| 60 int rtp_hdr_len_without_extn = kMinRtpHdrLen + 4 * cc_count; | |
| 61 if (rtp_hdr_len_without_extn > length) { | |
| 62 return false; | |
| 63 } | |
| 64 | |
| 65 // If extension bit is not set, we are done with header processing, as input | |
| 66 // length is verified above. | |
| 67 if (!(rtp[0] & 0x10)) { | |
| 68 return true; | |
| 69 } | |
| 70 | |
| 71 rtp += rtp_hdr_len_without_extn; | |
| 72 | |
| 73 // Getting extension profile length. | |
| 74 // Length is in 32 bit words. | |
| 75 uint16 extn_length = talk_base::GetBE16(rtp + 2) * 4; | |
| 76 | |
| 77 // Verify input length against total header size. | |
| 78 if (rtp_hdr_len_without_extn + kRtpExtnHdrLen + extn_length > length) { | |
| 79 return false; | |
| 80 } | |
| 81 return true; | |
| 82 } | |
| 83 | |
| 84 void UpdateAbsSendTimeExtnValue(char* extn_data, int len, | |
| 85 uint32 abs_send_time) { | |
| 86 // Absolute send time in RTP streams. | |
| 87 // | |
| 88 // The absolute send time is signaled to the receiver in-band using the | |
| 89 // general mechanism for RTP header extensions [RFC5285]. The payload | |
| 90 // of this extension (the transmitted value) is a 24-bit unsigned integer | |
| 91 // containing the sender's current time in seconds as a fixed point number | |
| 92 // with 18 bits fractional part. | |
| 93 // | |
| 94 // The form of the absolute send time extension block: | |
| 95 // | |
| 96 // 0 1 2 3 | |
| 97 // 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |
| 98 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 99 // | ID | len=2 | absolute send time | | |
| 100 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 101 DCHECK_EQ(len, kAbsSendTimeExtnLen); | |
| 102 // Now() has resolution ~1-15ms, using HighResNow(). But it is warned not to | |
| 103 // use it unless necessary, as it is expensive than Now(). | |
| 104 uint32 now_second = abs_send_time; | |
| 105 if (!now_second) { | |
| 106 uint64 now_us = | |
| 107 (base::TimeTicks::HighResNow() - base::TimeTicks()).InMicroseconds(); | |
| 108 // Convert second to 24-bit unsigned with 18 bit fractional part | |
| 109 now_second = | |
| 110 ((now_us << 18) / base::Time::kMicrosecondsPerSecond) & 0x00FFFFFF; | |
| 111 } | |
| 112 // TODO(mallinath) - Add SetBE24 to byteorder.h in libjingle. | |
| 113 extn_data[0] = static_cast<uint8>(now_second >> 16); | |
| 114 extn_data[1] = static_cast<uint8>(now_second >> 8); | |
| 115 extn_data[2] = static_cast<uint8>(now_second); | |
| 116 } | |
| 117 | |
| 118 // Assumes |len| is actual packet length + tag length. Updates HMAC at end of | |
| 119 // the RTP packet. | |
| 120 void UpdateRtpAuthTag(char* rtp, int len, | |
| 121 const talk_base::PacketOptions& options) { | |
| 122 // If there is no key, return. | |
| 123 if (options.packet_time_params.srtp_auth_key.empty()) | |
| 124 return; | |
| 125 | |
| 126 size_t tag_length = options.packet_time_params.srtp_auth_tag_len; | |
| 127 char* auth_tag = rtp + (len - tag_length); | |
| 128 | |
| 129 // We should have a fake HMAC value @ auth_tag. | |
| 130 DCHECK_EQ(0, memcmp(auth_tag, kFakeAuthTag, tag_length)); | |
| 131 | |
| 132 crypto::HMAC hmac(crypto::HMAC::SHA1); | |
| 133 if (!hmac.Init(reinterpret_cast<const unsigned char*>( | |
| 134 &options.packet_time_params.srtp_auth_key[0]), | |
| 135 options.packet_time_params.srtp_auth_key.size())) { | |
| 136 NOTREACHED(); | |
| 137 return; | |
| 138 } | |
| 139 | |
| 140 if (hmac.DigestLength() < tag_length) { | |
| 141 NOTREACHED(); | |
| 142 return; | |
| 143 } | |
| 144 | |
| 145 // Copy ROC after end of rtp packet. | |
| 146 memcpy(auth_tag, &options.packet_time_params.srtp_packet_index, 4); | |
| 147 // Authentication of a RTP packet will have RTP packet + ROC size. | |
| 148 int auth_required_length = len - tag_length + 4; | |
| 149 | |
| 150 unsigned char output[64]; | |
| 151 if (!hmac.Sign(base::StringPiece(rtp, auth_required_length), | |
| 152 output, sizeof(output))) { | |
| 153 NOTREACHED(); | |
| 154 return; | |
| 155 } | |
| 156 // Copy HMAC from output to packet. This is required as auth tag length | |
| 157 // may not be equal to the actual HMAC length. | |
| 158 memcpy(auth_tag, output, tag_length); | |
| 159 } | |
| 160 | |
| 161 } // namespace | 14 } // namespace |
| 162 | 15 |
| 163 namespace content { | 16 namespace content { |
| 164 | 17 |
| 165 namespace packet_processing_helpers { | |
| 166 | |
| 167 bool ApplyPacketOptions(char* data, int length, | |
| 168 const talk_base::PacketOptions& options, | |
| 169 uint32 abs_send_time) { | |
| 170 DCHECK(data != NULL); | |
| 171 DCHECK(length > 0); | |
| 172 // if there is no valid |rtp_sendtime_extension_id| and |srtp_auth_key| in | |
| 173 // PacketOptions, nothing to be updated in this packet. | |
| 174 if (options.packet_time_params.rtp_sendtime_extension_id == -1 && | |
| 175 options.packet_time_params.srtp_auth_key.empty()) { | |
| 176 return true; | |
| 177 } | |
| 178 | |
| 179 DCHECK(!IsDtlsPacket(data, length)); | |
| 180 DCHECK(!IsRtcpPacket(data)); | |
| 181 | |
| 182 // If there is a srtp auth key present then packet must be a RTP packet. | |
| 183 // RTP packet may have been wrapped in a TURN Channel Data or | |
| 184 // TURN send indication. | |
| 185 int rtp_start_pos; | |
| 186 int rtp_length; | |
| 187 if (!GetRtpPacketStartPositionAndLength( | |
| 188 data, length, &rtp_start_pos, &rtp_length)) { | |
| 189 // This method should never return false. | |
| 190 NOTREACHED(); | |
| 191 return false; | |
| 192 } | |
| 193 | |
| 194 // Skip to rtp packet. | |
| 195 char* start = data + rtp_start_pos; | |
| 196 // If packet option has non default value (-1) for sendtime extension id, | |
| 197 // then we should parse the rtp packet to update the timestamp. Otherwise | |
| 198 // just calculate HMAC and update packet with it. | |
| 199 if (options.packet_time_params.rtp_sendtime_extension_id != -1) { | |
| 200 UpdateRtpAbsSendTimeExtn( | |
| 201 start, rtp_length, | |
| 202 options.packet_time_params.rtp_sendtime_extension_id, abs_send_time); | |
| 203 } | |
| 204 | |
| 205 UpdateRtpAuthTag(start, rtp_length, options); | |
| 206 return true; | |
| 207 } | |
| 208 | |
| 209 bool GetRtpPacketStartPositionAndLength( | |
| 210 char* packet, int length, int* rtp_start_pos, int* rtp_packet_length) { | |
| 211 int rtp_begin, rtp_length; | |
| 212 if (IsTurnChannelData(packet)) { | |
| 213 // Turn Channel Message header format. | |
| 214 // 0 1 2 3 | |
| 215 // 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |
| 216 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 217 // | Channel Number | Length | | |
| 218 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 219 // | | | |
| 220 // / Application Data / | |
| 221 // / / | |
| 222 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 223 if (length < kTurnChannelHdrLen) { | |
| 224 return false; | |
| 225 } | |
| 226 | |
| 227 rtp_begin = kTurnChannelHdrLen; | |
| 228 rtp_length = talk_base::GetBE16(&packet[2]); | |
| 229 if (length < rtp_length + kTurnChannelHdrLen) { | |
| 230 return false; | |
| 231 } | |
| 232 } else if (IsTurnSendIndicationPacket(packet)) { | |
| 233 if (length <= P2PSocketHost::kStunHeaderSize) { | |
| 234 // Message must be greater than 20 bytes, if it's carrying any payload. | |
| 235 return false; | |
| 236 } | |
| 237 // Validate STUN message length. | |
| 238 int stun_msg_len = talk_base::GetBE16(&packet[2]); | |
| 239 if (stun_msg_len + P2PSocketHost::kStunHeaderSize != length) { | |
| 240 return false; | |
| 241 } | |
| 242 | |
| 243 // First skip mandatory stun header which is of 20 bytes. | |
| 244 rtp_begin = P2PSocketHost::kStunHeaderSize; | |
| 245 // Loop through STUN attributes until we find STUN DATA attribute. | |
| 246 char* start = packet + rtp_begin; | |
| 247 bool data_attr_present = false; | |
| 248 while ((packet + rtp_begin) - start < length) { | |
| 249 // Keep reading STUN attributes until we hit DATA attribute. | |
| 250 // Attribute will be a TLV structure. | |
| 251 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 252 // | Type | Length | | |
| 253 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 254 // | Value (variable) .... | |
| 255 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 256 // The value in the length field MUST contain the length of the Value | |
| 257 // part of the attribute, prior to padding, measured in bytes. Since | |
| 258 // STUN aligns attributes on 32-bit boundaries, attributes whose content | |
| 259 // is not a multiple of 4 bytes are padded with 1, 2, or 3 bytes of | |
| 260 // padding so that its value contains a multiple of 4 bytes. The | |
| 261 // padding bits are ignored, and may be any value. | |
| 262 uint16 attr_type, attr_length; | |
| 263 // Getting attribute type and length. | |
| 264 attr_type = talk_base::GetBE16(&packet[rtp_begin]); | |
| 265 attr_length = talk_base::GetBE16( | |
| 266 &packet[rtp_begin + sizeof(attr_type)]); | |
| 267 // Checking for bogus attribute length. | |
| 268 if (length < attr_length + rtp_begin) { | |
| 269 return false; | |
| 270 } | |
| 271 | |
| 272 if (attr_type != cricket::STUN_ATTR_DATA) { | |
| 273 rtp_begin += sizeof(attr_type) + sizeof(attr_length) + attr_length; | |
| 274 if ((attr_length % 4) != 0) { | |
| 275 rtp_begin += (4 - (attr_length % 4)); | |
| 276 } | |
| 277 continue; | |
| 278 } | |
| 279 | |
| 280 data_attr_present = true; | |
| 281 rtp_begin += 4; // Skip STUN_DATA_ATTR header. | |
| 282 rtp_length = attr_length; | |
| 283 // One final check of length before exiting. | |
| 284 if (length < rtp_length + rtp_begin) { | |
| 285 return false; | |
| 286 } | |
| 287 // We found STUN_DATA_ATTR. We can skip parsing rest of the packet. | |
| 288 break; | |
| 289 } | |
| 290 | |
| 291 if (!data_attr_present) { | |
| 292 // There is no data attribute present in the message. We can't do anything | |
| 293 // with the message. | |
| 294 return false; | |
| 295 } | |
| 296 | |
| 297 } else { | |
| 298 // This is a raw RTP packet. | |
| 299 rtp_begin = 0; | |
| 300 rtp_length = length; | |
| 301 } | |
| 302 | |
| 303 // Making sure we have a valid RTP packet at the end. | |
| 304 if (IsRtpPacket(packet + rtp_begin, rtp_length) && | |
| 305 ValidateRtpHeader(packet + rtp_begin, rtp_length)) { | |
| 306 *rtp_start_pos = rtp_begin; | |
| 307 *rtp_packet_length = rtp_length; | |
| 308 return true; | |
| 309 } | |
| 310 return false; | |
| 311 } | |
| 312 | |
| 313 // ValidateRtpHeader must be called before this method to make sure, we have | |
| 314 // a sane rtp packet. | |
| 315 bool UpdateRtpAbsSendTimeExtn(char* rtp, int length, | |
| 316 int extension_id, uint32 abs_send_time) { | |
| 317 // 0 1 2 3 | |
| 318 // 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |
| 319 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 320 // |V=2|P|X| CC |M| PT | sequence number | | |
| 321 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 322 // | timestamp | | |
| 323 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 324 // | synchronization source (SSRC) identifier | | |
| 325 // +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| 326 // | contributing source (CSRC) identifiers | | |
| 327 // | .... | | |
| 328 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 329 | |
| 330 // Return if extension bit is not set. | |
| 331 if (!(rtp[0] & 0x10)) { | |
| 332 return true; | |
| 333 } | |
| 334 | |
| 335 int cc_count = rtp[0] & 0x0F; | |
| 336 int rtp_hdr_len_without_extn = kMinRtpHdrLen + 4 * cc_count; | |
| 337 | |
| 338 rtp += rtp_hdr_len_without_extn; | |
| 339 | |
| 340 // Getting extension profile ID and length. | |
| 341 uint16 profile_id = talk_base::GetBE16(rtp); | |
| 342 // Length is in 32 bit words. | |
| 343 uint16 extn_length = talk_base::GetBE16(rtp + 2) * 4; | |
| 344 | |
| 345 rtp += kRtpExtnHdrLen; // Moving past extn header. | |
| 346 | |
| 347 bool found = false; | |
| 348 // WebRTC is using one byte header extension. | |
| 349 // TODO(mallinath) - Handle two byte header extension. | |
| 350 if (profile_id == 0xBEDE) { // OneByte extension header | |
| 351 // 0 | |
| 352 // 0 1 2 3 4 5 6 7 | |
| 353 // +-+-+-+-+-+-+-+-+ | |
| 354 // | ID | len | | |
| 355 // +-+-+-+-+-+-+-+-+ | |
| 356 | |
| 357 // 0 1 2 3 | |
| 358 // 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |
| 359 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 360 // | 0xBE | 0xDE | length=3 | | |
| 361 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 362 // | ID | L=0 | data | ID | L=1 | data... | |
| 363 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 364 // ...data | 0 (pad) | 0 (pad) | ID | L=3 | | |
| 365 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 366 // | data | | |
| 367 // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| 368 char* extn_start = rtp; | |
| 369 while (rtp - extn_start < extn_length) { | |
| 370 const int id = (*rtp & 0xF0) >> 4; | |
| 371 const int len = (*rtp & 0x0F) + 1; | |
| 372 // The 4-bit length is the number minus one of data bytes of this header | |
| 373 // extension element following the one-byte header. | |
| 374 if (id == extension_id) { | |
| 375 UpdateAbsSendTimeExtnValue(rtp + kOneByteHdrLen, len, abs_send_time); | |
| 376 found = true; | |
| 377 break; | |
| 378 } | |
| 379 rtp += kOneByteHdrLen + len; | |
| 380 // Counting padding bytes. | |
| 381 while ((*rtp == 0) && (rtp - extn_start < extn_length)) { | |
| 382 ++rtp; | |
| 383 } | |
| 384 } | |
| 385 } | |
| 386 return found; | |
| 387 } | |
| 388 | |
| 389 } // packet_processing_helpers | |
| 390 | |
| 391 P2PSocketHost::P2PSocketHost(IPC::Sender* message_sender, | 18 P2PSocketHost::P2PSocketHost(IPC::Sender* message_sender, |
| 392 int id) | 19 int id) |
| 393 : message_sender_(message_sender), | 20 : message_sender_(message_sender), |
| 394 id_(id), | 21 id_(id), |
| 395 state_(STATE_UNINITIALIZED) { | 22 state_(STATE_UNINITIALIZED) { |
| 396 } | 23 } |
| 397 | 24 |
| 398 P2PSocketHost::~P2PSocketHost() { } | 25 P2PSocketHost::~P2PSocketHost() { } |
| 399 | 26 |
| 400 // Verifies that the packet |data| has a valid STUN header. | 27 // Verifies that the packet |data| has a valid STUN header. |
| (...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 469 case P2P_SOCKET_STUN_SSLTCP_CLIENT: | 96 case P2P_SOCKET_STUN_SSLTCP_CLIENT: |
| 470 case P2P_SOCKET_STUN_TLS_CLIENT: | 97 case P2P_SOCKET_STUN_TLS_CLIENT: |
| 471 return new P2PSocketHostStunTcp(message_sender, id, type, url_context); | 98 return new P2PSocketHostStunTcp(message_sender, id, type, url_context); |
| 472 } | 99 } |
| 473 | 100 |
| 474 NOTREACHED(); | 101 NOTREACHED(); |
| 475 return NULL; | 102 return NULL; |
| 476 } | 103 } |
| 477 | 104 |
| 478 } // namespace content | 105 } // namespace content |
| OLD | NEW |