summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--media/base/decrypt_config.cc2
-rw-r--r--media/base/decrypt_config.h15
-rw-r--r--media/crypto/aes_decryptor.cc99
-rw-r--r--media/crypto/aes_decryptor.h32
-rw-r--r--media/crypto/aes_decryptor_unittest.cc146
-rw-r--r--media/filters/ffmpeg_video_decoder_unittest.cc3
-rw-r--r--media/filters/pipeline_integration_test.cc3
-rw-r--r--media/mp4/mp4_stream_parser.cc1
-rw-r--r--media/mp4/track_run_iterator.cc1
-rw-r--r--media/webm/webm_cluster_parser.cc24
-rw-r--r--media/webm/webm_constants.h4
-rw-r--r--ppapi/api/private/pp_content_decryptor.idl8
-rw-r--r--ppapi/c/private/pp_content_decryptor.h9
-rw-r--r--webkit/media/crypto/ppapi/cdm_wrapper.cc2
-rw-r--r--webkit/media/crypto/ppapi/clear_key_cdm.cc2
-rw-r--r--webkit/media/crypto/ppapi/content_decryption_module.h5
-rw-r--r--webkit/media/crypto/proxy_decryptor_unittest.cc3
-rw-r--r--webkit/plugins/ppapi/ppapi_plugin_instance.cc4
18 files changed, 109 insertions, 254 deletions
diff --git a/media/base/decrypt_config.cc b/media/base/decrypt_config.cc
index 3142751..53e2014 100644
--- a/media/base/decrypt_config.cc
+++ b/media/base/decrypt_config.cc
@@ -10,12 +10,10 @@ namespace media {
DecryptConfig::DecryptConfig(const std::string& key_id,
const std::string& iv,
- const std::string& checksum,
const int data_offset,
const std::vector<SubsampleEntry>& subsamples)
: key_id_(key_id),
iv_(iv),
- checksum_(checksum),
data_offset_(data_offset),
subsamples_(subsamples) {
CHECK_GT(key_id.size(), 0u);
diff --git a/media/base/decrypt_config.h b/media/base/decrypt_config.h
index 669aa36..be0bb4d 100644
--- a/media/base/decrypt_config.h
+++ b/media/base/decrypt_config.h
@@ -37,10 +37,7 @@ class MEDIA_EXPORT DecryptConfig {
// |key_id| is the ID that references the decryption key for this sample.
// |iv| is the initialization vector defined by the encrypted format.
// Currently |iv| must be 16 bytes as defined by WebM and ISO. Or must be
- // empty which signals to perform the integrity check on an unencrypted
- // frame as defined WebM.
- // |checksum| is the hash value of the encrypted buffer. |checksum| is
- // defined by the encrypted format and may be NULL.
+ // empty which signals an unencrypted frame.
// |data_offset| is the amount of data that should be discarded from the
// head of the sample buffer before applying subsample information. A
// decrypted buffer will be shorter than an encrypted buffer by this amount.
@@ -48,17 +45,15 @@ class MEDIA_EXPORT DecryptConfig {
// described above. A decrypted buffer will be equal in size to the sum
// of the subsample sizes.
//
- // |data_offset| is applied after |checksum|, but before |subsamples|.
+ // |data_offset| is applied before |subsamples|.
DecryptConfig(const std::string& key_id,
const std::string& iv,
- const std::string& checksum,
const int data_offset,
const std::vector<SubsampleEntry>& subsamples);
~DecryptConfig();
const std::string& key_id() const { return key_id_; }
const std::string& iv() const { return iv_; }
- const std::string& checksum() const { return checksum_; }
int data_offset() const { return data_offset_; }
const std::vector<SubsampleEntry>& subsamples() const { return subsamples_; }
@@ -68,10 +63,8 @@ class MEDIA_EXPORT DecryptConfig {
// Initialization vector.
const std::string iv_;
- // Checksum of the data to be verified before decrypting the data. This may
- // be empty for some formats.
- const std::string checksum_;
-
+ // TODO(fgalligan): Remove |data_offset_| if there is no plan to use it in
+ // the future.
// Amount of data to be discarded before applying subsample information.
const int data_offset_;
diff --git a/media/crypto/aes_decryptor.cc b/media/crypto/aes_decryptor.cc
index 777d79f..0fdfa2d 100644
--- a/media/crypto/aes_decryptor.cc
+++ b/media/crypto/aes_decryptor.cc
@@ -10,7 +10,6 @@
#include "base/stl_util.h"
#include "base/string_number_conversions.h"
#include "crypto/encryptor.h"
-#include "crypto/hmac.h"
#include "crypto/symmetric_key.h"
#include "media/base/decoder_buffer.h"
#include "media/base/decrypt_config.h"
@@ -18,72 +17,8 @@
namespace media {
-// The size is from the WebM encrypted specification. Current encrypted WebM
-// request for comments specification is here
-// http://wiki.webmproject.org/encryption/webm-encryption-rfc
-static const int kWebmSha1DigestSize = 20;
-static const char kWebmHmacSeed[] = "hmac-key";
-static const char kWebmEncryptionSeed[] = "encryption-key";
-
uint32 AesDecryptor::next_session_id_ = 1;
-// Derives a key using SHA1 HMAC. |secret| is the base secret to derive
-// the key from. |seed| is the known message to the HMAC algorithm. |key_size|
-// is how many bytes are returned in the key. Returns a string containing the
-// key on success. Returns an empty string on failure.
-static std::string DeriveKey(const base::StringPiece& secret,
- const base::StringPiece& seed,
- int key_size) {
- CHECK(!secret.empty());
- CHECK(!seed.empty());
- CHECK_GT(key_size, 0);
-
- crypto::HMAC hmac(crypto::HMAC::SHA1);
- if (!hmac.Init(secret)) {
- DVLOG(1) << "Could not initialize HMAC with secret data.";
- return std::string();
- }
-
- scoped_array<uint8> calculated_hmac(new uint8[hmac.DigestLength()]);
- if (!hmac.Sign(seed, calculated_hmac.get(), hmac.DigestLength())) {
- DVLOG(1) << "Could not calculate HMAC.";
- return std::string();
- }
-
- return std::string(reinterpret_cast<const char*>(calculated_hmac.get()),
- key_size);
-}
-
-// Checks data in |input| matches the HMAC in |input|. The check is using the
-// SHA1 algorithm. |hmac_key| is the key of the HMAC algorithm. Returns true if
-// the integrity check passes.
-static bool CheckData(const DecoderBuffer& input,
- const base::StringPiece& hmac_key) {
- CHECK(input.GetDataSize());
- CHECK(input.GetDecryptConfig());
- CHECK_GT(input.GetDecryptConfig()->checksum().size(), 0u);
- CHECK(!hmac_key.empty());
-
- crypto::HMAC hmac(crypto::HMAC::SHA1);
- if (!hmac.Init(hmac_key))
- return false;
-
- // The component that initializes |input.GetDecryptConfig()| is responsible
- // for checking that |input.GetDecryptConfig()->checksum_size()| matches
- // what is defined by the format.
-
- // Here, check that checksum size is not greater than the hash
- // algorithm's digest length.
- DCHECK_LE(input.GetDecryptConfig()->checksum().size(),
- hmac.DigestLength());
-
- base::StringPiece data_to_check(
- reinterpret_cast<const char*>(input.GetData()), input.GetDataSize());
-
- return hmac.VerifyTruncated(data_to_check,
- input.GetDecryptConfig()->checksum());
-}
-
enum ClearBytesBufferSel {
kSrcContainsClearBytes,
kDstContainsClearBytes
@@ -273,18 +208,6 @@ void AesDecryptor::Decrypt(const scoped_refptr<DecoderBuffer>& encrypted,
return;
}
- int checksum_size = encrypted->GetDecryptConfig()->checksum().size();
- // According to the WebM encrypted specification, it is an open question
- // what should happen when a frame fails the integrity check.
- // http://wiki.webmproject.org/encryption/webm-encryption-rfc
- if (checksum_size > 0 &&
- !key->hmac_key().empty() &&
- !CheckData(*encrypted, key->hmac_key())) {
- DVLOG(1) << "Integrity check failed.";
- decrypt_cb.Run(kError, NULL);
- return;
- }
-
scoped_refptr<DecoderBuffer> decrypted;
// An empty iv string signals that the frame is unencrypted.
if (encrypted->GetDecryptConfig()->iv().empty()) {
@@ -292,11 +215,7 @@ void AesDecryptor::Decrypt(const scoped_refptr<DecoderBuffer>& encrypted,
decrypted = DecoderBuffer::CopyFrom(encrypted->GetData() + data_offset,
encrypted->GetDataSize() - data_offset);
} else {
- // TODO(strobe): Currently, presence of checksum is used to indicate the use
- // of normal or WebM decryption keys. Consider a more explicit signaling
- // mechanism and the removal of the webm_decryption_key member.
- crypto::SymmetricKey* decryption_key = (checksum_size > 0) ?
- key->webm_decryption_key() : key->decryption_key();
+ crypto::SymmetricKey* decryption_key = key->decryption_key();
decrypted = DecryptData(*encrypted, decryption_key);
if (!decrypted) {
DVLOG(1) << "Decryption failed.";
@@ -346,22 +265,6 @@ bool AesDecryptor::DecryptionKey::Init() {
crypto::SymmetricKey::AES, secret_));
if (!decryption_key_.get())
return false;
-
- std::string raw_key = DeriveKey(secret_,
- kWebmEncryptionSeed,
- secret_.length());
- if (raw_key.empty())
- return false;
-
- webm_decryption_key_.reset(crypto::SymmetricKey::Import(
- crypto::SymmetricKey::AES, raw_key));
- if (!webm_decryption_key_.get())
- return false;
-
- hmac_key_ = DeriveKey(secret_, kWebmHmacSeed, kWebmSha1DigestSize);
- if (hmac_key_.empty())
- return false;
-
return true;
}
diff --git a/media/crypto/aes_decryptor.h b/media/crypto/aes_decryptor.h
index d86d4bc..63bff1c 100644
--- a/media/crypto/aes_decryptor.h
+++ b/media/crypto/aes_decryptor.h
@@ -25,8 +25,7 @@ namespace media {
class DecryptorClient;
// Decrypts an AES encrypted buffer into an unencrypted buffer. The AES
-// encryption must be CTR with a key size of 128bits. Optionally checks the
-// integrity of the encrypted data.
+// encryption must be CTR with a key size of 128bits.
class MEDIA_EXPORT AesDecryptor : public Decryptor {
public:
// The AesDecryptor does not take ownership of the |client|. The |client|
@@ -46,47 +45,34 @@ class MEDIA_EXPORT AesDecryptor : public Decryptor {
const std::string& session_id) OVERRIDE;
virtual void CancelKeyRequest(const std::string& key_system,
const std::string& session_id) OVERRIDE;
- // Decrypts |encrypted| buffer. |encrypted| should not be NULL. |encrypted|
- // will signal if an integrity check must be performed before decryption.
- // Returns a DecoderBuffer with the decrypted data if the decryption
- // succeeded through |decrypt_cb|.
+ // Decrypts |encrypted| buffer. |encrypted| should not be NULL. Returns a
+ // DecoderBuffer with the decrypted data if the decryption succeeded through
+ // |decrypt_cb|.
virtual void Decrypt(const scoped_refptr<DecoderBuffer>& encrypted,
const DecryptCB& decrypt_cb) OVERRIDE;
virtual void Stop() OVERRIDE;
private:
- // Helper class that manages the decryption key and HMAC key. The HMAC key
- // may be NULL.
+ // TODO(fgalligan): Remove this and change KeyMap to use crypto::SymmetricKey
+ // as there are no decryptors that are performing an integrity check.
+ // Helper class that manages the decryption key.
class DecryptionKey {
public:
explicit DecryptionKey(const std::string& secret);
~DecryptionKey();
- // Creates the encryption key, and derives the WebM decryption key and HMAC.
+ // Creates the encryption key.
bool Init();
crypto::SymmetricKey* decryption_key() { return decryption_key_.get(); }
- crypto::SymmetricKey* webm_decryption_key()
- { return webm_decryption_key_.get(); }
- base::StringPiece hmac_key() { return base::StringPiece(hmac_key_); }
private:
- // The base secret that is used to derive the decryption key and optionally
- // the HMAC key.
+ // The base secret that is used to create the decryption key.
const std::string secret_;
// The key used to decrypt the data.
scoped_ptr<crypto::SymmetricKey> decryption_key_;
- // The key used for decryption of WebM media, derived from the secret.
- scoped_ptr<crypto::SymmetricKey> webm_decryption_key_;
-
- // The key used to perform the integrity check. Currently the HMAC key is
- // defined by the WebM encrypted specification. Current encrypted WebM
- // request for comments specification is here
- // http://wiki.webmproject.org/encryption/webm-encryption-rfc
- std::string hmac_key_;
-
DISALLOW_COPY_AND_ASSIGN(DecryptionKey);
};
diff --git a/media/crypto/aes_decryptor_unittest.cc b/media/crypto/aes_decryptor_unittest.cc
index 95472f1..1b9d52e 100644
--- a/media/crypto/aes_decryptor_unittest.cc
+++ b/media/crypto/aes_decryptor_unittest.cc
@@ -41,8 +41,7 @@ struct WebmEncryptedData {
static const char kClearKeySystem[] = "org.w3.clearkey";
// Frames 0 & 1 are encrypted with the same key. Frame 2 is encrypted with a
-// different key. Frame 3 has the same HMAC key as frame 2, but frame 3 is
-// unencrypted.
+// different key. Frame 3 is unencrypted.
const WebmEncryptedData kWebmEncryptedFrames[] = {
{
// plaintext
@@ -57,12 +56,10 @@ const WebmEncryptedData kWebmEncryptedFrames[] = {
0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
}, 16,
// encrypted_data
- { 0x3c, 0x4e, 0xb8, 0xd9, 0x5c, 0x20, 0x48, 0x18,
- 0x4f, 0x03, 0x74, 0xa1, 0x01, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0x99, 0xaa, 0xff,
- 0xb7, 0x74, 0x02, 0x4e, 0x1c, 0x75, 0x3d, 0xee,
- 0xcb, 0x64, 0xf7
- }, 35
+ { 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xf0, 0xd1, 0x12, 0xd5, 0x24, 0x81, 0x96,
+ 0x55, 0x1b, 0x68, 0x9f, 0x38, 0x91, 0x85
+ }, 23
},
{
// plaintext
@@ -77,13 +74,11 @@ const WebmEncryptedData kWebmEncryptedFrames[] = {
0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
}, 16,
// encrypted_data
- { 0xe8, 0x4c, 0x51, 0x33, 0x14, 0x0d, 0xc7, 0x17,
- 0x32, 0x60, 0xc9, 0xd0, 0x01, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0xec, 0x8e, 0x87,
- 0x21, 0xd3, 0xb9, 0x1c, 0x61, 0xf6, 0x5a, 0x60,
- 0xaa, 0x07, 0x0e, 0x96, 0xd0, 0x54, 0x5d, 0x35,
- 0x9a, 0x4a, 0xd3
- }, 43
+ { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x57, 0x66, 0xf4, 0x12, 0x1a, 0xed, 0xb5,
+ 0x79, 0x1c, 0x8e, 0x25, 0xd7, 0x17, 0xe7, 0x5e,
+ 0x16, 0xe3, 0x40, 0x08, 0x27, 0x11, 0xe9
+ }, 31
},
{
// plaintext
@@ -97,12 +92,10 @@ const WebmEncryptedData kWebmEncryptedFrames[] = {
0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40
}, 16,
// encrypted_data
- { 0x46, 0x93, 0x8c, 0x93, 0x48, 0xf9, 0xeb, 0x30,
- 0x74, 0x55, 0x6b, 0xf2, 0x01, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x01, 0x48, 0x5e, 0x4a,
- 0x41, 0x2a, 0x8b, 0xf4, 0xc6, 0x47, 0x54, 0x90,
- 0x34, 0xf4, 0x8b
- }, 35
+ { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x01, 0x9c, 0x71, 0x26, 0x57, 0x3e, 0x25, 0x37,
+ 0xf7, 0x31, 0x81, 0x19, 0x64, 0xce, 0xbc
+ }, 23
},
{
// plaintext
@@ -116,15 +109,15 @@ const WebmEncryptedData kWebmEncryptedFrames[] = {
0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40
}, 16,
// encrypted_data
- { 0xee, 0xd6, 0xf5, 0x64, 0x5f, 0xe0, 0x6a, 0xa2,
- 0x9e, 0xd6, 0xce, 0x34, 0x00, 0x43, 0x68, 0x61,
- 0x6e, 0x67, 0x65, 0x64, 0x20, 0x4f, 0x72, 0x69,
- 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x20, 0x64, 0x61,
- 0x74, 0x61, 0x2e
- }, 35
+ { 0x00, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x64,
+ 0x20, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61,
+ 0x6c, 0x20, 0x64, 0x61, 0x74, 0x61, 0x2e
+ }, 23
}
};
+
+
static const uint8 kWebmWrongSizedKey[] = { 0x20, 0x20 };
static const uint8 kSubsampleOriginalData[] = "Original subsample data.";
@@ -184,28 +177,28 @@ static std::string GenerateCounterBlock(const uint8* iv, int iv_size) {
// Creates a WebM encrypted buffer that the demuxer would pass to the
// decryptor. |data| is the payload of a WebM encrypted Block. |key_id| is
// initialization data from the WebM file. Every encrypted Block has
-// an HMAC and a signal byte prepended to a frame. If the frame is encrypted
-// then an IV is prepended to the Block. Current encrypted WebM request for
-// comments specification is here
+// a signal byte prepended to a frame. If the frame is encrypted then an IV is
+// prepended to the Block. Current encrypted WebM request for comments
+// specification is here
// http://wiki.webmproject.org/encryption/webm-encryption-rfc
static scoped_refptr<DecoderBuffer> CreateWebMEncryptedBuffer(
const uint8* data, int data_size,
const uint8* key_id, int key_id_size) {
scoped_refptr<DecoderBuffer> encrypted_buffer = DecoderBuffer::CopyFrom(
- data + kWebMHmacSize, data_size - kWebMHmacSize);
+ data, data_size);
CHECK(encrypted_buffer);
- uint8 signal_byte = data[kWebMHmacSize];
+ uint8 signal_byte = data[0];
int data_offset = sizeof(signal_byte);
// Setting the DecryptConfig object of the buffer while leaving the
// initialization vector empty will tell the decryptor that the frame is
- // unencrypted but integrity should still be checked.
+ // unencrypted.
std::string counter_block_str;
if (signal_byte & kWebMFlagEncryptedFrame) {
uint64 network_iv;
- memcpy(&network_iv, data + kWebMHmacSize + data_offset, sizeof(network_iv));
+ memcpy(&network_iv, data + data_offset, sizeof(network_iv));
const uint64 iv = base::NetToHost64(network_iv);
counter_block_str =
GenerateCounterBlock(reinterpret_cast<const uint8*>(&iv), sizeof(iv));
@@ -216,7 +209,6 @@ static scoped_refptr<DecoderBuffer> CreateWebMEncryptedBuffer(
scoped_ptr<DecryptConfig>(new DecryptConfig(
std::string(reinterpret_cast<const char*>(key_id), key_id_size),
counter_block_str,
- std::string(reinterpret_cast<const char*>(data), kWebMHmacSize),
data_offset,
std::vector<SubsampleEntry>())));
return encrypted_buffer;
@@ -235,7 +227,6 @@ static scoped_refptr<DecoderBuffer> CreateSubsampleEncryptedBuffer(
scoped_ptr<DecryptConfig>(new DecryptConfig(
std::string(reinterpret_cast<const char*>(key_id), key_id_size),
std::string(reinterpret_cast<const char*>(iv), iv_size),
- std::string(),
data_offset,
subsample_entries)));
return encrypted_buffer;
@@ -290,6 +281,32 @@ class AesDecryptorTest : public testing::Test {
EXPECT_EQ(0, memcmp(plain_text, decrypted->GetData(), plain_text_size));
}
+ void DecryptAndExpectDataMismatch(
+ const scoped_refptr<DecoderBuffer>& encrypted,
+ const uint8* plain_text, int plain_text_size) {
+ scoped_refptr<DecoderBuffer> decrypted;
+ EXPECT_CALL(*this, BufferDecrypted(AesDecryptor::kSuccess, NotNull()))
+ .WillOnce(SaveArg<1>(&decrypted));
+
+ decryptor_.Decrypt(encrypted, decrypt_cb_);
+ ASSERT_TRUE(decrypted);
+ ASSERT_EQ(plain_text_size, decrypted->GetDataSize());
+ EXPECT_NE(0, memcmp(plain_text, decrypted->GetData(), plain_text_size));
+ }
+
+ void DecryptAndExpectSizeDataMismatch(
+ const scoped_refptr<DecoderBuffer>& encrypted,
+ const uint8* plain_text, int plain_text_size) {
+ scoped_refptr<DecoderBuffer> decrypted;
+ EXPECT_CALL(*this, BufferDecrypted(AesDecryptor::kSuccess, NotNull()))
+ .WillOnce(SaveArg<1>(&decrypted));
+
+ decryptor_.Decrypt(encrypted, decrypt_cb_);
+ ASSERT_TRUE(decrypted);
+ EXPECT_NE(plain_text_size, decrypted->GetDataSize());
+ EXPECT_NE(0, memcmp(plain_text, decrypted->GetData(), plain_text_size));
+ }
+
void DecryptAndExpectToFail(const scoped_refptr<DecoderBuffer>& encrypted) {
EXPECT_CALL(*this, BufferDecrypted(AesDecryptor::kError, IsNull()));
decryptor_.Decrypt(encrypted, decrypt_cb_);
@@ -344,7 +361,9 @@ TEST_F(AesDecryptorTest, WrongKey) {
CreateWebMEncryptedBuffer(frame.encrypted_data,
frame.encrypted_data_size,
frame.key_id, frame.key_id_size);
- ASSERT_NO_FATAL_FAILURE(DecryptAndExpectToFail(encrypted_data));
+ ASSERT_NO_FATAL_FAILURE(DecryptAndExpectDataMismatch(encrypted_data,
+ frame.plain_text,
+ frame.plain_text_size));
}
TEST_F(AesDecryptorTest, NoKey) {
@@ -372,7 +391,9 @@ TEST_F(AesDecryptorTest, KeyReplacement) {
CreateWebMEncryptedBuffer(frame.encrypted_data,
frame.encrypted_data_size,
frame.key_id, frame.key_id_size);
- ASSERT_NO_FATAL_FAILURE(DecryptAndExpectToFail(encrypted_data));
+ ASSERT_NO_FATAL_FAILURE(DecryptAndExpectDataMismatch(encrypted_data,
+ frame.plain_text,
+ frame.plain_text_size));
AddKeyAndExpectToSucceed(frame.key_id, frame.key_id_size,
frame.key, frame.key_size);
ASSERT_NO_FATAL_FAILURE(DecryptAndExpectToSucceed(encrypted_data,
@@ -423,26 +444,7 @@ TEST_F(AesDecryptorTest, MultipleKeysAndFrames) {
frame2.plain_text_size));
}
-TEST_F(AesDecryptorTest, HmacCheckFailure) {
- const WebmEncryptedData& frame = kWebmEncryptedFrames[0];
- GenerateKeyRequest(frame.key_id, frame.key_id_size);
- AddKeyAndExpectToSucceed(frame.key_id, frame.key_id_size,
- frame.key, frame.key_size);
-
- // Change byte 0 to modify the HMAC. Bytes 0-11 of WebM encrypted data
- // contains the HMAC.
- std::vector<uint8> frame_with_bad_hmac(
- frame.encrypted_data, frame.encrypted_data + frame.encrypted_data_size);
- frame_with_bad_hmac[0]++;
-
- scoped_refptr<DecoderBuffer> encrypted_data =
- CreateWebMEncryptedBuffer(&frame_with_bad_hmac[0],
- frame.encrypted_data_size,
- frame.key_id, frame.key_id_size);
- ASSERT_NO_FATAL_FAILURE(DecryptAndExpectToFail(encrypted_data));
-}
-
-TEST_F(AesDecryptorTest, IvCheckFailure) {
+TEST_F(AesDecryptorTest, CorruptedIv) {
const WebmEncryptedData& frame = kWebmEncryptedFrames[0];
GenerateKeyRequest(frame.key_id, frame.key_id_size);
AddKeyAndExpectToSucceed(frame.key_id, frame.key_id_size,
@@ -452,16 +454,18 @@ TEST_F(AesDecryptorTest, IvCheckFailure) {
// contains the IV.
std::vector<uint8> frame_with_bad_iv(
frame.encrypted_data, frame.encrypted_data + frame.encrypted_data_size);
- frame_with_bad_iv[kWebMHmacSize + 1]++;
+ frame_with_bad_iv[1]++;
scoped_refptr<DecoderBuffer> encrypted_data =
CreateWebMEncryptedBuffer(&frame_with_bad_iv[0],
frame.encrypted_data_size,
frame.key_id, frame.key_id_size);
- ASSERT_NO_FATAL_FAILURE(DecryptAndExpectToFail(encrypted_data));
+ ASSERT_NO_FATAL_FAILURE(DecryptAndExpectDataMismatch(encrypted_data,
+ frame.plain_text,
+ frame.plain_text_size));
}
-TEST_F(AesDecryptorTest, DataCheckFailure) {
+TEST_F(AesDecryptorTest, CorruptedData) {
const WebmEncryptedData& frame = kWebmEncryptedFrames[0];
GenerateKeyRequest(frame.key_id, frame.key_id_size);
AddKeyAndExpectToSucceed(frame.key_id, frame.key_id_size,
@@ -477,7 +481,9 @@ TEST_F(AesDecryptorTest, DataCheckFailure) {
CreateWebMEncryptedBuffer(&frame_with_bad_vp8_data[0],
frame.encrypted_data_size,
frame.key_id, frame.key_id_size);
- ASSERT_NO_FATAL_FAILURE(DecryptAndExpectToFail(encrypted_data));
+ ASSERT_NO_FATAL_FAILURE(DecryptAndExpectDataMismatch(encrypted_data,
+ frame.plain_text,
+ frame.plain_text_size));
}
TEST_F(AesDecryptorTest, EncryptedAsUnencryptedFailure) {
@@ -490,13 +496,16 @@ TEST_F(AesDecryptorTest, EncryptedAsUnencryptedFailure) {
// 12 of WebM encrypted data contains the signal byte.
std::vector<uint8> frame_with_wrong_signal_byte(
frame.encrypted_data, frame.encrypted_data + frame.encrypted_data_size);
- frame_with_wrong_signal_byte[kWebMHmacSize] = 0;
+ frame_with_wrong_signal_byte[0] = 0;
scoped_refptr<DecoderBuffer> encrypted_data =
CreateWebMEncryptedBuffer(&frame_with_wrong_signal_byte[0],
frame.encrypted_data_size,
frame.key_id, frame.key_id_size);
- ASSERT_NO_FATAL_FAILURE(DecryptAndExpectToFail(encrypted_data));
+ ASSERT_NO_FATAL_FAILURE(
+ DecryptAndExpectSizeDataMismatch(encrypted_data,
+ frame.plain_text,
+ frame.plain_text_size));
}
TEST_F(AesDecryptorTest, UnencryptedAsEncryptedFailure) {
@@ -506,16 +515,19 @@ TEST_F(AesDecryptorTest, UnencryptedAsEncryptedFailure) {
frame.key, frame.key_size);
// Change signal byte from an unencrypted frame to an encrypted frame. Byte
- // 12 of WebM encrypted data contains the signal byte.
+ // 0 of WebM encrypted data contains the signal byte.
std::vector<uint8> frame_with_wrong_signal_byte(
frame.encrypted_data, frame.encrypted_data + frame.encrypted_data_size);
- frame_with_wrong_signal_byte[kWebMHmacSize] = kWebMFlagEncryptedFrame;
+ frame_with_wrong_signal_byte[0] = kWebMFlagEncryptedFrame;
scoped_refptr<DecoderBuffer> encrypted_data =
CreateWebMEncryptedBuffer(&frame_with_wrong_signal_byte[0],
frame.encrypted_data_size,
frame.key_id, frame.key_id_size);
- ASSERT_NO_FATAL_FAILURE(DecryptAndExpectToFail(encrypted_data));
+ ASSERT_NO_FATAL_FAILURE(
+ DecryptAndExpectSizeDataMismatch(encrypted_data,
+ frame.plain_text,
+ frame.plain_text_size));
}
TEST_F(AesDecryptorTest, SubsampleDecryption) {
diff --git a/media/filters/ffmpeg_video_decoder_unittest.cc b/media/filters/ffmpeg_video_decoder_unittest.cc
index be32dac..57714c7 100644
--- a/media/filters/ffmpeg_video_decoder_unittest.cc
+++ b/media/filters/ffmpeg_video_decoder_unittest.cc
@@ -40,7 +40,6 @@ static const gfx::Rect kVisibleRect(320, 240);
static const gfx::Size kNaturalSize(320, 240);
static const uint8 kFakeKeyId[] = { 0x4b, 0x65, 0x79, 0x20, 0x49, 0x44 };
static const uint8 kFakeIv[DecryptConfig::kDecryptionKeySize] = { 0 };
-static const uint8 kFakeCheckSum[] = { 0, 0 };
// Create a fake non-empty encrypted buffer.
static scoped_refptr<DecoderBuffer> CreateFakeEncryptedBuffer() {
@@ -52,8 +51,6 @@ static scoped_refptr<DecoderBuffer> CreateFakeEncryptedBuffer() {
arraysize(kFakeKeyId)),
std::string(reinterpret_cast<const char*>(kFakeIv),
DecryptConfig::kDecryptionKeySize),
- std::string(reinterpret_cast<const char*>(kFakeCheckSum),
- arraysize(kFakeCheckSum)),
encrypted_frame_offset,
std::vector<SubsampleEntry>())));
return buffer;
diff --git a/media/filters/pipeline_integration_test.cc b/media/filters/pipeline_integration_test.cc
index 08bec43..019f28a 100644
--- a/media/filters/pipeline_integration_test.cc
+++ b/media/filters/pipeline_integration_test.cc
@@ -362,8 +362,7 @@ TEST_F(PipelineIntegrationTest, BasicPlayback_16x9AspectRatio) {
ASSERT_TRUE(WaitUntilOnEnded());
}
-// TODO(fgalligan): Enable after HMAC has been removed. http://crbug.com/150014
-TEST_F(PipelineIntegrationTest, DISABLED_EncryptedPlayback) {
+TEST_F(PipelineIntegrationTest, EncryptedPlayback) {
MockMediaSource source("bear-320x240-encrypted.webm", kWebM, 219816);
FakeDecryptorClient encrypted_media;
StartPipelineWithEncryptedMedia(&source, &encrypted_media);
diff --git a/media/mp4/mp4_stream_parser.cc b/media/mp4/mp4_stream_parser.cc
index b8f6331..2f51321 100644
--- a/media/mp4/mp4_stream_parser.cc
+++ b/media/mp4/mp4_stream_parser.cc
@@ -414,7 +414,6 @@ bool MP4StreamParser::EnqueueSample(BufferQueue* audio_buffers,
decrypt_config.reset(new DecryptConfig(
decrypt_config->key_id(),
decrypt_config->iv(),
- decrypt_config->checksum(),
decrypt_config->data_offset(),
subsamples));
}
diff --git a/media/mp4/track_run_iterator.cc b/media/mp4/track_run_iterator.cc
index 073eeee..36ec206 100644
--- a/media/mp4/track_run_iterator.cc
+++ b/media/mp4/track_run_iterator.cc
@@ -439,7 +439,6 @@ scoped_ptr<DecryptConfig> TrackRunIterator::GetDecryptConfig() {
std::string(reinterpret_cast<const char*>(&kid[0]), kid.size()),
std::string(reinterpret_cast<const char*>(cenc_info.iv),
arraysize(cenc_info.iv)),
- std::string(), // No checksum in MP4 using CENC.
0, // No offset to start of media data in MP4 using CENC.
cenc_info.subsamples));
}
diff --git a/media/webm/webm_cluster_parser.cc b/media/webm/webm_cluster_parser.cc
index cb7501e..a6867bc0 100644
--- a/media/webm/webm_cluster_parser.cc
+++ b/media/webm/webm_cluster_parser.cc
@@ -203,46 +203,42 @@ bool WebMClusterParser::OnBlock(int track_num, int timecode,
base::TimeDelta timestamp = base::TimeDelta::FromMicroseconds(
(cluster_timecode_ + timecode) * timecode_multiplier_);
- // Every encrypted Block has an HMAC and IV prepended to it. Current encrypted
- // WebM request for comments specification is here
+ // Every encrypted Block has a signal byte and IV prepended to it. Current
+ // encrypted WebM request for comments specification is here
// http://wiki.webmproject.org/encryption/webm-encryption-rfc
bool is_track_encrypted =
track_num == video_.track_num() && !video_encryption_key_id_.empty();
- // If stream is encrypted skip past the HMAC. Encrypted buffers must include
- // the signal byte, the IV (if frame is encrypted) and
- // the frame because the decryptor will verify this data before decryption.
- // The HMAC and IV will be copied into DecryptConfig.
- int offset = (is_track_encrypted) ? kWebMHmacSize : 0;
-
// The first bit of the flags is set when the block contains only keyframes.
// http://www.matroska.org/technical/specs/index.html
bool is_keyframe = (flags & 0x80) != 0;
scoped_refptr<StreamParserBuffer> buffer =
- StreamParserBuffer::CopyFrom(data + offset, size - offset, is_keyframe);
+ StreamParserBuffer::CopyFrom(data, size, is_keyframe);
if (is_track_encrypted) {
- uint8 signal_byte = data[kWebMHmacSize];
+ uint8 signal_byte = data[0];
int data_offset = sizeof(signal_byte);
// Setting the DecryptConfig object of the buffer while leaving the
// initialization vector empty will tell the decryptor that the frame is
- // unencrypted but integrity should still be checked.
+ // unencrypted.
std::string counter_block;
if (signal_byte & kWebMFlagEncryptedFrame) {
uint64 network_iv;
- memcpy(&network_iv, data + kWebMHmacSize + data_offset,
- sizeof(network_iv));
+ memcpy(&network_iv, data + data_offset, sizeof(network_iv));
const uint64 iv = base::NetToHost64(network_iv);
counter_block = GenerateCounterBlock(iv);
data_offset += sizeof(iv);
}
+ // TODO(fgalligan): Revisit if DecryptConfig needs to be set on unencrypted
+ // frames after the CDM API is finalized.
+ // Unencrypted frames of potentially encrypted streams currently set
+ // DecryptConfig.
buffer->SetDecryptConfig(scoped_ptr<DecryptConfig>(new DecryptConfig(
video_encryption_key_id_,
counter_block,
- std::string(reinterpret_cast<const char*>(data), kWebMHmacSize),
data_offset,
std::vector<SubsampleEntry>())));
}
diff --git a/media/webm/webm_constants.h b/media/webm/webm_constants.h
index 7d6f3ed..463b15a 100644
--- a/media/webm/webm_constants.h
+++ b/media/webm/webm_constants.h
@@ -199,11 +199,9 @@ const int64 kWebMUnknownSize = GG_LONGLONG(0x00FFFFFFFFFFFFFF);
const uint8 kWebMFlagKeyframe = 0x80;
-// The size is from the WebM encrypted specification. Current encrypted WebM
-// request for comments specification is here
+// Current encrypted WebM request for comments specification is here
// http://wiki.webmproject.org/encryption/webm-encryption-rfc
const uint8 kWebMFlagEncryptedFrame = 0x1;
-const int kWebMHmacSize = 12;
} // namespace media
diff --git a/ppapi/api/private/pp_content_decryptor.idl b/ppapi/api/private/pp_content_decryptor.idl
index 099cfe9..14d9c1c 100644
--- a/ppapi/api/private/pp_content_decryptor.idl
+++ b/ppapi/api/private/pp_content_decryptor.idl
@@ -76,7 +76,7 @@ struct PP_DecryptSubsampleDescription {
* The <code>PP_EncryptedBlockInfo</code> struct contains all the information
* needed to decrypt an encrypted block.
*/
-[assert_size(256)]
+[assert_size(240)]
struct PP_EncryptedBlockInfo {
/**
* Information needed by the client to track the block to be decrypted.
@@ -107,12 +107,6 @@ struct PP_EncryptedBlockInfo {
uint32_t iv_size;
/**
- * Checksum of the block to be decrypted.
- */
- uint8_t[12] checksum;
- uint32_t checksum_size;
-
- /**
* Subsample information of the block to be decrypted.
*/
PP_DecryptSubsampleDescription[16] subsamples;
diff --git a/ppapi/c/private/pp_content_decryptor.h b/ppapi/c/private/pp_content_decryptor.h
index 114ac57..fba09da 100644
--- a/ppapi/c/private/pp_content_decryptor.h
+++ b/ppapi/c/private/pp_content_decryptor.h
@@ -3,7 +3,7 @@
* found in the LICENSE file.
*/
-/* From private/pp_content_decryptor.idl modified Fri Aug 24 16:06:47 2012. */
+/* From private/pp_content_decryptor.idl modified Mon Sep 17 09:50:39 2012. */
#ifndef PPAPI_C_PRIVATE_PP_CONTENT_DECRYPTOR_H_
#define PPAPI_C_PRIVATE_PP_CONTENT_DECRYPTOR_H_
@@ -114,17 +114,12 @@ struct PP_EncryptedBlockInfo {
uint8_t iv[16];
uint32_t iv_size;
/**
- * Checksum of the block to be decrypted.
- */
- uint8_t checksum[12];
- uint32_t checksum_size;
- /**
* Subsample information of the block to be decrypted.
*/
struct PP_DecryptSubsampleDescription subsamples[16];
uint32_t num_subsamples;
};
-PP_COMPILE_ASSERT_STRUCT_SIZE_IN_BYTES(PP_EncryptedBlockInfo, 256);
+PP_COMPILE_ASSERT_STRUCT_SIZE_IN_BYTES(PP_EncryptedBlockInfo, 240);
/**
* @}
*/
diff --git a/webkit/media/crypto/ppapi/cdm_wrapper.cc b/webkit/media/crypto/ppapi/cdm_wrapper.cc
index 9098065..ef9afdd 100644
--- a/webkit/media/crypto/ppapi/cdm_wrapper.cc
+++ b/webkit/media/crypto/ppapi/cdm_wrapper.cc
@@ -205,8 +205,6 @@ void CdmWrapper::Decrypt(pp::Buffer_Dev encrypted_buffer,
input_buffer.key_id_size = encrypted_block_info.key_id_size;
input_buffer.iv = encrypted_block_info.iv;
input_buffer.iv_size = encrypted_block_info.iv_size;
- input_buffer.checksum = encrypted_block_info.checksum;
- input_buffer.checksum_size = encrypted_block_info.checksum_size;
input_buffer.num_subsamples = encrypted_block_info.num_subsamples;
std::vector<cdm::SubsampleEntry> subsamples;
diff --git a/webkit/media/crypto/ppapi/clear_key_cdm.cc b/webkit/media/crypto/ppapi/clear_key_cdm.cc
index 94addb4..ad2d739 100644
--- a/webkit/media/crypto/ppapi/clear_key_cdm.cc
+++ b/webkit/media/crypto/ppapi/clear_key_cdm.cc
@@ -31,8 +31,6 @@ static scoped_refptr<media::DecoderBuffer> CopyDecoderBufferFrom(
input_buffer.key_id_size),
std::string(reinterpret_cast<const char*>(input_buffer.iv),
input_buffer.iv_size),
- std::string(reinterpret_cast<const char*>(input_buffer.checksum),
- input_buffer.checksum_size),
input_buffer.data_offset,
subsamples));
diff --git a/webkit/media/crypto/ppapi/content_decryption_module.h b/webkit/media/crypto/ppapi/content_decryption_module.h
index 0f2244a..500fdf1 100644
--- a/webkit/media/crypto/ppapi/content_decryption_module.h
+++ b/webkit/media/crypto/ppapi/content_decryption_module.h
@@ -97,8 +97,6 @@ struct InputBuffer {
key_id_size(0),
iv(NULL),
iv_size(0),
- checksum(NULL),
- checksum_size(0),
subsamples(NULL),
num_subsamples(0),
timestamp(0) {}
@@ -114,9 +112,6 @@ struct InputBuffer {
const uint8_t* iv; // Initialization vector.
uint32_t iv_size; // Size (in bytes) of |iv|.
- const uint8_t* checksum;
- uint32_t checksum_size; // Size (in bytes) of the |checksum|.
-
const struct SubsampleEntry* subsamples;
uint32_t num_subsamples; // Number of subsamples in |subsamples|.
diff --git a/webkit/media/crypto/proxy_decryptor_unittest.cc b/webkit/media/crypto/proxy_decryptor_unittest.cc
index 097d48c..826d861 100644
--- a/webkit/media/crypto/proxy_decryptor_unittest.cc
+++ b/webkit/media/crypto/proxy_decryptor_unittest.cc
@@ -27,7 +27,6 @@ namespace webkit_media {
static const uint8 kFakeKeyId[] = { 0x4b, 0x65, 0x79, 0x20, 0x49, 0x44 };
static const uint8 kFakeIv[DecryptConfig::kDecryptionKeySize] = { 0 };
-static const uint8 kFakeCheckSum[] = { 0, 0 };
static const char kFakeKeySystem[] = "system.key.fake";
static const char kFakeSessionId[] = "FakeSessionId";
static const uint8 kFakeKey[] = { 0x4b, 0x65, 0x79 };
@@ -45,8 +44,6 @@ static scoped_refptr<DecoderBuffer> CreateFakeEncryptedBuffer() {
arraysize(kFakeKeyId)),
std::string(reinterpret_cast<const char*>(kFakeIv),
DecryptConfig::kDecryptionKeySize),
- std::string(reinterpret_cast<const char*>(kFakeCheckSum),
- arraysize(kFakeCheckSum)),
encrypted_frame_offset,
std::vector<media::SubsampleEntry>())));
return encrypted_buffer;
diff --git a/webkit/plugins/ppapi/ppapi_plugin_instance.cc b/webkit/plugins/ppapi/ppapi_plugin_instance.cc
index cd03fa9..3a357a8 100644
--- a/webkit/plugins/ppapi/ppapi_plugin_instance.cc
+++ b/webkit/plugins/ppapi/ppapi_plugin_instance.cc
@@ -359,13 +359,11 @@ bool MakeEncryptedBlockInfo(
block_info->data_offset = decrypt_config.data_offset();
if (!CopyStringToArray(decrypt_config.key_id(), block_info->key_id) ||
- !CopyStringToArray(decrypt_config.iv(), block_info->iv) ||
- !CopyStringToArray(decrypt_config.checksum(), block_info->checksum))
+ !CopyStringToArray(decrypt_config.iv(), block_info->iv))
return false;
block_info->key_id_size = decrypt_config.key_id().size();
block_info->iv_size = decrypt_config.iv().size();
- block_info->checksum_size = decrypt_config.checksum().size();
if (decrypt_config.subsamples().size() > arraysize(block_info->subsamples))
return false;
generated by cgit v1.1 at 2025-02-19 06:49:13 +0000