Add support for encrypted WebM files as defined in the RFC.

media/webm/webm_cluster_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/webm/webm_cluster_parser.h"
 
 #include "base/logging.h"
+#include "base/sys_byteorder.h"
 #include "media/base/data_buffer.h"
 #include "media/base/decrypt_config.h"
 #include "media/webm/webm_constants.h"
 
 namespace media {
 
 WebMClusterParser::WebMClusterParser(int64 timecode_scale,
                                      int audio_track_num,
                                      int video_track_num,
                                      const uint8* video_encryption_key_id,
@@ skipping 162 matching lines @@
   if (last_block_timecode_ != -1 && timecode < last_block_timecode_) {
     DVLOG(1) << "Got a block with a timecode before the previous block.";
     return false;
   }
 
   last_block_timecode_ = timecode;
 
   base::TimeDelta timestamp = base::TimeDelta::FromMicroseconds(
       (cluster_timecode_ + timecode) * timecode_multiplier_);
 
+  bool encrypted = track_num == video_.track_num() &&
+                         video_encryption_key_id_.get();
+
   // The first bit of the flags is set when the block contains only keyframes.
   // http://www.matroska.org/technical/specs/index.html
   bool is_keyframe = (flags & 0x80) != 0;
   scoped_refptr<StreamParserBuffer> buffer =
       StreamParserBuffer::CopyFrom(data, size, is_keyframe);
 
-  if (track_num == video_.track_num() && video_encryption_key_id_.get()) {
+  if (encrypted) {
+    // Every encrypted Block has an HMAC and IV prepended to it. Current WebM
+    // encrypted request for comments specification is here
+    // http://wiki.webmproject.org/encryption/webm-encryption-rfc.
+    uint64 network_iv;
+    memcpy(&network_iv,
+           data + DecryptConfig::kWebMIntegrityCheckSize,
+           sizeof(network_iv));
+    const uint64 iv = base::NetToHost64(network_iv);

[xhwang, 2012/06/14 19:42:27]

Can we hide all these in the HmacAesDecryptor?

1, We are passing the whole encrypted frame with prepending HMAC and IV to the
decryptor anyway. (Actually we have to do this because we need the "iv_frame"
for hmac checking.)
2, The demuxer and media stack doesn't need to know about these details.
3, The HmacAesDecryptor should be able to work well on the encrypted frame.

[ddorwin, 2012/06/14 21:41:24]

As mentioned earlier, we want DecryptConfig to be container-independent.
Unfortunately, I see the IV is verified as part of the HMAC, which makes
separation difficult. Maybe we can hide this by having char* data_to_verify and
an int offset_to_frame. That way, it's not known to the decryptor what exactly
is before the frame. We would still pass the iv separately.

[fgalligan1, 2012/07/03 22:00:15]

So now I'm passing the IV and the frame data. I put the HMAC into a
data_to_verify member. I also set an offset into the data in the config. I still
can't generalize the decryptor because of the what I said in the other comment.

     buffer->SetDecryptConfig(scoped_ptr<DecryptConfig>(new DecryptConfig(
+        data, DecryptConfig::kWebMIntegrityCheckSize, iv,
         video_encryption_key_id_.get(), video_encryption_key_id_size_)));
   }
 
   buffer->SetTimestamp(timestamp);
 
   if (block_duration >= 0) {
     buffer->SetDuration(base::TimeDelta::FromMicroseconds(
         block_duration * timecode_multiplier_));
   }
 
@@ skipping 89 matching lines @@
   DVLOG(2) << "AddToBufferQueue() : " << track_num_
            << " ts " << buffer->GetTimestamp().InSecondsF()
            << " dur " << buffer->GetDuration().InSecondsF()
            << " kf " << buffer->IsKeyframe()
            << " size " << buffer->GetDataSize();
 
   buffers_.push_back(buffer);
 }
 
 }  // namespace media