Add support for encrypted WebM files as defined in the RFC.

media/webm/webm_cluster_parser.cc

Index: media/webm/webm_cluster_parser.cc
diff --git a/media/webm/webm_cluster_parser.cc b/media/webm/webm_cluster_parser.cc
index 5b18c56e106a520df5e801b1a899a341a1ea8a7e..4e3ed33c6ebe9868c6077bb8585cc9694ad4b1cd 100644
--- a/media/webm/webm_cluster_parser.cc
+++ b/media/webm/webm_cluster_parser.cc
@@ -5,6 +5,7 @@
 #include "media/webm/webm_cluster_parser.h"
 
 #include "base/logging.h"
+#include "base/sys_byteorder.h"
 #include "media/base/data_buffer.h"
 #include "media/base/decrypt_config.h"
 #include "media/webm/webm_constants.h"
@@ -187,14 +188,26 @@ bool WebMClusterParser::OnBlock(int track_num, int timecode,
   base::TimeDelta timestamp = base::TimeDelta::FromMicroseconds(
       (cluster_timecode_ + timecode) * timecode_multiplier_);
 
+  bool encrypted = track_num == video_.track_num() &&
+                         video_encryption_key_id_.get();
+
   // The first bit of the flags is set when the block contains only keyframes.
   // http://www.matroska.org/technical/specs/index.html
   bool is_keyframe = (flags & 0x80) != 0;
   scoped_refptr<StreamParserBuffer> buffer =
       StreamParserBuffer::CopyFrom(data, size, is_keyframe);
 
-  if (track_num == video_.track_num() && video_encryption_key_id_.get()) {
+  if (encrypted) {
+    // Every encrypted Block has an HMAC and IV prepended to it. Current WebM
+    // encrypted request for comments specification is here
+    // http://wiki.webmproject.org/encryption/webm-encryption-rfc.
+    uint64 network_iv;
+    memcpy(&network_iv,
+           data + DecryptConfig::kWebMIntegrityCheckSize,
+           sizeof(network_iv));
+    const uint64 iv = base::NetToHost64(network_iv);

[xhwang, 2012/06/14 19:42:27]

Can we hide all these in the HmacAesDecryptor?

1, We are passing the whole encrypted frame with prepending HMAC and IV to the
decryptor anyway. (Actually we have to do this because we need the "iv_frame"
for hmac checking.)
2, The demuxer and media stack doesn't need to know about these details.
3, The HmacAesDecryptor should be able to work well on the encrypted frame.

[ddorwin, 2012/06/14 21:41:24]

As mentioned earlier, we want DecryptConfig to be container-independent.
Unfortunately, I see the IV is verified as part of the HMAC, which makes
separation difficult. Maybe we can hide this by having char* data_to_verify and
an int offset_to_frame. That way, it's not known to the decryptor what exactly
is before the frame. We would still pass the iv separately.

[fgalligan1, 2012/07/03 22:00:15]

So now I'm passing the IV and the frame data. I put the HMAC into a
data_to_verify member. I also set an offset into the data in the config. I still
can't generalize the decryptor because of the what I said in the other comment.

     buffer->SetDecryptConfig(scoped_ptr<DecryptConfig>(new DecryptConfig(
+        data, DecryptConfig::kWebMIntegrityCheckSize, iv,
         video_encryption_key_id_.get(), video_encryption_key_id_size_)));
   }