livekit-client 1.12.0 → 1.12.2

package/src/e2ee/worker/FrameCryptor.ts

@@ -1,6 +1,7 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
 // TODO code inspired by https://github.com/webrtc/samples/blob/gh-pages/src/content/insertable-streams/endtoend-encryption/js/worker.js
-import EventEmitter from 'eventemitter3';
+import { EventEmitter } from 'events';
+import type TypedEventEmitter from 'typed-emitter';
 import { workerLogger } from '../../logger';
 import type { VideoCodec } from '../../room/track/options';
 import { ENCRYPTION_ALGORITHM, IV_LENGTH, UNENCRYPTED_BYTES } from '../constants';
@@ -26,7 +27,7 @@ export interface TransformerInfo {
   abortController: AbortController;
 }
 
-export class BaseFrameCryptor extends EventEmitter<CryptorCallbacks> {
+export class BaseFrameCryptor extends (EventEmitter as new () => TypedEventEmitter<CryptorCallbacks>) {
   encodeFunction(
     encodedFrame: RTCEncodedVideoFrame | RTCEncodedAudioFrame,
     controller: TransformStreamDefaultController,
@@ -49,8 +50,6 @@ export class BaseFrameCryptor extends EventEmitter<CryptorCallbacks> {
 export class FrameCryptor extends BaseFrameCryptor {
   private sendCounts: Map<number, number>;
 
-  private isKeyInvalid = false;
-
   private participantId: string | undefined;
 
   private trackId: string | undefined;
@@ -270,16 +269,16 @@ export class FrameCryptor extends BaseFrameCryptor {
     const data = new Uint8Array(encodedFrame.data);
     const keyIndex = data[encodedFrame.data.byteLength - 1];
 
-    if (this.keys.getKeySet(keyIndex)) {
+    if (this.keys.getKeySet(keyIndex) && this.keys.hasValidKey) {
       try {
         const decodedFrame = await this.decryptFrame(encodedFrame, keyIndex);
+        this.keys.decryptionSuccess();
         if (decodedFrame) {
           return controller.enqueue(decodedFrame);
         }
-        this.isKeyInvalid = false;
       } catch (error) {
         if (error instanceof CryptorError && error.reason === CryptorErrorReason.InvalidKey) {
-          if (!this.isKeyInvalid) {
+          if (this.keys.hasValidKey) {
             workerLogger.warn('invalid key');
             this.emit(
               CryptorEvent.Error,
@@ -288,20 +287,12 @@ export class FrameCryptor extends BaseFrameCryptor {
                 CryptorErrorReason.InvalidKey,
               ),
             );
-            this.isKeyInvalid = true;
+            this.keys.decryptionFailure();
           }
         } else {
           workerLogger.warn('decoding frame failed', { error });
         }
       }
-    } else {
-      this.emit(
-        CryptorEvent.Error,
-        new CryptorError(
-          `key missing for participant ${this.participantId}`,
-          CryptorErrorReason.MissingKey,
-        ),
-      );
     }
 
     return controller.enqueue(encodedFrame);
@@ -407,6 +398,13 @@ export class FrameCryptor extends BaseFrameCryptor {
           }
 
           workerLogger.warn('maximum ratchet attempts exceeded, resetting key');
+          this.emit(
+            CryptorEvent.Error,
+            new CryptorError(
+              `valid key missing for participant ${this.participantId}`,
+              CryptorErrorReason.MissingKey,
+            ),
+          );
         }
       } else {
         throw new CryptorError(

package/src/e2ee/worker/ParticipantKeyHandler.ts

@@ -1,4 +1,5 @@
-import EventEmitter from 'eventemitter3';
+import { EventEmitter } from 'events';
+import type TypedEventEmitter from 'typed-emitter';
 import { workerLogger } from '../../logger';
 import { KEYRING_SIZE } from '../constants';
 import type { KeyProviderOptions, KeySet, ParticipantKeyHandlerCallbacks } from '../types';
@@ -15,7 +16,7 @@ import { deriveKeys, importKey, ratchet } from '../utils';
  * if decryption fails or can be triggered manually on both sender and receiver side.
  *
  */
-export class ParticipantKeyHandler extends EventEmitter<ParticipantKeyHandlerCallbacks> {
+export class ParticipantKeyHandler extends (EventEmitter as new () => TypedEventEmitter<ParticipantKeyHandlerCallbacks>) {
   private currentKeyIndex: number;
 
   private cryptoKeyRing: Array<KeySet>;
@@ -28,6 +29,14 @@ export class ParticipantKeyHandler extends EventEmitter<ParticipantKeyHandlerCal
 
   private participantId: string | undefined;
 
+  private decryptionFailureCount = 0;
+
+  private _hasValidKey: boolean = true;
+
+  get hasValidKey() {
+    return this._hasValidKey;
+  }
+
   constructor(
     participantId: string | undefined,
     isEnabled: boolean,
@@ -40,12 +49,37 @@ export class ParticipantKeyHandler extends EventEmitter<ParticipantKeyHandlerCal
     this.keyProviderOptions = keyProviderOptions;
     this.ratchetPromiseMap = new Map();
     this.participantId = participantId;
+    this.resetKeyStatus();
   }
 
   setEnabled(enabled: boolean) {
     this.enabled = enabled;
   }
 
+  decryptionFailure() {
+    if (this.keyProviderOptions.failureTolerance < 0) {
+      return;
+    }
+    this.decryptionFailureCount += 1;
+
+    if (this.decryptionFailureCount > this.keyProviderOptions.failureTolerance) {
+      this._hasValidKey = false;
+    }
+  }
+
+  decryptionSuccess() {
+    this.resetKeyStatus();
+  }
+
+  /**
+   * Call this after user initiated ratchet or a new key has been set in order to make sure to mark potentially
+   * invalid keys as valid again
+   */
+  resetKeyStatus() {
+    this.decryptionFailureCount = 0;
+    this._hasValidKey = true;
+  }
+
   /**
    * Ratchets the current key (or the one at keyIndex if provided) and
    * returns the ratcheted material
@@ -84,6 +118,17 @@ export class ParticipantKeyHandler extends EventEmitter<ParticipantKeyHandlerCal
     return ratchetPromise;
   }
 
+  /**
+   * takes in a key material with `deriveBits` and `deriveKey` set as key usages
+   * and derives encryption keys from the material and sets it on the key ring buffer
+   * together with the material
+   * also resets the valid key property and updates the currentKeyIndex
+   */
+  async setKey(material: CryptoKey, keyIndex = 0) {
+    await this.setKeyFromMaterial(material, keyIndex);
+    this.resetKeyStatus();
+  }
+
   /**
    * takes in a key material with `deriveBits` and `deriveKey` set as key usages
    * and derives encryption keys from the material and sets it on the key ring buffer
@@ -108,6 +153,7 @@ export class ParticipantKeyHandler extends EventEmitter<ParticipantKeyHandlerCal
 
   async setCurrentKeyIndex(index: number) {
     this.currentKeyIndex = index % this.cryptoKeyRing.length;
+    this.resetKeyStatus();
   }
 
   isEnabled() {

package/src/e2ee/worker/e2ee.worker.ts

@@ -7,6 +7,7 @@ import type {
   ErrorMessage,
   KeyProviderOptions,
   RatchetMessage,
+  RatchetRequestMessage,
 } from '../types';
 import { FrameCryptor } from './FrameCryptor';
 import { ParticipantKeyHandler } from './ParticipantKeyHandler';
@@ -75,7 +76,7 @@ onmessage = (ev) => {
         workerLogger.debug('set shared key');
         setSharedKey(data.key, data.keyIndex);
       } else if (data.participantId) {
-        getParticipantKeyHandler(data.participantId).setKeyFromMaterial(data.key, data.keyIndex);
+        getParticipantKeyHandler(data.participantId).setKey(data.key, data.keyIndex);
       } else {
         workerLogger.error('no participant Id was provided and shared key usage is disabled');
       }
@@ -92,13 +93,18 @@ onmessage = (ev) => {
       });
       break;
     case 'ratchetRequest':
-      getParticipantKeyHandler(data.participantId).ratchetKey(data.keyIndex);
-
+      handleRatchetRequest(data);
     default:
       break;
   }
 };
 
+async function handleRatchetRequest(data: RatchetRequestMessage['data']) {
+  const keyHandler = getParticipantKeyHandler(data.participantId);
+  await keyHandler.ratchetKey(data.keyIndex);
+  keyHandler.resetKeyStatus();
+}
+
 function getTrackCryptor(participantId: string, trackId: string) {
   let cryptor = participantCryptors.find((c) => c.getTrackId() === trackId);
   if (!cryptor) {
@@ -131,7 +137,7 @@ function getParticipantKeyHandler(participantId?: string) {
   if (!keys) {
     keys = new ParticipantKeyHandler(participantId, true, keyProviderOptions);
     if (sharedKey) {
-      keys.setKeyFromMaterial(sharedKey);
+      keys.setKey(sharedKey);
     }
     participantKeys.set(participantId, keys);
   }
@@ -171,9 +177,9 @@ function setEncryptionEnabled(enable: boolean, participantId?: string) {
 function setSharedKey(key: CryptoKey, index?: number) {
   workerLogger.debug('setting shared key');
   sharedKey = key;
-  publisherKeys?.setKeyFromMaterial(key, index);
+  publisherKeys?.setKey(key, index);
   for (const [, keyHandler] of participantKeys) {
-    keyHandler.setKeyFromMaterial(key, index);
+    keyHandler.setKey(key, index);
   }
 }
 

package/src/index.ts

@@ -1,5 +1,5 @@
 import { LogLevel, setLogExtension, setLogLevel } from './logger';
-import { DataPacket_Kind, DisconnectReason, VideoQuality } from './proto/livekit_models';
+import { DataPacket_Kind, DisconnectReason, VideoQuality } from './proto/livekit_models_pb';
 import DefaultReconnectPolicy from './room/DefaultReconnectPolicy';
 import Room, { ConnectionState, RoomState } from './room/Room';
 import LocalParticipant from './room/participant/LocalParticipant';