livekit-client 1.13.2 → 1.13.4

package/dist/livekit-client.e2ee.worker.mjs

@@ -882,6 +882,54 @@ function ratchet(material, salt) {
     return crypto.subtle.deriveBits(algorithmOptions, material, 256);
   });
 }
+function needsRbspUnescaping(frameData) {
+  for (var i = 0; i < frameData.length - 3; i++) {
+    if (frameData[i] == 0 && frameData[i + 1] == 0 && frameData[i + 2] == 3) return true;
+  }
+  return false;
+}
+function parseRbsp(stream) {
+  const dataOut = [];
+  var length = stream.length;
+  for (var i = 0; i < stream.length;) {
+    // Be careful about over/underflow here. byte_length_ - 3 can underflow, and
+    // i + 3 can overflow, but byte_length_ - i can't, because i < byte_length_
+    // above, and that expression will produce the number of bytes left in
+    // the stream including the byte at i.
+    if (length - i >= 3 && !stream[i] && !stream[i + 1] && stream[i + 2] == 3) {
+      // Two rbsp bytes.
+      dataOut.push(stream[i++]);
+      dataOut.push(stream[i++]);
+      // Skip the emulation byte.
+      i++;
+    } else {
+      // Single rbsp byte.
+      dataOut.push(stream[i++]);
+    }
+  }
+  return new Uint8Array(dataOut);
+}
+const kZerosInStartSequence = 2;
+const kEmulationByte = 3;
+function writeRbsp(data_in) {
+  const dataOut = [];
+  var numConsecutiveZeros = 0;
+  for (var i = 0; i < data_in.length; ++i) {
+    var byte = data_in[i];
+    if (byte <= kEmulationByte && numConsecutiveZeros >= kZerosInStartSequence) {
+      // Need to escape.
+      dataOut.push(kEmulationByte);
+      numConsecutiveZeros = 0;
+    }
+    dataOut.push(byte);
+    if (byte == 0) {
+      ++numConsecutiveZeros;
+    } else {
+      numConsecutiveZeros = 0;
+    }
+  }
+  return new Uint8Array(dataOut);
+}
 
 class SifGuard {
   constructor() {
@@ -1045,8 +1093,9 @@ class FrameCryptor extends BaseFrameCryptor {
       const keyIndex = this.keys.getCurrentKeyIndex();
       if (encryptionKey) {
         const iv = this.makeIV((_a = encodedFrame.getMetadata().synchronizationSource) !== null && _a !== void 0 ? _a : -1, encodedFrame.timestamp);
+        let frameInfo = this.getUnencryptedBytes(encodedFrame);
         // Thіs is not encrypted and contains the VP8 payload descriptor or the Opus TOC byte.
-        const frameHeader = new Uint8Array(encodedFrame.data, 0, this.getUnencryptedBytes(encodedFrame));
+        const frameHeader = new Uint8Array(encodedFrame.data, 0, frameInfo.unencryptedBytes);
         // Frame trailer contains the R|IV_LENGTH and key index
         const frameTrailer = new Uint8Array(2);
         frameTrailer[0] = IV_LENGTH;
@@ -1063,14 +1112,18 @@ class FrameCryptor extends BaseFrameCryptor {
             name: ENCRYPTION_ALGORITHM,
             iv,
             additionalData: new Uint8Array(encodedFrame.data, 0, frameHeader.byteLength)
-          }, encryptionKey, new Uint8Array(encodedFrame.data, this.getUnencryptedBytes(encodedFrame)));
-          const newData = new ArrayBuffer(frameHeader.byteLength + cipherText.byteLength + iv.byteLength + frameTrailer.byteLength);
-          const newUint8 = new Uint8Array(newData);
-          newUint8.set(frameHeader); // copy first bytes.
-          newUint8.set(new Uint8Array(cipherText), frameHeader.byteLength); // add ciphertext.
-          newUint8.set(new Uint8Array(iv), frameHeader.byteLength + cipherText.byteLength); // append IV.
-          newUint8.set(frameTrailer, frameHeader.byteLength + cipherText.byteLength + iv.byteLength); // append frame trailer.
-          encodedFrame.data = newData;
+          }, encryptionKey, new Uint8Array(encodedFrame.data, frameInfo.unencryptedBytes));
+          let newDataWithoutHeader = new Uint8Array(cipherText.byteLength + iv.byteLength + frameTrailer.byteLength);
+          newDataWithoutHeader.set(new Uint8Array(cipherText)); // add ciphertext.
+          newDataWithoutHeader.set(new Uint8Array(iv), cipherText.byteLength); // append IV.
+          newDataWithoutHeader.set(frameTrailer, cipherText.byteLength + iv.byteLength); // append frame trailer.
+          if (frameInfo.isH264) {
+            newDataWithoutHeader = writeRbsp(newDataWithoutHeader);
+          }
+          var newData = new Uint8Array(frameHeader.byteLength + newDataWithoutHeader.byteLength);
+          newData.set(frameHeader);
+          newData.set(newDataWithoutHeader, frameHeader.byteLength);
+          encodedFrame.data = newData.buffer;
           return controller.enqueue(encodedFrame);
         } catch (e) {
           // TODO: surface this to the app.
@@ -1098,6 +1151,7 @@ class FrameCryptor extends BaseFrameCryptor {
       if (isFrameServerInjected(encodedFrame.data, this.sifTrailer)) {
         this.sifGuard.recordSif();
         if (this.sifGuard.isSifAllowed()) {
+          encodedFrame.data = encodedFrame.data.slice(0, encodedFrame.data.byteLength - this.sifTrailer.byteLength);
           return controller.enqueue(encodedFrame);
         } else {
           workerLogger.warn('SIF limit reached, dropping frame');
@@ -1149,6 +1203,7 @@ class FrameCryptor extends BaseFrameCryptor {
       if (!ratchetOpts.encryptionKey && !keySet) {
         throw new TypeError("no encryption key found for decryption of ".concat(this.participantIdentity));
       }
+      let frameInfo = this.getUnencryptedBytes(encodedFrame);
       // Construct frame trailer. Similar to the frame header described in
       // https://tools.ietf.org/html/draft-omara-sframe-00#section-4.2
       // but we put it at the end.
@@ -1157,7 +1212,15 @@ class FrameCryptor extends BaseFrameCryptor {
       // payload  |IV...(length = IV_LENGTH)|R|IV_LENGTH|KID |
       // ---------+-------------------------+-+---------+----
       try {
-        const frameHeader = new Uint8Array(encodedFrame.data, 0, this.getUnencryptedBytes(encodedFrame));
+        const frameHeader = new Uint8Array(encodedFrame.data, 0, frameInfo.unencryptedBytes);
+        var encryptedData = new Uint8Array(encodedFrame.data, frameHeader.length, encodedFrame.data.byteLength - frameHeader.length);
+        if (frameInfo.isH264 && needsRbspUnescaping(encryptedData)) {
+          encryptedData = parseRbsp(encryptedData);
+          const newUint8 = new Uint8Array(frameHeader.byteLength + encryptedData.byteLength);
+          newUint8.set(frameHeader);
+          newUint8.set(encryptedData, frameHeader.byteLength);
+          encodedFrame.data = newUint8.buffer;
+        }
         const frameTrailer = new Uint8Array(encodedFrame.data, encodedFrame.data.byteLength - 2, 2);
         const ivLength = frameTrailer[0];
         const iv = new Uint8Array(encodedFrame.data, encodedFrame.data.byteLength - ivLength - frameTrailer.byteLength, ivLength);
@@ -1252,26 +1315,32 @@ class FrameCryptor extends BaseFrameCryptor {
   }
   getUnencryptedBytes(frame) {
     var _a;
+    var frameInfo = {
+      unencryptedBytes: 0,
+      isH264: false
+    };
     if (isVideoFrame(frame)) {
       let detectedCodec = (_a = this.getVideoCodec(frame)) !== null && _a !== void 0 ? _a : this.videoCodec;
       if (detectedCodec === 'av1' || detectedCodec === 'vp9') {
         throw new Error("".concat(detectedCodec, " is not yet supported for end to end encryption"));
       }
       if (detectedCodec === 'vp8') {
-        return UNENCRYPTED_BYTES[frame.type];
+        frameInfo.unencryptedBytes = UNENCRYPTED_BYTES[frame.type];
+        return frameInfo;
       }
       const data = new Uint8Array(frame.data);
       try {
         const naluIndices = findNALUIndices(data);
         // if the detected codec is undefined we test whether it _looks_ like a h264 frame as a best guess
-        const isH264 = detectedCodec === 'h264' || naluIndices.some(naluIndex => [NALUType.SLICE_IDR, NALUType.SLICE_NON_IDR].includes(parseNALUType(data[naluIndex])));
-        if (isH264) {
+        frameInfo.isH264 = detectedCodec === 'h264' || naluIndices.some(naluIndex => [NALUType.SLICE_IDR, NALUType.SLICE_NON_IDR].includes(parseNALUType(data[naluIndex])));
+        if (frameInfo.isH264) {
           for (const index of naluIndices) {
             let type = parseNALUType(data[index]);
             switch (type) {
               case NALUType.SLICE_IDR:
               case NALUType.SLICE_NON_IDR:
-                return index + 2;
+                frameInfo.unencryptedBytes = index + 2;
+                return frameInfo;
               default:
                 break;
             }
@@ -1281,9 +1350,11 @@ class FrameCryptor extends BaseFrameCryptor {
       } catch (e) {
         // no op, we just continue and fallback to vp8
       }
-      return UNENCRYPTED_BYTES[frame.type];
+      frameInfo.unencryptedBytes = UNENCRYPTED_BYTES[frame.type];
+      return frameInfo;
     } else {
-      return UNENCRYPTED_BYTES.audio;
+      frameInfo.unencryptedBytes = UNENCRYPTED_BYTES.audio;
+      return frameInfo;
     }
   }
   /**