livekit-client 2.15.5 → 2.15.7

package/dist/livekit-client.e2ee.worker.mjs

@@ -484,8 +484,6 @@ const KEY_PROVIDER_DEFAULTS = {
   failureTolerance: DECRYPTION_FAILURE_TOLERANCE,
   keyringSize: 16
 };
-const MAX_SIF_COUNT = 100;
-const MAX_SIF_DURATION = 2000;
 
 class LivekitError extends Error {
   constructor(code, message) {
@@ -1093,42 +1091,6 @@ function writeRbsp(data_in) {
   return new Uint8Array(dataOut);
 }
 
-class SifGuard {
-  constructor() {
-    this.consecutiveSifCount = 0;
-    this.lastSifReceivedAt = 0;
-    this.userFramesSinceSif = 0;
-  }
-  recordSif() {
-    var _a;
-    this.consecutiveSifCount += 1;
-    (_a = this.sifSequenceStartedAt) !== null && _a !== void 0 ? _a : this.sifSequenceStartedAt = Date.now();
-    this.lastSifReceivedAt = Date.now();
-  }
-  recordUserFrame() {
-    if (this.sifSequenceStartedAt === undefined) {
-      return;
-    } else {
-      this.userFramesSinceSif += 1;
-    }
-    if (
-    // reset if we received more user frames than SIFs
-    this.userFramesSinceSif > this.consecutiveSifCount ||
-    // also reset if we got a new user frame and the latest SIF frame hasn't been updated in a while
-    Date.now() - this.lastSifReceivedAt > MAX_SIF_DURATION) {
-      this.reset();
-    }
-  }
-  isSifAllowed() {
-    return this.consecutiveSifCount < MAX_SIF_COUNT && (this.sifSequenceStartedAt === undefined || Date.now() - this.sifSequenceStartedAt < MAX_SIF_DURATION);
-  }
-  reset() {
-    this.userFramesSinceSif = 0;
-    this.consecutiveSifCount = 0;
-    this.sifSequenceStartedAt = undefined;
-  }
-}
-
 /**
  * NALU (Network Abstraction Layer Unit) utilities for H.264 and H.265 video processing
  * Contains functions for parsing and working with NALUs in video frames
@@ -1389,6 +1351,49 @@ function processNALUsForEncryption(data, knownCodec) {
   };
 }
 
+/**
+ * Create a crypto hash using Web Crypto API for secure comparison operations
+ */
+function cryptoHash(data) {
+  return __awaiter(this, void 0, void 0, function* () {
+    const hashBuffer = yield crypto.subtle.digest('SHA-256', data);
+    const hashArray = new Uint8Array(hashBuffer);
+    return Array.from(hashArray).map(b => b.toString(16).padStart(2, '0')).join('');
+  });
+}
+/**
+ * Pre-computed SHA-256 hashes for secure comparison operations
+ */
+const CryptoHashes = {
+  VP8KeyFrame8x8: 'ef0161653d8b2b23aad46624b420af1d03ce48950e9fc85718028f91b50f9219',
+  H264KeyFrame2x2SPS: 'f0a0e09647d891d6d50aa898bce7108090375d0d55e50a2bb21147afee558e44',
+  H264KeyFrame2x2PPS: '61d9665eed71b6d424ae9539330a3bdd5cb386d4d781c808219a6e36750493a7',
+  H264KeyFrame2x2IDR: 'faffc26b68a2fc09096fa20f3351e706398b6f838a7500c8063472c2e476e90d',
+  OpusSilenceFrame: 'aad8d31fc56b2802ca500e58c2fb9d0b29ad71bb7cb52cd6530251eade188988'
+};
+/**
+ * Check if a byte array matches any of the known SIF payload frame types using secure crypto hashes
+ */
+function identifySifPayload(data) {
+  return __awaiter(this, void 0, void 0, function* () {
+    const hash = yield cryptoHash(data);
+    switch (hash) {
+      case CryptoHashes.VP8KeyFrame8x8:
+        return 'vp8';
+      case CryptoHashes.H264KeyFrame2x2SPS:
+        return 'h264';
+      case CryptoHashes.H264KeyFrame2x2PPS:
+        return 'h264';
+      case CryptoHashes.H264KeyFrame2x2IDR:
+        return 'h264';
+      case CryptoHashes.OpusSilenceFrame:
+        return 'opus';
+      default:
+        return null;
+    }
+  });
+}
+
 const encryptionEnabledMap = new Map();
 class BaseFrameCryptor extends eventsExports.EventEmitter {
   encodeFunction(encodedFrame, controller) {
@@ -1413,7 +1418,6 @@ class FrameCryptor extends BaseFrameCryptor {
     this.rtpMap = new Map();
     this.keyProviderOptions = opts.keyProviderOptions;
     this.sifTrailer = (_a = opts.sifTrailer) !== null && _a !== void 0 ? _a : Uint8Array.from([]);
-    this.sifGuard = new SifGuard();
   }
   get logContext() {
     return {
@@ -1437,7 +1441,6 @@ class FrameCryptor extends BaseFrameCryptor {
     }
     this.participantIdentity = id;
     this.keys = keys;
-    this.sifGuard.reset();
   }
   unsetParticipant() {
     workerLogger.debug('unsetting participant', this.logContext);
@@ -1599,22 +1602,17 @@ class FrameCryptor extends BaseFrameCryptor {
       if (!this.isEnabled() ||
       // skip for decryption for empty dtx frames
       encodedFrame.data.byteLength === 0) {
-        workerLogger.debug('skipping empty frame', this.logContext);
-        this.sifGuard.recordUserFrame();
         return controller.enqueue(encodedFrame);
       }
       if (isFrameServerInjected(encodedFrame.data, this.sifTrailer)) {
-        workerLogger.debug('enqueue SIF', this.logContext);
-        this.sifGuard.recordSif();
-        if (this.sifGuard.isSifAllowed()) {
-          encodedFrame.data = encodedFrame.data.slice(0, encodedFrame.data.byteLength - this.sifTrailer.byteLength);
+        encodedFrame.data = encodedFrame.data.slice(0, encodedFrame.data.byteLength - this.sifTrailer.byteLength);
+        if (yield identifySifPayload(encodedFrame.data)) {
+          workerLogger.debug('enqueue SIF', this.logContext);
           return controller.enqueue(encodedFrame);
         } else {
-          workerLogger.warn('SIF limit reached, dropping frame');
+          workerLogger.warn('Unexpected SIF frame payload, dropping frame', this.logContext);
           return;
         }
-      } else {
-        this.sifGuard.recordUserFrame();
       }
       const data = new Uint8Array(encodedFrame.data);
       const keyIndex = data[encodedFrame.data.byteLength - 1];
@@ -2099,6 +2097,11 @@ onmessage = ev => {
         break;
       case 'updateCodec':
         getTrackCryptor(data.participantIdentity, data.trackId).setVideoCodec(data.codec);
+        workerLogger.info('updated codec', {
+          participantIdentity: data.participantIdentity,
+          trackId: data.trackId,
+          codec: data.codec
+        });
         break;
       case 'setRTPMap':
         // this is only used for the local participant
@@ -2148,7 +2151,8 @@ function getTrackCryptor(participantIdentity, trackId) {
   let cryptor = cryptors[0];
   if (!cryptor) {
     workerLogger.info('creating new cryptor for', {
-      participantIdentity
+      participantIdentity,
+      trackId
     });
     if (!keyProviderOptions) {
       throw Error('Missing keyProvider options');