mediasoup 3.22.0 → 3.23.1

package/worker/scripts/package-lock.json

@@ -21,15 +21,15 @@
 			}
 		},
 		"node_modules/brace-expansion": {
-			"version": "5.0.7",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-			"integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+			"version": "5.0.8",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+			"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
 			"license": "MIT",
 			"dependencies": {
 				"balanced-match": "^4.0.2"
 			},
 			"engines": {
-				"node": "18 || 20 || >=22"
+				"node": "20 || >=22"
 			}
 		},
 		"node_modules/glob": {
@@ -105,9 +105,9 @@
 			"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="
 		},
 		"brace-expansion": {
-			"version": "5.0.7",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-			"integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+			"version": "5.0.8",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+			"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
 			"requires": {
 				"balanced-match": "^4.0.2"
 			}

package/worker/src/RTC/ICE/StunPacket.cpp

@@ -4,8 +4,9 @@
 #include "RTC/ICE/StunPacket.hpp"
 #include "Logger.hpp"
 #include "MediaSoupErrors.hpp"
+#include <openssl/crypto.h>
 #include <cstdio>  // std::snprintf()
-#include <cstring> // std::memcmp(), std::memcpy(), std::memset()
+#include <cstring> // std::memcpy(), std::memset()
 #include <string>
 
 namespace RTC
@@ -744,7 +745,10 @@ namespace RTC
 
 			// Compare the computed HMAC-SHA1 with the MESSAGE-INTEGRITY in the STUN
 			// packet.
-			if (std::memcmp(messageIntegrity, computedMessageIntegrity, StunPacket::FixedHeaderLength) == 0)
+			//
+			// NOTE: Use `CRYPTO_memcmp()` to have constant time memory comparison.
+			// See https://github.com/versatica/mediasoup/security/advisories/GHSA-xvjj-6cm4-ppgq
+			if (CRYPTO_memcmp(messageIntegrity, computedMessageIntegrity, StunPacket::FixedHeaderLength) == 0)
 			{
 				result = StunPacket::AuthenticationResult::OK;
 			}

package/worker/src/RTC/RTP/Packet.cpp

@@ -1083,6 +1083,17 @@ namespace RTC
 				return false;
 			}
 
+			if (len > extenLen)
+			{
+				MS_WARN_TAG(
+				  rtp,
+				  "no enough space for updated dependency descriptor [needed:%zu, available:%" PRIu8 "]",
+				  len,
+				  extenLen);
+
+				return false;
+			}
+
 			std::memcpy(extenValue, data, len);
 
 			SetExtensionLength(this->headerExtensionIds.dependencyDescriptor, len);

package/worker/src/RTC/SCTP/association/Association.cpp

@@ -54,6 +54,7 @@ namespace RTC
 		      this->associationListenerDeferrer,
 		      sctpOptions.mtu,
 		      sctpOptions.defaultStreamPriority,
+		      sctpOptions.defaultStreamBufferedAmountLowThreshold,
 		      sctpOptions.totalBufferedAmountLowThreshold),
 		    t1InitTimer(this->shared->CreateBackoffTimer(
 		      BackoffTimerHandleInterface::BackoffTimerHandleOptions{

package/worker/src/RTC/SCTP/association/StateCookie.cpp

@@ -4,7 +4,8 @@
 #include "RTC/SCTP/association/StateCookie.hpp"
 #include "Logger.hpp"
 #include "MediaSoupErrors.hpp"
-#include <cstring> // std::memcpy(), std::memcmp()
+#include <openssl/crypto.h>
+#include <cstring> // std::memcpy()
 #include <string_view>
 
 namespace RTC
@@ -179,7 +180,9 @@ namespace RTC
 			const uint8_t* expectedMac = Utils::Crypto::GetHmacSha1(
 			  reinterpret_cast<const char*>(macKey), macKeyLength, buffer, StateCookie::MacOffset);
 
-			return std::memcmp(buffer + StateCookie::MacOffset, expectedMac, StateCookie::MacLength) == 0;
+			// NOTE: Use `CRYPTO_memcmp()` to have constant time memory comparison.
+			// See https://github.com/versatica/mediasoup/security/advisories/GHSA-xvjj-6cm4-ppgq
+			return CRYPTO_memcmp(buffer + StateCookie::MacOffset, expectedMac, StateCookie::MacLength) == 0;
 		}
 
 		Types::SctpImplementation StateCookie::DetermineSctpImplementation(

package/worker/src/RTC/SCTP/packet/errorCauses/MissingMandatoryParameterErrorCause.cpp

@@ -81,8 +81,11 @@ namespace RTC
 			  new MissingMandatoryParameterErrorCause(const_cast<uint8_t*>(buffer), bufferLength);
 
 			// In this chunk we must validate that some fields have correct values.
+			//
+			// NOTE: Must cast result to uint64_t to avoid integer overflow.
+			// See https://github.com/versatica/mediasoup/security/advisories/GHSA-p9cq-fqxc-987w
 			if (
-			  (errorCause->GetNumberOfMissingParameters() * 2) !=
+			  (static_cast<uint64_t>(errorCause->GetNumberOfMissingParameters()) * 2) !=
 			  causeLength -
 			    MissingMandatoryParameterErrorCause::MissingMandatoryParameterErrorCauseHeaderLength)
 			{

package/worker/src/RTC/SCTP/tx/RoundRobinSendQueue.cpp

@@ -20,9 +20,11 @@ namespace RTC
 		  AssociationListenerInterface& associationListener,
 		  size_t mtu,
 		  uint16_t defaultPriority,
+		  size_t defaultStreamBufferedAmountLowThreshold,
 		  size_t totalBufferedAmountLowThreshold)
 		  : associationListener(associationListener),
 		    defaultPriority(defaultPriority),
+		    defaultStreamBufferedAmountLowThreshold(defaultStreamBufferedAmountLowThreshold),
 		    scheduler(mtu),
 		    totalBufferedAmountThresholdWatcher(
 		      [this]()
@@ -256,7 +258,9 @@ namespace RTC
 
 			if (it == this->streams.end())
 			{
-				return 0;
+				// The stream is created lazily (on first send or when its threshold is
+				// explicitly set), so report the default that it will be created with.
+				return this->defaultStreamBufferedAmountLowThreshold;
 			}
 
 			const auto& stream = it->second;
@@ -297,7 +301,11 @@ namespace RTC
 				    this->associationListener.OnAssociationStreamBufferedAmountLow(streamId);
 			    }));
 
-			return it2->second;
+			auto& stream = it2->second;
+
+			stream.GetBufferedAmount().SetLowThreshold(this->defaultStreamBufferedAmountLowThreshold);
+
+			return stream;
 		}
 
 		void RoundRobinSendQueue::AssertIsConsistent() const

package/worker/src/RTC/SrtpSession.cpp

@@ -5,7 +5,6 @@
 #include "DepLibSRTP.hpp"
 #include "Logger.hpp"
 #include "MediaSoupErrors.hpp"
-#include <cstring> // std::memset()
 
 namespace RTC
 {
@@ -127,42 +126,34 @@ namespace RTC
 	{
 		MS_TRACE();
 
-		srtp_policy_t policy; // NOLINT(cppcoreguidelines-pro-type-member-init)
-
-		// Set all policy fields to 0.
-		std::memset(&policy, 0, sizeof(srtp_policy_t));
+		srtp_profile_t profile;
 
 		switch (cryptoSuite)
 		{
 			case CryptoSuite::AEAD_AES_256_GCM:
 			{
-				srtp_crypto_policy_set_aes_gcm_256_16_auth(&policy.rtp);
-				srtp_crypto_policy_set_aes_gcm_256_16_auth(&policy.rtcp);
+				profile = srtp_profile_aead_aes_256_gcm;
 
 				break;
 			}
 
 			case CryptoSuite::AEAD_AES_128_GCM:
 			{
-				srtp_crypto_policy_set_aes_gcm_128_16_auth(&policy.rtp);
-				srtp_crypto_policy_set_aes_gcm_128_16_auth(&policy.rtcp);
+				profile = srtp_profile_aead_aes_128_gcm;
 
 				break;
 			}
 
 			case CryptoSuite::AES_CM_128_HMAC_SHA1_80:
 			{
-				srtp_crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtp);
-				srtp_crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtcp);
+				profile = srtp_profile_aes128_cm_sha1_80;
 
 				break;
 			}
 
 			case CryptoSuite::AES_CM_128_HMAC_SHA1_32:
 			{
-				srtp_crypto_policy_set_aes_cm_128_hmac_sha1_32(&policy.rtp);
-				// NOTE: Must be 80 for RTCP.
-				srtp_crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtcp);
+				profile = srtp_profile_aes128_cm_sha1_32;
 
 				break;
 			}
@@ -173,35 +164,101 @@ namespace RTC
 			}
 		}
 
-		MS_ASSERT(
-		  keyLen == policy.rtp.cipher_key_len, "given keyLen does not match policy.rtp.cipher_keyLen");
+		// Create the policy object.
+		srtp_policy_t policy{ nullptr };
+		srtp_err_status_t err = srtp_policy_create(std::addressof(policy));
+
+		if (DepLibSRTP::IsError(err))
+		{
+			MS_THROW_ERROR("srtp_policy_create() failed: %s", DepLibSRTP::GetErrorString(err).c_str());
+		}
+
+		// Set SSRC.
+		srtp_ssrc_t ssrc{};
 
 		switch (type)
 		{
 			case Type::INBOUND:
 			{
-				policy.ssrc.type = ssrc_any_inbound;
+				ssrc.type = ssrc_any_inbound;
 
 				break;
 			}
 
 			case Type::OUTBOUND:
 			{
-				policy.ssrc.type = ssrc_any_outbound;
+				ssrc.type = ssrc_any_outbound;
 
 				break;
 			}
 		}
 
-		policy.ssrc.value = 0;
-		policy.key        = key;
+		ssrc.value = 0;
+
+		err = srtp_policy_set_ssrc(policy, ssrc);
+
+		if (DepLibSRTP::IsError(err))
+		{
+			srtp_policy_destroy(policy);
+			MS_THROW_ERROR("srtp_policy_set_ssrc() failed: %s", DepLibSRTP::GetErrorString(err).c_str());
+		}
+
+		// Set the crypto profile.
+		err = srtp_policy_set_profile(policy, profile);
+
+		if (DepLibSRTP::IsError(err))
+		{
+			srtp_policy_destroy(policy);
+			MS_THROW_ERROR("srtp_policy_set_profile() failed: %s", DepLibSRTP::GetErrorString(err).c_str());
+		}
+
+		// Split the concatenated key+salt buffer using the profile's lengths.
+		const size_t masterKeyLen  = srtp_profile_get_master_key_length(profile);
+		const size_t masterSaltLen = srtp_profile_get_master_salt_length(profile);
+
+		MS_ASSERT(
+		  keyLen == masterKeyLen + masterSaltLen,
+		  "given keyLen does not match profile master key + salt length");
+
+		err = srtp_policy_add_key(
+		  policy,
+		  /*key*/ key,
+		  /*key_len*/ masterKeyLen,
+		  /*salt*/ key + masterKeyLen,
+		  /*salt_len*/ masterSaltLen,
+		  /*mki*/ nullptr,
+		  /*mki_len*/ 0);
+
+		if (DepLibSRTP::IsError(err))
+		{
+			srtp_policy_destroy(policy);
+			MS_THROW_ERROR("srtp_policy_add_key() failed: %s", DepLibSRTP::GetErrorString(err).c_str());
+		}
+
 		// Required for sending RTP retransmission without RTX.
-		policy.allow_repeat_tx = true;
-		policy.window_size     = 1024;
-		policy.next            = nullptr;
+		err = srtp_policy_set_allow_repeat_tx(policy, true);
+
+		if (DepLibSRTP::IsError(err))
+		{
+			srtp_policy_destroy(policy);
+			MS_THROW_ERROR(
+			  "srtp_policy_set_allow_repeat_tx() failed: %s", DepLibSRTP::GetErrorString(err).c_str());
+		}
+
+		err = srtp_policy_set_window_size(policy, 1024);
+
+		if (DepLibSRTP::IsError(err))
+		{
+			srtp_policy_destroy(policy);
+			MS_THROW_ERROR(
+			  "srtp_policy_set_window_size() failed: %s", DepLibSRTP::GetErrorString(err).c_str());
+		}
+
+		// Create the SRTP session.
+		err = srtp_create(std::addressof(this->session), policy);
 
-		// Set the SRTP session.
-		const srtp_err_status_t err = srtp_create(&this->session, &policy);
+		// Policy is no longer needed once the session is created.
+		srtp_policy_destroy(policy);
 
 		if (DepLibSRTP::IsError(err))
 		{

package/worker/src/RTC/Transport.cpp

@@ -49,20 +49,10 @@ namespace RTC
 	{
 		MS_TRACE();
 
+		this->direct                = options->direct();
 		this->maxSendMessageSize    = options->maxSendMessageSize();
 		this->maxReceiveMessageSize = options->maxReceiveMessageSize();
 
-		if (options->direct())
-		{
-			this->direct = true;
-		}
-		else
-		{
-			this->sctpSendBufferSize              = options->sctpSendBufferSize();
-			this->sctpPerStreamSendQueueLimit     = options->sctpPerStreamSendQueueLimit();
-			this->sctpMaxReceiverWindowBufferSize = options->sctpMaxReceiverWindowBufferSize();
-		}
-
 		if (
 		  auto initialAvailableOutgoingBitrate = options->initialAvailableOutgoingBitrate();
 		  initialAvailableOutgoingBitrate.has_value())
@@ -80,11 +70,13 @@ namespace RTC
 			const RTC::SCTP::SctpOptions sctpOptions = {
 				.mtu                         = RTC::Consts::MaxSafeMtuSizeForSctp,
 				.maxSendMessageSize          = this->maxSendMessageSize,
-				.maxSendBufferSize           = this->sctpSendBufferSize,
-				.perStreamSendQueueLimit     = this->sctpPerStreamSendQueueLimit,
+				.maxSendBufferSize           = options->sctpSendBufferSize(),
+				.perStreamSendQueueLimit     = options->sctpPerStreamSendQueueLimit(),
 				.maxReceiveMessageSize       = this->maxReceiveMessageSize,
-				.maxReceiverWindowBufferSize = this->sctpMaxReceiverWindowBufferSize,
-				.requireAuthenticatedCookie  = requireSctpStateCookieAuthentication
+				.maxReceiverWindowBufferSize = options->sctpMaxReceiverWindowBufferSize(),
+				.defaultStreamBufferedAmountLowThreshold =
+				  options->sctpDefaultStreamBufferedAmountLowThreshold(),
+				.requireAuthenticatedCookie = requireSctpStateCookieAuthentication
 			};
 
 			this->sctpAssociation = std::make_unique<RTC::SCTP::Association>(

package/worker/subprojects/libsrtp3.wrap

@@ -1,8 +1,8 @@
 [wrap-file]
-directory = libsrtp-3.0.0-beta
-source_url = https://github.com/versatica/libsrtp/archive/v3.0.0-beta.zip
-source_filename = libsrtp-3.0.0-beta.zip
-source_hash = b0cb21aaf27120b1a242f3d9b07c145b4a6c7a02a25da0824539fd95611f690c
+directory = libsrtp-3.0.0-beta-2fc078db
+source_url = https://github.com/versatica/libsrtp/archive/v3.0.0-beta-2fc078db.zip
+source_filename = libsrtp-3.0.0-beta-2fc078db.zip
+source_hash = d2c0fc2fdb84c615ed835471014611fb0b55f92c183c690ebeceb6ad4821a8b9
 
 [provide]
 libsrtp3 = libsrtp3_dep

package/worker/tasks.py

@@ -43,7 +43,7 @@ NUM_CORES = (
 )
 PYTHON = os.getenv("PYTHON") or sys.executable
 MESON = os.getenv("MESON") or f"{PIP_MESON_NINJA_DIR}/bin/meson"
-MESON_VERSION = os.getenv("MESON_VERSION") or "1.9.1"
+MESON_VERSION = os.getenv("MESON_VERSION") or "1.11.2"
 # MESON_ARGS can be used to provide extra configuration parameters to meson,
 # such as adding defines or changing optimization options. For instance, use
 # `MESON_ARGS="-Dms_log_trace=true -Dms_log_file_line=true" npm i` to compile

package/worker/test/src/RTC/SCTP/association/TestAssociation.cpp

@@ -1057,6 +1057,40 @@ SCENARIO("SCTP Association", "[sctp][association]")
 		REQUIRE(a.listener.HasOnStreamBufferedAmountLowBeenCalledWithStreamId(1) == true);
 	}
 
+	SECTION("applies the configured default buffered amount low threshold to new streams")
+	{
+		auto sctpOptions = makeSctpOptions();
+
+		sctpOptions.defaultStreamBufferedAmountLowThreshold = 1024;
+
+		AssociationUnderTest a(sctpOptions);
+
+		// Sending a message creates the outgoing stream, which must inherit the
+		// configured default buffered amount low threshold.
+		sendMessage(a, 1, 53, std::vector<uint8_t>(10));
+
+		REQUIRE(a.association.GetStreamBufferedAmountLowThreshold(1) == 1024);
+	}
+
+	SECTION("does not trigger buffered amount low until crossing a non-zero default threshold")
+	{
+		auto sctpOptions = makeSctpOptions();
+
+		sctpOptions.defaultStreamBufferedAmountLowThreshold = 1024;
+
+		AssociationUnderTest a(sctpOptions);
+		AssociationUnderTest z;
+
+		connectAssociations(a, z);
+
+		// A small message never takes the buffered amount above the threshold, so
+		// draining it must not trigger the event.
+		sendMessage(a, 1, 53, std::vector<uint8_t>(10));
+		exchangeMessages(a, z);
+
+		REQUIRE(a.listener.HasOnStreamBufferedAmountLowBeenCalledWithStreamId(1) == false);
+	}
+
 	SECTION("detects the peer implementation")
 	{
 		AssociationUnderTest a;

package/worker/test/src/RTC/SCTP/association/TestStreamResetHandler.cpp

@@ -57,6 +57,7 @@ namespace
 		      this->associationListener,
 		      this->sctpOptions.mtu,
 		      this->sctpOptions.defaultStreamPriority,
+		      this->sctpOptions.defaultStreamBufferedAmountLowThreshold,
 		      this->sctpOptions.totalBufferedAmountLowThreshold),
 		    dataTracker(this->delayedAckTimer.get(), RemoteInitialTsn),
 		    reassemblyQueue(this->sctpOptions.maxReceiverWindowBufferSize),

package/worker/test/src/RTC/SCTP/packet/errorCauses/TestMissingMandatoryParameterErrorCause.cpp

@@ -164,6 +164,30 @@ SCENARIO("Invalid Stream Identifier Error Cause (2)", "[serializable][sctp][erro
 		// clang-format on
 
 		REQUIRE(!RTC::SCTP::MissingMandatoryParameterErrorCause::Parse(buffer3, sizeof(buffer3)));
+
+		// Security advisory.
+		// See https://github.com/versatica/mediasoup/security/advisories/GHSA-p9cq-fqxc-987w
+		//
+		// Number of missing parameters chosen so that, multiplied by 2 in 32-bit
+		// arithmetic, it wraps around to a value that would falsely match the
+		// length field. 0x80000001 (2147483649) * 2 wraps to 2, which equals
+		// Length 10 minus the 8-byte header. The check must be done in 64-bit
+		// arithmetic so this malformed cause is rejected instead of accepted
+		// (which would later drive an out-of-bounds read while iterating the
+		// bogus 2.1 billion parameter count).
+		// clang-format off
+		alignas(4) uint8_t buffer4[] =
+		{
+			// Code:2 (MISSING-MANDATORY-PARAMETER), Length: 10
+			0x00, 0x02, 0x00, 0x0A,
+			// Number of missing params: 0x80000001 (2147483649)
+			0x80, 0x00, 0x00, 0x01,
+			// A single param type (2 bytes) plus 2 bytes of padding
+			0x00, 0x05, 0x00, 0x00,
+		};
+		// clang-format on
+
+		REQUIRE(!RTC::SCTP::MissingMandatoryParameterErrorCause::Parse(buffer4, sizeof(buffer4)));
 	}
 
 	SECTION("MissingMandatoryParameterErrorCause::Factory() succeeds")