[Ffmpeg-devel] [RFC] MXF AES decryption
Reimar Döffinger
Reimar.Doeffinger
Thu Feb 8 22:15:51 CET 2007
Hello,
On Sun, Jan 14, 2007 at 09:00:59PM +0100, Baptiste Coudurier wrote:
> Reimar D?ffinger wrote:
> > [...]
> >>> @@ -768,9 +913,16 @@
> >>> av_log(mxf->fc, AV_LOG_INFO, "source track %d: stream %d, no descriptor found\n", source_track->track_id, st->index);
> >>> continue;
> >>> }
> >>> + essence_container_ul = descriptor->essence_container_ul;
> >>> + if (IS_KLV_KEY(essence_container_ul, mxf_encrypted_essence_container)) {
> >>> + MXFCryptoContext *cc = mxf_find_track_cryptocontext(mxf, descriptor->linked_track_id);
> >>> + if (cc)
> >>> + essence_container_ul = cc->source_ul;
> >>> + mxf->sync_key = mxf_encrypted_triplet_key;
> >>> + }
> >> That's wrong. descriptor essence container should be original source
> >> coutainer. That file is broken. Working 100% solution must be
> >> implemented, also linked track id is optional in S377M. Yes it is
> >> complicated but a working 100% solution exists.
> >
> > I moved the sync_key setting someplace else, so the remaining code is
> > only a hack. I hope you don't expect my to improve a hack without any
> > samples that would need it (since it's a hack I'm actually tempted to
> > just remove the linked_track_id check and DMSegment and CryptoFramework
> > parsing and just grab the source_ul from the first best CryptoContext
> > found).
> >
>
> Well if track count is only one, I agree that would be more convenient.
Since the problems are probably caused by an old version of the spec and
the code is needed for later per-track encryption key (if it will ever
be implemented *g*) I decided to keep it.
I fixed it to use source_track->track_id instead of
descriptor->linked_track_id though.
Does this version look again to be applied?
Greetings,
Reimar D?ffinger
-------------- next part --------------
Index: libavformat/avformat.h
===================================================================
--- libavformat/avformat.h (revision 7881)
+++ libavformat/avformat.h (working copy)
@@ -25,8 +25,8 @@
extern "C" {
#endif
-#define LIBAVFORMAT_VERSION_INT ((51<<16)+(8<<8)+0)
-#define LIBAVFORMAT_VERSION 51.8.0
+#define LIBAVFORMAT_VERSION_INT ((51<<16)+(9<<8)+0)
+#define LIBAVFORMAT_VERSION 51.9.0
#define LIBAVFORMAT_BUILD LIBAVFORMAT_VERSION_INT
#define LIBAVFORMAT_IDENT "Lavf" AV_STRINGIFY(LIBAVFORMAT_VERSION)
@@ -379,6 +371,9 @@
* maximum duration in AV_TIME_BASE units over which the input should be analyzed in av_find_stream_info()
*/
int max_analyze_duration;
+
+ const uint8_t *key;
+ int keylen;
} AVFormatContext;
typedef struct AVPacketList {
Index: libavformat/mxf.c
===================================================================
--- libavformat/mxf.c (revision 7881)
+++ libavformat/mxf.c (working copy)
@@ -46,6 +46,7 @@
//#define DEBUG
#include "avformat.h"
+#include "aes.h"
typedef uint8_t UID[16];
@@ -60,6 +61,9 @@
Descriptor,
Track,
EssenceContainerData,
+ CryptoFramework,
+ CryptoContext,
+ DMSegment,
};
typedef struct MXFStructuralComponent {
@@ -125,6 +129,27 @@
UID linked_package_uid;
} MXFEssenceContainerData;
+typedef struct MXFDMSegment {
+ UID uid;
+ enum MXFMetadataSetType type;
+ int *trackids;
+ int trackids_count;
+ UID framework_ul;
+} MXFDMSegment;
+
+typedef struct MXFCryptoFramework {
+ UID uid;
+ enum MXFMetadataSetType type;
+ UID cryptocontext;
+} MXFCryptoFramework;
+
+typedef struct MXFCryptoContext {
+ UID uid;
+ enum MXFMetadataSetType type;
+ UID contextid;
+ UID source_ul;
+} MXFCryptoContext;
+
typedef struct {
UID uid;
enum MXFMetadataSetType type;
@@ -137,6 +162,7 @@
int metadata_sets_count;
const uint8_t *sync_key;
AVFormatContext *fc;
+ struct AVAES *aesc;
} MXFContext;
typedef struct KLVPacket {
@@ -173,6 +199,7 @@
static const uint8_t mxf_essence_element_key[] = { 0x06,0x0e,0x2b,0x34,0x01,0x02,0x01,0x01,0x0d,0x01,0x03,0x01 };
/* complete keys to match */
static const uint8_t mxf_encrypted_triplet_key[] = { 0x06,0x0e,0x2b,0x34,0x02,0x04,0x01,0x07,0x0d,0x01,0x03,0x01,0x02,0x7e,0x01,0x00 };
+static const uint8_t mxf_encrypted_essence_container[] = { 0x06,0x0e,0x2b,0x34,0x04,0x01,0x01,0x07,0x0d,0x01,0x03,0x01,0x02,0x0b,0x01,0x00 };
#define IS_KLV_KEY(x, y) (!memcmp(x, y, sizeof(y)))
@@ -245,6 +272,64 @@
return 0;
}
+static int mxf_decrypt_triplet(AVFormatContext *s, AVPacket *pkt, KLVPacket *klv)
+{
+ static const uint8_t checkv[16] = {0x43, 0x48, 0x55, 0x4b, 0x43, 0x48, 0x55, 0x4b, 0x43, 0x48, 0x55, 0x4b, 0x43, 0x48, 0x55, 0x4b};
+ MXFContext *mxf = s->priv_data;
+ ByteIOContext *pb = &s->pb;
+ offset_t end = url_ftell(pb) + klv->length;
+ uint64_t size;
+ uint64_t orig_size;
+ uint64_t plaintext_size;
+ uint8_t ivec[16];
+ uint8_t tmpbuf[16];
+ int index;
+ if (s->key && s->keylen == 16) {
+ if (!mxf->aesc) {
+ mxf->aesc = av_malloc(av_aes_size);
+ av_aes_init(mxf->aesc, s->key, 128, 1);
+ }
+ }
+ // crypto context
+ url_fskip(pb, klv_decode_ber_length(pb));
+ // plaintext offset
+ klv_decode_ber_length(pb);
+ plaintext_size = get_be64(pb);
+ // source klv key
+ klv_decode_ber_length(pb);
+ get_buffer(pb, klv->key, 16);
+ if (!IS_KLV_KEY(klv, mxf_essence_element_key)) goto err_out;
+ index = mxf_get_stream_index(s, &klv);
+ if (index < 0) goto err_out;
+ // source size
+ klv_decode_ber_length(pb);
+ orig_size = get_be64(pb);
+ if (orig_size < plaintext_size) goto err_out;
+ // enc. code
+ size = klv_decode_ber_length(pb);
+ if (size < 32 || size - 32 < orig_size) goto err_out;
+ get_buffer(pb, ivec, 16);
+ get_buffer(pb, tmpbuf, 16);
+ if (mxf->aesc)
+ av_aes_crypt(mxf->aesc, tmpbuf, tmpbuf, 1, ivec, 1);
+ if (memcmp(tmpbuf, checkv, 16))
+ av_log(s, AV_LOG_ERROR, "probably incorrect decryption key\n");
+ size -= 32;
+ av_get_packet(pb, pkt, size);
+ size -= plaintext_size;
+ if (mxf->aesc)
+ av_aes_crypt(mxf->aesc, &pkt->data[plaintext_size],
+ &pkt->data[plaintext_size], size >> 4, ivec, 1);
+ pkt->size = orig_size;
+ pkt->stream_index = index;
+ url_fskip(pb, end - url_ftell(pb));
+ return 0;
+
+err_out:
+ url_fskip(pb, end - url_ftell(pb));
+ return -1;
+}
+
static int mxf_read_packet(AVFormatContext *s, AVPacket *pkt)
{
MXFContext *mxf = s->priv_data;
@@ -259,9 +344,13 @@
PRINT_KEY("read packet", klv.key);
#endif
if (IS_KLV_KEY(klv.key, mxf_encrypted_triplet_key)) {
+ int res = mxf_decrypt_triplet(s, pkt, &klv);
mxf->sync_key = mxf_encrypted_triplet_key;
- av_log(s, AV_LOG_ERROR, "encrypted triplet not supported\n");
- return -1;
+ if (res < 0) {
+ av_log(s, AV_LOG_ERROR, "invalid encoded triplet\n");
+ return -1;
+ }
+ return 0;
}
if (IS_KLV_KEY(klv.key, mxf_essence_element_key)) {
int index = mxf_get_stream_index(s, &klv);
@@ -487,6 +576,46 @@
return 0;
}
+static int mxf_read_metadata_dmsegment(MXFDMSegment *dmsegment, ByteIOContext *pb, int tag)
+{
+ switch(tag) {
+ case 0x6101:
+ get_buffer(pb, dmsegment->framework_ul, 16);
+ break;
+ case 0x6102:
+ dmsegment->trackids_count = get_be32(pb);
+ if (dmsegment->trackids_count >= UINT_MAX / sizeof(int))
+ return -1;
+ dmsegment->trackids = av_malloc(dmsegment->trackids_count * sizeof(int));
+ url_fskip(pb, 4); /* useless size of objects, always 4 according to specs */
+ get_buffer(pb, (uint8_t *)dmsegment->trackids, dmsegment->trackids_count * sizeof(int));
+ break;
+ }
+ return 0;
+}
+static int mxf_read_metadata_cryptographic_framework(MXFCryptoFramework *cryptoframework, ByteIOContext *pb, int tag)
+{
+ switch(tag) {
+ case 0xFFFF:
+ get_buffer(pb, cryptoframework->cryptocontext, 16);
+ break;
+ }
+ return 0;
+}
+
+static int mxf_read_metadata_cryptographic_context(MXFCryptoContext *cryptocontext, ByteIOContext *pb, int tag)
+{
+ switch(tag) {
+ case 0xFFFE:
+ get_buffer(pb, cryptocontext->contextid, 16);
+ break;
+ case 0xFFFD:
+ get_buffer(pb, cryptocontext->source_ul, 16);
+ break;
+ }
+ return 0;
+}
+
/* SMPTE RP224 http://www.smpte-ra.org/mdd/index.html */
static const MXFDataDefinitionUL mxf_data_definition_uls[] = {
{ { 0x06,0x0E,0x2B,0x34,0x04,0x01,0x01,0x01,0x01,0x03,0x02,0x02,0x01,0x00,0x00,0x00 }, CODEC_TYPE_VIDEO },
@@ -577,6 +706,27 @@
return NULL;
}
+static MXFCryptoContext *mxf_find_track_cryptocontext(MXFContext *mxf, int track_id)
+{
+ int i, j;
+ for (i = 0; i < mxf->metadata_sets_count; i++) {
+ if (mxf->metadata_sets[i]->type == DMSegment) {
+ MXFDMSegment *seg = (MXFDMSegment *)mxf->metadata_sets[i];
+ for (j = 0; j < seg->trackids_count; j++)
+ if (seg->trackids[j] == track_id) break;
+ if (j < seg->trackids_count || seg->trackids_count == 0) {
+ MXFCryptoContext *cc = NULL;
+ MXFCryptoFramework *cf = mxf_resolve_strong_ref(mxf, seg->framework_ul, CryptoFramework);
+ if (cf)
+ cc = mxf_resolve_strong_ref(mxf, cf->cryptocontext, CryptoContext);
+ if (cc)
+ return cc;
+ }
+ }
+ }
+ return NULL;
+}
+
static int mxf_parse_structural_metadata(MXFContext *mxf)
{
MXFPackage *material_package = NULL;
@@ -604,6 +754,7 @@
const MXFCodecUL *codec_ul = NULL;
const MXFCodecUL *container_ul = NULL;
AVStream *st;
+ UID *essence_container_ul;
if (!(material_track = mxf_resolve_strong_ref(mxf, &material_package->tracks_refs[i], Track))) {
av_log(mxf->fc, AV_LOG_ERROR, "could not resolve material track strong ref\n");
@@ -693,9 +844,17 @@
av_log(mxf->fc, AV_LOG_INFO, "source track %d: stream %d, no descriptor found\n", source_track->track_id, st->index);
continue;
}
+ essence_container_ul = descriptor->essence_container_ul;
+ /* HACK: replacing the original key with mxf_encrypted_essence_container
+ * is not allowed according to specs, try to find correct information anyway */
+ if (IS_KLV_KEY(essence_container_ul, mxf_encrypted_essence_container)) {
+ MXFCryptoContext *cc = mxf_find_track_cryptocontext(mxf, source_track->track_id);
+ if (cc)
+ essence_container_ul = cc->source_ul;
+ }
#ifdef DEBUG
PRINT_KEY("essence codec ul", descriptor->essence_codec_ul);
- PRINT_KEY("essence container ul", descriptor->essence_container_ul);
+ PRINT_KEY("essence container ul", essence_container_ul);
#endif
/* TODO: drop PictureEssenceCoding and SoundEssenceCompression, only check EssenceContainer */
codec_ul = mxf_get_codec_ul(mxf_codec_uls, &descriptor->essence_codec_ul);
@@ -705,7 +864,7 @@
st->codec->extradata_size = descriptor->extradata_size;
}
if (st->codec->codec_type == CODEC_TYPE_VIDEO) {
- container_ul = mxf_get_codec_ul(mxf_picture_essence_container_uls, &descriptor->essence_container_ul);
+ container_ul = mxf_get_codec_ul(mxf_picture_essence_container_uls, essence_container_ul);
if (st->codec->codec_id == CODEC_ID_NONE)
st->codec->codec_id = container_ul->id;
st->codec->width = descriptor->width;
@@ -713,7 +872,7 @@
st->codec->bits_per_sample = descriptor->bits_per_sample; /* Uncompressed */
st->need_parsing = 2; /* only parse headers */
} else if (st->codec->codec_type == CODEC_TYPE_AUDIO) {
- container_ul = mxf_get_codec_ul(mxf_sound_essence_container_uls, &descriptor->essence_container_ul);
+ container_ul = mxf_get_codec_ul(mxf_sound_essence_container_uls, essence_container_ul);
if (st->codec->codec_id == CODEC_ID_NONE)
st->codec->codec_id = container_ul->id;
st->codec->channels = descriptor->channels;
@@ -759,6 +918,9 @@
{ { 0x06,0x0E,0x2B,0x34,0x02,0x53,0x01,0x01,0x0d,0x01,0x01,0x01,0x01,0x01,0x47,0x00 }, mxf_read_metadata_generic_descriptor, sizeof(MXFDescriptor), Descriptor }, /* AES3 */
{ { 0x06,0x0E,0x2B,0x34,0x02,0x53,0x01,0x01,0x0d,0x01,0x01,0x01,0x01,0x01,0x3A,0x00 }, mxf_read_metadata_track, sizeof(MXFTrack), Track }, /* Static Track */
{ { 0x06,0x0E,0x2B,0x34,0x02,0x53,0x01,0x01,0x0d,0x01,0x01,0x01,0x01,0x01,0x3B,0x00 }, mxf_read_metadata_track, sizeof(MXFTrack), Track }, /* Generic Track */
+ { { 0x06,0x0E,0x2B,0x34,0x02,0x53,0x01,0x01,0x0d,0x01,0x01,0x01,0x01,0x01,0x41,0x00 }, mxf_read_metadata_dmsegment, sizeof(MXFDMSegment), DMSegment },
+ { { 0x06,0x0E,0x2B,0x34,0x02,0x53,0x01,0x01,0x0d,0x01,0x04,0x01,0x02,0x01,0x00,0x00 }, mxf_read_metadata_cryptographic_framework, sizeof(MXFCryptoFramework), CryptoFramework },
+ { { 0x06,0x0E,0x2B,0x34,0x02,0x53,0x01,0x01,0x0d,0x01,0x04,0x01,0x02,0x02,0x00,0x00 }, mxf_read_metadata_cryptographic_context, sizeof(MXFCryptoContext), CryptoContext },
{ { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }, NULL, 0, AnyType },
};
@@ -823,7 +985,8 @@
#ifdef DEBUG
PRINT_KEY("read header", klv.key);
#endif
- if (IS_KLV_KEY(klv.key, mxf_essence_element_key)) {
+ if (IS_KLV_KEY(klv.key, mxf_essence_element_key) ||
+ IS_KLV_KEY(klv.key, mxf_encrypted_triplet_key)) {
/* FIXME avoid seek */
url_fseek(&s->pb, klv.offset, SEEK_SET);
break;
@@ -862,12 +1025,16 @@
case MaterialPackage:
av_freep(&((MXFPackage *)mxf->metadata_sets[i])->tracks_refs);
break;
+ case DMSegment:
+ av_freep(&((MXFDMSegment *)mxf->metadata_sets[i])->trackids);
+ break;
default:
break;
}
av_freep(&mxf->metadata_sets[i]);
}
av_freep(&mxf->metadata_sets);
+ av_freep(&mxf->aesc);
return 0;
}
Index: libavutil/Makefile
===================================================================
--- libavutil/Makefile (revision 7881)
+++ libavutil/Makefile (working copy)
@@ -17,6 +17,7 @@
fifo.o \
tree.o \
lzo.o \
+ aes.o \
HEADERS = avutil.h common.h mathematics.h integer.h rational.h \
intfloat_readwrite.h md5.h adler32.h log.h fifo.h lzo.h
More information about the ffmpeg-devel
mailing list