Talon/voice-cat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(media): rewrite relay re-seal seq so multi-user audio decrypts

Browse Source 
The media AEAD nonce is an implicit per-direction monotonic counter;
open() reconstructs it from the 14-byte header seq field (the AAD), so
the contract is header.seq == the counter seal() used. The SFU relay
decrypted inbound frames with the sender key, re-sealed with the
recipient send_crypto (its own counter), but forwarded the sender
header verbatim -- so seq carried the wrong counter and the recipient
rebuilt the wrong nonce, silently dropping every relayed frame. It only
worked for a single first-ever sender into a fresh recipient, which is
why reverse/3rd-party audio failed.

Rewrite the outgoing header seq to the recipient peek_send_counter()
before re-sealing so each server->client direction is one contiguous
monotonic counter and the nonce always matches. Safe: the jitter buffer
orders by timestamp, not seq. No wire-format/proto/ABI change.

Adds test_relay_interleaved_reseal regression coverage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Talon
2026-06-17 21:38:27 +02:00
parent 118ca5129f
commit 2185d9d15c
3 changed files with 140 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

104
tests/test_media_aead.cpp
View File

@@ -3,6 +3,7 @@
*
* Uses a synthetic 32-byte key directly (no TLS context needed for unit tests).
*/
#include <array>
#include <cstdio>
#include <cstring>
#include <vector>
@@ -148,6 +149,108 @@ static void test_multiple_packets() {
}
}
// Build a 14-byte AAD (voice frame header) with a given ssrc + seq.
static std::vector<uint8_t> make_aad_ssrc(uint32_t ssrc, uint16_t seq) {
VoiceFrame f;
f.ssrc = ssrc;
f.seq = seq;
std::vector<uint8_t> aad(kVoiceHeaderSize);
serialize_header(f, aad.data());
return aad;
}
// Simulate one server relay hop for a single frame, sender → recipient R.
// - sender seals with its send key, setting header seq = its own send counter (client contract).
// - server opens with the sender's key, then re-seals with R's send key.
// - if rewrite_seq, the re-sealed header's seq is set to R's send counter (the fix); otherwise
// the sender's seq is forwarded verbatim (the bug).
// Returns true iff R successfully decrypts the relayed frame.
static bool relay_one(SodiumMediaCrypto& sender_send, SodiumMediaCrypto& server_recv,
SodiumMediaCrypto& r_send, SodiumMediaCrypto& r_recv,
uint32_t ssrc, const std::vector<uint8_t>& plain, bool rewrite_seq) {
// Client A→server: seq carries the sender's send counter.
auto in_aad = make_aad_ssrc(ssrc, static_cast<uint16_t>(sender_send.peek_send_counter()));
std::vector<uint8_t> cipher(plain.size() + crypto_aead_chacha20poly1305_ietf_ABYTES);
long sealed = sender_send.seal(plain.data(), plain.size(), in_aad.data(), in_aad.size(),
cipher.data(), cipher.size());
if (sealed < 0) return false;
// Server decrypts the inbound frame.
std::vector<uint8_t> recovered(plain.size());
long opened = server_recv.open(cipher.data(), static_cast<size_t>(sealed),
in_aad.data(), in_aad.size(),
recovered.data(), recovered.size());
if (opened < 0) return false;
// Server re-seals to R. Header passes through except seq, which (when fixed) is set to R's
// own send counter so R's open() reconstructs the matching nonce.
std::vector<uint8_t> out_aad = in_aad; // copy header verbatim
if (rewrite_seq) {
uint64_t ctr = r_send.peek_send_counter();
out_aad[8] = static_cast<uint8_t>((ctr >> 8) & 0xFF);
out_aad[9] = static_cast<uint8_t>(ctr & 0xFF);
}
std::vector<uint8_t> relay_cipher(recovered.size() + crypto_aead_chacha20poly1305_ietf_ABYTES);
long resealed = r_send.seal(recovered.data(), static_cast<size_t>(opened),
out_aad.data(), out_aad.size(),
relay_cipher.data(), relay_cipher.size());
if (resealed < 0) return false;
// R decrypts the relayed frame.
std::vector<uint8_t> r_recovered(recovered.size());
long r_opened = r_recv.open(relay_cipher.data(), static_cast<size_t>(resealed),
out_aad.data(), out_aad.size(),
r_recovered.data(), r_recovered.size());
return r_opened == static_cast<long>(plain.size());
}
// Regression test for the relay nonce-desync bug: two senders (A, B) relayed into one recipient
// (R) interleaved. The media AEAD nonce is an implicit per-direction counter reconstructed from
// the header seq; if the relay forwards the sender's seq verbatim, it no longer matches R's send
// counter and frames fail to decrypt. The relay must rewrite seq = R's send counter.
static void test_relay_interleaved_reseal() {
auto make_key = [](const char* label) {
std::array<uint8_t, crypto_aead_chacha20poly1305_ietf_KEYBYTES> k{};
crypto_generichash(k.data(), k.size(),
reinterpret_cast<const uint8_t*>(label),
std::strlen(label), nullptr, 0);
return k;
};
auto kA = make_key("relay-A"); // A↔server direction
auto kB = make_key("relay-B"); // B↔server direction
auto kR = make_key("relay-R"); // server↔R direction
std::vector<uint8_t> plain(80, 0x3C);
// Fixed path: interleaved A/B frames all decrypt at R.
{
SodiumMediaCrypto a_send(kA.data()), srv_recv_a(kA.data());
SodiumMediaCrypto b_send(kB.data()), srv_recv_b(kB.data());
SodiumMediaCrypto r_send(kR.data()), r_recv(kR.data());
bool all_ok = true;
for (int i = 0; i < 8; ++i) {
all_ok &= relay_one(a_send, srv_recv_a, r_send, r_recv, 0x1111, plain, /*rewrite=*/true);
all_ok &= relay_one(b_send, srv_recv_b, r_send, r_recv, 0x2222, plain, /*rewrite=*/true);
}
CHECK(all_ok); // with the fix, every interleaved relayed frame decrypts at R
}
// Control: forwarding seq verbatim (the bug) must drop frames once the counters diverge.
{
SodiumMediaCrypto a_send(kA.data()), srv_recv_a(kA.data());
SodiumMediaCrypto b_send(kB.data()), srv_recv_b(kB.data());
SodiumMediaCrypto r_send(kR.data()), r_recv(kR.data());
int failures = 0;
for (int i = 0; i < 8; ++i) {
if (!relay_one(a_send, srv_recv_a, r_send, r_recv, 0x1111, plain, /*rewrite=*/false)) ++failures;
if (!relay_one(b_send, srv_recv_b, r_send, r_recv, 0x2222, plain, /*rewrite=*/false)) ++failures;
}
CHECK(failures > 0); // proves the verbatim-seq path is broken (locks in the regression)
}
}
int main() {
if (sodium_init() < 0) {
std::printf("FAIL: sodium_init failed\n");
@@ -158,6 +261,7 @@ int main() {
test_anti_replay();
test_tamper_detection();
test_multiple_packets();
test_relay_interleaved_reseal();
if (g_failures == 0) {
std::printf("media_aead: all tests passed\n");