feat(gateway): bind Apollo launch to encrypted session work

gateway/apollo_native.go

@@ -1,17 +1,19 @@
 package gateway
 
 import (
-	"bufio"
 	"bytes"
 	"context"
+	"crypto/rand"
 	"crypto/sha256"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/binary"
 	"encoding/hex"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 	"sync"
@@ -36,20 +38,32 @@ func NewNativeApolloBackend() *NativeApolloBackend {
 
 func (b *NativeApolloBackend) Management(ctx context.Context, request LaunchRequest) ([]byte, error) {
 	work := request.ProviderWork
-	if err := work.Validate(); err != nil || work.ProviderProfile != ProviderProfileApollo {
+	if err := work.Validate(); err != nil || request.SessionID == "" || request.SessionID != work.SessionID || work.ProviderProfile != ProviderProfileApollo {
 		return nil, ErrProviderMalformed
 	}
+	client, err := newPinnedApolloHTTPClient(work)
+	if err != nil {
+		return nil, err
+	}
+	return apolloGet(ctx, client, work, "/serverinfo", nil)
+}
+
+func newPinnedApolloHTTPClient(work protocol.ProviderSessionWork) (*http.Client, error) {
 	tlsConfig, err := pinnedApolloTLSConfig(work)
 	if err != nil {
 		return nil, err
 	}
-	client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}, Timeout: 5 * time.Second}
-	managementURL := "https://" + net.JoinHostPort(work.ManagementHost, strconv.FormatInt(work.ManagementPort, 10)) + "/serverinfo"
-	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodGet, managementURL, nil)
+	return &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}, Timeout: 5 * time.Second}, nil
+}
+
+func apolloGet(ctx context.Context, client *http.Client, work protocol.ProviderSessionWork, path string, values url.Values) ([]byte, error) {
+	endpoint := url.URL{Scheme: "https", Host: net.JoinHostPort(work.ManagementHost, strconv.FormatInt(work.ManagementPort, 10)), Path: path}
+	endpoint.RawQuery = values.Encode()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)
 	if err != nil {
 		return nil, ErrProviderMalformed
 	}
-	response, err := client.Do(httpRequest)
+	response, err := client.Do(request)
 	if err != nil {
 		return nil, err
 	}
@@ -94,7 +108,43 @@ func pinnedApolloTLSConfig(work protocol.ProviderSessionWork) (*tls.Config, erro
 
 func (b *NativeApolloBackend) Setup(ctx context.Context, request LaunchRequest) ([]byte, error) {
 	work := request.ProviderWork
-	if err := work.Validate(); err != nil || request.SessionID == "" {
+	if err := work.Validate(); err != nil || request.SessionID == "" || request.SessionID != work.SessionID || work.ProviderProfile != ProviderProfileApollo {
+		return nil, ErrProviderMalformed
+	}
+	client, err := newPinnedApolloHTTPClient(work)
+	if err != nil {
+		return nil, err
+	}
+	inventory, err := apolloGet(ctx, client, work, "/applist", url.Values{"uniqueid": []string{work.ClientID}})
+	if err != nil || !apolloInventoryContains(inventory, work.ApplicationID) {
+		return nil, ErrProviderMalformed
+	}
+	key := make([]byte, 16)
+	if _, err := rand.Read(key); err != nil {
+		return nil, err
+	}
+	var keyID [4]byte
+	if _, err := rand.Read(keyID[:]); err != nil {
+		return nil, err
+	}
+	launch, err := apolloGet(ctx, client, work, "/launch", url.Values{
+		"uniqueid": {work.ClientID}, "appid": {work.ApplicationID}, "rikey": {hex.EncodeToString(key)},
+		"rikeyid": {strconv.FormatUint(uint64(binary.BigEndian.Uint32(keyID[:])), 10)}, "localAudioPlayMode": {"0"},
+		"corever": {"1"},
+	})
+	if err != nil {
+		return nil, err
+	}
+	launchResponse, err := parseApolloLaunchResponse(launch)
+	if err != nil {
+		return nil, err
+	}
+	streamURL, err := url.Parse(launchResponse.SessionURL)
+	if err != nil || streamURL.Scheme != "rtspenc" || streamURL.Hostname() != work.StreamHost {
+		return nil, ErrProviderMalformed
+	}
+	streamPort, err := strconv.ParseInt(streamURL.Port(), 10, 64)
+	if err != nil || streamPort != work.StreamPort {
 		return nil, ErrProviderMalformed
 	}
 	conn, err := b.Dialer.DialContext(ctx, "tcp", net.JoinHostPort(work.StreamHost, strconv.FormatInt(work.StreamPort, 10)))
@@ -104,12 +154,22 @@ func (b *NativeApolloBackend) Setup(ctx context.Context, request LaunchRequest)
 	if deadline, ok := ctx.Deadline(); ok {
 		_ = conn.SetDeadline(deadline)
 	}
-	requestText := "SETUP rtsp://" + work.StreamHost + "/streamid=video/0/0 RTSP/1.0\r\nCSeq: 1\r\nTransport: RTP/AVP/TCP;interleaved=0-1\r\nSession: " + request.SessionID + "\r\n\r\n"
-	if _, err := io.WriteString(conn, requestText); err != nil {
+	codec, err := newEncryptedRTSPCodec(key)
+	if err != nil {
 		_ = conn.Close()
 		return nil, err
 	}
-	response, err := readRTSPHeaders(conn, 16*1024)
+	requestText := "SETUP rtsp://" + work.StreamHost + "/streamid=video/0/0 RTSP/1.0\r\nCSeq: 1\r\nTransport: RTP/AVP/TCP;interleaved=0-1\r\n\r\n"
+	encoded, err := codec.SealClient([]byte(requestText))
+	if err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	if _, err := conn.Write(encoded); err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	response, err := readEncryptedRTSPHeaders(conn, codec)
 	if err != nil {
 		_ = conn.Close()
 		return nil, err
@@ -122,10 +182,10 @@ func (b *NativeApolloBackend) Setup(ctx context.Context, request LaunchRequest)
 
 func (b *NativeApolloBackend) Open(_ context.Context, request LaunchRequest, _ RTSPResponse) (ProviderSession, error) {
 	b.mu.Lock()
-	conn := b.pending[request.SessionID]
+	conn, ok := b.pending[request.SessionID]
 	delete(b.pending, request.SessionID)
 	b.mu.Unlock()
-	if conn == nil {
+	if !ok || conn == nil {
 		return nil, ErrProviderDisconnected
 	}
 	session := newNativeApolloSession(conn, request.SessionID)
@@ -144,20 +204,25 @@ func readBounded(reader io.Reader, max int) ([]byte, error) {
 	return data, nil
 }
 
-func readRTSPHeaders(conn net.Conn, max int) ([]byte, error) {
-	reader := bufio.NewReaderSize(conn, 4096)
-	var response []byte
-	for len(response) < max {
-		line, err := reader.ReadBytes('\n')
-		if err != nil {
-			return nil, err
-		}
-		response = append(response, line...)
-		if strings.HasSuffix(string(response), "\r\n\r\n") {
-			return response, nil
-		}
+func readEncryptedRTSPHeaders(conn net.Conn, codec *encryptedRTSPCodec) ([]byte, error) {
+	header := make([]byte, encryptedRTSPHeaderSize)
+	if _, err := io.ReadFull(conn, header); err != nil {
+		return nil, err
 	}
-	return nil, ErrProviderMalformed
+	length := binary.BigEndian.Uint32(header[:4]) & 0x7fffffff
+	if length == 0 || length > encryptedRTSPMaxPayload {
+		return nil, ErrProviderMalformed
+	}
+	frame := make([]byte, encryptedRTSPHeaderSize+int(length))
+	copy(frame, header)
+	if _, err := io.ReadFull(conn, frame[encryptedRTSPHeaderSize:]); err != nil {
+		return nil, err
+	}
+	plaintext, err := codec.OpenHost(frame)
+	if err != nil || len(plaintext) > 16*1024 || !strings.HasSuffix(string(plaintext), "\r\n\r\n") {
+		return nil, ErrProviderMalformed
+	}
+	return plaintext, nil
 }
 
 type nativeApolloSession struct {