From a383d87281feffd4dfed689cfbb8e35641bce5b7 Mon Sep 17 00:00:00 2001 From: Erik Hortsch Date: Mon, 2 Nov 2026 10:29:26 -0800 Subject: [PATCH] Add OSS Scanner build image and threat model Co-Authored-By: Claude Opus 5.5 --- .oss-scanner/Dockerfile | 36 ++++++++++++++++ .oss-scanner/threat_model.md | 84 ++++++++++++++++++++++++++++++++++++ 2 files changed, 120 insertions(+) create mode 100644 .oss-scanner/Dockerfile create mode 100644 .oss-scanner/threat_model.md diff --git a/.oss-scanner/Dockerfile b/.oss-scanner/Dockerfile new file mode 100644 index 000000000..90b68eeca --- /dev/null +++ b/.oss-scanner/Dockerfile @@ -0,0 +1,36 @@ +# Copyright 2026 LiveKit, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Build image for Anthropic's OSS Scanner. Keep the Go version at or above go.mod's: GOTOOLCHAIN=local won't fetch one. +FROM golang:1.26-bookworm + +ENV DEBIAN_FRONTEND=noninteractive \ + GOTOOLCHAIN=local + +RUN apt-get update && apt-get install -y --no-install-recommends \ + build-essential ca-certificates git \ + && rm -rf /var/lib/apt/lists/* + +WORKDIR /src +COPY . /src + +RUN go mod download && go mod verify +RUN go build ./... && go vet ./auth/... ./webhook/... ./datatrack/... ./sdp/... + +RUN go test -count=1 -timeout 20m ./... || echo 'WARNING: baseline tests failed' + +ENV GOPROXY=off \ + GOSUMDB=off + +CMD ["bash"] diff --git a/.oss-scanner/threat_model.md b/.oss-scanner/threat_model.md new file mode 100644 index 000000000..42d7b7ed0 --- /dev/null +++ b/.oss-scanner/threat_model.md @@ -0,0 +1,84 @@ +# LiveKit protocol threat model + +`github.com/livekit/protocol` is a Go library shared by the LiveKit server, the +Go server SDK, and LiveKit's media services. It holds the protobuf definitions +and generated code, plus the Go helpers that interpret untrusted input on their +behalf: access-token and webhook verification, SDP and RTP helpers, data-track +packet parsing, and decode budgets for protobuf and JSON. + +## Scope and trust boundaries + +Audit the hand-written Go on `main`. Prioritise: + +- `auth/`: access-token minting, parsing, and verification, and grant + semantics (`ClaimGrants`, `VideoGrant`, `SIPGrant`, agent and inference + grants). +- `webhook/`: `Receive` / `ReceiveWebhookEvent` (signature and body-hash + verification) and the outbound notifier. +- `utils/jwtutil/`, `utils/decodebudget/`: JWT helpers and resource limits for + decoding untrusted protobuf and JSON. +- `datatrack/`, `sdp/`, `utils/rtputil/`, `codecs/`: parsers for packets and + SDP that arrive from clients. +- `sip/`: SIP token building, phone-number normalisation, and trunk and + dispatch-rule matching. +- `utils/` helpers that redact secrets or handle IDs. + +Out of scope: generated code (`*.pb.go`, `*.twirp.go`, `*.psrpc.go`), the +`.proto` files themselves, the JS packages under `packages/`, and build tooling +under `magefile.go` and `tools/`. Report a bug in a generated file only when +the generator template or the `.proto` definition causes it. + +Untrusted input: access tokens and webhook requests from the network, SDP, +RTP/RTCP, and data-track packets from clients, and any protobuf or JSON a +client can send that these packages decode. + +Trusted: API secrets, the caller's configuration, and values the embedding +application passes in after it has authenticated them. + +LiveKit server (`livekit/livekit`) is enrolled separately. Report bugs in how +the server uses these packages there; report bugs in the packages here. + +## Security properties + +- **Token verification:** a token must verify only with its issuer's secret, + only with HS256, and only inside its validity window. Parsing an unverified + token must never be treated as verification. Grants must deserialize exactly + as signed; a token must not gain a grant, room, or identity it was not issued. +- **Webhook verification:** an event must be accepted only when its token + verifies and the body's SHA-256 matches the signed hash. +- **Parsing:** SDP, RTP extensions, data-track packets, and decode-budget + inputs must not panic, loop, or allocate without bound on malformed input. +- **Decode budgets:** the budget must bound the memory and CPU of decoding the + message it is applied to. +- **Secrets:** API secrets must not appear in logs, errors, or redacted output. + +## Severity guidance + +- **Critical:** forging a token or webhook that verifies without the secret. +- **High:** accepting an expired, wrong-algorithm, or wrong-issuer token; + grant escalation through parsing; a panic reachable from untrusted network + input that crashes the embedding process. +- **Medium:** unbounded resource use from one untrusted input; a decode budget + that undercounts by a large factor; secret leakage into logs. +- **Low / not a finding:** misuse that needs the API secret or caller + configuration; issues only in generated code; outbound webhook delivery + behaviour (retries, ordering) without a security impact. + +## Testing + +The checkout is at `/src`. Go dependencies are cached. `GOPROXY=off` and +`GOSUMDB=off` prevent downloads. No external services are needed. + +```sh +cd /src +go test -count=1 ./... +go test -race -count=1 ./auth/... ./webhook/... ./datatrack/... ./sdp/... +go test -run '^$' -fuzz FuzzPacketUnmarshal -fuzztime 60s ./datatrack +go test -run '^$' -fuzz FuzzSDPFragmentUnmarshal -fuzztime 60s ./sdp +``` + +## Reports + +State the attacker's required access (none, any valid token, or a specific +grant), the entry point, and the demonstrated impact. Provide a minimal +reproducer, preferably a Go test in the affected package.