ben.carrasco/sbc-inbound
1
0
Fork 0
mirror of https://github.com/jambonz/sbc-inbound.git synced 2025-12-18 20:27:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set strict source on rtpengine (#210)

Browse Source 
* Set strict source on rtpengine

RTPBleed

* use env var for strict source

* lint

* Update utils.js

* arghhhh

* clarification

* change
This commit is contained in:
Sam Machin
2025-08-04 00:44:47 +01:00
committed by GitHub
parent 45684aa337
commit 83461f99e8
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
data/rtp-transcoding.json
View File

@@ -3,6 +3,6 @@
"DTLS": "off",
"SDES": "off",
"ICE": "remove",
"flags": ["media handover", "port latching"],
"flags": ["port latching"],
"rtcp-mux": ["accept"]
}

4
data/srtp-transcoding.json
View File

@@ -3,14 +3,14 @@
"transport-protocol": "UDP/TLS/RTP/SAVPF",
"ICE": "default",
"SDES": "off",
"flags": ["generate mid", "SDES-no", "media handover", "port latching"],
"flags": ["generate mid", "SDES-no", "port latching"],
"rtcp-mux": ["require"]
},
"teams": {
"transport-protocol": "RTP/SAVP",
"ICE": "default",
"SDES": "off",
"flags": ["generate mid", "SDES-no", "media handover", "port latching"],
"flags": ["generate mid", "SDES-no", "port latching"],
"rtcp-mux": ["accept"]
}
}

6
lib/utils.js
View File

@@ -30,6 +30,12 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, teams = false) {
dstOpts.flags.push('inject DTMF');
srcOpts.flags.push('inject DTMF');
}
/** By default use strict source to secure aganst RTPInject vuln,
* set env var to true to disable it and use media handover instead */
const disableStrictSource = !!process.env.RTPENGINE_DISABLE_STRICT_SOURCE;
dstOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
srcOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
const acceptCodecs = process.env.JAMBONES_ACCEPT_AND_TRANSCODE ?
process.env.JAMBONES_ACCEPT_AND_TRANSCODE :
process.env.JAMBONES_ACCEPT_G729 ? 'g729' : '';