Set strict source on rtpengine (#210)

* Set strict source on rtpengine

RTPBleed

* use env var for strict source

* lint

* Update utils.js

* arghhhh

* clarification

* change

data/rtp-transcoding.json

@@ -3,6 +3,6 @@
   "DTLS": "off",
   "SDES": "off",
   "ICE": "remove",
-  "flags": ["media handover", "port latching"],
+  "flags": ["port latching"],
   "rtcp-mux": ["accept"]
 }

data/srtp-transcoding.json

@@ -3,14 +3,14 @@
     "transport-protocol": "UDP/TLS/RTP/SAVPF",
     "ICE": "default",
     "SDES": "off",
-    "flags": ["generate mid", "SDES-no", "media handover", "port latching"],
+    "flags": ["generate mid", "SDES-no", "port latching"],
     "rtcp-mux": ["require"]  
   },
   "teams": {
     "transport-protocol": "RTP/SAVP",
     "ICE": "default",
     "SDES": "off",
-    "flags": ["generate mid", "SDES-no", "media handover", "port latching"],
+    "flags": ["generate mid", "SDES-no", "port latching"],
     "rtcp-mux": ["accept"]
   }
 }

lib/utils.js

@@ -30,6 +30,12 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, teams = false) {
     dstOpts.flags.push('inject DTMF');
     srcOpts.flags.push('inject DTMF');
   }
+  /** By default use strict source to secure aganst RTPInject vuln,
+   * set env var to true to disable it and use media handover instead */
+  const disableStrictSource = !!process.env.RTPENGINE_DISABLE_STRICT_SOURCE;
+  dstOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
+  srcOpts.flags.push(disableStrictSource ?  'media handover' : 'strict source');
+
   const acceptCodecs = process.env.JAMBONES_ACCEPT_AND_TRANSCODE ?
     process.env.JAMBONES_ACCEPT_AND_TRANSCODE :
     process.env.JAMBONES_ACCEPT_G729 ? 'g729' : '';

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sbc-inbound",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "sbc-inbound",
-      "version": "0.9.4",
+      "version": "0.9.5",
       "license": "MIT",
       "dependencies": {
         "@aws-sdk/client-auto-scaling": "^3.549.0",
@@ -2364,10 +2364,11 @@
       "integrity": "sha512-AlcaJBi/pqqJBIQ8U9Mcpc9i8Aqxn88Skv5d+xBX006BY5u8N3mGLHa5Lgppa7L/HfwgwLgZ6NYs+Ag6uUmJRA=="
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"
@@ -8567,9 +8568,9 @@
       "integrity": "sha512-AlcaJBi/pqqJBIQ8U9Mcpc9i8Aqxn88Skv5d+xBX006BY5u8N3mGLHa5Lgppa7L/HfwgwLgZ6NYs+Ag6uUmJRA=="
     },
     "brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "dev": true,
       "requires": {
         "balanced-match": "^1.0.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbc-inbound",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "main": "app.js",
   "engines": {
     "node": ">= 18.0.0"