Set strict source on rtpengine (#210)

* Set strict source on rtpengine

RTPBleed

* use env var for strict source

* lint

* Update utils.js

* arghhhh

* clarification

* change

data/rtp-transcoding.json

@@ -3,6 +3,6 @@
   "DTLS": "off",
   "SDES": "off",
   "ICE": "remove",
-  "flags": ["media handover", "port latching"],
+  "flags": ["port latching"],
   "rtcp-mux": ["accept"]
 }

data/srtp-transcoding.json

@@ -3,14 +3,14 @@
     "transport-protocol": "UDP/TLS/RTP/SAVPF",
     "ICE": "default",
     "SDES": "off",
-    "flags": ["generate mid", "SDES-no", "media handover", "port latching"],
+    "flags": ["generate mid", "SDES-no", "port latching"],
     "rtcp-mux": ["require"]  
   },
   "teams": {
     "transport-protocol": "RTP/SAVP",
     "ICE": "default",
     "SDES": "off",
-    "flags": ["generate mid", "SDES-no", "media handover", "port latching"],
+    "flags": ["generate mid", "SDES-no", "port latching"],
     "rtcp-mux": ["accept"]
   }
 }

lib/utils.js

@@ -30,6 +30,12 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, teams = false) {
     dstOpts.flags.push('inject DTMF');
     srcOpts.flags.push('inject DTMF');
   }
+  /** By default use strict source to secure aganst RTPInject vuln,
+   * set env var to true to disable it and use media handover instead */
+  const disableStrictSource = !!process.env.RTPENGINE_DISABLE_STRICT_SOURCE;
+  dstOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
+  srcOpts.flags.push(disableStrictSource ?  'media handover' : 'strict source');
+
   const acceptCodecs = process.env.JAMBONES_ACCEPT_AND_TRANSCODE ?
     process.env.JAMBONES_ACCEPT_AND_TRANSCODE :
     process.env.JAMBONES_ACCEPT_G729 ? 'g729' : '';