From 9357920f767d57db1b3f9abb1415758ca62d0271 Mon Sep 17 00:00:00 2001
From: Sam Machin <sam@sammachin.com>
Date: Mon, 4 Aug 2025 00:44:31 +0100
Subject: [PATCH] set strict source (#185)

* set strict source

RTPBleed

* change to env var for strict source

* Update srtp-transcoding.json

* lint

* lint

* reverse the logic

* and argghhh

* clarification

* change
---
 data/rtp-transcoding.json  | 2 +-
 data/srtp-transcoding.json | 4 ++--
 lib/utils.js               | 6 ++++++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/data/rtp-transcoding.json b/data/rtp-transcoding.json
index c302add..029986d 100644
--- a/data/rtp-transcoding.json
+++ b/data/rtp-transcoding.json
@@ -3,6 +3,6 @@
   "DTLS": "off",
   "SDES": "off",
   "ICE": "remove",
-  "flags": ["media handover", "port latching"],
+  "flags": ["port latching"],
   "rtcp-mux": ["demux"]
 }
\ No newline at end of file
diff --git a/data/srtp-transcoding.json b/data/srtp-transcoding.json
index 9d37a53..e6182f3 100644
--- a/data/srtp-transcoding.json
+++ b/data/srtp-transcoding.json
@@ -3,13 +3,13 @@
     "transport-protocol": "UDP/TLS/RTP/SAVPF",
     "ICE": "force",
     "SDES": "off",
-    "flags": ["generate mid", "SDES-no", "media handover", "port latching"],
+    "flags": ["generate mid", "SDES-no", "port latching"],
     "rtcp-mux": ["require"]  
   },
   "teams": {
     "transport-protocol": "RTP/SAVP",
     "ICE": "force",
-    "flags": ["generate mid", "media handover",
+    "flags": ["generate mid",
       "SDES-no-AES_CM_128_HMAC_SHA1_32",
       "SDES-no-F8_128_HMAC_SHA1_80",
       "SDES-no-F8_128_HMAC_SHA1_32",
diff --git a/lib/utils.js b/lib/utils.js
index 7c3e91b..49e270b 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -28,6 +28,12 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, padCrypto, teams
       srcOpts.flags.push('inject DTMF');
     }
   }
+  /** By default use strict source to secure aganst RTPInject vuln,
+   * set env var to true to disable it and use media handover instead */
+  const disableStrictSource = !!process.env.RTPENGINE_DISABLE_STRICT_SOURCE;
+  dstOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
+  srcOpts.flags.push(disableStrictSource ?  'media handover' : 'strict source');
+
   const common = {
     'call-id': req.get('Call-ID'),
     'replace': ['origin', 'session-connection'],