ben.carrasco/sbc-outbound
1
0
Fork 0
mirror of https://github.com/jambonz/sbc-outbound.git synced 2025-12-19 04:27:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

set strict source (#185)

Browse Source 
* set strict source

RTPBleed

* change to env var for strict source

* Update srtp-transcoding.json

* lint

* lint

* reverse the logic

* and argghhh

* clarification

* change
This commit is contained in:
Sam Machin
2025-08-04 00:44:31 +01:00
committed by GitHub
parent 6771cbdefc
commit 9357920f76
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
data/rtp-transcoding.json
View File

@@ -3,6 +3,6 @@
"DTLS": "off", "DTLS": "off",
"SDES": "off", "SDES": "off",
"ICE": "remove", "ICE": "remove",
"flags": ["media handover", "port latching"], "flags": ["port latching"],
"rtcp-mux": ["demux"] "rtcp-mux": ["demux"]
} }

4
data/srtp-transcoding.json
View File

@@ -3,13 +3,13 @@
"transport-protocol": "UDP/TLS/RTP/SAVPF", "transport-protocol": "UDP/TLS/RTP/SAVPF",
"ICE": "force", "ICE": "force",
"SDES": "off", "SDES": "off",
"flags": ["generate mid", "SDES-no", "media handover", "port latching"], "flags": ["generate mid", "SDES-no", "port latching"],
"rtcp-mux": ["require"] "rtcp-mux": ["require"]
}, },
"teams": { "teams": {
"transport-protocol": "RTP/SAVP", "transport-protocol": "RTP/SAVP",
"ICE": "force", "ICE": "force",
"flags": ["generate mid", "media handover", "flags": ["generate mid",
"SDES-no-AES_CM_128_HMAC_SHA1_32", "SDES-no-AES_CM_128_HMAC_SHA1_32",
"SDES-no-F8_128_HMAC_SHA1_80", "SDES-no-F8_128_HMAC_SHA1_80",
"SDES-no-F8_128_HMAC_SHA1_32", "SDES-no-F8_128_HMAC_SHA1_32",

6
lib/utils.js
View File

@@ -28,6 +28,12 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, padCrypto, teams
srcOpts.flags.push('inject DTMF'); srcOpts.flags.push('inject DTMF');
} }
} }
/** By default use strict source to secure aganst RTPInject vuln,
* set env var to true to disable it and use media handover instead */
const disableStrictSource = !!process.env.RTPENGINE_DISABLE_STRICT_SOURCE;
dstOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
srcOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
const common = { const common = {
'call-id': req.get('Call-ID'), 'call-id': req.get('Call-ID'),
'replace': ['origin', 'session-connection'], 'replace': ['origin', 'session-connection'],