only accept fs/rtp options from internal CIDR (#140)

app.js

@@ -144,6 +144,7 @@ const cidrs = cidrsEnv
   .split(',')
   .map((s) => s.trim());
 const matcher = new CIDRMatcher(cidrs);
+srf.locals.matcher = matcher;
 
 srf.connect({ host: DRACHTIO_HOST, port: DRACHTIO_PORT, secret: DRACHTIO_SECRET });
 srf.on('connect', (err, hp, version, localHostports) => {

lib/options.js

@@ -10,7 +10,7 @@ const fsServiceUrls = new Map();
 const rtpServers = new Map();
 
 module.exports = ({srf, logger}) => {
-  const {stats, addToSet, removeFromSet, isMemberOfSet, retrieveSet} = srf.locals;
+  const {stats, addToSet, removeFromSet, isMemberOfSet, retrieveSet, matcher} = srf.locals;
 
   const setNameFs = `${(JAMBONES_CLUSTER_ID || 'default')}:active-fs`;
   const setNameRtp = `${(JAMBONES_CLUSTER_ID || 'default')}:active-rtp`;
@@ -119,6 +119,16 @@ module.exports = ({srf, logger}) => {
       return req.srf.endSession(req);
     }
 
+    /* an internal status ping must originate from within our private network;
+       otherwise an attacker could insert bogus active-fs / active-rtp records into redis.
+       Silently ignore (respond as an ordinary OPTIONS ping) if the source is not trusted. */
+    if (matcher && !matcher.contains(req.source_address)) {
+      logger.warn({source_address: req.source_address},
+        'ignoring FS/RTP status OPTIONS ping from IP outside JAMBONES_NETWORK_CIDR');
+      res.send(200);
+      return req.srf.endSession(req);
+    }
+
     try {
       let map, status, countOfMembers;
       const h = ['X-FS-Status', 'X-RTP-Status'].find((h) => req.has(h));