Preston_PLB
/
freeswitch
forked from Mirrors/freeswitch
1
0
Fork 0
Code Pull Requests Activity

Merge pull request from GHSA-39gv-hq72-j6m6 

[Core] Reject DTLS packets coming from a source different than the current ICE negotiated path.
This commit is contained in:
Andrey Volk 2023-12-22 17:57:34 +03:00 committed by GitHub
parent 623f6176a3 6ea8c96c3d
commit 86cbda90b8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/switch_rtp.c
View File

@ -3374,7 +3374,20 @@ static int do_dtls(switch_rtp_t *rtp_session, switch_dtls_t *dtls)
return 0;
}
if (is_ice && !rtp_session->ice.cand_responsive) {
if (is_ice && !(rtp_session->ice.type & ICE_LITE) && !rtp_session->ice.cand_responsive) {
switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(rtp_session->session), SWITCH_LOG_DEBUG6, "Got DTLS packet but candidate is not responsive\n");
return 0;
}
if (is_ice && !switch_cmp_addr(rtp_session->from_addr, rtp_session->ice.addr, SWITCH_TRUE)) {
char tmp_buf1[80] = "";
char tmp_buf2[80] = "";
const char *host_from = switch_get_addr(tmp_buf1, sizeof(tmp_buf1), rtp_session->from_addr);
const char *host_ice_cur_addr = switch_get_addr(tmp_buf2, sizeof(tmp_buf2), rtp_session->ice.addr);
switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(rtp_session->session), SWITCH_LOG_DEBUG5, "Got DTLS packet from [%s] whilst current ICE negotiated address is [%s]. Ignored.\n", host_from, host_ice_cur_addr);
return 0;
}