Browse Source

MT#62735 honour strict-source during learning

Change-Id: Ic4eb9ebf20020bfea1840102e542d3ec5b9adcf2
rfuchs/security
Richard Fuchs 7 months ago
parent
commit
5132e74a41
2 changed files with 28 additions and 13 deletions
  1. +17
    -2
      daemon/media_socket.c
  2. +11
    -11
      t/auto-daemon-tests-heuristic.pl

+ 17
- 2
daemon/media_socket.c View File

@ -2536,11 +2536,26 @@ static bool media_packet_address_check(struct packet_handler_ctx *phc)
phc->mp.stream->detected_endpoints[idx] = phc->mp.fsin;
// now grab the best matched endpoint
for (idx = 0; idx < 4; idx++) {
use_endpoint_confirm = &phc->mp.stream->detected_endpoints[idx];
unsigned int matched_idx;
for (matched_idx = 0; matched_idx < 4; matched_idx++) {
use_endpoint_confirm = &phc->mp.stream->detected_endpoints[matched_idx];
if (use_endpoint_confirm->address.family)
break;
}
// finally, if there has been a better match and if strict-source is set,
// drop this packet
if (PS_ISSET(phc->mp.stream, STRICT_SOURCE) && matched_idx < idx) {
ilog(LOG_INFO | LOG_FLAG_LIMIT, "Drop during learning due to strict-source attribute; "
"got %s%s%s, "
"best match %s%s%s",
FMT_M(endpoint_print_buf(&phc->mp.fsin)),
FMT_M(endpoint_print_buf(use_endpoint_confirm)));
atomic64_inc_na(&phc->mp.stream->stats_in->errors);
atomic64_inc_na(&phc->mp.sfd->local_intf->stats->in.errors);
ret = true;
goto out;
}
}
if (wait_time)


+ 11
- 11
t/auto-daemon-tests-heuristic.pl View File

@ -359,19 +359,19 @@ snd($sock_a, $port_b, rtp(0, 1001, 3160, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1001, 3160, 0x1234, "\x00" x 160));
# callee send from different port
snd($sock_c, $port_a, rtp(0, 2001, 4160, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2001, 4160, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1002, 3320, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1002, 3320, 0x1234, "\x00" x 160));
# callee send from different address
snd($sock_d, $port_a, rtp(0, 2002, 4320, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2002, 4320, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1003, 3480, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1003, 3480, 0x1234, "\x00" x 160));
# callee send from different everything
snd($sock_e, $port_a, rtp(0, 2003, 4480, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2003, 4480, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1004, 3640, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1004, 3640, 0x1234, "\x00" x 160));
@ -384,19 +384,19 @@ snd($sock_a, $port_b, rtp(0, 1005, 3800, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1005, 3800, 0x1234, "\x00" x 160));
# callee send from different port
snd($sock_c, $port_a, rtp(0, 2005, 4800, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2005, 4800, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1006, 3960, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1006, 3960, 0x1234, "\x00" x 160));
# callee send from different address
snd($sock_d, $port_a, rtp(0, 2006, 4960, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2006, 4960, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1007, 4120, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1007, 4120, 0x1234, "\x00" x 160));
# callee send from different everything
snd($sock_e, $port_a, rtp(0, 2007, 5120, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2007, 5120, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1008, 4280, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1008, 4280, 0x1234, "\x00" x 160));
@ -506,7 +506,7 @@ snd($sock_a, $port_b, rtp(0, 1002, 3320, 0x1234, "\x00" x 160));
rcv($sock_c, $port_a, rtpm(0, 1002, 3320, 0x1234, "\x00" x 160));
# callee send from different address
snd($sock_d, $port_a, rtp(0, 2002, 4320, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2002, 4320, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to almost good candidate (different address ignored)
snd($sock_a, $port_b, rtp(0, 1003, 3480, 0x1234, "\x00" x 160));
rcv($sock_c, $port_a, rtpm(0, 1003, 3480, 0x1234, "\x00" x 160));
@ -519,19 +519,19 @@ rcv($sock_b, $port_a, rtpm(0, 1004, 3640, 0x1234, "\x00" x 160));
# callee send from different everything
snd($sock_e, $port_a, rtp(0, 2004, 4640, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2004, 4640, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1005, 3800, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1005, 3800, 0x1234, "\x00" x 160));
# callee send from different port
snd($sock_c, $port_a, rtp(0, 2005, 4800, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2005, 4800, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1006, 3960, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1006, 3960, 0x1234, "\x00" x 160));
# callee send from different address
snd($sock_d, $port_a, rtp(0, 2006, 4960, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2006, 4960, 0x1234, "\x00" x 160));
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1007, 4120, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1007, 4120, 0x1234, "\x00" x 160));
@ -547,7 +547,7 @@ sleep(4);
# callee send from different everything
snd($sock_e, $port_a, rtp(0, 2008, 5280, 0x1234, "\x00" x 160));
rcv($sock_a, $port_b, rtpm(0, 2008, 5280, 0x1234, "\x00" x 160)); # first packet that confirms the address still gets through
rcv_no($sock_a);
# caller send, forward to expected
snd($sock_a, $port_b, rtp(0, 1009, 4440, 0x1234, "\x00" x 160));
rcv($sock_b, $port_a, rtpm(0, 1009, 4440, 0x1234, "\x00" x 160));


Loading…
Cancel
Save