Run the check against ICE candidates not just for DTLS packets, but for
all received packets, except STUN which have authentication and are
needed to learn new ICE candidates.
Change-Id: I25df8fa6db4f828a68ba3b9e5cd35d2b56c0df08
(cherry picked from commit 8317cc7071)
(cherry picked from commit 1400fafa75)
To not come across the sink's mutation (e.g. `endpoint.address.family`)
just lock way earlier, before to start processing and
translating endpoint to the kernel related structs.
Otherwise the other signaling path may mutate something
which will make the sink unactual and provide
to the `__re_address_translate_ep()` NULLed or garbage structs.
Change-Id: I88d87ae88abe4e37aaa5d3cdda76ed0ca82e4842
(cherry picked from commit e16a2309e0)
(cherry picked from commit c58a3fa79f)
ICE drops packets early in media_demux_protocols() (via
ice_peer_address_known()), which means in media_packet_address_check()
we can immediately set any socket as confirmed that has received
anything.
Take receiving socket into account to determine whether the endpoint is
a match.
Disable endpoint learning with ICE. ICE is in charge of determining
endpoint address and local socket.
`media-handover` and `strict-source` handling remains in place. With
`media-handover` set, we allow changing endpoint and local socket based
on what is actually received, overriding the nomination from ICE.
Change-Id: Ieac2893355df6ee560b497867181e6f47d646f2e
(cherry picked from commit d3af013494)
(cherry picked from commit dd347cf5b4)
Don't just check for the selected_sfd to be non null, but also for the
socket to actually be open, as this is needed for the translate_ep set
of functions in particular.
Change-Id: I78cb0f7b8c9e4359c9e037485b29f63e0cd9476b
(cherry picked from commit 9cb902319c)
(cherry picked from commit 4847c8ad10)
A stream that needs to be unkernelized that wasn't actually kernelized
due to lack of support or information still needs to have the flag reset
so that it can retried.
Change-Id: I7de17236d382d4f4dbfc3225c37688769cc9c8ad
(cherry picked from commit ab8b7fb228)
(cherry picked from commit a6cb6daf04)
Pull the kernel in/out checks down below the "out" label, and use the
existing flags from the STUN connect event instead of directly calling
the relevant function.
Change-Id: Ide1ebf0d18446427535d9e63dadf7fdbbddc6c94
(cherry picked from commit 209e5a38dc)
(cherry picked from commit 2a358af600)
Set the stream as kernelized even if it couldn't be, so that we don't
keep trying.
Change-Id: Icf05c6cab2f52d918ba04e7cb2089347b3f72378
(cherry picked from commit 46e8d6c305)
(cherry picked from commit 021826b38a)
If SRTP/DTLS isn't yet established, do fully bail out of the kernelize
function, instead of just logging a message and blindly continuing, as
it would eventually fail due to missing or invalid SRTP parameters.
Fix-up for f2d57de078
Change-Id: I3521f54fe2001d3c67118a3502807d8cb6ada7ee
(cherry picked from commit 7ab5cf3ebf)
(cherry picked from commit 6e3871c893)
We can bail right there instead of having to rely on the
`(!reti->local.family)` condition
Change-Id: I584e90dd1a705cfbe1cd3e3d849e1fa88f511448
(cherry picked from commit dbcd657908)
(cherry picked from commit ef54dbe419)
Similar in spirit to f2d57de078, but for
the encrypt case.
Closes#2127
Change-Id: I06c82f4a1d768a863922e2240aebb6c1d243e269
(cherry picked from commit e6469c006b)
(cherry picked from commit 46e89e94ca)
In case of the reverse direction of a subscription, no stream handler will be found. Previously, the
decrypt struct was left zeroed, the kernel module rejected this with ``EINVAL`` and the daemon logged:
```
[core] Failed to push relay stream to kernel: Invalid argument
```
This patch sets ``REC_NULL``/``REH_NULL`` and marks the target as non-forwarding, matching what is
expected by ``validate_srtp``.
Closes#2126
Change-Id: I5aa2b490c65e5d97dc9b2ddd24c09f9ae7b63892
(cherry picked from commit 47371520ee)
(cherry picked from commit 411656a913)
This can be an expected condition
Change-Id: Ib4514e97a3faf45e2a52a3372b59e1c09d8f3176
(cherry picked from commit f2d57de078)
(cherry picked from commit c3701c32a8)
Currently the function has two cycles (while-outer-cycle and
for-inner-cycle).
The inner one operates on the given `pp` pointer and can potentially
mutate it (the pointer isn't const), hence the outer cycle will
continue with a mutated pointer.
Instead just use a local scope pointer to manipulate linked list's
data.
P.S.: the `pp` pointer isn't a double pointer, so unlikely was
expected (even by design) to be modified (e.g. its address or what
it actually points to).
Change-Id: Ia36bcb6fb47e9e72ae25a838f8005ca99f4c591d
(cherry picked from commit a4875c336e)
(cherry picked from commit 443c2ed26e)
With selected_sfd being protected by in_lock, we pretty much have to
hold at least in_lock everywhere, and end up requiring both locks in
many places. The distinction has become pointless.
Change-Id: Ic0ad976c2d68d9639b9434da7f0e6e9c0d84c185
Different instances of rtpengine may be configured with different port
ranges. If HA requests usage of a port not part of our pool, allow it.
Change-Id: Ib4ace6c4facac35ea44948720fa46bcbdaf441d3
Use different function to get a port from a pool and return it, and
reserve a port in a pool permanently during startup.
Change-Id: I030dc2ebbe30c9b47252669717f235177f15219d
Protect selected_sfd with in_lock.
Protect RTCP sending with in_lock and out_lock as appropriate.
Has the odd side effect of RTCP reports expected in tests to be sent one
packet later than before.
Closes#1966
Probably fixes#1927
Change-Id: I225b43dff8e8fbb938d3be6aad50249997615d77
A simple mechanism to track whether a given media endpoint has been
advertised to the public. If it hasn't, then any media received on it is
considered suspicious, and source addresses are ignored for learning
purposes.
Change-Id: I76a08e3f442f263dad192ff496a5d734a9349d26
Richard Fuchs
Donat Zenichev
Alexander Bakker
John Burke
Orgad Shaneh