implement keysize mismatch #197
Conversation
russelltg
force-pushed
the
key_size_mismatch
branch
from
c053983
to
bbb0c33
Compare
russelltg
force-pushed
the
key_size_mismatch
branch
from
79928b5
to
78f4ed7
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #197 +/- ##
==========================================
- Coverage 77.54% 75.84% -1.70%
==========================================
Files 85 88 +3
Lines 14000 14287 +287
==========================================
- Hits 10856 10836 -20
- Misses 3144 3451 +307 ☔ View full report in Codecov by Sentry. |
| warn!("Key size mismatch: caller requested {:?}, listener was configured with {:?}. Selecting {:?}", incoming.key_size, key_settings.key_size, incoming.key_size); | ||
| key_settings.key_size = incoming.key_size; |
There was a problem hiding this comment.
Is this intended behavior? If my understanding is correct, this means the client can change the server's encryption settings to what it wants.
It can even set the key size to 0, but thankfully that is then caught here by defaulting to Bytes16 instead of no encryption at all.
There was a problem hiding this comment.
Let me confirm what the ref impl does...
There was a problem hiding this comment.
Interesting, it seems to base it off SRTO_SENDER
https://github.com/haivision/srt/blob/39822840c506d72cef5a742d28f32ea28e144345/srtcore/core.cpp#L4927
There was a problem hiding this comment.
We don't currently implement SRTO_SENDER because it is only really needed for old SRT compatibility (new SRT is always full duplex). However the docs say that this is the only modern use of it https://github.com/Haivision/srt/blob/master/docs/API/API-socket-options.md#SRTO_SENDER
There was a problem hiding this comment.
For example:
$ srt-live-transmit "srt://:2222?pbkeylen=24&passphrase=password123" udp://127.0.0.1:3333 -a:no &
$ srt-live-transmit udp://:1111 "srt://127.0.0.1:2222?passphrase=password123&pbkeylen=16" -a:no
18:55:59.730216/SRT:RcvQ:w1!W:SRT.cn: processConnectResponse: PBKEYLEN conflict - keep 16; peer-advertised PBKEYLEN 24 rejected because Agent is SRTO_SENDER
$ srt-live-transmit udp://:1111 "srt://:2222?passphrase=password123&pbkeylen=16" -a:no &
$ srt-live-transmit "srt://127.0.0.1:2222?pbkeylen=24&passphrase=password123" udp://127.0.0.1:3333 -a:no
18:57:28.338138/SRT:RcvQ:w1!W:SRT.cn: processConnectResponse: PBKEYLEN conflict - OVERRIDDEN 24 by 16 from PEER (as AGENT is not SRTO_SENDER)
Fixes #195