jeka/utun2
1
0 Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

nat: reject local STUN paths as Internet mapping evidence

Browse Source
This commit is contained in:
evgeny committed 2026-10-17 18:50:10 +02:00
1 parent 7a40ba536e
commit dbe2640e74
2 files changed
+6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/routing_layer/nat_detection.c
+2
View File
@@ -593,6 +593,8 @@ static void select_profile(struct nat_socket *state) {
(stun.status == STUN_NAT_COMPLETE || stun.status == STUN_NAT_PARTIAL) &&
stun.measured_at_tb && now >= stun.measured_at_tb && now - stun.measured_at_tb < STUN_NAT_TTL_TB &&
stun.server_count == 2 && stun.translated == 1 && (stun.mapping == STUN_MAP_MATCH || stun.mapping == STUN_MAP_EIM) &&
public_address(state->detector, &stun.servers[0]) && public_address(state->detector, &stun.servers[1]) &&
public_address(state->detector, &stun.mapped[0]) &&
(!selected_address.ss_family || route_ping_addr_equal(&selected_address, &stun.mapped[0], 0))) {
selected.mapping = ADDRESS_MAP_EIM; selected.inbound = ADDRESS_IN_UNKNOWN; selected.source = ADDRESS_SOURCE_STUN;
}
tests/test_stun_nat.c
+4
View File
@@ -393,6 +393,10 @@ static void test_fallback(int rfc) {
assert(socket->address_profile.mapping == ADDRESS_MAP_EIM && socket->address_profile.inbound == ADDRESS_IN_UNKNOWN);
assert(!memcmp(&socket->address_profile, &duplicate->address_profile, sizeof(socket->address_profile)));
assert(!socket->nat_addr.ss_family && !duplicate->nat_addr.ss_family);
nat_detection_set_allow_local(owner->nat_det, 0);
wait_source(&nf, socket, ADDRESS_SOURCE_NONE);
nat_detection_set_allow_local(owner->nat_det, 1);
wait_source(&nf, socket, ADDRESS_SOURCE_STUN);
struct nat_check_status status;
end = get_time_tb() + 30000;
do { test_clock_poll(nf.ua, 1000); assert(!nat_detection_get_status(owner->nat_det, socket, &status)); }