From dbe2640e743cb01ee3c44d7589549bc4786e3758 Mon Sep 17 00:00:00 2001 From: evgeny Date: Sat, 17 Oct 2026 18:50:10 +0200 Subject: [PATCH] nat: reject local STUN paths as Internet mapping evidence --- src/routing_layer/nat_detection.c | 2 ++ tests/test_stun_nat.c | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/src/routing_layer/nat_detection.c b/src/routing_layer/nat_detection.c index d0de3ad2..482aedb3 100644 --- a/src/routing_layer/nat_detection.c +++ b/src/routing_layer/nat_detection.c @@ -593,6 +593,8 @@ static void select_profile(struct nat_socket *state) { (stun.status == STUN_NAT_COMPLETE || stun.status == STUN_NAT_PARTIAL) && stun.measured_at_tb && now >= stun.measured_at_tb && now - stun.measured_at_tb < STUN_NAT_TTL_TB && stun.server_count == 2 && stun.translated == 1 && (stun.mapping == STUN_MAP_MATCH || stun.mapping == STUN_MAP_EIM) && + public_address(state->detector, &stun.servers[0]) && public_address(state->detector, &stun.servers[1]) && + public_address(state->detector, &stun.mapped[0]) && (!selected_address.ss_family || route_ping_addr_equal(&selected_address, &stun.mapped[0], 0))) { selected.mapping = ADDRESS_MAP_EIM; selected.inbound = ADDRESS_IN_UNKNOWN; selected.source = ADDRESS_SOURCE_STUN; } diff --git a/tests/test_stun_nat.c b/tests/test_stun_nat.c index 528533e0..69c83364 100644 --- a/tests/test_stun_nat.c +++ b/tests/test_stun_nat.c @@ -393,6 +393,10 @@ static void test_fallback(int rfc) { assert(socket->address_profile.mapping == ADDRESS_MAP_EIM && socket->address_profile.inbound == ADDRESS_IN_UNKNOWN); assert(!memcmp(&socket->address_profile, &duplicate->address_profile, sizeof(socket->address_profile))); assert(!socket->nat_addr.ss_family && !duplicate->nat_addr.ss_family); + nat_detection_set_allow_local(owner->nat_det, 0); + wait_source(&nf, socket, ADDRESS_SOURCE_NONE); + nat_detection_set_allow_local(owner->nat_det, 1); + wait_source(&nf, socket, ADDRESS_SOURCE_STUN); struct nat_check_status status; end = get_time_tb() + 30000; do { test_clock_poll(nf.ua, 1000); assert(!nat_detection_get_status(owner->nat_det, socket, &status)); }