search

AirenSoft / OvenMediaEngine

OvenMediaEngine (OME) is a Sub-Second Latency Live Streaming Server with Large-Scale and High-Definition. #WebRTC #LLHLS
https://OvenMediaEngine.com/ome
GNU Affero General Public License v3.0
2.48k stars 1.05k forks source link

Possible DoS attack against OVT protocol #1595

Open SceneCityDev opened 3 months ago

SceneCityDev commented 3 months ago

In #1583 I had reported that the OVT stream worker can get stuck.

I have just seen the issue again, and this time was able to pin-point it in the log.

I now believe the issue is caused by exploit scanners hitting the OVT port:

[2024-04-07 10:28:51.928] I [SPOvtPub-t9000:977192] OVT | ovt_publisher.cpp:181  | OvtProvider is connected : <ClientSocket: 0x7f1e6a80aa10, #36, Connected, TCP, Nonblocking, 192.241.196.124:43098>
[2024-04-07 10:28:51.928] C [SPOvtPub-t9000:977192] OVT | ovt_publisher.cpp:198  | Unavailable message
[2024-04-07 10:28:55.070] W [DechevcQsv:978070] ManagedQueue | managed_queue.h:444  | [152] mngq:v=#default#origin1:s=test3:p=trs:n=filter_video size has exceeded the threshold: queue: 132, threshold: 117, peak: 299
[2024-04-07 10:29:00.141] W [DechevcQsv:978070] ManagedQueue | managed_queue.h:444  | [152] mngq:v=#default#origin1:s=test3:p=trs:n=filter_video size has exceeded the threshold: queue: 120, threshold: 117, peak: 299
[2024-04-07 10:29:01.929] I [SPOvtPub-t9000:977192] OVT | ovt_publisher.cpp:266  | OvtProvider is disconnected(2) : <ClientSocket: 0x7f1e6a80aa10, #36, Disconnected, TCP, Nonblocking, 192.241.196.124:43098>

192.241.196.124 is not one of my edges, but an exploit scanner:

https://www.abuseipdb.com/check/192.241.196.124

Does OVT have any authentication at all? I find it weird that someone sending random garbage to this port can cause a critical error, and that it takes 10 seconds (!) until that socket gets disconnected.

As you can see the ManagedQueue getting stuck happens exactly at this moment.

For now, I'll try to firewall the port for all IPs that aren't my edges.

I think it should be looked at how the OVT code can quickly check if something is a valid client, and close the socket if not, and not making it part of any queue before it's clear it's a valid client.

getroot commented 3 months ago

Thank you for clarifying the issue. If so, it would be a good idea to close this issue and continue linking to issue #1583.

When I originally designed OVT, I intended to secure it with a firewall, but I would consider a separate authentication process.

stale[bot] commented 1 month ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.