RTSP client polling

When clients of our RTSP server forcefully die, our server keeps sending information to them. This causes a DoS attack. http://forum.videolan.org/viewtopic.php?t=11035

See 14.37 of http://www.rtsp.org/2004/drafts/draft06/draft-ietf-mmusic-rfc2326bis-06.txt for RTCP see: http://www.ietf.org/rfc/rfc1889.txt

added Difficulty::medium label

RFC2326bis (RTSP/1.1 draft) says you MUST NOT stop sending RTP data when a clients disconnect from the server. Clients are supposed to be able to do that then reconnect. So VLC's behavior is actually correct.

So, hmm, well, I'm pretty much against unilateraly stopping the stream when the client disconnects. I don't know if implementing RTCP would allow a clean solution to that (I doubt it). However, I would assume there has to be some kind of timeout and maybe VLC doesn't do that. Will check.

Well... after a more precise check, it turns out the correct behavior is indeed not to stop the RTP stream when the client hangs up the TCP session, but to implement a liveness timeout.

There are two ways for the client to show it is still alive :

• send RTCP feedback,
• send an empty OPTIONS or, better yet, SET_PARAMETER, request.

Given we don't support RTCP (#157 (closed)), we can't check for this properly, so we just can't fix this bug (otherwise we'd timeout living clients which would be worst).

changed milestone to %0.8.5-final

changed milestone to %Features paradize

I wouldnt say a DoS attack should have normal as severity...

added Severity::critical label

Please use severities with consideration

added Severity::major label and removed Severity::critical label

Some RTCP code was added recently so might as well bring this ticket to 0.8.6.

Original author: tumu

changed milestone to %0.8.6

This is part of #157 (closed)

added Status::duplicate label

closed

This is not part of RTCP support. What we need to do is timeout clients that haven't refreshed the session (through RTSP control connection) for a while. Clients are supposed to send dummy OPTIONS query with the appropriate Session-ID to keep a stream alive.

Failing to detect that, our RTSP server would indeed be a nice DoS proxy.

removed Status::duplicate label

reopened

assigned to @Courmisch

added Type::task label