Pre Merge pull request !46 from 阿斌/N/A

fix: 修复 issue 2159 级联点播自定义 SSRC 鉴权 key 未刷新问题

src/main/java/com/genersoft/iot/vmp/gb28181/service/impl/PlayServiceImpl.java

@@ -859,6 +859,9 @@ public class PlayServiceImpl implements IPlayService {
             }
         }else {
             log.info("[Invite 200OK] 收到invite 200, 发现下级自定义了ssrc: {}", ssrcInResponse);
+            String oldStreamId = String.format("%08x", Long.parseLong(ssrcInfo.getSsrc())).toUpperCase();
+            String newStreamId = String.format("%08x", Long.parseLong(ssrcInResponse)).toUpperCase();
+            receiveRtpServerService.refreshAuthenticateInfo(oldStreamId, newStreamId);
             // ssrc 不一致
             if (mediaServerItem.isRtpEnable()) {
                 // 多端口

src/main/java/com/genersoft/iot/vmp/gb28181/session/SSRCFactory.java

@@ -50,7 +50,7 @@ public class SSRCFactory {
     public void init() {
         String sipDomain = sipConfig.getDomain();
         domainPart = sipDomain.length() >= 8 ? sipDomain.substring(3, 8) : sipDomain;
-        scheduler.scheduleAtFixedRate(this::rebuild, 10, 30, TimeUnit.SECONDS);
+        scheduler.scheduleAtFixedRate(this::rebuild, 5, 5, TimeUnit.SECONDS);
     }
 
     public String getPlaySsrc(String mediaServerId) {
@@ -127,7 +127,7 @@ public class SSRCFactory {
                 usedMap.put(server.getId(), bits);
                 if (count > 8000) {
                     log.info("[SSRC重建] 媒体节点 {} 的SSRC使用率已超过80%，请注意扩展服务提升性能", server.getId());
-                } else {
+                }
                 if (log.isDebugEnabled()) {
                     log.debug("[SSRC重建] 节点 {} 已占用 {} 个SSRC", server.getId(), count);
                 }
@@ -135,4 +135,3 @@ public class SSRCFactory {
         }
     }
 }
-}

src/main/java/com/genersoft/iot/vmp/gb28181/utils/SipUtils.java

@@ -206,6 +206,21 @@ public class SipUtils {
 
     public static Gb28181Sdp parseSDP(String sdpStr) throws SdpParseException {
         
+        // 校验：拦截空内容与注入攻击特征
+        if (sdpStr == null || sdpStr.trim().isEmpty()) {
+            throw new SdpParseException(0, 0, "SDP内容为空");
+        }
+        // 标准SDP每行格式固定为 "x=value"，不存在SQL关键字；出现则视为注入攻击
+        String sdpUpper = sdpStr.toUpperCase();
+        if (sdpUpper.contains("' OR '") || sdpUpper.contains("' OR 1") || sdpUpper.contains(" OR 1=1")
+                || sdpUpper.contains("--") || sdpUpper.contains("/*") || sdpUpper.contains("*/")
+                || sdpUpper.contains("DROP ") || sdpUpper.contains("INSERT ") || sdpUpper.contains("UPDATE ")
+                || sdpUpper.contains("DELETE ") || sdpUpper.contains("UNION ") || sdpUpper.contains("SELECT ")) {
+            log.error("[SDP注入攻击] 检测到非法SDP内容，已拒绝解析，内容长度: {}", sdpStr.length());
+            throw new SdpParseException(0, 0, "非法SDP内容");
+        }
+        //校验结束
+
         // jainSip不支持y= f=字段， 移除以解析。
         int ssrcIndex = sdpStr.indexOf("y=");
         int mediaDescriptionIndex = sdpStr.indexOf("f=");

src/main/java/com/genersoft/iot/vmp/service/IReceiveRtpServerService.java

@@ -39,4 +39,6 @@ public interface IReceiveRtpServerService {
     void addAuthenticateInfo(String streamId, String streamReplace, Boolean enableAudio, Boolean enableMp4, Integer mp4MaxSecond);
 
     ResultForOnPublish getAuthenticateInfo(String streamId);
+
+    void refreshAuthenticateInfo(String oldStreamId, String newStreamId);
 }

src/main/java/com/genersoft/iot/vmp/service/impl/RtpServerServiceImpl.java

@@ -406,4 +406,22 @@ public class RtpServerServiceImpl implements IReceiveRtpServerService {
          }
          return null;
      }
+
+     @Override
+     public void refreshAuthenticateInfo(String oldStreamId, String newStreamId) {
+         if (oldStreamId == null || newStreamId == null || oldStreamId.equals(newStreamId)) {
+             return;
+         }
+         String oldKey = String.format("%s:%s", VideoManagerConstants.RTP_AUTHENTICATE, oldStreamId);
+         Object obj = redisTemplate.opsForValue().get(oldKey);
+         if (obj instanceof ResultForOnPublish) {
+             String newKey = String.format("%s:%s", VideoManagerConstants.RTP_AUTHENTICATE, newStreamId);
+             redisTemplate.opsForValue().set(newKey, obj);
+             redisTemplate.expire(newKey, 60, TimeUnit.SECONDS);
+             redisTemplate.delete(oldKey);
+             log.info("[刷新RTP鉴权信息] {} -> {}", oldStreamId, newStreamId);
+         } else {
+             log.warn("[刷新RTP鉴权信息] 未找到旧key: {}", oldKey);
+         }
+     }
 }