@blockcast/mmt-container 2.0.0 → 2.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockcast/mmt-container",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "MMTP/LOC container parsing for MMT over MoQ and SSM",
   "type": "module",
   "main": "dist/index.js",
@@ -169,10 +169,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@blockcast/fec-worker": "^2.0.0",
-    "@blockcast/mmt-base": "^2.0.0",
-    "@blockcast/mmt-fec": "^2.0.0",
-    "@blockcast/mmt-manifest-verify": "^2.0.0",
+    "@blockcast/fec-worker": "^2.0.1",
+    "@blockcast/mmt-base": "^2.0.1",
+    "@blockcast/mmt-fec": "^2.0.1",
+    "@blockcast/mmt-manifest-verify": "^2.0.1",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.8.0",
     "ajv": "^8.17.1",

package/src/multicast-transport.ts

@@ -16,6 +16,7 @@ import {
   MMTP_PACKET_ID_MAX,
   MMTP_SIGNALING_PACKET_ID,
   readMMTPPacketId,
+  sameIpAddress,
 } from '@blockcast/mmt-base'
 import { isBcpV2RecordCandidate } from '@blockcast/mmt-manifest-verify'
 
@@ -41,6 +42,12 @@ export interface MulticastTransportConfig {
    * are "MHM2" passes ahead of the packet_id read and the allow-list, and is
    * never counted toward a packet_id. On an unprotected join it is an
    * unparseable MMTP packet, as before.
+   *
+   * A protected join admits only datagrams whose reported sender is the
+   * flow's S (`sourceAddress`, or `senderAddress` on ASM), compared as IP
+   * addresses, before anything hashes them (multicast-02 7.2.7). A datagram
+   * with no reported sender is dropped, and a join that cannot report one
+   * (no S, or an ATSC 3.0 tuner) is declined `invalid-request`.
    */
   protected?: boolean
 }
@@ -148,7 +155,8 @@ export interface MulticastTransportStats {
    * one (G, port, packet_id); the first sender whose packet is accepted owns
    * the sub-flow until the next join, and every other sender is dropped here,
    * before any gap, duplicate or FEC ledger sees it. A join or a silence
-   * failback releases the lock.
+   * failback releases the lock. On a protected join it also counts every
+   * datagram whose sender is not the flow's S, or is not reported.
    */
   packetsDroppedForeignSender: number
 }
@@ -215,7 +223,14 @@ function hasMulticastGateway(): boolean {
   return typeof getMulticastGlobals().multicast?.subscribe === 'function'
 }
 
-/** The `bytes` event's sender (multicast-contract 1.3.0); undefined when unknown. */
+/**
+ * The `bytes` event's sender (multicast-contract 1.3.0); undefined when unknown.
+ *
+ * The provider filters (S, G, port) and owns the multicast-02 7.2.7
+ * destination MUST: the event carries no destination address, so libmmt
+ * cannot discard a datagram whose IP destination is not G (pim BLO-51627).
+ * On a protected flow libmmt checks the sender itself, against S.
+ */
 function senderOf(event: CustomEvent<unknown>): string | undefined {
   const sourceAddress = (event as { sourceAddress?: unknown }).sourceAddress
   return typeof sourceAddress === 'string' ? sourceAddress : undefined
@@ -343,6 +358,10 @@ export class MulticastTransport<TPacketContext = never> {
   readonly #acceptedBytesByPacketId = new Map<number, { bytes: number }>()
   #packetIds: ReadonlySet<number> | null = null
   #protected = false
+  // A protected join's S, and the last sender spelling that matched it, so a
+  // matching sender parses once per spelling rather than per datagram.
+  #protectedSource: string | undefined = undefined
+  #matchedSource: string | undefined = undefined
   // The sender S this join's accepted packets came from, once known; see
   // packetsDroppedForeignSender. Cleared by every join and by a silence
   // failback, so a replacement publisher is not locked out.
@@ -406,6 +425,11 @@ export class MulticastTransport<TPacketContext = never> {
     // failure before it runs, so the catch classifies a decline by where the
     // join stopped, never by what the error says.
     let failure: MulticastJoinDeclineReason = 'invalid-request'
+    const protectedSource = config.protected === true ? config.sourceAddress ?? config.senderAddress : undefined
+    if (config.protected === true && (protectedSource === undefined || config.atsc3)) {
+      console.warn('[MulticastTransport] protected join refused: the path reports no per-datagram sender to check against S')
+      return this.#declined(generation, 'invalid-request')
+    }
     try {
       const packetIds = config.packetIds?.length ? new Set(config.packetIds) : null
       console.log(
@@ -454,8 +478,9 @@ export class MulticastTransport<TPacketContext = never> {
       // costs batching on every any-source join, including one on a pre-1.3.0
       // provider that sends no sender and so gets no lock for it; keep it
       // unless the provider can say it carries the sender.
+      // A protected join checks every datagram's sender, so it listens to `bytes` too.
       const anySource = !config.sourceAddress && !config.senderAddress && !config.atsc3
-      const packetListener: PacketListener = !anySource && subscriptionDeliversPacketBatches(subscription)
+      const packetListener: PacketListener = !anySource && protectedSource === undefined && subscriptionDeliversPacketBatches(subscription)
         ? {
             type: 'packets',
             listener: (event) => {
@@ -473,6 +498,8 @@ export class MulticastTransport<TPacketContext = never> {
       this.#packetListener = packetListener
       this.#packetIds = packetIds
       this.#protected = config.protected === true
+      this.#protectedSource = protectedSource
+      this.#matchedSource = undefined
       this.#providerFilter = {
         acknowledged: packetIds,
         sent: 0,
@@ -1009,6 +1036,8 @@ export class MulticastTransport<TPacketContext = never> {
     this.#delivery = undefined
     this.#packetIds = null
     this.#protected = false
+    this.#protectedSource = undefined
+    this.#matchedSource = undefined
     this.#providerFilter = null
     this.#context = undefined
     this.#withdrawnPacketIds.clear()
@@ -1016,8 +1045,18 @@ export class MulticastTransport<TPacketContext = never> {
 
   /** The ingress filter; an accepted packet is counted here, once. */
   #acceptPacket(packet: Uint8Array, sourceAddress?: string): boolean {
+    const source = this.#protectedSource
+    if (source !== undefined && (sourceAddress === undefined || sourceAddress !== this.#matchedSource)) {
+      if (sourceAddress === undefined || !sameIpAddress(sourceAddress, source)) {
+        this.#stats.packetsDroppedForeignSender++
+        return false
+      }
+      this.#matchedSource = sourceAddress
+    }
     // Absent means unknown (a pre-1.3.0 provider, a tuner): never a new sender.
-    const owner = this.#lockedTo?.() ?? this.#sender
+    // A protected flow's S check above replaces the first-seen lock, which
+    // compares spellings and would refuse S written another way.
+    const owner = source === undefined ? this.#lockedTo?.() ?? this.#sender : undefined
     if (sourceAddress !== undefined && owner !== undefined && sourceAddress !== owner) {
       this.#stats.packetsDroppedForeignSender++
       return false