Check ICE ufrag and pwd in WHIP PATCH requests.

rtpconn/whipclient.go

@@ -165,6 +165,28 @@ func (c *WhipClient) GotOffer(ctx context.Context, offer []byte) ([]byte, error)
 	return c.gotOffer(ctx, offer)
 }
 
+func (c *WhipClient) UFragPwd() (string, string, error) {
+	c.mu.Lock()
+	conn := c.connection
+	c.mu.Unlock()
+	if conn == nil {
+		return "", "", errors.New("no connection in WHIP client")
+	}
+
+	rs := conn.pc.GetReceivers()
+	if len(rs) < 1 {
+		return "", "", errors.New("no receivers in PeerConnection")
+	}
+
+	parms, err := rs[0].Transport().ICETransport().GetRemoteParameters()
+	if err != nil {
+		return "", "", err
+	}
+
+	return parms.UsernameFragment, parms.Password, nil
+
+}
+
 // called locked
 func (c *WhipClient) gotOffer(ctx context.Context, offer []byte) ([]byte, error) {
 	conn := c.connection

webserver/whip.go

@@ -346,7 +346,7 @@ func whipResourceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	_, _, candidates, err := parseSDPFrag(
+	ufrag, pwd, candidates, err := parseSDPFrag(
 		http.MaxBytesReader(w, r.Body, sdpLimit),
 	)
 	if err != nil {
@@ -354,6 +354,20 @@ func whipResourceHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad request", http.StatusBadRequest)
 		return
 	}
+	u, p, err := c.UFragPwd()
+	if err != nil {
+		log.Printf("WHIP UfragPwd: %v", err)
+		http.Error(w, "internal server error",
+			http.StatusInternalServerError,
+		)
+		return
+	}
+	if u != ufrag || p != pwd {
+		http.Error(w, "ICE restarts are not supported yet",
+			http.StatusUnprocessableEntity,
+		)
+		return
+	}
 	for _, init := range candidates {
 		err := c.GotICECandidate(init)
 		if err != nil {