Roku Casting Agent Broadcasting Malformed SSDP Packets

Archived
1

I have lionic agent running on an OpenWRT gateway. When I started a recent Roku Casting app (https://okaapps.com/product/1519399703) I noticed that my security agent started crashing immediately after receiving the cast app SSDP packet.

See the SSDP packet details before. Comparing this to other casting agents SSDP packets the line after the User-Agent is different.

ROKU CAST SSDP PACKET

Frame 325: 188 bytes on wire (1504 bits), 188 bytes captured (1504 bits)
Ethernet II, Src: RealtekS_03:19:46 (00:e0:4c:03:19:46), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.1.170, Dst: 255.255.255.255
User Datagram Protocol, Src Port: 53545, Dst Port: 1900
Simple Service Discovery Protocol
M-SEARCH * HTTP/1.1\n
Host: 239.255.255.250:1900\n
Man: “ssdp:discover”\n
MX: 3\n
ST: urn:dial-multiscreen-org:service:dial:1\n
USER-AGENT: RkuCastClient\n
\n
[Full request URI: http://239.255.255.250:1900*]
[HTTP request 1/1]

NON ROKU CAST SSDP PACKET

Frame 17: 170 bytes on wire (1360 bits), 170 bytes captured (1360 bits)
Ethernet II, Src: AMPAKTec_6b:31:44 (08:e9:f6:6b:31:44), Dst: IPv4mcast_7f:ff:fa (01:00:5e:7f:ff:fa)
Internet Protocol Version 4, Src: 192.168.1.121, Dst: 239.255.255.250
User Datagram Protocol, Src Port: 44232, Dst Port: 1900
Simple Service Discovery Protocol
M-SEARCH * HTTP/1.1\r\n
HOST:239.255.255.250:1900\r\n
MAN:“ssdp:discover”\r\n
MX:1\r\n
ST:ST_TEST\r\n
USER-AGENT:OS/version product/version\r\n
\r\n
[Full request URI: http://239.255.255.250:1900*]
[HTTP request 1/1]

Notice in the Roku packet the line after USER-AGENT is \n and in the non Roku packet it is \r\n

Anyone care to comment on this?

2

Yes, it looks like Roku’s SSDP implementation is slightly out of spec, sending LF line terminators instead of CRLF. However, the SSDP specification defers to RFC 2616 (HTTP/1.1) which says that clients should be tolerant of implementations that send just a single LF instead of CRLF. I don’t think we’re going to change the code soon, as 12.5 has just been deployed to most users, so I suggest filing a bug with the security agent developer about their parser crash.

3

Thanks for the quick response. Was there a change in the Roku SSDP implementation recently? I see there was a rollout Sept 12th, 2023. Just trying to track when this came into being (or maybe its always been this way?).

https://developer.roku.com/docs/developer-program/release-notes/roku-os-release-notes.md

4

When I started a recent Roku Casting app (https://okaapps.com/product/1519399703) I noticed that my security agent started crashing immediately after receiving the cast app SSDP packet.

This doesn’t appear to me to have anything to do with Roku OS. Roku OS doesn’t generate the SSDP packet that is quoted here. Instead that appears to be something that the “Casting app” you refer to is producing itself. So I recommend that you should file a bug report to them.

5

Doesn’t this…

USER-AGENT: RokuCastClient\n

indicate it is Roku software?

6

No, that’s not something that Roku OS sends.

That would be something sent from whatever device you’re running this “casting” software from, presumably as it wants to discover your Roku device(s) on the network.