Mercurial > hgrepos > FreeBSD > ports > net > turnserver
view files/patch-examples_etc_turnserver.conf @ 13:c7cf16351c81
Apply patches for proper STUN message validation:
1. Validate the size of an attribute before returning it to the caller.
Previously this was being done in stun_attr_get_next_str() to check
that the previous attribute didn't exceed the size of the underlying buffer,
however by that point any maliciously crafted attributes would have already
had their chance to attack the caller.
commit 9b8baa805582ae66d2a1ed68483609f90fcfb4d0
2. Validate the size of the buffer in stun_get_command_message_len_str().
Without this the caller could read off the end of the underlying buffer
if it receives a maliciously crafted packet with an invalid header size.
commit 14cb1c94e7be98869f45678ba195a26796a797c4
3. Changed type from int to size_t to avoid warning.
warning: comparison between signed and unsigned integer expressions
commit 4722697645cf033de8cf4f34e4214af750746365
See also: https://github.com/coturn/coturn/pull/472
| author | Franz Glasner <fzglas.hg@dom66.de> |
|---|---|
| date | Sat, 28 Mar 2020 15:44:52 +0100 |
| parents | 9a1ee735f28f |
| children | 4a6383e57d12 |
line wrap: on
line source
--- examples/etc/turnserver.conf.orig 2019-03-02 21:06:19 UTC +++ examples/etc/turnserver.conf @@ -315,17 +315,17 @@ # as the user database. # This database can be used for long-term credential mechanism # and it can store the secret value for secret-based timed authentication in TURN RESP API. -# Use string format as below (space separated parameters, all optional): +# Use string format as below (space separated parameters, all optional, "socket" has higher prio than "ip"): # -#redis-userdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>" +#redis-userdb="ip=<ip-address> socket=<unix-domain-socket-path> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>" # Redis status and statistics database connection string, if used (default - empty, no Redis stats DB used). # This database keeps allocations status information, and it can be also used for publishing # and delivering traffic and allocation event notifications. # The connection string has the same parameters as redis-userdb connection string. -# Use string format as below (space separated parameters, all optional): +# Use string format as below (space separated parameters, all optional, "socket" has higher prio than "ip"): # -#redis-statsdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>" +#redis-statsdb="ip=<ip-address> socket=<unix-domain-socket-path> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>" # The default realm to be used for the users when no explicit # origin/realm relationship was found in the database, or if the TURN