Mercurial > prosody-hg

annotate plugins/mod_turn_external.lua @ 14150:2a66728d9e29 13.0 13.0.5

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_proxy65: Consistently apply authorization checks The module checked for authorization when a client asked for the address:port of the proxy service. It did not check for authorization when processing a request to activate a bytestream. This meant that any unauthenticated party able to guess the IP/port and XMPP domain of a proxy65 service (generally low difficulty) would be able to use the proxy to relay traffic between two connections. This factors out the permission check, and applies it to every request type.
author Matthew Wild <mwild1@gmail.com>
date Wed, 29 Apr 2026 11:40:43 +0100
parents 7fd6feb86dbe
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
12977
74b9e05af71e plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents: 12437
diff changeset
1 local set = require "prosody.util.set";
12282
fe5a87b5972f mod_turn_external: Simplify configuration
Kim Alvefur <zash@zash.se>
parents: 11599
diff changeset
2
11599
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 local secret = module:get_option_string("turn_external_secret");
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 local host = module:get_option_string("turn_external_host", module.host);
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 local user = module:get_option_string("turn_external_user");
13213
50324f66ca2a plugins: Use integer config API with interval specification where sensible
Kim Alvefur <zash@zash.se>
parents: 13209
diff changeset
6 local port = module:get_option_integer("turn_external_port", 3478, 1, 65535);
13209
c8d949cf6b09 plugins: Switch to :get_option_period() for time range options
Kim Alvefur <zash@zash.se>
parents: 12977
diff changeset
7 local ttl = module:get_option_period("turn_external_ttl", "1 day");
12282
fe5a87b5972f mod_turn_external: Simplify configuration
Kim Alvefur <zash@zash.se>
parents: 11599
diff changeset
8 local tcp = module:get_option_boolean("turn_external_tcp", false);
13213
50324f66ca2a plugins: Use integer config API with interval specification where sensible
Kim Alvefur <zash@zash.se>
parents: 13209
diff changeset
9 local tls_port = module:get_option_integer("turn_external_tls_port", nil, 1, 65535);
11599
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10
12437
9f5d0b77e3df mod_turn_external: Update status and friendlier handling of missing secret option (fixes #1727)
Matthew Wild <mwild1@gmail.com>
parents: 12290
diff changeset
11 if not secret then
9f5d0b77e3df mod_turn_external: Update status and friendlier handling of missing secret option (fixes #1727)
Matthew Wild <mwild1@gmail.com>
parents: 12290
diff changeset
12 module:log_status("error", "Failed to initialize: the 'turn_external_secret' option is not set in your configuration");
9f5d0b77e3df mod_turn_external: Update status and friendlier handling of missing secret option (fixes #1727)
Matthew Wild <mwild1@gmail.com>
parents: 12290
diff changeset
13 return;
9f5d0b77e3df mod_turn_external: Update status and friendlier handling of missing secret option (fixes #1727)
Matthew Wild <mwild1@gmail.com>
parents: 12290
diff changeset
14 end
11599
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15
12282
fe5a87b5972f mod_turn_external: Simplify configuration
Kim Alvefur <zash@zash.se>
parents: 11599
diff changeset
16 local services = set.new({ "stun-udp"; "turn-udp" });
fe5a87b5972f mod_turn_external: Simplify configuration
Kim Alvefur <zash@zash.se>
parents: 11599
diff changeset
17 if tcp then
fe5a87b5972f mod_turn_external: Simplify configuration
Kim Alvefur <zash@zash.se>
parents: 11599
diff changeset
18 services:add("stun-tcp");
fe5a87b5972f mod_turn_external: Simplify configuration
Kim Alvefur <zash@zash.se>
parents: 11599
diff changeset
19 services:add("turn-tcp");
fe5a87b5972f mod_turn_external: Simplify configuration
Kim Alvefur <zash@zash.se>
parents: 11599
diff changeset
20 end
12283
b5686debb497 mod_turn_external: Add option to enable TURN over TLS
Kim Alvefur <zash@zash.se>
parents: 12282
diff changeset
21 if tls_port then
b5686debb497 mod_turn_external: Add option to enable TURN over TLS
Kim Alvefur <zash@zash.se>
parents: 12282
diff changeset
22 services:add("turns-tcp");
b5686debb497 mod_turn_external: Add option to enable TURN over TLS
Kim Alvefur <zash@zash.se>
parents: 12282
diff changeset
23 end
12282
fe5a87b5972f mod_turn_external: Simplify configuration
Kim Alvefur <zash@zash.se>
parents: 11599
diff changeset
24
11599
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 module:depends "external_services";
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26
12283
b5686debb497 mod_turn_external: Add option to enable TURN over TLS
Kim Alvefur <zash@zash.se>
parents: 12282
diff changeset
27 for _, type in ipairs({ "stun"; "turn"; "turns" }) do
11599
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 for _, transport in ipairs({"udp"; "tcp"}) do
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 if services:contains(type .. "-" .. transport) then
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 module:add_item("external_service", {
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 type = type;
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32 transport = transport;
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 host = host;
12283
b5686debb497 mod_turn_external: Add option to enable TURN over TLS
Kim Alvefur <zash@zash.se>
parents: 12282
diff changeset
34 port = type == "turns" and tls_port or port;
11599
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35
14100
7fd6feb86dbe mod_turn_external: hand out credentials for type == turns too
Mike Yuan <me@yhndnzj.com>
parents: 13213
diff changeset
36 username = (type == "turn" or type == "turns") and user or nil;
7fd6feb86dbe mod_turn_external: hand out credentials for type == turns too
Mike Yuan <me@yhndnzj.com>
parents: 13213
diff changeset
37 secret = (type == "turn" or type == "turns") and secret or nil;
7fd6feb86dbe mod_turn_external: hand out credentials for type == turns too
Mike Yuan <me@yhndnzj.com>
parents: 13213
diff changeset
38 ttl = (type == "turn" or type == "turns") and ttl or nil;
11599
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 })
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40 end
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41 end
ed405b6357a8 mod_turn_external: Simple module to offer TURN(+STUN) via mod_external_services
Kim Alvefur <zash@zash.se>
parents:
diff changeset
42 end