mirrors/coturn
1
0
Fork 0
mirror of https://github.com/coturn/coturn.git synced 2026-05-05 02:46:08 +02:00
Code Issues Projects Releases Wiki Activity

Pin session origin only after MESSAGE-INTEGRITY validates (#1871)

Browse Source 
The first ALLOCATE set ss->origin_set=1 before check_stun_auth ran, so
an unauthenticated attacker could lock the session into a realm of their
choice by forging the ORIGIN attribute on the first packet. If per-realm
ACLs differ, this lets the attacker pick the most permissive realm for
that session.

Defer the commit of ss->origin_set until check_stun_auth succeeds with a
valid MESSAGE-INTEGRITY. Until auth passes, every request re-parses
ORIGIN, so the 401 challenge still carries the correct realm derived
from the current ORIGIN attribute.
This commit is contained in:
Pavel Punsky 2026-04-18 17:16:47 -07:00 committed by GitHub
parent 4d0b3c7660
commit c37ccf4df9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/server/ns_turn_server.c
View File

@ -3701,8 +3701,10 @@ static int handle_turn_command(turn_turnserver *server, ts_ur_super_session *ss,
sar = stun_attr_get_next_str(ioa_network_buffer_data(in_buffer->nbh),
ioa_network_buffer_get_size(in_buffer->nbh), sar);
}
ss->origin_set = 1;
/* Note: ss->origin_set is intentionally NOT committed here. We pin the origin only
after the request's MESSAGE-INTEGRITY validates (see post-auth block below). An
unauthenticated first ALLOCATE could otherwise lock the session into a realm of
the attacker's choice. Until auth succeeds, every request re-parses the origin. */
}
if (!err_code && !(*resp_constructed) && !no_response) {
@ -3716,6 +3718,10 @@ static int handle_turn_command(turn_turnserver *server, ts_ur_super_session *ss,
if (postpone_reply) {
no_response = 1;
}
/* Pin origin only after the request was authenticated (MESSAGE-INTEGRITY validated). */
if (!err_code && message_integrity && (method == STUN_METHOD_ALLOCATE)) {
ss->origin_set = 1;
}
}
}
}