mirror of
https://github.com/coturn/coturn.git
synced 2026-10-24 00:08:57 +03:00
ac601f832d
RFC 7635 Section 6.2 keys HMAC-SHA1 MESSAGE-INTEGRITY with the token's full 160-bit mac_key. The OAuth path went through the long-term-credential helpers, which hash only get_hmackey_size(SHA1) = 16 bytes, so requests from RFC 7635 compliant clients failed with 401 and coturn's responses could not be verified by them. turnutils_uclient shared the truncation, so the bundled client never noticed. Add integrity helpers that take an explicit key length and use the whole mac_key for OAuth sessions, both when checking requests (userdb and check_stun_auth) and when signing responses. --oauth-legacy-mac-key on turnserver (and on turnutils_uclient) restores the 16-byte truncation for deployments that depend on it; the server logs a warning when it is on. A mac_key whose last 4 bytes are zero hashes the same in both modes. Fixes #2091 and #644 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
1.4 KiB
YAML
59 lines
1.4 KiB
YAML
name: CMake
|
|
|
|
on:
|
|
push:
|
|
branches: ["master"]
|
|
tags: ["4.*"]
|
|
pull_request:
|
|
branches: ["master"]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
BUILD_TYPE: Release
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ 'ubuntu:22.04', 'ubuntu:26.04' ]
|
|
|
|
runs-on: ubuntu-latest
|
|
# Backstop so a hung test script cannot burn the 6h GitHub default.
|
|
timeout-minutes: 40
|
|
container: ${{ matrix.os }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Install dependencies
|
|
env:
|
|
DEBIAN_FRONTEND: noninteractive
|
|
uses: ./.github/workflows/actions/ubuntu-build-deps
|
|
|
|
- name: Configure
|
|
run: cmake -S . -B build -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DBUILD_TESTING=ON
|
|
- name: Build
|
|
run: cmake --build build --parallel $(nproc)
|
|
|
|
- name: Unit tests
|
|
run: ctest --test-dir build --output-on-failure
|
|
|
|
- run: ./run_tests.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_ratelimit_401.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_conf.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_dtls_default.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_ipv6_relay.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_mobile.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_oauth.sh
|
|
working-directory: examples/
|