mirror of
https://github.com/coturn/coturn.git
synced 2026-10-24 00:08:57 +03:00
ac601f832d
RFC 7635 Section 6.2 keys HMAC-SHA1 MESSAGE-INTEGRITY with the token's full 160-bit mac_key. The OAuth path went through the long-term-credential helpers, which hash only get_hmackey_size(SHA1) = 16 bytes, so requests from RFC 7635 compliant clients failed with 401 and coturn's responses could not be verified by them. turnutils_uclient shared the truncation, so the bundled client never noticed. Add integrity helpers that take an explicit key length and use the whole mac_key for OAuth sessions, both when checking requests (userdb and check_stun_auth) and when signing responses. --oauth-legacy-mac-key on turnserver (and on turnutils_uclient) restores the 16-byte truncation for deployments that depend on it; the server logs a warning when it is on. A mac_key whose last 4 bytes are zero hashes the same in both modes. Fixes #2091 and #644 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
102 lines
3.4 KiB
YAML
102 lines
3.4 KiB
YAML
name: Linux
|
|
|
|
on:
|
|
push:
|
|
branches: ["master"]
|
|
tags: ["4.*"]
|
|
pull_request:
|
|
branches: ["master"]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
name: build + test
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- amazonlinux:2023
|
|
- ubuntu:22.04
|
|
- ubuntu:26.04
|
|
runs-on: ubuntu-latest
|
|
# Backstop so a hung test script cannot burn the 6h GitHub default.
|
|
timeout-minutes: 40
|
|
container:
|
|
image: ${{ matrix.os }}
|
|
volumes:
|
|
- ${{ contains('amazonlinux:2 ubuntu:16.04 ubuntu:18.04', matrix.os) && '/node20217:/node20217:rw,rshared' || ' ' }}
|
|
- ${{ contains('amazonlinux:2 ubuntu:16.04 ubuntu:18.04', matrix.os) && '/node20217:/__e/node20:ro,rshared' || ' ' }}
|
|
steps:
|
|
- name: Install `yum` dependencies
|
|
run: yum install -y gcc make gzip tar openssl-devel libevent-devel wget which
|
|
if: ${{ contains(matrix.os, 'amazonlinux') }}
|
|
|
|
- name: Install Node.js 20 built against glibc 2.17 for GitHub Actions
|
|
run: |
|
|
set -ex
|
|
which apt \
|
|
&& apt update \
|
|
&& apt install -y wget xz-utils
|
|
which yum \
|
|
&& yum install -y wget xz
|
|
wget https://unofficial-builds.nodejs.org/download/release/v20.9.0/node-v20.9.0-linux-x64-glibc-217.tar.xz
|
|
tar -xf node-v20.9.0-linux-x64-glibc-217.tar.xz --strip-components 1 -C /node20217
|
|
ldd /__e/node20/bin/node
|
|
working-directory: /tmp/
|
|
if: ${{ contains('amazonlinux:2 ubuntu:16.04 ubuntu:18.04', matrix.os) }}
|
|
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Install `apt` dependencies
|
|
# Set env variable or otherwise `tzdata` package requires interaction.
|
|
env:
|
|
DEBIAN_FRONTEND: noninteractive
|
|
uses: ./.github/workflows/actions/ubuntu-build-deps
|
|
if: ${{ contains(matrix.os, 'ubuntu') }}
|
|
|
|
- run: ./configure
|
|
- run: make
|
|
- run: make install prefix=$(pwd)
|
|
|
|
- run: make check
|
|
|
|
- run: ./run_tests.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_ratelimit_401.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_conf.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_dtls_default.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_ipv6_relay.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_mobile.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_prom.sh
|
|
working-directory: examples/
|
|
if: ${{ contains(matrix.os, 'ubuntu') }}
|
|
|
|
# Regression cover for shipped security fixes. These drive raw STUN over
|
|
# python3, so a missing interpreter must not silently skip them here.
|
|
- run: ./run_tests_mobility_quota.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_mobility_resume_flood.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_stateless_binding.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_stateless_nonce.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_oauth.sh
|
|
working-directory: examples/
|
|
|
|
- run: ./run_tests_expiry.sh
|
|
working-directory: examples/
|
|
# Needs a second bindable loopback address, which is native on Linux.
|
|
- run: ./run_tests_rfc5780.sh
|
|
working-directory: examples/
|
|
- run: ./run_tests_multiplex_peer.sh
|
|
working-directory: examples/
|