mirror of
https://github.com/coturn/coturn.git
synced 2026-10-24 00:08:57 +03:00
d49ee56aa9
good_peer_addr() denies loopback, multicast and zero peers by default, but had no guard for other internal address scopes, and a denied-peer-ip list is IPv4-only in typical deployments — an IPv4 range cannot even express an IPv6 internal target. An authenticated TURN user could therefore drive the RFC 6062 TCP CONNECT relay to a native-IPv6 internal service (e.g. a ULA-hosted Redis/SQL backend) or to the 169.254.169.254 cloud metadata service, none of which an IPv4 denied-peer-ip covers. Add `ioa_addr_is_internal_deny_default()` and reject these scopes in `good_peer_addr()` unconditionally: - IPv4 link-local `169.254.0.0/16` (incl. the `169.254.169.254` cloud metadata service) - IPv6 link-local `fe80::/10` - IPv6 unique-local (ULA) `fc00::/7` - IPv6 site-local `fec0::/10` IPv4-in-IPv6 canonicalization is applied first, so encoded forms (e.g. `::ffff:169.254.169.254`) are caught too. Loopback is intentionally excluded so it keeps its existing `--allow-loopback-peers` gate; RFC1918 / CGNAT stay relayable so legitimate LAN and enterprise TURN deployments are unaffected. Adds unit tests covering each denied scope and confirming loopback / RFC1918 / public addresses are not flagged.