mirror of
https://github.com/coturn/coturn.git
synced 2026-10-24 00:08:57 +03:00
6c13608c28
The IPv6 branch of addr_less_eq compared all 16 bytes independently and returned 0 if any single byte of addr1 exceeded addr2 -- a component-wise partial order, not the intended lexicographic total order. As a result ioa_addr_in_range tested a rectangular per-byte box instead of the contiguous span [min,max], so any non-prefix-aligned IPv6 denied-peer-ip range under-blocked: an authenticated TURN client could relay to denied internal IPv6 peers (TURN-specific SSRF), and allowed-peer-ip was likewise corrupted. in6_addr is stored MSB-first (network order), so a byte-wise memcmp is exactly the required lexicographic ordering. Add regression tests over native non-prefix-aligned and wide IPv6 ranges using the advisory's own example addresses. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>