Skip to content
Snippets Groups Projects
Commit 9fccbb01 authored by Moritz Bitsch's avatar Moritz Bitsch
Browse files

Implement TURN server authentication with hmac 

This is a prefered method to allow limited access to the TURN server
parent 109892b4
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
Cargo.lock
+ 35
− 0
View file @ 9fccbb01
...@@ -245,6 +245,7 @@ dependencies = [ ...@@ -245,6 +245,7 @@ dependencies = [
"crossbeam", "crossbeam",
"directories", "directories",
"heed", "heed",
"hmac",
"http", "http",
"image", "image",
"jsonwebtoken", "jsonwebtoken",
...@@ -266,6 +267,7 @@ dependencies = [ ...@@ -266,6 +267,7 @@ dependencies = [
"serde", "serde",
"serde_json", "serde_json",
"serde_yaml", "serde_yaml",
"sha-1",
"sled", "sled",
"thiserror", "thiserror",
"thread_local", "thread_local",
...@@ -428,6 +430,16 @@ dependencies = [ ...@@ -428,6 +430,16 @@ dependencies = [
"lazy_static", "lazy_static",
] ]
[[package]]
name = "crypto-mac"
version = "0.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b1d1a86f49236c215f271d40892d5fc950490551400b02ef360692c29815c714"
dependencies = [
"generic-array",
"subtle",
]
[[package]] [[package]]
name = "curve25519-dalek" name = "curve25519-dalek"
version = "3.2.0" version = "3.2.0"
...@@ -897,6 +909,16 @@ dependencies = [ ...@@ -897,6 +909,16 @@ dependencies = [
"libc", "libc",
] ]
[[package]]
name = "hmac"
version = "0.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b"
dependencies = [
"crypto-mac",
"digest",
]
[[package]] [[package]]
name = "hostname" name = "hostname"
version = "0.3.1" version = "0.3.1"
...@@ -2422,6 +2444,19 @@ dependencies = [ ...@@ -2422,6 +2444,19 @@ dependencies = [
"yaml-rust", "yaml-rust",
] ]
[[package]]
name = "sha-1"
version = "0.9.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "99cd6713db3cf16b6c84e06321e049a9b9f699826e16096d23bbcc44d15d51a6"
dependencies = [
"block-buffer",
"cfg-if 1.0.0",
"cpufeatures",
"digest",
"opaque-debug",
]
[[package]] [[package]]
name = "sha1" name = "sha1"
version = "0.6.0" version = "0.6.0"
......
Cargo.toml
+ 3
− 0
View file @ 9fccbb01
...@@ -79,6 +79,9 @@ num_cpus = "1.13.0" ...@@ -79,6 +79,9 @@ num_cpus = "1.13.0"
threadpool = "1.8.1" threadpool = "1.8.1"
heed = { git = "https://github.com/timokoesters/heed.git", rev = "f6f825da7fb2c758867e05ad973ef800a6fe1d5d", optional = true } heed = { git = "https://github.com/timokoesters/heed.git", rev = "f6f825da7fb2c758867e05ad973ef800a6fe1d5d", optional = true }
thread_local = "1.1.3" thread_local = "1.1.3"
# used for TURN server authentication
hmac = "0.11.0"
sha-1 = "0.9.8"
[features] [features]
default = ["conduit_bin", "backend_sqlite"] default = ["conduit_bin", "backend_sqlite"]
......
src/client_server/voip.rs
+ 44
− 7
View file @ 9fccbb01
use crate::{database::DatabaseGuard, ConduitResult}; use crate::{database::DatabaseGuard, ConduitResult, Ruma};
use hmac::{Hmac, Mac, NewMac};
use ruma::api::client::r0::voip::get_turn_server_info; use ruma::api::client::r0::voip::get_turn_server_info;
use std::time::Duration; use ruma::SecondsSinceUnixEpoch;
use sha1::Sha1;
use std::time::{Duration, SystemTime};
type HmacSha1 = Hmac<Sha1>;
#[cfg(feature = "conduit_bin")] #[cfg(feature = "conduit_bin")]
use rocket::get; use rocket::get;
...@@ -8,12 +13,44 @@ ...@@ -8,12 +13,44 @@
/// # `GET /_matrix/client/r0/voip/turnServer` /// # `GET /_matrix/client/r0/voip/turnServer`
/// ///
/// TODO: Returns information about the recommended turn server. /// TODO: Returns information about the recommended turn server.
#[cfg_attr(feature = "conduit_bin", get("/_matrix/client/r0/voip/turnServer"))] #[cfg_attr(
#[tracing::instrument(skip(db))] feature = "conduit_bin",
pub async fn turn_server_route(db: DatabaseGuard) -> ConduitResult<get_turn_server_info::Response> { get("/_matrix/client/r0/voip/turnServer", data = "<body>")
)]
#[tracing::instrument(skip(body, db))]
pub async fn turn_server_route(
body: Ruma<get_turn_server_info::Request>,
db: DatabaseGuard,
) -> ConduitResult<get_turn_server_info::Response> {
let sender_user = body.sender_user.as_ref().expect("user is authenticated");
let turn_secret = db.globals.turn_secret();
let (username, password) = if turn_secret != "" {
let expiry = SecondsSinceUnixEpoch::from_system_time(
SystemTime::now() + Duration::from_secs(db.globals.turn_ttl()),
)
.expect("time is valid");
let username: String = format!("{}:{}", expiry.get(), sender_user);
let mut mac = HmacSha1::new_from_slice(turn_secret.as_bytes())
.expect("HMAC can take key of any size");
mac.update(username.as_bytes());
let password: String = base64::encode_config(mac.finalize().into_bytes(), base64::STANDARD);
(username, password)
} else {
(
db.globals.turn_username().clone(),
db.globals.turn_password().clone(),
)
};
Ok(get_turn_server_info::Response { Ok(get_turn_server_info::Response {
username: db.globals.turn_username().clone(), username: username,
password: db.globals.turn_password().clone(), password: password,
uris: db.globals.turn_uris().to_vec(), uris: db.globals.turn_uris().to_vec(),
ttl: Duration::from_secs(db.globals.turn_ttl()), ttl: Duration::from_secs(db.globals.turn_ttl()),
} }
......
src/database.rs
+ 2
− 0
View file @ 9fccbb01
...@@ -80,6 +80,8 @@ pub struct Config { ...@@ -80,6 +80,8 @@ pub struct Config {
turn_password: String, turn_password: String,
#[serde(default = "Vec::new")] #[serde(default = "Vec::new")]
turn_uris: Vec<String>, turn_uris: Vec<String>,
#[serde(default)]
turn_secret: String,
#[serde(default = "default_turn_ttl")] #[serde(default = "default_turn_ttl")]
turn_ttl: u64, turn_ttl: u64,
......
src/database/globals.rs
+ 4
− 0
View file @ 9fccbb01
...@@ -242,6 +242,10 @@ pub fn turn_username(&self) -> &String { ...@@ -242,6 +242,10 @@ pub fn turn_username(&self) -> &String {
&self.config.turn_username &self.config.turn_username
} }
pub fn turn_secret(&self) -> &String {
&self.config.turn_secret
}
/// TODO: the key valid until timestamp is only honored in room version > 4 /// TODO: the key valid until timestamp is only honored in room version > 4
/// Remove the outdated keys and insert the new ones. /// Remove the outdated keys and insert the new ones.
/// ///
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment