chatmail / chatmail/chatmail-turn
Allow configuration of UDP port range
- Dominant language
- Rust
- Stars
- 10
- Forks
- 4
- Avg merge
- 8h 33m
- Merged PRs (30d)
- 1
Description
The documentation [here](https://chatmail.at/doc/relay/overview.html) has the following tidbit in it:
```
chatmail-turn listens on port
3478 UDP (STUN/TURN), and temporarily opens further UDP ports when users request them.
UDP port range is not restricted, any free port may be allocated.
```
This makes firewalling a chatmail server an absolute nightmare, as according to this spec, users need to allow ANY ingress traffic to ANY UDP port on the public address (or at least the unprivileged range, as I'd hope it won't pick system ports)
This is an absolutely immense attack surface, and it seems like something of an oversight.
At the very least, having a fixed range of ports would be a start, like the IANA "dynamic/private" port range (49152-65535). It's still incredibly wide, however, and allowing relay operators to size this to their user base would probably be optimal, if at all feasible.
For reference, Coturn supports this as `min-port` and `max-port` in `turnserver.conf`, having something similar would be fairly useful.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.