chatmail / chatmail/chatmail-turn

Allow configuration of UDP port range

Open
#8 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
Rust
Stars
10
Forks
4
Avg merge
8h 33m
Merged PRs (30d)
1

Description

The documentation [here](https://chatmail.at/doc/relay/overview.html) has the following tidbit in it:

```
chatmail-turn listens on port

3478 UDP (STUN/TURN), and temporarily opens further UDP ports when users request them.
UDP port range is not restricted, any free port may be allocated.
```

This makes firewalling a chatmail server an absolute nightmare, as according to this spec, users need to allow ANY ingress traffic to ANY UDP port on the public address (or at least the unprivileged range, as I'd hope it won't pick system ports)

This is an absolutely immense attack surface, and it seems like something of an oversight.
At the very least, having a fixed range of ports would be a start, like the IANA "dynamic/private" port range (49152-65535). It's still incredibly wide, however, and allowing relay operators to size this to their user base would probably be optimal, if at all feasible.

For reference, Coturn supports this as `min-port` and `max-port` in `turnserver.conf`, having something similar would be fairly useful.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.