Commit Graph

943 Commits

Author SHA1 Message Date
Michael Jones
c3d235b6e9
Check the result of malloc in send_message_to_redis (#1515) 2024-06-02 16:36:27 -07:00
Michael Jones
0de3bda383
Check the result of malloc in mongo_set_realm_option_one (#1516) 2024-06-02 16:35:37 -07:00
Michael Jones
868f15a672
Move the hiredis_libevent2 code from common to relay (#1509)
The point of this change is to make the build instructions a bit more
straight forward. Since the hiresevent2 source files are only ever used
by the relay target, this scoping makes sense in general.
2024-06-01 18:16:39 -07:00
Michael Jones
d1db5e590d
Include what you use (#1512)
Use the include-what-you-use program to (partially) clean up header
includes, so that only includes which are needed, and no includes that
are not needed (or at least closer to that ideal) are done.

For a c-language project, the build-time improvements from this change
is minimal. This would have a much bigger impact on a C++ project than a
C-project for build times.

So for coturn, this change is mostly intended to just provide
consistency and make it easier to locate weird issues like strange
dependencies, and unnecessary connections between code.
2024-06-01 18:13:08 -07:00
Michael Jones
e45d846331
Check the result of malloc in string_list_add (#1495) 2024-05-29 20:49:54 -07:00
Michael Jones
35a3293531
Check the result of realloc and calloc in ch_map_get (#1497) 2024-05-29 20:48:46 -07:00
Michael Jones
66a85ef09e
Address clang-tidy warnings in db files (#1405)
The general approach here was:

- Always declare variables as close to where they are defined as
possible.
- Check for pre-conditions of functions before doing work (e.g. ensure
we can connect to the DB before doing a bunch of string formatting)
- Keep the scope of mutexes as reasonably small as practical.
- Use idiomatic C11, such as for-loops over the thing being iterated,
not while() loops over constants, or variables that aren't modified.
- Prefer if(fail){return} function-body after over `if(not fail){
function-body inside if} return;

Clang-tidy returns a clean bill of health, but while going through this
file i noticed a lot of things that raise questions.

Lack of checking column counts. Lack of handling the possibility of
multiple return values. Questionably handling of strings. Complete lack
of checking function inputs for invalid values (e.g. nullptr).

I'm not going to fix those, my organization doesn't USE the DB drivers,
so i have little interest in re-working the logic beyond addressing
clang-tidy warnings for my own sanity, but i did add TODO comments for
someone else to look at in the future.



Additional note: While the changes look very invasive.... they aren't.

I don't think there is a way to get github to ignore whitespace in the
filediff, but if someone were to compare the commit locally, they'll see
that almost all of the changes are just adjusting indentation.
2024-05-29 20:44:23 -07:00
redraincatching
99777bd585
malloc now allocates space for string terminator (#1507)
addresses a code scanner vulnerability

the combination of `strlen` and `malloc` results in space being
allocated for the string, but not the null terminator required to end
the string, so space for an extra character has to be manually specified

#### references
- CERT C Coding Standard: [MEM35-C. Allocate sufficient memory for an
object](https://www.securecoding.cert.org/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object).
- Common Weakness Enumeration:
[CWE-131](https://cwe.mitre.org/data/definitions/131.html).
- Common Weakness Enumeration:
[CWE-120](https://cwe.mitre.org/data/definitions/120.html).
- Common Weakness Enumeration:
[CWE-122](https://cwe.mitre.org/data/definitions/122.html).
2024-05-29 20:42:31 -07:00
Michael Jones
ad94684b23
Use bool over int for the turnutils_uclient program (#1420)
Converts all of the variables in the uclient program that should be bool
but weren't.

A few other minor adjustments made at the behest of clang-tidy, but this
change does not address all of clang-tidy's complaints.
2024-05-29 20:39:51 -07:00
Michael Jones
58dc071b46
Fix lint complaint about comment (#1506) 2024-05-29 19:07:20 -07:00
Michael Jones
e8fa2f666a
Avoid read-past-end of string in get_bold_admin_title (#1499) 2024-05-27 13:47:54 -07:00
Michael Jones
544382f313
Fix mingw and MSVC ci build (#1491) 2024-05-27 13:43:40 -07:00
Michael Jones
46caa941d3
Check allocation results in add_static_user_account (#1501) 2024-05-27 12:05:21 -07:00
Pavel Punsky
47fcc99853
Address some build issues introduced by api changes (#1505)
#1502 made APIs consistent with using bool as a return value where true
is success and false is failure
In a few places the change broke code

This PR fixes the breakage
2024-05-27 12:00:23 -07:00
Michael Jones
846f717059
Check the result of calloc in handle_logon_request (#1498) 2024-05-27 11:30:49 -07:00
Michael Jones
a32d1a2704
Avoid writing potentially uninitialized data to aes_128 key file (#1500) 2024-05-27 10:56:12 -07:00
Pavel Punsky
17926fe70b
Use active CPU number instead of total number (#1469)
The code used `get_system_number_of_cpus()` instead of
`get_system_active_number_of_cpus()` to configure number of relay
servers.
That caused incorrect number to be used on virtualized systems. See
#1468
2024-05-26 18:35:15 -07:00
redraincatching
90799f5c60
defined a magic number for stun fingerprinting (#1489)
The value `0x5354554e`, used twice in the `ns_turn_msg.c`, was unclear,
and was changed to a macro that better explained its usage, as defined
in [RFC
5389](https://datatracker.ietf.org/doc/html/rfc5389#section-15.5)
2024-05-26 18:34:10 -07:00
Michael Jones
4e8524d9d7
avoid potential nullptr derefernence in udp_create_server_socket (#1496) 2024-05-26 18:22:31 -07:00
Michael Jones
f3b73f60d0
Change the various map functions to return bool instead of inconsistantly return 0, 1, or -1 (#1502) 2024-05-26 17:45:18 -07:00
Michael Jones
6fc5cf31e9
Check the result of malloc in del_alt_server (#1503) 2024-05-26 17:34:15 -07:00
Michael Jones
2c45aa731c
Avoid nullptr dereference of server variable in various functions (#1504) 2024-05-26 17:32:02 -07:00
Gustavo Garcia
14e6d16d14
Fix msvc analyzer error on goto label on rfc5769check (#1486)
rfc5769check.c file is using ERROR as a label for gotos but apparently
that name is already used for a constant and msvc analyzer detects it as
an error.

Rename it to "err" that is already used in other parts of the codebase
and also more consistent in terms of casing.

Co-authored-by: Gustavo Garcia <gustavogb@mail.com>
2024-05-05 12:19:10 +02:00
Stefan Junker
158fe9b698
Fix buffer overflow in generate_enc_password with increase rsalt by 2 (#1463)
before this change i see a bufferflow during `readable_string`.
2024-05-04 18:26:35 +02:00
Gustavo Garcia
386371c174
Fix lint errors 2024-04-21 23:05:29 +02:00
Nikolayshcx
eb3af26867
Add support for raw public keys (Rfc 7250) (#1458)
Resolving #1456

---------

Co-authored-by: nmegdanov <nikolay.megdanov@softavail.com>
2024-04-19 17:12:48 +02:00
Gustavo Garcia
c2d13700ac Fix clang-format lint warnings 2024-04-19 17:08:49 +02:00
Gustavo Garcia
28294cf053 Fix const during free warning in rfc5769check app 2024-04-19 16:23:30 +02:00
Kang Lin
5b68014699
Refactor: peer_input_handle (#1325) 2024-04-19 12:09:43 +02:00
NO NAME
3f66c028fa
Fix Cmake find issue in libevent (#1466)
Fixed an issue in libevent's CMake configuration where pthreads were not
correctly added to the optional components list, leading to a
compilation error. #1448

Co-authored-by: linwenchen <wenchen0803@qq.com>
2024-04-09 11:51:31 +02:00
Pavel Punsky
edebb9ad05
Print version only, no extra lines (#1441)
Before
<img width="615" alt="Screenshot 2024-03-02 at 2 47 48 PM"
src="https://github.com/coturn/coturn/assets/2505440/c3f01e97-914c-4391-af32-d3442d265e90">

After
<img width="402" alt="Screenshot 2024-03-02 at 2 47 28 PM"
src="https://github.com/coturn/coturn/assets/2505440/ce3deb7b-5f70-4158-8cd9-eceae0dcc995">
2024-03-31 09:53:21 +02:00
ashamedbit
412788b120
Fix memory leak in rfc5769check.c (#1410)
I came across the open issue #1368 which is a leaksanitizer report about
a leak that happens on make check. I was able to reproduce the bug on
running `make check` and was able to generate a patch for it. The leak
happens within function `check_oauth`.

Issue: The variable `base64encoded_ltp` is allocated within
`base64_encode` however it is not de-allocated within the coming loop.

I have verified that after the patch, the leak no longer occurs through
`leaksanitizer` (and there is no double free for that matter)

---------

Co-authored-by: Pavel Punsky <eakraly@users.noreply.github.com>
2024-03-03 14:04:40 -08:00
ashamedbit
456e2e81b3
Fix memory leak in netengine.c (#1411)
This is in response to issue #1366
The clang static analyzer basically claims that there is a memory leak
happening in `set_ssl_ctx` for the variable `args`. The leak is
triggered when the base event `base` is NULL and the condition within
`set_ssl_ctx` is not triggered. Therefore as a patch I am adding an else
condition to free it. (It cannot be freed after the event is created by
`event_new` because `args` can be invoked as argument for callback
function later on)

Please let me know if this patch is helpful :)

---------

Co-authored-by: Pavel Punsky <eakraly@users.noreply.github.com>
2024-03-02 14:15:58 -08:00
ashamedbit
68b9f19f7f
Fix memory leak on http_server.c (#1412)
This is in response to issue #1365.
The clang static analyzer basically claims that there is a memory leak
happening in `parse_http_request_1` for the variable `kv`. The leak is
triggered when evhttp_parse_query_str fails and is unable to obtain key
value pairs for a given URI. In this case ret is freed, however kv is
still not freed and thereafter not used. Therefore as a patch I am
freeing kv right after ret is freed.

Please let me know if this patch is helpful :)

---------

Co-authored-by: Pavel Punsky <eakraly@users.noreply.github.com>
2024-03-02 14:10:53 -08:00
Pavel Punsky
2c265c9777
Delete unused variable (#1437) 2024-02-25 16:07:08 -08:00
redraincatching
ac00b41a8e
changed variables in stunclient.c to bool (C11) (#1421)
# changed variables that appeared in `stunclient.c` and their uses to
`bool` to follow C11 idioms
## approach was as follows:
- if a variable of type `int` was only being used as a boolean, replace
it with bool as defined in `<stdbool.h>`
- replace its declaration and assignment with true/false, depending on
prior assignment as 0/1

changes were only made when i was certain the variables were not being
used as an int, so i may have missed some

---

## variables changed in `stunclient.c`
- `rfc5780`
- `change_ip`
- `change_port`

their usages were changed only where they appeared in the apps
directory, and then everywhere that generated a warning after make

- `stunclient.c` itself
- `natdiscovery.c`
2024-02-20 18:43:24 -08:00
redraincatching
0c8d646e2d
added missing function prototype of turn_random_number() (#1428)
trivial - cmake generated a warning that `ns_turn_msg.c` used a function
that had no prior prototype - most other files used the `turn_random()`
function but this uses `turn_random_number()` which has no prototype, so
i've added it to the header file
2024-02-10 20:57:33 -08:00
Jan Brasna
9dfe8d5128
Fix no-tls warning typo (#1426)
Trivial log warning typo introduced in #1256 corrected.
2024-02-09 20:15:19 -08:00
Michael Jones
2459db6266
Adjust wording in cmake message when prometheous cannot be found. (#1418) 2024-01-31 17:57:20 -08:00
Michael Jones
da332ed9e7
Add the InsertBraces command for clang-format to ensure that all conditionals always have braces (#1408)
- Why? Because code where conditionals lack braces is much harder to read, and prone to indentation confusion.
- How? Just added an extra flag to .clang-format and re-ran clang-format on all the files.

I also moved .clang-format up to the top level of the repo so that it can be applied to the fuzz targets as well.
2024-01-27 16:38:40 -08:00
Pavel Punsky
0afbc6204d
Replace HeapAlloc with malloc (#1378)
Use malloc/free instead of HeapAlloc/HeapFree
2024-01-18 21:08:28 -08:00
korayvt
348380f248
Added sessionID to some log lines (#1334)
Co-authored-by: KORAY VATANSEVER <koray.vatansever@turkcell.com.tr>

Some events are missed when logs are filtered by session ID. That's why I added the sessionID to some log lines.
2024-01-17 22:16:57 -08:00
Cybermilitia
7546c24b2f
Missing session ID in coturn logs for denied IP - 1330 (#1332)
Co-authored-by: CUMHUR KARAHAN <cumhur.karahan@turkcell.com.tr>

Added session id parameter to use it in "A peer IP denied in the range" logs. Besides, server ID has been made visible in this logs.
Before
```
023-08-24T17:23:17.221745770+03:00 stdout F 268472: : ERROR: A peer IP 169.254.38.68 denied in the range: 169.254.0.0-169.254.255.255
```

And after - new view:
```
2023-09-28T10:53:49.627778472+03:00 stdout F 1247: : ERROR: session 006000000000000004: A peer IP 172.21.198.41 denied in the range: 172.21.198.40-172.21.198.50 in server 6
```
2024-01-15 19:12:24 -08:00
Pavel Punsky
acf607ee50
Fix mingw build (#1376) 2024-01-15 18:26:54 -08:00
Pavel Punsky
c062d5e2af
Simplify macOS detection macros (#1372) 2024-01-15 15:18:35 -08:00
Pavel Punsky
f8e9892d3e
Fix potential null passed to function expecting nonnull (#1373) 2024-01-15 15:13:32 -08:00
Evgeny Khramtsov
7ecfb537e9
Only set MHD_USE_DUAL_STACK if IPv6 is available (#1362)
Co-authored-by: Evgeny Khramtsov <evgeny.khramtsov@ringcentral.com>

If IPv6 is not enabled during runtime, prometheus server fails to start with `EAFNOSUPPORT` because `MHD_USE_DUAL_STACK` is set unconditionally.

This PR fixes it. As a bonus, it also checks if libmicrohttpd is compiled with IPv6 support.
2024-01-14 12:49:59 -08:00
Kang Lin
294f897ccd
CMake: find prometheus(fix #1304) (#1315)
fix #1304
2023-11-22 20:34:53 -08:00
Subhra264
9485c9567e
Fix: Return correct error code for create_relay_connection in case of RESERVATION-TOKEN failure (#1319)
Fixes #1266 

According to RFC 5766, [section 6.2](https://www.rfc-editor.org/rfc/rfc5766#section-6.2) point no. 5, the turn server needs to reject the request with 508 (Insufficient Capacity) error code when the given RESERVATION-TOKEN is not valid.
2023-11-22 20:30:27 -08:00
Pavel Punsky
99cc8aaa65
Reduce ifdefs in code: TURN_NO_PROMETHEUS (#1116)
TURN_NO_PROMETHEUS define is used in minimal amount of places now
2023-11-05 17:49:03 -08:00