Re: Turnserver pending many security fixes
Stuart Henderson <[email protected]> Wed, 5 Aug 2026 09:51:29 +0100
| Newsgroups | gmane.os.openbsd.ports |
|---|---|
| Message-ID | <[email protected]> |
On 2026/07/29 17:45, Stuart Henderson wrote:
> On 2026/07/29 14:48, Filip Lax wrote:
> > Hi I run CoTurn (which for Openbsd is called Turnserver) and found that from Openbsd port version to current latest version there is alot of security patches.
> >
> > CoTurn is 99,9% used as internet facing app, TURN and STUN utility to assist bridging peer2peer users, and so it is in an exposed position.
> >
> > Sadly I dont have the profficiency to update a port myself so I try to ask here for help from the port author.
>
> you could try this. I'm not running this software so not tested beyond
> build and "make test". (CC'ing martijn@ who looked at updates to this before..)
>
> (FWIW, last time I looked at this stuff, restund seemed slightly saner
> than coturn..)
...and here's a newer version.
Index: Makefile
===================================================================
RCS file: /cvs/ports/telephony/coturn/Makefile,v
diff -u -p -r1.21 Makefile
--- Makefile 19 Mar 2026 06:29:53 -0000 1.21
+++ Makefile 5 Aug 2026 08:50:21 -0000
@@ -1,6 +1,6 @@
COMMENT = coturn STUN/TURN server
-V = 4.9.0-r0
+V = 4.16.0-r0
GH_ACCOUNT = coturn
GH_PROJECT = coturn
GH_TAGNAME = docker/${V}
@@ -15,12 +15,11 @@ CATEGORIES = telephony
PERMIT_PACKAGE = Yes
WANTLIB += c crypto event_core event_extra event_openssl event_pthreads
-WANTLIB += hiredis intl mariadb pq pthread sqlite3 ssl m z
+WANTLIB += hiredis hiredis_ssl mariadb pq pthread sqlite3 ssl
LIB_DEPENDS = databases/mariadb \
databases/postgresql \
databases/sqlite3 \
- devel/gettext,-runtime \
devel/libevent2 \
databases/libhiredis
@@ -32,6 +31,10 @@ CONFIGURE_ENV = TURN_NO_MONGO=1 \
TURN_NO_SYSTEMD=1
# Don't pick up devel/pkgconf
CONFIGURE_ENV += PKGCONFIG="pkg-config"
+
+post-extract:
+ cd ${WRKSRC}; \
+ patch -Ep1 < patches/openssl-1.1.1/0001-restore-openssl-1.1.1-support.patch
post-install:
rm -rf ${PREFIX}/etc
Index: distinfo
===================================================================
RCS file: /cvs/ports/telephony/coturn/distinfo,v
diff -u -p -r1.7 distinfo
--- distinfo 19 Mar 2026 06:29:53 -0000 1.7
+++ distinfo 5 Aug 2026 08:50:21 -0000
@@ -1,2 +1,2 @@
-SHA256 (turnserver-4.9.0pl0.tar.gz) = yCqvwI3ynHV2HxTNLTZHkpe7KsA3sKPrtX15uuvz1CQ=
-SIZE (turnserver-4.9.0pl0.tar.gz) = 546458
+SHA256 (turnserver-4.16.0pl0.tar.gz) = rTFIWUyN32RU0R1GfMAcMyz9/9/1KE+PdzGxmmOSido=
+SIZE (turnserver-4.16.0pl0.tar.gz) = 788829
Index: patches/patch-configure
===================================================================
RCS file: /cvs/ports/telephony/coturn/patches/patch-configure,v
diff -u -p -r1.1 patch-configure
--- patches/patch-configure 19 Mar 2026 06:29:53 -0000 1.1
+++ patches/patch-configure 5 Aug 2026 08:50:21 -0000
@@ -3,7 +3,7 @@
Index: configure
--- configure.orig
+++ configure
-@@ -448,7 +448,7 @@ fi
+@@ -451,7 +451,7 @@ fi
###########################
type ginstall 2>>/dev/null
Index: patches/patch-src_apps_common_apputils_c
===================================================================
RCS file: /cvs/ports/telephony/coturn/patches/patch-src_apps_common_apputils_c,v
diff -u -p -r1.2 patch-src_apps_common_apputils_c
--- patches/patch-src_apps_common_apputils_c 19 Mar 2026 06:29:53 -0000 1.2
+++ patches/patch-src_apps_common_apputils_c 5 Aug 2026 08:50:21 -0000
@@ -1,7 +1,7 @@
Index: src/apps/common/apputils.c
--- src/apps/common/apputils.c.orig
+++ src/apps/common/apputils.c
-@@ -1190,7 +1190,7 @@ char *find_config_file(const char *config_file) {
+@@ -1178,7 +1178,7 @@ char *find_config_file(const char *config_file) {
/////////////////// SYS SETTINGS ///////////////////////
void ignore_sigpipe(void) {
@@ -9,4 +9,4 @@ Index: src/apps/common/apputils.c
+#if defined(__linux__) || defined(__APPLE__) || defined(__OpenBSD__)
/* Ignore SIGPIPE from TCP sockets */
if (signal(SIGPIPE, SIG_IGN) == SIG_ERR) {
- perror("Cannot set SIGPIPE handler");
+ TURN_LOG_FUNC(TURN_LOG_LEVEL_ERROR, "Cannot set SIGPIPE handler: %s\n", strerror(errno));
Index: patches/patch-src_apps_relay_mainrelay_c
===================================================================
RCS file: /cvs/ports/telephony/coturn/patches/patch-src_apps_relay_mainrelay_c,v
diff -u -p -r1.4 patch-src_apps_relay_mainrelay_c
--- patches/patch-src_apps_relay_mainrelay_c 19 Mar 2026 06:29:53 -0000 1.4
+++ patches/patch-src_apps_relay_mainrelay_c 5 Aug 2026 08:50:21 -0000
@@ -1,18 +1,9 @@
- Don't create a default pidfile
-- Revert 4c674289a8a2 to use old DH code, LibreSSL doesn't have OSSL_{DECODER,PARAM}
Index: src/apps/relay/mainrelay.c
--- src/apps/relay/mainrelay.c.orig
+++ src/apps/relay/mainrelay.c
-@@ -33,7 +33,6 @@
- */
-
- #include "mainrelay.h"
--
- #include "dbdrivers/dbdriver.h"
-
- #include "prom_server.h"
-@@ -132,7 +131,7 @@ turn_params_t turn_params = {
+@@ -134,7 +134,7 @@ turn_params_t turn_params = {
false, /* do_not_use_config_file */
@@ -21,187 +12,3 @@ Index: src/apps/relay/mainrelay.c
"", /* acme_redirect */
//////////////// Listener server /////////////////
-@@ -3523,7 +3522,7 @@ static void adjust_key_file_names(void) {
- adjust_key_file_name(turn_params.dh_file, "DH key", 0);
- }
- }
--static EVP_PKEY *get_dh566(void) {
-+static DH *get_dh566(void) {
-
- unsigned char dh566_p[] = {0x36, 0x53, 0xA8, 0x9C, 0x3C, 0xF1, 0xD1, 0x1B, 0x2D, 0xA2, 0x64, 0xDE, 0x59, 0x3B, 0xE3,
- 0x8C, 0x27, 0x74, 0xC2, 0xBE, 0x9B, 0x6D, 0x56, 0xE7, 0xDF, 0xFF, 0x67, 0x6A, 0xD2, 0x0C,
-@@ -3537,33 +3536,16 @@ static EVP_PKEY *get_dh566(void) {
- // -----END DH PARAMETERS-----
-
- unsigned char dh566_g[] = {0x05};
-+ DH *dh;
-
-- BIGNUM *p = BN_bin2bn(dh566_p, sizeof(dh566_p), NULL);
-- BIGNUM *g = BN_bin2bn(dh566_g, sizeof(dh566_g), NULL);
-- if (!p || !g) {
-- BN_free(p);
-- BN_free(g);
-- return NULL;
-+ if ((dh = DH_new()) == NULL) {
-+ return (NULL);
- }
--
-- OSSL_PARAM_BLD *bld = OSSL_PARAM_BLD_new();
-- OSSL_PARAM_BLD_push_BN(bld, "p", p);
-- OSSL_PARAM_BLD_push_BN(bld, "g", g);
-- OSSL_PARAM *params = OSSL_PARAM_BLD_to_param(bld);
-- OSSL_PARAM_BLD_free(bld);
-- BN_free(p);
-- BN_free(g);
--
-- EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);
-- EVP_PKEY *pkey = NULL;
-- EVP_PKEY_fromdata_init(pctx);
-- EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEY_PARAMETERS, params);
-- EVP_PKEY_CTX_free(pctx);
-- OSSL_PARAM_free(params);
-- return pkey;
-+ DH_set0_pqg(dh, BN_bin2bn(dh566_p, sizeof(dh566_p), NULL), NULL, BN_bin2bn(dh566_g, sizeof(dh566_g), NULL));
-+ return (dh);
- }
-
--static EVP_PKEY *get_dh1066(void) {
-+static DH *get_dh1066(void) {
-
- unsigned char dh1066_p[] = {0x02, 0x0E, 0x26, 0x6F, 0xAA, 0x9F, 0xA8, 0xE5, 0x3F, 0x70, 0x88, 0xF1, 0xA9, 0x29, 0xAE,
- 0x1A, 0x2B, 0xA8, 0x2F, 0xE8, 0xE5, 0x0E, 0x81, 0x78, 0xD7, 0x12, 0x41, 0xDC, 0xE2, 0xD5,
-@@ -3582,33 +3564,16 @@ static EVP_PKEY *get_dh1066(void) {
- // -----END DH PARAMETERS-----
-
- unsigned char dh1066_g[] = {0x02};
-+ DH *dh;
-
-- BIGNUM *p = BN_bin2bn(dh1066_p, sizeof(dh1066_p), NULL);
-- BIGNUM *g = BN_bin2bn(dh1066_g, sizeof(dh1066_g), NULL);
-- if (!p || !g) {
-- BN_free(p);
-- BN_free(g);
-- return NULL;
-+ if ((dh = DH_new()) == NULL) {
-+ return (NULL);
- }
--
-- OSSL_PARAM_BLD *bld = OSSL_PARAM_BLD_new();
-- OSSL_PARAM_BLD_push_BN(bld, "p", p);
-- OSSL_PARAM_BLD_push_BN(bld, "g", g);
-- OSSL_PARAM *params = OSSL_PARAM_BLD_to_param(bld);
-- OSSL_PARAM_BLD_free(bld);
-- BN_free(p);
-- BN_free(g);
--
-- EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);
-- EVP_PKEY *pkey = NULL;
-- EVP_PKEY_fromdata_init(pctx);
-- EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEY_PARAMETERS, params);
-- EVP_PKEY_CTX_free(pctx);
-- OSSL_PARAM_free(params);
-- return pkey;
-+ DH_set0_pqg(dh, BN_bin2bn(dh1066_p, sizeof(dh1066_p), NULL), NULL, BN_bin2bn(dh1066_g, sizeof(dh1066_g), NULL));
-+ return (dh);
- }
-
--static EVP_PKEY *get_dh2066(void) {
-+static DH *get_dh2066(void) {
-
- unsigned char dh2066_p[] = {
- 0x03, 0x31, 0x77, 0x20, 0x58, 0xA6, 0x69, 0xA3, 0x9D, 0x2D, 0x5E, 0xE0, 0x5C, 0x46, 0x82, 0x0F, 0x9E, 0x80, 0xF0,
-@@ -3636,30 +3601,13 @@ static EVP_PKEY *get_dh2066(void) {
- // -----END DH PARAMETERS-----
-
- unsigned char dh2066_g[] = {0x05};
-+ DH *dh;
-
-- BIGNUM *p = BN_bin2bn(dh2066_p, sizeof(dh2066_p), NULL);
-- BIGNUM *g = BN_bin2bn(dh2066_g, sizeof(dh2066_g), NULL);
-- if (!p || !g) {
-- BN_free(p);
-- BN_free(g);
-- return NULL;
-+ if ((dh = DH_new()) == NULL) {
-+ return (NULL);
- }
--
-- OSSL_PARAM_BLD *bld = OSSL_PARAM_BLD_new();
-- OSSL_PARAM_BLD_push_BN(bld, "p", p);
-- OSSL_PARAM_BLD_push_BN(bld, "g", g);
-- OSSL_PARAM *params = OSSL_PARAM_BLD_to_param(bld);
-- OSSL_PARAM_BLD_free(bld);
-- BN_free(p);
-- BN_free(g);
--
-- EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);
-- EVP_PKEY *pkey = NULL;
-- EVP_PKEY_fromdata_init(pctx);
-- EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEY_PARAMETERS, params);
-- EVP_PKEY_CTX_free(pctx);
-- OSSL_PARAM_free(params);
-- return pkey;
-+ DH_set0_pqg(dh, BN_bin2bn(dh2066_p, sizeof(dh2066_p), NULL), NULL, BN_bin2bn(dh2066_g, sizeof(dh2066_g), NULL));
-+ return (dh);
- }
-
- static int pem_password_func(char *buf, int size, int rwflag, void *password) {
-@@ -3791,14 +3739,19 @@ static void set_ctx(SSL_CTX **out, const char *protoco
- if (nid == 0) {
- TURN_LOG_FUNC(TURN_LOG_LEVEL_ERROR, "unknown curve name: %s\n", curve_name);
- curve_name = DEFAULT_EC_CURVE_NAME;
-+ nid = OBJ_sn2nid(curve_name);
- set_auto_curve = 1;
- }
- }
-
- {
-- if (SSL_CTX_set1_groups_list(ctx, curve_name) != 1) {
-- TURN_LOG_FUNC(TURN_LOG_LEVEL_ERROR, "%s: ERROR: set EC curve '%s' failed\n", __FUNCTION__, curve_name);
-+ EC_KEY *ecdh = EC_KEY_new_by_curve_name(nid);
-+ if (!ecdh) {
-+ TURN_LOG_FUNC(TURN_LOG_LEVEL_ERROR, "%s: ERROR: allocate EC suite\n", __FUNCTION__);
- set_auto_curve = 1;
-+ } else {
-+ SSL_CTX_set_tmp_ecdh(ctx, ecdh);
-+ EC_KEY_free(ecdh);
- }
- }
- }
-@@ -3811,20 +3764,13 @@ static void set_ctx(SSL_CTX **out, const char *protoco
-
- { // DH algorithms:
-
-- EVP_PKEY *dh = NULL;
-+ DH *dh = NULL;
- if (turn_params.dh_file[0]) {
- FILE *paramfile = fopen(turn_params.dh_file, "r");
- if (!paramfile) {
- perror("Cannot open DH file");
- } else {
-- OSSL_DECODER_CTX *dctx =
-- OSSL_DECODER_CTX_new_for_pkey(&dh, "PEM", NULL, "DH", EVP_PKEY_KEY_PARAMETERS, NULL, NULL);
-- if (dctx) {
-- if (!OSSL_DECODER_from_fp(dctx, paramfile)) {
-- dh = NULL;
-- }
-- OSSL_DECODER_CTX_free(dctx);
-- }
-+ dh = PEM_read_DHparams(paramfile, NULL, NULL, NULL);
- fclose(paramfile);
- if (dh) {
- turn_params.dh_key_size = DH_CUSTOM;
-@@ -3846,11 +3792,11 @@ static void set_ctx(SSL_CTX **out, const char *protoco
- TURN_LOG_FUNC(TURN_LOG_LEVEL_ERROR, "%s: ERROR: cannot allocate DH suite\n", __FUNCTION__);
- err = 1;
- } else {
-- if (1 != SSL_CTX_set0_tmp_dh_pkey(ctx, dh)) {
-+ if (1 != SSL_CTX_set_tmp_dh(ctx, dh)) {
- TURN_LOG_FUNC(TURN_LOG_LEVEL_ERROR, "%s: ERROR: cannot set DH\n", __FUNCTION__);
- err = 1;
- }
-- // No EVP_PKEY_free: SSL_CTX_set0_tmp_dh_pkey always takes ownership
-+ DH_free(dh);
- }
- }
-
Index: patches/patch-src_apps_relay_mainrelay_h
===================================================================
RCS file: patches/patch-src_apps_relay_mainrelay_h
diff -N patches/patch-src_apps_relay_mainrelay_h
--- patches/patch-src_apps_relay_mainrelay_h 19 Mar 2026 06:29:53 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,15 +0,0 @@
-- Revert 4c674289a8a2 to use old DH code, LibreSSL doesn't have OSSL_{DECODER,PARAM}
-
-Index: src/apps/relay/mainrelay.h
---- src/apps/relay/mainrelay.h.orig
-+++ src/apps/relay/mainrelay.h
-@@ -87,9 +87,7 @@
- #include "ns_ioalib_impl.h"
-
- #include <openssl/aes.h>
--#include <openssl/decoder.h>
- #include <openssl/err.h>
--#include <openssl/param_build.h>
- #include <openssl/pem.h>
- #include <openssl/ssl.h>
-
Index: pkg/PLIST
===================================================================
RCS file: /cvs/ports/telephony/coturn/pkg/PLIST,v
diff -u -p -r1.6 PLIST
--- pkg/PLIST 19 Mar 2026 06:29:53 -0000 1.6
+++ pkg/PLIST 5 Aug 2026 08:50:21 -0000
@@ -89,6 +89,7 @@ share/examples/turnserver/scripts/mobile
share/examples/turnserver/scripts/mobile/mobile_tcp_client.sh
share/examples/turnserver/scripts/mobile/mobile_tls_client_c2c_tcp_relay.sh
share/examples/turnserver/scripts/mobile/mobile_udp_client.sh
+share/examples/turnserver/scripts/mobility_resume_flood.py
share/examples/turnserver/scripts/oauth.sh
share/examples/turnserver/scripts/pack.sh
share/examples/turnserver/scripts/peer.sh