4 ms·

It's not really a bug in old coturn, just a feature in the protocol. According to the article newer versions just disable routing to 127.0.0.1 by default but t

It's not really a bug in old coturn, just a feature in the protocol. According to the article newer versions just disable routing to 127.0.0.1 by default but there are still other network addresses you might have to consider (see article for a recommended list of "denied-peer-ips").

gfodor 7y ago
Yup, sorry if my phrasing implied it's a bug. It's just better defaults, and there's evidence to support the idea slack was just running the software with the old defaults.
- StillBored 7y ago
  But its not necessarily the defaults. The article isn't clear if the private services are on 127/8 or the TURN server has access to other things in the DMZ/VPC/whatever. I'm guessing its actually the latter as everyone is so fond of the 1:1 VM/container->service model. Meaning its likely a config problem with the denied-peer-ips the parent here links.
jerf 7y ago
You may already know this, but it's worth getting the word out. Do not just deny routing to 127.0.0.1. 127.0.0.1 is merely the conventional "localhost" address; however, ALL 127.x.x.x is "localhost". You can check this now on your local command line with "ping 127.1.2.3". (This just seems to be one of those bugs that every proxy goes through at some point, just like pretty much any attempt to write a web server that serves files off disk will have at least one directory traversal bug.)
- zrm 7y ago
  Also don't forget that IPv6 ::1 is localhost too.
  - deleted 7y ago
    [deleted]
- z3t4 7y ago
  The IP protocol is full of security gotchas so you better use a higher level protocol. Spoofing, arp attacks, TCP session hijacking, etc.
- MrStonedOne 7y ago
  Fun fact, windows blocks remote desktoping to localhost (because doing so would lock the console session unless you break license and modify termserv). Fun fact 2, this only blocks 127.0.0.1. (side note: if you don't mind breaking license compliance on your personal pc, you can use this to remote desktop into other user accounts on the same pc for a nice separation of work spaces (or just move to linux))
  - o-__-o 7y ago
    You are not breaking the license if you pay per-seat rather than per-device. Ask me about CALs, I can tell you all about them.
    - monsieurbanana 7y ago
      Let's start with an easy question, what is CAL?
      - o-__-o 7y ago
        Client access license. For Microsoft Windows they come in per-seat and per-machine. To OPs point, they were talking about RDP. When you are licensing per-machine then (windows server) you are limited to one desktop user and two remote users (for windows desktop it’s one user at a time). When it is per-seat then you can have as many concurrent connections as you have licensed for. Per-seat is enforced by Microsoft Licensing Server
        MrStonedOne 7y ago
        I was mainly referring to personal pc uses, not corp/server users. It's still technically breaking the license to override TERMSERV.dll's protections on home/professional PCs not allowing somebody to be logged in while somebody else is already logged in. ie, a home or professional licensed pc can not support 1 user on remote desktop, and 1 user sitting down in front of it at the same time, you have to pay for a server license to get that functionality. This technical limitation is considered a DRM measure and also protected by the DMCA anti-circumvention provision. if you don't mind breaking the law, I was pointing out how you could use abuse 127.0.0.2 to connect remote desktop to localhost in other to do seperate user accounts for seperate tasks, (such as putting your job hunting activities in a seperate account so you don't get distracted by discord/chrome desktop notifications and reddit in your new tab page)
- jackewiehose 7y ago
  Yes and I think you typically want to use this whole recommended list of deny-ips. Maybe that should be the default for coturn. But running coturn in its default-config isn't a good idea anyway.
- ddrt 7y ago
  Isn’t that 127 address a bogon?

gfodor 7y ago

Yup, sorry if my phrasing implied it's a bug. It's just better defaults, and there's evidence to support the idea slack was just running the software with the old defaults.

StillBored 7y ago
But its not necessarily the defaults. The article isn't clear if the private services are on 127/8 or the TURN server has access to other things in the DMZ/VPC/whatever. I'm guessing its actually the latter as everyone is so fond of the 1:1 VM/container->service model. Meaning its likely a config problem with the denied-peer-ips the parent here links.

jerf 7y ago

You may already know this, but it's worth getting the word out. Do not just deny routing to 127.0.0.1. 127.0.0.1 is merely the conventional "localhost" address; however, ALL 127.x.x.x is "localhost". You can check this now on your local command line with "ping 127.1.2.3". (This just seems to be one of those bugs that every proxy goes through at some point, just like pretty much any attempt to write a web server that serves files off disk will have at least one directory traversal bug.)

zrm 7y ago
Also don't forget that IPv6 ::1 is localhost too.
- deleted 7y ago
  [deleted]
z3t4 7y ago
The IP protocol is full of security gotchas so you better use a higher level protocol. Spoofing, arp attacks, TCP session hijacking, etc.
MrStonedOne 7y ago
Fun fact, windows blocks remote desktoping to localhost (because doing so would lock the console session unless you break license and modify termserv). Fun fact 2, this only blocks 127.0.0.1. (side note: if you don't mind breaking license compliance on your personal pc, you can use this to remote desktop into other user accounts on the same pc for a nice separation of work spaces (or just move to linux))
- o-__-o 7y ago
  You are not breaking the license if you pay per-seat rather than per-device. Ask me about CALs, I can tell you all about them.
  - monsieurbanana 7y ago
    Let's start with an easy question, what is CAL?
    - o-__-o 7y ago
      Client access license. For Microsoft Windows they come in per-seat and per-machine. To OPs point, they were talking about RDP. When you are licensing per-machine then (windows server) you are limited to one desktop user and two remote users (for windows desktop it’s one user at a time). When it is per-seat then you can have as many concurrent connections as you have licensed for. Per-seat is enforced by Microsoft Licensing Server
      - MrStonedOne 7y ago
        I was mainly referring to personal pc uses, not corp/server users. It's still technically breaking the license to override TERMSERV.dll's protections on home/professional PCs not allowing somebody to be logged in while somebody else is already logged in. ie, a home or professional licensed pc can not support 1 user on remote desktop, and 1 user sitting down in front of it at the same time, you have to pay for a server license to get that functionality. This technical limitation is considered a DRM measure and also protected by the DMCA anti-circumvention provision. if you don't mind breaking the law, I was pointing out how you could use abuse 127.0.0.2 to connect remote desktop to localhost in other to do seperate user accounts for seperate tasks, (such as putting your job hunting activities in a seperate account so you don't get distracted by discord/chrome desktop notifications and reddit in your new tab page)
jackewiehose 7y ago
Yes and I think you typically want to use this whole recommended list of deny-ips. Maybe that should be the default for coturn. But running coturn in its default-config isn't a good idea anyway.
ddrt 7y ago
Isn’t that 127 address a bogon?