Xirsys.XTurn.PeerFilter (xturn v2.0.0)

Validates XOR-PEER-ADDRESS for CreatePermission and ChannelBind.

What problem this solves

Clients name peer endpoints when creating permissions or binding channels. The server must reject addresses that would relay to the wrong place (wildcards, multicast, the TURN listener ports, or disallowed same-IP cases) while still allowing hairpin to other ports on the advertised server address.

Internal note

Called from TURN action handlers; returns forbidden?/3 boolean.

RFCs

RFC 8656 (pt.9 peer address restrictions)
RFC 5766 (CreatePermission, ChannelBind)

Summary

Functions

forbidden?(peer, client_ip \\ nil, active_families \\ [])

Returns whether a peer address must be rejected for permission or channel bind.

Functions

forbidden?(peer, client_ip \\ nil, active_families \\ [])

Returns whether a peer address must be rejected for permission or channel bind.

Malformed or non-tuple peers return true.

Examples

iex> Xirsys.XTurn.PeerFilter.forbidden?({{0, 0, 0, 0}, 1234})
true

iex> Xirsys.XTurn.PeerFilter.forbidden?({{224, 0, 0, 1}, 1234})
true

iex> Xirsys.XTurn.PeerFilter.forbidden?({{203, 0, 113, 50}, 50000}, {203, 0, 113, 50}, [])
true

iex> Xirsys.XTurn.PeerFilter.forbidden?({{0x2001, 0, 0, 0, 0, 0, 0, 1}, 1234}, nil, [8])
true

iex> Xirsys.XTurn.PeerFilter.forbidden?(:not_a_peer)
true