TURN username and password may not contain :.

[jwalton]

Which version are you using?

v0.23.5

Which operating system are you using?

• Linux amd64 standard

Describe the issue

The documentation states I should configure my ICE servers with something like:

webrtcICEServers: [turn:user:pass:host:port]

But, what if my user has a : in it? My username and password are being generated by a third party (using the Rest API access and a shared key) with a 24 hour expiry, so I wrote something that updates the MedixMTX config with the new credentials every 24 hours, but I'm running into trouble because MediaMTX is not going to correctly parse my username.

I can see a couple of different possible fixes for this. One would be to allowed escaped :s in the config, so we could do:

webrtcICEServers: [turn:user\:with\:colons:pass:host:port]

We can fix this in a couple of different ways. One would be to allowed escaped :s in the config, so we could do:

webrtcICEServers: [turn:user\:with\:colons:pass:host:port]

We'd have to also allow \\ to be a single backslash. This is nice because it's not a breaking change for most people (only for people with \s in their usernames or passwords). The other would be to make this a proper structure in the config file:

webrtcICEServers:
    - urls: [turn:host:port]
       username: user
       credential: pass

I'm happy to open a PR if you have a way you'd prefer this to be fixed.

Describe how to replicate the issue

Try to set webrtcICEServers: [turn:user:user:pass:example.com:3478]. When you try to play video, the browser will raise the error RTCPeerConnection constructor passed invalid RTCConfiguration - missing username.

Did you attach the server logs?

no

Did you attach a network dump?

no

[aler9]

Thanks for reporting the issue, this is fixed by #2000. Be aware that the configuration key was changed from webrtcICEServers to webrtcICEServers2 and has this new format:

# List of ICE servers.
webrtcICEServers2:
  # URL can point to a STUN, TURN or TURNS server.
  # STUN servers are used to obtain the public IP of server and clients. They are
  # needed when server and clients are on different LANs.
  # TURN/TURNS servers are needed when a direct connection between server and
  # clients is not possible. All traffic is routed through them.
- url: stun:stun.l.google.com:19302
  # if user is "AUTH_SECRET", then authentication is secret based.
  # the secret must be inserted into the password field.
  username: ''
  password: ''

Using the old configuration is still possible but doesn't allow using special characters.

[jwalton]

Thanks for the fix! :)

[aler9]

added in v0.23.7

[github-actions]

This issue is being locked automatically because it has been closed for more than 6 months.
Please open a new issue in case you encounter a similar problem.