Re: [webrtc-pc] Do not allow DNS candidates in "relay" mode (#2533)

>>Another way this specific issue occurs is when DNS name for the relay server is resolved
>
>That is slightly different. The remote candidate is under the attackers control, your own TURN server isn't.

It is not technically your own TURN server -- it is under the web site control, but I see what you are saying. 

I guess you can do DNS resolution of non-local FQDN candidates through the TURN server -- it should work as a forwarded UDP socket. This will even work better if geographical locality is actually desired, since your would want them to be resolved to the IP address closest to the TURN server, not the client.

-- 
GitHub Notification of comment by rshpount
Please view or discuss this issue at https://github.com/w3c/webrtc-pc/issues/2533#issuecomment-634467280 using your GitHub account

Received on Wednesday, 27 May 2020 06:56:21 UTC