From 0d0a2751019ada65852ce443ff5675df7d083647 Mon Sep 17 00:00:00 2001
From: lukasIO <lukas.seiler@neesh.de>
Date: Tue, 14 Dec 2021 22:36:02 +0100
Subject: [PATCH] Turn with external tls termination (#168)

* add TURN TCP port for plain tcp listener

* use externalTLS turn config option

* remove unused TCPPort config option
---
 pkg/config/config.go | 13 ++++++------
 pkg/service/turn.go  | 47 ++++++++++++++++++++++++++++----------------
 2 files changed, 37 insertions(+), 23 deletions(-)

diff --git a/pkg/config/config.go b/pkg/config/config.go
index 35d698b10..8b0bd9d53 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -103,12 +103,13 @@ type CodecSpec struct {
 }
 
 type TURNConfig struct {
-	Enabled  bool   `yaml:"enabled"`
-	Domain   string `yaml:"domain"`
-	CertFile string `yaml:"cert_file"`
-	KeyFile  string `yaml:"key_file"`
-	TLSPort  int    `yaml:"tls_port"`
-	UDPPort  int    `yaml:"udp_port"`
+	Enabled     bool   `yaml:"enabled"`
+	Domain      string `yaml:"domain"`
+	CertFile    string `yaml:"cert_file"`
+	KeyFile     string `yaml:"key_file"`
+	TLSPort     int    `yaml:"tls_port"`
+	UDPPort     int    `yaml:"udp_port"`
+	ExternalTLS bool   `yaml:"external_tls"`
 }
 
 type WebHookConfig struct {
diff --git a/pkg/service/turn.go b/pkg/service/turn.go
index 78be106d4..30f4a52a0 100644
--- a/pkg/service/turn.go
+++ b/pkg/service/turn.go
@@ -55,26 +55,39 @@ func NewTurnServer(conf *config.Config, authHandler turn.AuthHandler) (*turn.Ser
 			return nil, errors.New("TURN domain is not correct")
 		}
 
-		cert, err := tls.LoadX509KeyPair(turnConf.CertFile, turnConf.KeyFile)
-		if err != nil {
-			return nil, errors.Wrap(err, "TURN tls cert required")
-		}
+		if !turnConf.ExternalTLS {
+			cert, err := tls.LoadX509KeyPair(turnConf.CertFile, turnConf.KeyFile)
+			if err != nil {
+				return nil, errors.Wrap(err, "TURN tls cert required")
+			}
 
-		tlsListener, err := tls.Listen("tcp4", "0.0.0.0:"+strconv.Itoa(turnConf.TLSPort),
-			&tls.Config{
-				MinVersion:   tls.VersionTLS12,
-				Certificates: []tls.Certificate{cert},
-			})
-		if err != nil {
-			return nil, errors.Wrap(err, "could not listen on TURN TCP port")
-		}
+			tlsListener, err := tls.Listen("tcp4", "0.0.0.0:"+strconv.Itoa(turnConf.TLSPort),
+				&tls.Config{
+					MinVersion:   tls.VersionTLS12,
+					Certificates: []tls.Certificate{cert},
+				})
+			if err != nil {
+				return nil, errors.Wrap(err, "could not listen on TURN TCP port")
+			}
 
-		listenerConfig := turn.ListenerConfig{
-			Listener:              tlsListener,
-			RelayAddressGenerator: relayAddrGen,
+			listenerConfig := turn.ListenerConfig{
+				Listener:              tlsListener,
+				RelayAddressGenerator: relayAddrGen,
+			}
+			serverConfig.ListenerConfigs = append(serverConfig.ListenerConfigs, listenerConfig)
+		} else {
+			tcpListener, err := net.Listen("tcp4", "0.0.0.0:"+strconv.Itoa(turnConf.TLSPort))
+			if err != nil {
+				return nil, errors.Wrap(err, "could not listen on TURN TCP port")
+			}
+
+			listenerConfig := turn.ListenerConfig{
+				Listener:              tcpListener,
+				RelayAddressGenerator: relayAddrGen,
+			}
+			serverConfig.ListenerConfigs = append(serverConfig.ListenerConfigs, listenerConfig)
 		}
-		serverConfig.ListenerConfigs = append(serverConfig.ListenerConfigs, listenerConfig)
-		logValues = append(logValues, "turn.portTLS", turnConf.TLSPort)
+		logValues = append(logValues, "turn.portTLS", turnConf.TLSPort, "turn.externalTLS", turnConf.ExternalTLS)
 	}
 
 	if turnConf.UDPPort > 0 {