feat: Add authentication to TURN (#331)

kylecarbs · web-flow · commit e140b59d7ad8 · 2021-05-04T15:32:29.000Z
diff --git a/internal/cmd/tunnel.go b/internal/cmd/tunnel.go
@@ -104,14 +104,18 @@ type tunnneler struct {
 }
 
 func (c *tunnneler) start(ctx context.Context) error {
+	username, password, err := wsnet.TURNCredentials(c.token)
+	if err != nil {
+		return xerrors.Errorf("failed to parse credentials from token")
+	}
 	server := webrtc.ICEServer{
 		URLs:           []string{wsnet.TURNEndpoint(c.brokerAddr)},
-		Username:       "insecure",
-		Credential:     "pass",
+		Username:       username,
+		Credential:     password,
 		CredentialType: webrtc.ICECredentialTypePassword,
 	}
 
-	err := wsnet.DialICE(server, nil)
+	err = wsnet.DialICE(server, nil)
 	if errors.Is(err, wsnet.ErrInvalidCredentials) {
 		return xerrors.Errorf("failed to authenticate your user for this workspace")
 	}
diff --git a/wsnet/auth.go b/wsnet/auth.go
@@ -0,0 +1,21 @@
+package wsnet
+
+import (
+	"crypto/sha256"
+	"errors"
+	"strings"
+)
+
+// TURNCredentials returns a username and password pair
+// for a Coder token.
+func TURNCredentials(token string) (username, password string, err error) {
+	str := strings.SplitN(token, "-", 2)
+	if len(str) != 2 {
+		err = errors.New("invalid token format")
+		return
+	}
+	username = str[0]
+	hash := sha256.Sum256([]byte(str[1]))
+	password = string(hash[:])
+	return
+}
