Merge pull request #5707 from fraenki/turnserver_140

net/turnserver: release 1.4

net/turnserver/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		turnserver
-PLUGIN_VERSION=		1.3
+PLUGIN_VERSION=		1.4
 PLUGIN_COMMENT=		The coturn STUN/TURN Server
 PLUGIN_DEPENDS=		turnserver
 PLUGIN_MAINTAINER=	[email protected]

net/turnserver/pkg-descr

@@ -6,6 +6,14 @@ WWW: https://github.com/coturn/coturn
 Plugin Changelog
 ================
 
+1.4
+
+Changed:
+* now runs without root privileges
+
+Fixed:
+* fix wrong file permissions for certs/keys and PID directory (#5704)
+
 1.3
 
 Changed:

net/turnserver/src/etc/inc/plugins.inc.d/turnserver.inc

@@ -48,7 +48,7 @@ function turnserver_services()
 
     $services[] = array(
         'description' => gettext('coturn STUN/TURN Server'),
-        'pidfile' => '/var/run/turnserver.pid',
+        'pidfile' => '/var/run/turnserver/turnserver.pid',
         'configd' => array(
             'restart' => array('turnserver restart'),
             'start' => array('turnserver start'),

net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/export_certs.php

@@ -56,6 +56,8 @@ if (isset($configObj->OPNsense->turnserver->settings->TlsCertificate) and !empty
             file_put_contents($cert_filename, $cert_content);
             file_put_contents($pkey_filename, $pkey_content);
             chmod($pkey_filename, 0600);
+            chown($pkey_filename, '_turnserver');
+            chown($cert_filename, '_turnserver');
         }
     }
 }

net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/setup.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+mkdir -p /var/run/turnserver
+chown _turnserver:_turnserver /var/run/turnserver
+
+/usr/local/opnsense/scripts/OPNsense/Turnserver/export_certs.php

net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/rc.conf.d

@@ -1,6 +1,6 @@
 {% if helpers.exists('OPNsense.turnserver.settings.Enabled') and OPNsense.turnserver.settings.Enabled|default("0") == "1" %}
 turnserver_enable="YES"
-turnserver_setup="/usr/local/opnsense/scripts/OPNsense/Turnserver/export_certs.php"
+turnserver_setup="/usr/local/opnsense/scripts/OPNsense/Turnserver/setup.sh"
 {% else %}
 turnserver_enable="NO"
 {% endif %}

net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/turnserver.conf

@@ -59,4 +59,5 @@ log-file=syslog
 no-software-attribute
 no-multicast-peers
 no-rfc5780
+pidfile="/var/run/turnserver/turnserver.pid"
 response-origin-only-with-rfc5780