# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1646512498 0
# Node ID 53b4549c220940a9e96a7b765a81a9ee529359a4
# Parent  a9b6ed86b5731d8419f119155a7b3d7fe10d2ea9
prosodyctl: check turn: Add check for private IP returned from STUN.

diff -r a9b6ed86b573 -r 53b4549c2209 util/prosodyctl/check.lua
--- a/util/prosodyctl/check.lua	Sat Mar 05 20:34:24 2022 +0000
+++ b/util/prosodyctl/check.lua	Sat Mar 05 20:34:58 2022 +0000
@@ -63,6 +63,7 @@
 
 local function check_turn_service(turn_service, ping_service)
 	local stun = require "net.stun";
+	local ip = require "util.ip";
 
 	-- Create UDP socket for communication with the server
 	local sock = assert(require "socket".udp());
@@ -103,6 +104,9 @@
 		result.error = "STUN server did not return an address";
 		return result;
 	end
+	if ip.new_ip(result.external_ip.address).private then
+		table.insert(result.warnings, "STUN returned a private IP! Is the TURN server behind a NAT and misconfigured?");
+	end
 
 	-- Send a TURN "allocate" request. Expected to fail due to auth, but
 	-- necessary to obtain a valid realm/nonce from the server.