From cf5cd38cf9ff27855bd7fb104ba1897cd58cf760 Mon Sep 17 00:00:00 2001
From: "Kai P." <48416618+poeggi@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:55:05 +0300
Subject: [PATCH] webrtc: fix deprecated webrtcICEServers parser for IPv6
 hosts; (#5932)

strings.Split produces wrong part count when the host contains colons
(IPv6). SplitN(s, ";", 4) keeps the hostport token intact.

---------

Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
---
 internal/conf/conf.go      |  7 ++++---
 internal/conf/conf_test.go | 15 +++++++++++++++
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/internal/conf/conf.go b/internal/conf/conf.go
index 291cebdc..a6a8787b 100644
--- a/internal/conf/conf.go
+++ b/internal/conf/conf.go
@@ -986,10 +986,11 @@ func (conf *Conf) Validate(l logger.Writer) error {
 			"and has been replaced with 'webrtcICEServers2'")
 
 		for _, server := range *conf.WebRTCICEServers {
-			parts := strings.Split(server, ":")
-			if len(parts) == 5 {
+			// old format: scheme:username:password:hostport; SplitN avoids splitting IPv6 colons
+			parts := strings.SplitN(server, ":", 4)
+			if len(parts) == 4 {
 				conf.WebRTCICEServers2 = append(conf.WebRTCICEServers2, WebRTCICEServer{
-					URL:      parts[0] + ":" + parts[3] + ":" + parts[4],
+					URL:      parts[0] + ":" + parts[3],
 					Username: parts[1],
 					Password: parts[2],
 				})
diff --git a/internal/conf/conf_test.go b/internal/conf/conf_test.go
index 3232cc35..c638a04a 100644
--- a/internal/conf/conf_test.go
+++ b/internal/conf/conf_test.go
@@ -343,6 +343,21 @@ func TestConfDeprecatedAuth(t *testing.T) {
 	}, conf.AuthInternalUsers)
 }
 
+func TestConfDeprecatedWebRTCICEServersIPv6(t *testing.T) {
+	tmpf := createTempFile(t, []byte(
+		"webrtcICEServers:\n"+
+			"- \"turn:myuser:mypass:[2001:db8::1]:3478?transport=tcp\"\n"))
+
+	conf, _, err := Load(tmpf, nil, nil)
+	require.NoError(t, err)
+
+	require.Equal(t, []WebRTCICEServer{{
+		URL:      "turn:[2001:db8::1]:3478?transport=tcp",
+		Username: "myuser",
+		Password: "mypass",
+	}}, conf.WebRTCICEServers2)
+}
+
 func TestConfErrors(t *testing.T) {
 	for _, ca := range []struct {
 		name string