Mumble: murmur: each connection to the server is counted as a "user"

[botanegg]

Describe the bug
Each connection to the server is counted as a "user"

Steps to Reproduce

1. Go to 'Mumble server connect' choose a server to use
2. Open terminal and connect to the server by telnet e.g. telnet example.org 64738
3. See at 'Mumble server connect' window (users counter have increased)

Expected behavior
I expect something like nothing is changed in user counter (because is only TCP connection. ???it is not estabilished mumble control stream???)

• OS: I used this docker image https://github.com/goofball222/murmur/
• Version: Murmur 1.3

Upd:
It is reproducible on Murmur 1.3.1 too.

[streaps]

This looks like the easiest way to DoS a murmur server.

[botanegg]

I just tested next way:

1. Setup maximum users as 2
2. Connect via telnet two times
3. Got Server connection rejected: Server is full (max 2 users). in my Mumble client

upd:
after some retries I got Global ban :D
Ignoring connection: ***MASKED IP*** (Global ban)

[Krzmbrzl]

Is there a use-case for using a TCP-connection to the server without connecting to it? :thinking:

after some retries I got Global ban :D

That can be turned off in the server settings. It should only be a temporary ban though

[botanegg]

It is question about legit usage of TCP conection??

Currently I using https://github.com/matteocorti/check_ssl_cert for checking ssl cert outdating

For my users it seems like periodicaly 1/100 users on server, but when someone join to server, they do not see anyone online.

[Krzmbrzl]

It is question about legit usage of TCP conection??

Ah so the TCP connection doesn't have to talk to the mumble server for it to be counted as a User? Okay now I see the problem :bulb:

[Kissaki]

Yeah, user count should reflect accepted Mumble connections count. Not TCP connection count.

[botanegg]

I do not looking deep in the code, but found interesting thing
We can have a problem with this, because session ids pool also dependent on iMaxUsers

https://github.com/mumble-voip/mumble/blob/7c67ea33f47716a188da045ead2035f978fc6253/src/murmur/Server.cpp#L250-L251

https://github.com/mumble-voip/mumble/blob/7c67ea33f47716a188da045ead2035f978fc6253/src/murmur/Server.cpp#L1349-L1354