Co-authored-by: Evgeny Khramtsov <evgeny.khramtsov@ringcentral.com>
If IPv6 is not enabled during runtime, prometheus server fails to start with `EAFNOSUPPORT` because `MHD_USE_DUAL_STACK` is set unconditionally.
This PR fixes it. As a bonus, it also checks if libmicrohttpd is compiled with IPv6 support.
Fixes#1266
According to RFC 5766, [section 6.2](https://www.rfc-editor.org/rfc/rfc5766#section-6.2) point no. 5, the turn server needs to reject the request with 508 (Insufficient Capacity) error code when the given RESERVATION-TOKEN is not valid.
For our deployment, it is useful if coturn returns a valid HTTP response to an HTTP request. To do this on the same port as STUN/TURN and without enabling the admin site, I have extended `read_client_connection()` to return a canned HTTP response, in response to an HTTP request, rather than immediately closing the connection.
Fixes#1259
If `ur_string_map_put ` fails then the string that was just `strdup`-ed
will leak memory
Now the return value is checked and memory free-ed in case of failure
- srandom/random provide stronger randomness characteristics than
srand/rand in some operating systems.
- usage of srand/rand is not very consistent in coturn.
There is room for more refactoring and use apputils helper functions in
ns_turn_msg.c too but i'm not sure that dependency from "client" module
to "apps" module is a good idea yet.
Thx @0xdea
Co-authored-by: Gustavo Garcia <gustavogb@mail.com>
Add missing checks for length of realm/nonce/server_name before copying
those values to the buffer passed to stun_is_challenge_response_str.
The function stun_is_challenge_response_str is only used in uclient test
application.
Thank you very much @0xdea
Co-authored-by: Gustavo Garcia <gustavogb@mail.com>
Fixes https://github.com/coturn/coturn/issues/1239
https to web ui freeze in browser if no_tls option used, because no tls
stuff initialized.
This PR add warning about this and comment aboute this in default config
Environment:
- Windows 10
- Cygwin 2.925
make output:
```
<command-line>: note: this is the location of the previous definition
src/apps/common/ns_turn_utils.c:53:10: fatal error: sys/syscall.h: No such file or directory
53 | #include <sys/syscall.h>
| ^~~~~~~~~~~~~~~
compilation terminated.
In file included from src/client/ns_turn_ioaddr.h:34,
from src/client/ns_turn_msg.h:34,
from src/apps/common/stun_buffer.h:34,
from src/apps/common/stun_buffer.c:31:
src/ns_turn_defs.h:223: warning: "TURN_NO_SCTP" redefined
223 | #define TURN_NO_SCTP
|
<command-line>: note: this is the location of the previous definition
make: *** [Makefile:127: bin/turnutils_oauth] Error 1
```
I tested the code part by using manual and automated tools for more than
2 years.
Fixes#823
When you try to delete an alternate server in the list by using "das :" command on the CLI, the session gets stuck and can't response although alternate server is removed.
The problem appears to be related to calling del_alt_server function in the same function recursively.
Co-authored-by: CUMHUR KARAHAN <cumhur.karahan@turkcell.com.tr>
Update version number, generate authors and changelog files
Release notes (short summary of changes)
```
- Make sure microhttpd starts using epoll if supported
- Add sessioncount to prometheus metrics
- Add STUN request/response/error prometheus counters
- Cleanup logs on turnserver start
- Fix duplicate stdout log output
- Log threadId to logs to aid in multi-threaded debugging
- Optional build info compiled into turnserver binary
- Fix arguments expansion in `docker-entrypoint.sh`
- Santise database connection strings before printing to log
- Support Windows MSVC
- Add configuration option for TLS 1.3 ciphersuites
- Improve openssl3 and FIPS support
- Use single SSL_CTX for TLS and DTLS support
- Update openssl API use to non-deprecated version
- Set string bytes to null to prevent random origin
- Fix memory corruption on socket close
- Fix packet backlog fifo that processed packets in reverse order in some scenarios
- Fix off-by-one when terminating gcm_nonce
- Fixes to Redis memleaks and socketleaks
- Fix malformed response to mobility refresh request
- Fuzzing support
- Ignore raw UDP if no_udp is enabled
- Better detect availability of SCTP protocol
```
---------
Co-authored-by: tyranron <tyranron@gmail.com>
In some cases the prometheus server was started using SELECT even if
EPOLL was supported.
Some flags were changed in microhttpd and now we use MHD_VERSION to make
sure to use the right ones in all cases (support old version, for ubuntu
16.04 for ex).
This fixes the issue #1167
I also added a log to make sure we know which version is used,
especially to inform the user that the SELECT version might lead to
issues on highly used servers.
PR #855 introduced new include <ssys/sysinfo.h>
It is not required for compilation or turnserver function but breaks
OpenBSD build (which does not have this file)
This PR removes the include to restore OpenBSD build compatibility
Fixes#1162
Test Plan:
TBD - need some one to test build
This pull request is a split of PR #1061
As @KangLin pointed out in the original PR those sockets should ideally
be permanently non-blocking for performance reasons, but they are NOT at
the moment.
Someone with more knowledge about the code in dtls_listener.c should
probably have a look if it would be feasible to change the sockets to
non-blocking already at creation, similar to what is done in
udpserver.c...
There are two different API's in OpenSSL for configuring TLS ciphers,
one for TLS 1.2 and below, and another for TLS 1.3. coturn only calls
the TLS 1.2 API when handling the `--cipher-list` configuration option,
which means that it's not possible to use non-default ciphersuites with
TLS 1.3 connections.
This PR calls appropriate OpenSSL API to allow TLS 1.3 ciphersuites to be configured.
coturn running inside a docker container runs as PID 1, however PID 1
has special signal handling semantics (see the note at the bottom of the
section
[here](https://docs.docker.com/engine/reference/run/#foreground)).
coturn relies on the default behaviour of SIGTERM to terminate the
process, however as no signal handler is explicitly installed, it
doesn't respond to SIGTERM when running inside a container. This PR
fixes this problem by installing explicit signal handlers for SIGINT and
SIGTERM, which trigger the same termination mechanism as the admin
interface "halt" command.
This is a port of wireapp#6 for upstream.
This PR fixes some errata from #996 and #989:
- Some DTLS code was left over in the common path for allocating and
initialising `SSL_CTX`'s, and the DTLS-specific configuration code was
erroneously operating on the TLS context instead of the DTLS context.
- In both the TLS and DTLS codepaths, the previous refactoring inverted
the logic for the `--no-tlsv1`/`--no-tlsv1_1`/etc command line options,
so that these options would instead *enable* the respective (D)TLS
versions, instead of disabling this. This would mean that by default
coturn would only support TLS 1.3 and DTLS 1.2, and no earlier versions.
I've also regenerated the manual pages (with the `make-man.sh` script)
to match the documentation in the README files.
TURN_USERDB_TYPE enum does not need to be "dynamic" based on what
libraries actually available during the build - all potentially
supported DB options are now enumerated.
Printing (to log or http) the DB type name is done with much less code
(using a helper function `userdb_type_to_string`)
Fix memory corruption introduced by commit
c8663f4a91
If there was an unsuccessful session registration in
open_client_connection_session, it adds a timer (before it didn't).
Later during runtime, at session destruction, it removes the
client_socket in close_ioa_socket. Then the timer gets triggered and
runs the cleanup method client_to_be_allocated_timeout_handler and tries
to access the stored client_socket. This then fails as it already was
freed.
The fix just sets the client_socket pointer to null and then the timer
should detect this and not access already freed memory.
The issue affects version 4.6.0, 4.6.0-r0 and 4.6.0-r1.
Co-authored-by: Paul Kramer <paul.kramer@logmein.com>
Fix memory corruption introduced by commit
c8663f4a91
If there was an unsuccessful session registration in
open_client_connection_session, it adds a timer (before it didn't).
Later during runtime, at session destruction, it removes the
client_socket in close_ioa_socket. Then the timer gets triggered and
runs the cleanup method client_to_be_allocated_timeout_handler and tries
to access the stored client_socket. This then fails as it already was
freed.
The fix just sets the client_socket pointer to null and then the timer
should detect this and not access already freed memory.
The issue affects version 4.6.0, 4.6.0-r0 and 4.6.0-r1.
Co-authored-by: Paul Kramer <paul.kramer@logmein.com>
Reformatting and removing some duplications:
- Some lines have WARNING WARNING: cleaned up.
- Lines printed using perror: only LOG_ mechanism should be used.
- Printing IO mechanism (epoll for example) for each thread: selected
mechanism logged once
- Duplicate lines (perror and also LOG): duplication removed
- Duplicates: clean up (because calling function multiple times -
configuration load)
Example usage with make:
make CPPFLAGS="-DTURN_SERVER_BUILD_INFO=\"\\\" git: $(git rev-parse
HEAD) build: 123\\\"\""
Example usage with cmake:
cmake .. -DTURN_SERVER_BUILD_INFO="\" git: $(git rev-parse HEAD) build:
123\""
I would like to get feedback on this and see if people is confortable
with these clang rules.
Right now is using the "llvm" style increasing the line length from 80
to 120 given that coturn is using long lines often.
Co-authored-by: Pavel Punsky <eakraly@users.noreply.github.com>
Prometheus would aggregate across all labels (when not specifying)
In this scenario `turn_total_allocations` does not need separate label
"type=all" as such in this case the result would be double the actual
amount
