mirror of
https://github.com/coturn/coturn.git
synced 2026-10-24 00:08:57 +03:00
c6cd2106b6
## What Makes `--stateless-nonce` the default, and closes two paths that created a per-packet session for unauthenticated UDP traffic even when it was enabled. ## Behaviour changes for operators 1. **The default challenge nonce goes from 16 to 24 characters.** RFC 8489 requires clients to treat NONCE as an opaque string of up to 128 characters, so compliant clients are unaffected. `--stateless-nonce=false` restores the stored random nonce and the 16-character challenge. 2. **The default signing key is ephemeral**, so a restart costs each client one `438` re-auth round-trip, as does a retry that lands on a different instance behind a load balancer. `--stateless-nonce-secret` shares the key across a fleet and avoids both. (This is not a regression — today a retry landing on another instance finds no session either — but it becomes the default story.) ## Validation Run in a container (Linux, isolated network namespace): - build clean; 17/17 unit tests - 11 example suites with zero FAIL lines: `run_tests`, `_conf`, `_stateless_nonce`, `_mobile`, `_dtls_default`, `_multiplex_peer`, `_stateless_binding`, `_ratelimit_401`, `_mobility_quota`, `_expiry`, `_mobility_resume_flood` - both fuzzing smoke targets (`ASan 0`, `ASan 1`) - `clang-format-15` clean; mandoc lint unchanged at 104 pre-existing warnings
This directory contains various example scripts for the TURN server functionality illustration. 1) peer.sh starts the "peer" application that serves as a peer for all examples. 2) "basic" directory contains set of scripts which works together to demonstrate very basic anynymous functionality of the TURN server. The "peer.sh" must be used, too. 3) "longtermsecure" directory contains set of scripts demonstrating the long-term authentication mechanism (peer.sh to be used, too). 4) "longtermsecuredb" shows how to start TURN server with database. The clients from the directory "longtermsecure" can be used with the relay scripts in the "longtermsecuredb" directory. Of course, the database (SQLite, PostgreSQL, MySQL, Redis or MongoDB) must be set for these scripts to work correctly. 5) "restapi" shows how to use TURN REST API. 6) "loadbalance" shows how to use the simple load-balancing mechanism based upon the ALTERNATE-SERVER functionality. 7) "selfloadbalance" shows how to use the "self-load-balance" TURN server capabilities. 8) "mobile" shows the "mobile" connections - how the TURN session can change its client address.