mirror of
https://github.com/coturn/coturn.git
synced 2026-10-24 00:08:57 +03:00
ce26268da8
## What The DTLS client listeners are no longer started by default. They come up only when `--dtls` is given. Until now DTLS came up automatically whenever usable certificates were configured, so every deployment that wanted TLS also exposed a DTLS handshake path it had never asked for. That path is the most expensive unauthenticated entry point the server has: it builds an `SSL` object, an `ioa_socket` and a session *before* the DTLS cookie is verified. Deployments that do not serve DTLS clients were paying for that surface silently. ## Compatibility `--no-dtls` keeps its meaning, including `--no-dtls=false` to ask for DTLS, so an existing configuration resolves to exactly the listeners it asked for. Both spellings now log a deprecation warning naming `--dtls`: ``` CONFIG: --no-dtls is deprecated and now redundant: DTLS listeners are not started unless --dtls is given CONFIG: --no-dtls=false is deprecated: use --dtls to start the DTLS listeners ``` **This is a behaviour change for anyone who relied on the old default.** A deployment that configured certificates and passed no DTLS flag loses its DTLS listeners on upgrade. The only signal such an operator gets is a startup line, emitted when the certificates are usable but DTLS is off: ``` DTLS listeners are not started; use --dtls to start them ``` If the project would rather have a transition release — default unchanged, but logging that it is about to change — that is a small edit to this branch; say so in review. ## How `turn_params` carries the state as `dtls` rather than the previous `no_dtls`, so the listener and netengine tests read as "DTLS is on" instead of double negatives, and `openssl_setup()`'s two-flag guards lose their De Morgan wrapper (`!(no_tls && no_dtls)` becomes `!no_tls || dtls`). The telnet CLI and web admin listings consequently report `dtls` instead of `no-dtls`, matching the flag an operator actually sets. Documentation follows in `README.md`, `README.turnserver`, the built-in help and `examples/etc/turnserver.conf`. The `--pkey` help entry had a sentence truncated mid-clause; the rewrite fixes it. ## Tests New `examples/run_tests_dtls_default.sh` pins four cases: - no flag: no DTLS context, the hint line is logged, and a `turnutils_uclient -S` session cannot complete; - `--dtls`: context created, DTLS client relays end to end; - `--no-dtls`: warns, stays off; - `--no-dtls=false`: warns, starts DTLS, client relays. It is wired into all four workflows, so this default is now covered on both Linux and macOS. Example scripts that only ever wanted DTLS off drop the now-redundant flag; the ones that drive DTLS clients pass `--dtls`. Also run green: `ctest` (18/18 macOS, 17/17 Linux) and, on both platforms where applicable, `run_tests.sh`, `run_tests_conf.sh`, `run_tests_multiplex_peer.sh`, `run_tests_stateless_nonce.sh`, `run_tests_stateless_binding.sh`, `run_tests_ratelimit_401.sh`, `run_tests_mobile.sh`, `run_tests_rfc5780.sh`, `run_tests_expiry.sh`; fuzzing smoke tests (ASan, both targets); and the packaged Debian image build plus its Bats suite (19 tests, 0 failures, 2 skipped). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
28 lines
1.2 KiB
Bash
Executable File
28 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# This is an example how to start a TURN Server in
|
|
# non-secure mode (when authentication is not used).
|
|
# We start here a TURN Server listening on IPv4 address
|
|
# 127.0.0.1 and on IPv6 address ::1. We use 127.0.0.1 as
|
|
# IPv4 relay address, and we use ::1 as IPv6 relay address.
|
|
# Other options:
|
|
# set bandwidth limit on client session 3000000 bytes per second (--max-bps)
|
|
# use fingerprints (-f)
|
|
# use 3 relay threads (-m 3)
|
|
# use min UDP relay port 32355 and max UDP relay port 65535
|
|
# --no-tls means that we are not trying to
|
|
# --no-auth means that no authentication to be used,
|
|
# allow anonymous users.
|
|
# start TLS and DTLS services.
|
|
# --cli-password=secret means that cli password set to "secret"
|
|
# Other parameters (config file name, etc) are default.
|
|
|
|
if [ -d examples ] ; then
|
|
cd examples
|
|
fi
|
|
|
|
export LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:/usr/local/lib/:/usr/local/mysql/lib/
|
|
export DYLD_LIBRARY_PATH=${DYLD_LIBRARY_PATH}:/usr/local/lib/:/usr/local/mysql/lib/
|
|
|
|
PATH="bin:../bin:../../bin:${PATH}" turnserver -v --syslog -L 127.0.0.1 -L ::1 -E 127.0.0.1 -E ::1 --allow-loopback-peers --cli-password secred --max-bps=3000000 -f -m 3 --min-port=32355 --max-port=65535 --no-tls --no-auth --db="var/db/turndb" $@
|