docker/4.14.0-r0

4.14.0-r0 Docker image version of 4.14.0 Coturn release.

Docker Hub | GitHub Container Registry | Quay.io

Changelog

4.14.0

New

• No more dependency on https://github.com/digitalocean/prometheus-client-c for prometheus metrics! Prometheus library has been rewritten from scratch for the use of coturn. Functionality still depends on libmicrohttpd. Prometheus support is now compiled in if libmicrohttpd is available. Still needs to be enabled to function.
• HTTPS support for prometheus client (optional)
• TLS support for redis - now compatible with managed redis (optional)
• Rate limiting "401 Unauthorized" responses - reduces reflection attacks off the coturn server. This is an experimental feature - not fully tested on production scale deployment and massive DDoS attacks. New prometheus counters should help shed some light on real life behavior and performance. The feature is off by default.

What's Changed

• validate hmackey length in sqlite_get_user_key before hex decode by @alhudz in #1948
• Add out-of-tree patch to restore deprecated OpenSSL 1.1.1 support by @eakraly in #1952
• Add optional TLS transport for Redis connections by @eakraly in #1951
• Fix relay threads override by @eakraly in #1953
• Flush prometheus hot-path counters once per second to kill lock contention by @eakraly in #1954
• fix signed-char index out-of-bounds read in base64_decode by @alhudz in #1950
• Build Prometheus exporter from vendored local sources by @eakraly in #1955
• Prom https by @eakraly in #1956
• Fix realm quota data race and warnings by @eakraly in #1958
• Add per-source rate-limiting of UDP 401 Unauthorized responses by @eakraly in #1957

Full Changelog: 4.13.1...4.14.0

4.13.1

What's in this release

Security fixes

What's Changed

• null-terminate server_name in stun_is_challenge_response_str by @alhudz in #1944
• Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks by @eakraly in #1945
• Auto-deny coturn's own database backend endpoints as relay peers by @eakraly in #1946
• Deny link-local / ULA / site-local relay peers by default by @eakraly in #1947

New Contributors

• @alhudz made their first contribution in #1944

Full Changelog: 4.13.0...4.13.1

docker/4.13.1-r0

4.13.1-r0 Docker image version of 4.13.1 Coturn release.

Docker Hub | GitHub Container Registry | Quay.io

Changelog

docker/4.13.0-r0

4.13.0-r0 Docker image version of 4.13.0 Coturn release.

Docker Hub | GitHub Container Registry | Quay.io

Changelog

4.13.0

What's in this release

• More performance improvements for --udp-recvmmsg and --multiplex-peer. If your system does not rely on TURN unique ports give multiplexing a try - it has capacity to dramatically increase performance.
• Security fixes

What's Changed

• Wrap atomic everywhere by @eakraly in #1922
• Fix sendmmsg stride bug in multiplex-peer UDP batch flush by @eakraly in #1925
• Reap TURN permissions/channels via a per-thread sweep instead of per-object timers by @eakraly in #1926
• Add --udp-sendmmsg-log to observe egress sendmmsg/UDP-GSO batching by @eakraly in #1927
• Expose recvmmsg/sendmmsg UDP batch sizes as Prometheus metrics by @eakraly in #1928
• Restrict recvmmsg fast path to shared fan-in sockets (make --udp-recvmmsg useful standalone) by @eakraly in #1929
• Enable --udp-recvmmsg by default on Linux by @eakraly in #1930
• Security hardening: port parsing, admin brute-force throttle, credential log redaction, constant-time compare, OAuth bounds checks, permission cap by @eakraly in #1932
• Adapt .gitignore to allow files already in repo (#1935) by @tbart in #1936
• Add continuous latency mode to stunclient by @eakraly in #1937
• Fix test_redis_format link failure by @eakraly in #1939
• Fix configure MANPREFIX typo by @misi in #1940
• Fix missing sqlite3 dependendcy by @misi in #1941
• Fix UDP receive buffer ownership by @eakraly in #1938

New Contributors

• @tbart made their first contribution in #1936

Full Changelog: 4.12.0...4.13.0

docker/4.12.0-r0

4.12.0-r0 Docker image version of 4.12.0 Coturn release.

Docker Hub | GitHub Container Registry | Quay.io

Changelog

4.12.0

coturn 4.12.0

This release focuses on high-throughput UDP relay performance, new multiplexed peer relay mode, improved load testing tools, and documentation cleanup.

Highlights

• Added optional --multiplex-peer mode, which uses shared per-thread IPv4/IPv6 relay sockets instead of one relay port per allocation.

  • Helps lift the usual relay port range allocation ceiling.
  • Uses exact peer IP:port demultiplexing.
  • Rejects EVEN-PORT allocations in this mode.
  • Documented in docs/multiplex-peer.md.

• Added Linux UDP fast paths:

  • --udp-recvmmsg for batched UDP receives.
  • --udp-gso for UDP-GSO relay send batching when used with multiplex-peer.
  • sendmmsg/recvmmsg improvements across relay, peer, and uclient paths.

• Improved turnutils_uclient load generation:

  • Multi-threaded listener/receive pool.
  • Sender thread pool.
  • UDP-GSO send batching.
  • recv_pps reporting.
  • --no-even-port option for clean multiplex-peer testing.

Added

• New turnserver options:

  • --multiplex-peer
  • --multiplex-peer-port
  • --udp-recvmmsg
  • --udp-recvmmsg-log
  • --udp-gso

• New turnutils_uclient options:

  • --listener-threads
  • --sender-threads
  • --no-even-port

• CI coverage for uclient thread pools, UDP-GSO, recv PPS reporting, and multiplex-peer tests.

Fixed

• Fixed TTL/TOS type conversion.
• Fixed a memory leak introduced by the recvmmsg path.
• Removed stale --ne option from turnserver --help.
• Fixed fuzzing dictionary encoding for HTTP end-of-header bytes.

Changed

• Updated bundled khash.
• Restored CodeQL permissions, category, and manual build mode.
• Updated examples and docs for CLI behavior, invalid packet handling, RFC5780 behavior, and current command-line options.

Documentation

• Added multiplex-peer design and implementation guide.
• Synced turnserver, turnutils, and man page documentation with current options.
• Added DeepWiki link to the README.

Contributors

Thanks to:

• Corey Siltala
• Gustavo Garcia
• Kai Ren
• Pavel Punsky
• nfuhler

docker/4.11.0-r0

4.11.0-r0 Docker image version of 4.11.0 Coturn release.

Docker Hub | GitHub Container Registry | Quay.io

Changelog

4.11.0

In this release

• Unit tests!
• Multiple performance improvements
• Multiple security fixes
• Increased fuzzing coverage https://introspector.oss-fuzz.com/project-profile?project=coturn
• Additional memory validation using fil-c compiler

What's Changed

• Fix prometheus response memory leak introduced in 4.10.0
• Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC by @eakraly in #1869
• Fix format-string injection in Redis DB driver by @eakraly in #1870
• Abort on malformed allowed/denied-peer-ip at startup by @eakraly in #1872
• Pin session origin only after MESSAGE-INTEGRITY validates by @eakraly in #1871
• Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux by @eakraly in #1868
• Drop udp_relay_servers_number config and clean up dead UDP id-space by @eakraly in #1874
• Add Unity-based unit test scaffolding by @eakraly in #1875
• Delete log line per relay thread on start by @eakraly in #1876
• Out of bound HTTP detection in parser by @eakraly in #1877
• Extend STUN client fuzz builder coverage by @eakraly in #1878
• Extend fuzzing coverage and enable local fuzzing in a container by @eakraly in #1881
• Cover all public stun_buffer.c wrappers in FuzzStunClient by @eakraly in #1883
• HTTP parsing fixes by @eakraly in #1882
• Unblock fuzz coverage for is_http and rare STUN attributes by @eakraly in #1884
• Seed address-mapping table in fuzz initializer by @eakraly in #1885
• Add deterministic challenge-response builder to FuzzStun by @eakraly in #1886
• Add fuzz coverage for integrity helpers by @eakraly in #1888
• Hoist turn_server_get_engine() out of per-packet hot path by @eakraly in #1889
• Inline addr_cpy() in the header by @eakraly in #1892
• Trim two redundant checks from per-packet relay hot path by @eakraly in #1890
• Inline get_ioa_addr_len() in the header by @eakraly in #1891
• Cache hot lookups in TURN data-path handlers by @eakraly in #1893
• Load generator mode in turnutils_uclient by @eakraly in #1894
• Filc harness and pointer typedefs by @eakraly in #1896

Full Changelog: 4.10.0...4.11.0