Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package coturn for openSUSE:Factory checked in at 2026-08-27 19:04:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/coturn (Old) and /work/SRC/openSUSE:Factory/.coturn.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "coturn" Thu Aug 27 19:04:29 2026 rev:30 rq:1374102 version:4.17.2 Changes: -------- --- /work/SRC/openSUSE:Factory/coturn/coturn.changes 2026-08-09 21:42:10.152234188 +0200 +++ /work/SRC/openSUSE:Factory/.coturn.new.1265/coturn.changes 2026-08-27 19:04:31.301810004 +0200 @@ -1,0 +2,17 @@ +Thu Aug 27 14:37:43 UTC 2026 - Johannes Weberhofer <[email protected]> + +- Added chaneglog for version 4.16.0 +- Improved older changelogs and added CVS/boo numbers + +- Update to version 4.17.2 + * Fix outgoing UDP TTL pinned to 1 on client-facing sockets in + gh#coturn/coturn#2045 + +- Update to version 4.17.1 + * Gate merges on the more tests suites by @eakraly + in gh#coturn/coturn#2039 + * build: Drop ginstall detection in configure by @eakraly + in gh#coturn/coturn#2038 + * Flash before socket close by @eakraly in gh#coturn/coturn#2041 + +------------------------------------------------------------------- @@ -20,0 +38 @@ + CVE-2026-73216, boo#1275000 @@ -22,0 +41 @@ + CVE-2026-73215, boo#1274999 @@ -42,0 +62,34 @@ +- Update to version 4.16.0 +Security fixes + * CVE-2026-68555, boo#1275768 + * CVE-2026-73213, boo#1274997 + * CVE-2026-73214, boo#1274998 + DTLS listener: correct the handshake buffer bound and remove the + non-functional client-cert path by @eakraly in gh#coturn/coturn#2003 + +Changes + * Restore support for hiredis < 1.1.0 (for AlmaLinux/RHEL/Rocky Linux 9) + by @robert-scheck in gh#coturn/coturn#2001 + * Add --stateless-nonce: bound memory under valid-structure STUN floods + (gh#coturn/coturn#1999) by @eakraly in gh#coturn/coturn#2002 + * Fix NULL deref: --prometheus-address/-path/-port take a required + value by @eakraly in gh#coturn/coturn#2005 + * Return 508, not 400/440, when a well-formed Allocate cannot be satisfied + by @eakraly in gh#coturn/coturn#2007 + * Narrow ChannelBind to the RFC 8656 channel range 0x4000-0x4FFF + by @eakraly in gh#coturn/coturn#2006 + * Split --stun-backward-compatibility: move RFC 3489 handling to its own + deprecated flag by @eakraly in gh#coturn/coturn#2008 + * DTLS: drop non-handshake records from unknown sources by + @eakraly in gh#coturn/coturn#2010 + * DTLS: cap concurrent half-open handshakes (pre-cookie state-exhaustion) + by @eakraly in gh#coturn/coturn#2012 + * DTLS: release idle handshake buffers on half-open sockets by + @eakraly in gh#coturn/coturn#2013 + * Declare ERROR-CODE / ADDRESS-ERROR-CODE reason phrases without padding + by @eakraly in gh#coturn/coturn#2015 + * Send: make a duplicate XOR-PEER-ADDRESS first-wins instead of last-wins + by @eakraly in gh#coturn/coturn#2016 + * multiplex-peer: bound the shared per-thread peer demux table by @eakraly + in gh#coturn/coturn#2017 + @@ -53 +106 @@ - error 420. + error 420. CVE-2026-68554, boo#1275767 @@ -57 +110 @@ - from the user that created the allocation. + from the user that created the allocation. CVE-2026-65981, boo#1273388 @@ -60 +113 @@ - instead of silently dropping them. + instead of silently dropping them. CVE-2026-62959, boo#1273238 @@ -69 +122 @@ - (gh#coturn/coturn#1964). + (gh#coturn/coturn#1964). CVE-2026-68552, boo#1275765 @@ -188,0 +242 @@ + CVE-2026-73212, boo#1274996 @@ -196,0 +251,6 @@ +Security fixes + * CVE-2026-68553, boo#1275766 + * CVE-2026-53449, boo#1271324 + * CVE-2026-53450, boo#1271325 + +Changes @@ -219,0 +280,3 @@ + + Fix for CVE-2026-53448, boo#1271323 + @@ -246,21 +309,49 @@ - * Filc harness and pointer typedefs (#1896). - * Load generator mode in turnutils_uclient (#1894). - * Cache hot lookups in TURN data-path handlers (#1893). - * Inline get_ioa_addr_len() in the header (#1891). - * Trim two redundant checks from per-packet relay hot path. - * Hoist turn_server_get_engine() out of per-packet hot path. - * Add fuzz coverage for integrity helpers (#1888). - * Add deterministic challenge-response builder to FuzzStun. - * Seed address-mapping table in fuzz initializer (#1885). - * Unblock fuzz coverage for is_http and rare STUN attributes. - * HTTP parsing fixes (#1882). - * Out of bound HTTP detection in parser (#1877). - * Delete log line per relay thread on start (#1876). - * Add Unity-based unit test scaffolding (#1875). - * Drop udp_relay_servers_number config and clean up dead UDP - id-space (#1874). - * Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux. - * Pin session origin only after MESSAGE-INTEGRITY validates. - * Abort on malformed allowed/denied-peer-ip at startup (#1872). - * Fix format-string injection in Redis DB driver (#1870). - * Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC. + + Fix for CVE-2026-43915, boo#1268547 + + * Fix prometheus response memory leak introduced in 4.10.0 + * Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC by + @eakraly in gh#coturn/coturn#1869 + * Fix format-string injection in Redis DB driver + by @eakraly in gh#coturn/coturn#1870 + * Abort on malformed allowed/denied-peer-ip at startup by + @eakraly in gh#coturn/coturn#1872 + * Pin session origin only after MESSAGE-INTEGRITY validates by + @eakraly in gh#coturn/coturn#1871 + * Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux by + @eakraly in gh#coturn/coturn#1868 + * Drop udp_relay_servers_number config and clean up dead UDP id-space by + @eakraly in gh#coturn/coturn#1874 + * Add Unity-based unit test scaffolding by @eakraly in + gh#coturn/coturn#1875 + * Delete log line per relay thread on start by @eakraly in + gh#coturn/coturn#1876 + * Out of bound HTTP detection in parser by @eakraly in + gh#coturn/coturn#1877 + * Extend STUN client fuzz builder coverage by @eakraly + in gh#coturn/coturn#1878 + * Extend fuzzing coverage and enable local fuzzing in a container by + @eakraly in gh#coturn/coturn#1881 + * Cover all public stun_buffer.c wrappers in FuzzStunClient by @eakraly + in gh#coturn/coturn#1883 + * HTTP parsing fixes by @eakraly in gh#coturn/coturn#1882 + * Unblock fuzz coverage for is_http and rare STUN attributes by @eakraly + in gh#coturn/coturn#1884 + * Seed address-mapping table in fuzz initializer by @eakraly + in gh#coturn/coturn#1885 + * Add deterministic challenge-response builder to FuzzStun by + @eakraly in gh#coturn/coturn#1886 + * Add fuzz coverage for integrity helpers by @eakraly in + gh#coturn/coturn#1888 + * Hoist turn_server_get_engine() out of per-packet hot path by + @eakraly in gh#coturn/coturn#1889 + * Inline addr_cpy() in the header by @eakraly in gh#coturn/coturn#1892 + * Trim two redundant checks from per-packet relay hot path by + @eakraly in gh#coturn/coturn#1890 + * Inline get_ioa_addr_len() in the header by @eakraly + in gh#coturn/coturn#1891 + * Cache hot lookups in TURN data-path handlers by @eakraly + in gh#coturn/coturn#1893 + * Load generator mode in turnutils_uclient by @eakraly + in gh#coturn/coturn#1894 + * Filc harness and pointer typedefs by @eakraly in gh#coturn/coturn#1896 @@ -272,14 +363,21 @@ - * Skip response buffer allocation for STUN indications. - * WebRTC Auth optimization path (#1860). - * Fix null pointer dereferences in post_parse() (#1859). - * Extend seed corpus (#1858). - * Add Linux-only `recvmmsg` receive path for DTLS/UDP listener. - * Fix Linux build warnings (#1853). - * perf: remove mutex from per-thread super_memory allocator. - * Keep only NEV_UDP_SOCKET_PER_THREAD network engine. - * Fix stack buffer overflow in OAuth token decoding. - * Update config and Readme files about deprecated TLSv1/1.1. - * perf: eliminate mutex and reduce copies on auth message - dispatch (#1843). - * perf: replace mutex_bps with lock-free atomics for bandwidth - tracking. +Security + * CVE-2026-40613 Misaligned Memory Access STUN Attribute Parser + +Performance + * Add Linux-only recvmmsg client receive path for DTLS/UDP listener + (gh#coturn/coturn#1852) + * Skip response buffer allocation for STUN indications + * Remove mutex from per-thread super_memory allocator (gh#coturn/coturn#1851) + * Eliminate mutex and reduce copies on auth message dispatch + (gh#coturn/coturn#1843) + * Replace mutex_bps with lock-free atomics for bandwidth tracking + (gh#coturn/coturn#1846) + * Remove unused mutex from ur_map structure (gh#coturn/coturn#1861) + * WebRTC Auth optimization path (gh#coturn/coturn#1860) + * Improve worst case scenario - avoid memory allocation + (gh#coturn/coturn#1823) + +Memory issues + * Fix null pointer dereferences in post_parse() (gh#coturn/coturn#1859) + * Fix stack buffer overflow in OAuth token decoding (gh#coturn/coturn#1850) + CVE-2026-43994, boo#1268548 @@ -287,13 +385,20 @@ - causes (#1844). - * fix: restore RFC 3489 (old STUN) backward compatibility broken - since 4.7.0 (#1839). - * Change port identifiers to use uint16_t (#1752). - * Fixes: run_tests.sh and no db (#1834). - * Add session usage reporting callback to TURN database driver. - * Initialize variables before use (#1832). - * Replace perror with logging (#1831). - * CLI interface is disabled by default. - * Disable reason string in response messages to reduce - amplification factor. - * Perf: improve worst case scenario optimization. - * Fix compilation warnings (#1822). + (gh#coturn/coturn#1844) + * Initialize variables before use (gh#coturn/coturn#1832) + +General Improvements + * Disable reason string in response messages to reduce amplification factor + (gh#coturn/coturn#1829) + * Keep only NEV_UDP_SOCKET_PER_THREAD network engine (gh#coturn/coturn#1849) + * Replace perror with logging (gh#coturn/coturn#1831) + * Extend seed corpus (gh#coturn/coturn#1858) and add more fuzzing scenarios + (gh#coturn/coturn#1857) + * Update config and Readme files about deprecated TLSv1/1.1 + (gh#coturn/coturn#1848) + * Restore RFC 3489 (old STUN) backward compatibility broken since 4.7.0 + (gh#coturn/coturn#1839) + * Change port identifiers to use uint16_t (gh#coturn/coturn#1752) + * Fixes: run_tests.sh and no db (gh#coturn/coturn#1834) + * Improve PostgreSQL.md Clarity (gh#coturn/coturn#1833) + * Add session usage reporting callback to TURN database driver + (gh#coturn/coturn#1794) + * CLI interface is disabled by default (gh#coturn/coturn#1830 Old: ---- coturn-4.17.0.tar.gz New: ---- coturn-4.17.2.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ coturn.spec ++++++ --- /var/tmp/diff_new_pack.jRQvbs/_old 2026-08-27 19:04:32.255844572 +0200 +++ /var/tmp/diff_new_pack.jRQvbs/_new 2026-08-27 19:04:32.257844644 +0200 @@ -24,7 +24,7 @@ %endif %bcond_without apparmor Name: coturn -Version: 4.17.0 +Version: 4.17.2 Release: 0 Summary: TURN and STUN server for VoIP License: BSD-3-Clause ++++++ coturn-4.17.0.tar.gz -> coturn-4.17.2.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/.github/workflows/actions/ubuntu-build-deps/action.yml new/coturn-4.17.2/.github/workflows/actions/ubuntu-build-deps/action.yml --- old/coturn-4.17.0/.github/workflows/actions/ubuntu-build-deps/action.yml 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/.github/workflows/actions/ubuntu-build-deps/action.yml 2026-08-08 23:56:48.000000000 +0200 @@ -38,6 +38,7 @@ iwyu \ ninja-build \ pkgconf \ + python3 \ wget if [ "$(lsb_release -s -r)x" == "16.04x" ]; then apt install -y clang-tools; fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/.github/workflows/cifuzz.yml new/coturn-4.17.2/.github/workflows/cifuzz.yml --- old/coturn-4.17.0/.github/workflows/cifuzz.yml 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/.github/workflows/cifuzz.yml 2026-08-08 23:56:48.000000000 +0200 @@ -47,7 +47,7 @@ if: ${{ failure() && steps.build.outcome == 'success' }} - name: upload sarif - uses: github/codeql-action/[email protected] + uses: github/codeql-action/[email protected] with: sarif_file: cifuzz-sarif/results.sarif if: ${{ always() && steps.build.outcome == 'success' }} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/.github/workflows/codeql.yml new/coturn-4.17.2/.github/workflows/codeql.yml --- old/coturn-4.17.0/.github/workflows/codeql.yml 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/.github/workflows/codeql.yml 2026-08-08 23:56:48.000000000 +0200 @@ -32,7 +32,7 @@ SUDO: true - name: Initialize CodeQL - uses: github/codeql-action/[email protected] + uses: github/codeql-action/[email protected] with: languages: c-cpp build-mode: manual @@ -43,6 +43,6 @@ run: cmake --build ${{github.workspace}}/build --config ${{env.BUILD_TYPE}} --parallel - name: Perform CodeQL Analysis - uses: github/codeql-action/[email protected] + uses: github/codeql-action/[email protected] with: category: "/language:c-cpp" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/.github/workflows/linux.yml new/coturn-4.17.2/.github/workflows/linux.yml --- old/coturn-4.17.0/.github/workflows/linux.yml 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/.github/workflows/linux.yml 2026-08-08 23:56:48.000000000 +0200 @@ -74,3 +74,22 @@ - run: ./run_tests_prom.sh working-directory: examples/ if: ${{ contains(matrix.os, 'ubuntu') }} + + # Regression cover for shipped security fixes. These drive raw STUN over + # python3, so a missing interpreter must not silently skip them here. + - run: ./run_tests_mobility_quota.sh + working-directory: examples/ + - run: ./run_tests_mobility_resume_flood.sh + working-directory: examples/ + - run: ./run_tests_stateless_binding.sh + working-directory: examples/ + - run: ./run_tests_stateless_nonce.sh + working-directory: examples/ + + - run: ./run_tests_expiry.sh + working-directory: examples/ + # Needs a second bindable loopback address, which is native on Linux. + - run: ./run_tests_rfc5780.sh + working-directory: examples/ + - run: ./run_tests_multiplex_peer.sh + working-directory: examples/ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/.github/workflows/macos.yml new/coturn-4.17.2/.github/workflows/macos.yml --- old/coturn-4.17.0/.github/workflows/macos.yml 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/.github/workflows/macos.yml 2026-08-08 23:56:48.000000000 +0200 @@ -51,6 +51,19 @@ - run: ./run_tests_dtls_default.sh working-directory: examples/ + # run_tests_rfc5780.sh and run_tests_multiplex_peer.sh are deliberately + # absent: the first needs a 127.0.0.2 alias macOS does not configure by + # default and would only SKIP, the second exercises Linux-only paths. + # Both run in the Linux workflow. + - run: ./run_tests_mobility_quota.sh + working-directory: examples/ + - run: ./run_tests_mobility_resume_flood.sh + working-directory: examples/ + - run: ./run_tests_stateless_binding.sh + working-directory: examples/ + - run: ./run_tests_stateless_nonce.sh + working-directory: examples/ + build-cmake: name: build + test cmake strategy: @@ -87,3 +100,16 @@ working-directory: examples/ - run: ./run_tests_dtls_default.sh working-directory: examples/ + + # run_tests_rfc5780.sh and run_tests_multiplex_peer.sh are deliberately + # absent: the first needs a 127.0.0.2 alias macOS does not configure by + # default and would only SKIP, the second exercises Linux-only paths. + # Both run in the Linux workflow. + - run: ./run_tests_mobility_quota.sh + working-directory: examples/ + - run: ./run_tests_mobility_resume_flood.sh + working-directory: examples/ + - run: ./run_tests_stateless_binding.sh + working-directory: examples/ + - run: ./run_tests_stateless_nonce.sh + working-directory: examples/ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/.github/workflows/msvc.yml new/coturn-4.17.2/.github/workflows/msvc.yml --- old/coturn-4.17.0/.github/workflows/msvc.yml 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/.github/workflows/msvc.yml 2026-08-08 23:56:48.000000000 +0200 @@ -76,7 +76,7 @@ # Upload SARIF file to GitHub Code Scanning Alerts - name: Upload SARIF to GitHub - uses: github/codeql-action/[email protected] + uses: github/codeql-action/[email protected] with: sarif_file: ${{ steps.run-analysis.outputs.sarif }} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/CMakeLists.txt new/coturn-4.17.2/CMakeLists.txt --- old/coturn-4.17.0/CMakeLists.txt 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/CMakeLists.txt 2026-08-08 23:56:48.000000000 +0200 @@ -41,7 +41,7 @@ set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${CMAKE_SOURCE_DIR}/cmake) # TODO: Modify this when the version is released -SET(BUILD_VERSION "4.17.0") +SET(BUILD_VERSION "4.17.2") # Find Git Version Patch IF(EXISTS "${CMAKE_SOURCE_DIR}/.git") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/ChangeLog new/coturn-4.17.2/ChangeLog --- old/coturn-4.17.0/ChangeLog 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/ChangeLog 2026-08-08 23:56:48.000000000 +0200 @@ -1,3 +1,25 @@ +Release 4.17.2 + +Changelist: +- Fix outgoing UDP TTL pinned to 1 on client-facing sockets (#2045) (Pavel Punsky <[email protected]>) + +Contributors: +- Pavel Punsky <[email protected]> + +Release 4.17.1 + +Changelist: +- Flash before socket close (#2041) (Pavel Punsky <[email protected]>) +- build: Drop ginstall detection in configure (#2038) (Pavel Punsky <[email protected]>) +- Gate merges on the more tests suites (#2039) (Pavel Punsky <[email protected]>) +- docker: Fix test for image version (Kai Ren <[email protected]>) +- docker: Upgrade Coturn to 4.17.0 version (Kai Ren <[email protected]>) + +Contributors: +- Kai Ren <[email protected]> +- Pavel Punsky <[email protected]> +- dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> + Release 4.17.0 Changelist: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/configure new/coturn-4.17.2/configure --- old/coturn-4.17.0/configure 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/configure 2026-08-08 23:56:48.000000000 +0200 @@ -450,36 +450,26 @@ # Install shell commands ########################### -type ginstall 2>>/dev/null +# install(1) dates from 4.2BSD and takes explicit modes, so non-executable +# files (man pages, docs, schemas) do not inherit the 0755 default. +type install 2>>/dev/null ER=$? if [ ${ER} -eq 0 ] ; then - INSTALL_PROGRAM="ginstall" - INSTALL_MAN="ginstall" - INSTALL_SCRIPT="ginstall" - INSTALL_SHARED_LIB="ginstall" - INSTALL_STATIC_LIB="ginstall" - INSTALL_DATA="ginstall" - MKDIR="ginstall -d" + INSTALL_PROGRAM="install -p" + INSTALL_MAN="install -p -m 0644" + INSTALL_SCRIPT="install -p" + INSTALL_SHARED_LIB="install -p" + INSTALL_STATIC_LIB="install -p" + INSTALL_DATA="install -p -m 0644" + MKDIR="install -d" else - type install 2>>/dev/null - ER=$? - if [ ${ER} -eq 0 ] ; then - INSTALL_PROGRAM="install -p" - INSTALL_MAN="install -p -m 0644" - INSTALL_SCRIPT="install -p" - INSTALL_SHARED_LIB="install -p" - INSTALL_STATIC_LIB="install -p" - INSTALL_DATA="install -p -m 0644" - MKDIR="install -d" - else - INSTALL_PROGRAM="cp -pf" - INSTALL_MAN="cp -pf" - INSTALL_SCRIPT="cp -pf" - INSTALL_SHARED_LIB="cp -pf" - INSTALL_STATIC_LIB="cp -pf" - INSTALL_DATA="cp -pf" - MKDIR="mkdir -p" - fi + INSTALL_PROGRAM="cp -pf" + INSTALL_MAN="cp -pf" + INSTALL_SCRIPT="cp -pf" + INSTALL_SHARED_LIB="cp -pf" + INSTALL_STATIC_LIB="cp -pf" + INSTALL_DATA="cp -pf" + MKDIR="mkdir -p" fi type pkill 2>>/dev/null diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/docker/coturn/CHANGELOG.md new/coturn-4.17.2/docker/coturn/CHANGELOG.md --- old/coturn-4.17.0/docker/coturn/CHANGELOG.md 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/docker/coturn/CHANGELOG.md 2026-08-08 23:56:48.000000000 +0200 @@ -4,6 +4,20 @@ +## [4.17.0-r0] · 2026-08-05 +[4.17.0-r0]: /../../tree/docker/4.17.0-r0 + +### Upgraded + +- [Coturn] 4.17.0: <https://github.com/coturn/coturn/blob/4.17.0/ChangeLog> + +### Security updated + +- [Debian Linux] "trixie" 20260803 (13.6): <https://github.com/docker-library/official-images/commit/ee0c246fb4f97d25b6cab5455f65da034921bc65> + + + + ## [4.16.0-r0] · 2026-07-30 [4.16.0-r0]: /../../tree/docker/4.16.0-r0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/docker/coturn/Makefile new/coturn-4.17.2/docker/coturn/Makefile --- old/coturn-4.17.0/docker/coturn/Makefile 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/docker/coturn/Makefile 2026-08-08 23:56:48.000000000 +0200 @@ -24,7 +24,7 @@ # Project parameters # ###################### -COTURN_VER ?= 4.16.0 +COTURN_VER ?= 4.17.0 COTURN_MIN_VER = $(strip $(shell echo $(COTURN_VER) | cut -d '.' -f1,2)) COTURN_MAJ_VER = $(strip $(shell echo $(COTURN_VER) | cut -d '.' -f1)) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/docker/coturn/README.md new/coturn-4.17.2/docker/coturn/README.md --- old/coturn-4.17.0/docker/coturn/README.md 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/docker/coturn/README.md 2026-08-08 23:56:48.000000000 +0200 @@ -15,8 +15,8 @@ ## Supported tags and respective `Dockerfile` links -- [`4.16.0-r0`, `4.16.0-r0-debian`, `4.16.0`, `4.16.0-debian`, `4.16.0-trixie`, `4.16`, `4.16-debian`, `4.16-trixie`, `4`, `4-debian`, `4-trixie`, `debian`, `trixie`, `latest`][d1] -- [`4.16.0-r0-alpine`, `4.16.0-alpine`, `4.16.0-alpine3.24`, `4.16-alpine`, `4.16-alpine3.24`, `4-alpine`, `4-alpine3.24`, `alpine`, `alpine3.24`][d2] +- [`4.17.0-r0`, `4.17.0-r0-debian`, `4.17.0`, `4.17.0-debian`, `4.17.0-trixie`, `4.17`, `4.17-debian`, `4.17-trixie`, `4`, `4-debian`, `4-trixie`, `debian`, `trixie`, `latest`][d1] +- [`4.17.0-r0-alpine`, `4.17.0-alpine`, `4.17.0-alpine3.24`, `4.17-alpine`, `4.17-alpine3.24`, `4-alpine`, `4-alpine3.24`, `alpine`, `alpine3.24`][d2] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/docker/coturn/tests/main.bats new/coturn-4.17.2/docker/coturn/tests/main.bats --- old/coturn-4.17.0/docker/coturn/tests/main.bats 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/docker/coturn/tests/main.bats 2026-08-08 23:56:48.000000000 +0200 @@ -42,7 +42,7 @@ run docker run --rm --pull never --platform $PLATFORM \ --entrypoint sh $IMAGE -c \ "turnserver -o --log-file=stdout | grep -m 1 'Version Coturn' \ - | cut -d ' ' -f6 \ + | cut -d ' ' -f5 \ | cut -d '-' -f2" [ "$status" -eq 0 ] [ ! "$output" = '' ] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/examples/run_tests_conf.sh new/coturn-4.17.2/examples/run_tests_conf.sh --- old/coturn-4.17.0/examples/run_tests_conf.sh 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/examples/run_tests_conf.sh 2026-08-08 23:56:48.000000000 +0200 @@ -34,13 +34,13 @@ echo "dtls" >> $BINDIR/turnserver.conf echo "cert=../examples/ca/turn_server_cert.pem" >> $BINDIR/turnserver.conf echo "pkey=../examples/ca/turn_server_pkey.pem" >> $BINDIR/turnserver.conf +# Force log output to stdout (which we redirect to $TURNSERVER_LOG below). +# Without this, turnserver writes to its platform-default location +# (syslog or /var/log/turn_*.log) and our log file stays empty, which +# breaks wait_for_turnserver's "Total relay threads:" probe and leaves +# the FAIL diagnostics useless. +echo "log-file=stdout" >> $BINDIR/turnserver.conf if [ $IS_DARWIN -eq 0 ]; then - # Force log output to stdout (which we redirect to $TURNSERVER_LOG below). - # Without this, turnserver writes to its platform-default location - # (syslog or /var/log/turn_*.log) and our log file stays empty, which - # breaks wait_for_turnserver's "Total relay threads:" probe and leaves - # the FAIL diagnostics useless. - echo "log-file=stdout" >> $BINDIR/turnserver.conf # Server-side fast paths: enable on Linux so the conf-driven test # cycle also exercises the recvmmsg drain path. The udp-gso path # lives behind multiplex-peer (that mode is what enables sendmmsg @@ -54,11 +54,11 @@ fi echo 'Running turnserver' -if [ $IS_DARWIN -eq 1 ]; then - $BINDIR/turnserver -c $BINDIR/turnserver.conf > /dev/null & -else - $BINDIR/turnserver -c $BINDIR/turnserver.conf > "$TURNSERVER_LOG" 2>&1 & -fi +# Both platforms capture the log: macOS used to launch with >/dev/null and a +# fixed sleep, which raced uclient against a still-initializing server on hosts +# with many local addresses (relay init runs per address). Same shape as +# run_tests.sh. +$BINDIR/turnserver -c $BINDIR/turnserver.conf > "$TURNSERVER_LOG" 2>&1 & turnserver_pid="$!" echo 'Running peer client' if [ $IS_DARWIN -eq 1 ]; then @@ -97,15 +97,11 @@ tail -30 "$TURNSERVER_LOG" 2>/dev/null || echo "(log file missing)" return 1 } -if [ $IS_DARWIN -eq 1 ]; then - sleep 5 -else - wait_for_turnserver || exit 1 - # No-barrier builds can log readiness before all worker event loops have - # had a scheduling turn. Keep the old startup cushion after the active - # per-process readiness check. - sleep 2 -fi +wait_for_turnserver || exit 1 +# No-barrier builds can log readiness before all worker event loops have +# had a scheduling turn. Keep the old startup cushion after the active +# per-process readiness check. +sleep 2 # See run_tests.sh for rationale — same shape, mirrored here so the # conf-driven test produces the same actionable failure output. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/src/apps/relay/ns_ioalib_engine_impl.c new/coturn-4.17.2/src/apps/relay/ns_ioalib_engine_impl.c --- old/coturn-4.17.0/src/apps/relay/ns_ioalib_engine_impl.c 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/src/apps/relay/ns_ioalib_engine_impl.c 2026-08-08 23:56:48.000000000 +0200 @@ -173,6 +173,8 @@ static void close_socket_net_data(ioa_socket_handle s); +static void udp_sendmmsg_flush_before_socket_invalidation(ioa_socket_handle s); + #if defined(__linux__) static int ensure_engine_recvmmsg_state(ioa_engine_handle e); static int socket_udp_read_batch_recvmmsg(ioa_socket_handle s, int *last_len); @@ -2006,6 +2008,13 @@ if (parent_s) { add_socket_to_parent(parent_s, ret); + /* This socket shares the parent's fd, so IP_TTL/TOS is the same kernel-level + * socket option: inherit the parent's known state instead of leaving these + * zero-initialized, which floors every outgoing TTL to 1 (see set_socket_ttl). */ + ret->default_ttl = parent_s->default_ttl; + ret->current_ttl = parent_s->current_ttl; + ret->default_tos = parent_s->default_tos; + ret->current_tos = parent_s->current_tos; } else { set_socket_options(ret); } @@ -2134,6 +2143,11 @@ return; } + /* Drain the thread-local sendmmsg/GSO batch while this socket and its + * descriptor are still valid: a deferred flush would otherwise dereference + * freed memory or write to a closed (possibly reused) fd. */ + udp_sendmmsg_flush_before_socket_invalidation(s); + s->done = 1; /* Release the DTLS half-open slot if this socket's handshake never finished @@ -2203,6 +2217,10 @@ return ret; } + /* Detaching clears s->fd and s->parent_s, so any queued datagram would be + * flushed to a descriptor this socket no longer owns. */ + udp_sendmmsg_flush_before_socket_invalidation(s); + s->tobeclosed = 1; if (s->parent_s) { @@ -4131,6 +4149,30 @@ udp_sendmmsg_flush(); } } + +static void udp_sendmmsg_flush_before_socket_invalidation(ioa_socket_handle s) { + udp_sendmmsg_batch_state *state = &udp_sendmmsg_batch; + + if (state->count == 0) { + return; + } + + /* sendmmsg()/GSO write to the cached fd, so a socket can invalidate the batch + * without owning any entry: child sockets queue under their parent's fd. */ + if (state->fd == udp_send_fd(s)) { + udp_sendmmsg_flush(); + return; + } + + /* A detached socket no longer resolves to the batch fd, but its queued + * entries still point at it. */ + for (unsigned int i = 0; i < state->count; ++i) { + if (state->entries[i].s == s) { + udp_sendmmsg_flush(); + return; + } + } +} #else void udp_sendmmsg_batch_begin(void) {} @@ -4153,6 +4195,8 @@ UNUSED_ARG(ttl); UNUSED_ARG(tos); } + +static void udp_sendmmsg_flush_before_socket_invalidation(ioa_socket_handle s) { UNUSED_ARG(s); } #endif int udp_send(ioa_socket_handle s, const ioa_addr *dest_addr, const char *buffer, int len) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/coturn-4.17.0/src/ns_turn_defs.h new/coturn-4.17.2/src/ns_turn_defs.h --- old/coturn-4.17.0/src/ns_turn_defs.h 2026-08-05 06:11:45.000000000 +0200 +++ new/coturn-4.17.2/src/ns_turn_defs.h 2026-08-08 23:56:48.000000000 +0200 @@ -35,7 +35,7 @@ #ifndef __IOADEFS__ #define __IOADEFS__ -#define TURN_SERVER_VERSION "4.17.0" +#define TURN_SERVER_VERSION "4.17.2" #define TURN_SERVER_VERSION_NAME "Gorst" #ifndef TURN_SERVER_BUILD_INFO #define TURN_SERVER_BUILD_INFO ""
