| AArch64 | |
| ppc64le | |
| s390x | |
| x86-64 |
- Update to version 4.14.0
New
* No more dependency on prometheus-client-c
* HTTPS support for prometheus client (optional)
* TLS support for redis - now compatible with managed redis
(optional).
* Rate limiting "401 Unauthorized" responses - reduces
reflection attacks off the coturn server. This is an
experimental feature - not fully tested on production scale
deployment and massive DDoS attacks. New prometheus counters
should help shed some light on real life behavior and
performance. The feature is off by default.
What's Changed
* validate hmackey length in sqlite_get_user_key before hex
decode.
* Add out-of-tree patch to restore deprecated OpenSSL 1.1.1.
* Add optional TLS transport for Redis connections.
* Fix relay threads override.
* Flush prometheus hot-path counters once per second to kill
lock contention.
* fix signed-char index out-of-bounds read in base64_decode.
* Build Prometheus exporter from vendored local sources.
* Prom https.
* Fix realm quota data race and warnings.
* Add per-source rate-limiting of UDP 401 Unauthorized responses
- Update to version 4.13.1
* null-terminate server_name in stun_is_challenge_response_str.
* Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks.
* Auto-deny coturn's own database backend endpoints as relay
peers.
* Deny link-local / ULA / site-local relay peers by default.
- Update to version 4.13.0
* Wrap atomic everywhere.
* Fix sendmmsg stride bug in multiplex-peer UDP batch flush.
* Reap TURN permissions/channels via a per-thread sweep instead
of per-object timers.
* Add --udp-sendmmsg-log to observe egress sendmmsg/UDP-GSO
batching.
* Expose recvmmsg/sendmmsg UDP batch sizes as Prometheus metrics
* Restrict recvmmsg fast path to shared fan-in sockets
(make --udp-recvmmsg useful standalone).
* Enable --udp-recvmmsg by default on Linux.
* Security hardening: port parsing, admin brute-force throttle,
credential log redaction, constant-time compare, OAuth bounds
checks, permission cap (#1932).
* Add continuous latency mode to stunclient.
* Fix test_redis_format link failure.
* Fix configure MANPREFIX typo.
* Fix missing sqlite3 dependendcy.
* Fix UDP receive buffer ownership.
- Update to version 4.12.0
* Update khash to the latest version (#1919).
* Update readme to match latest changes (#1920).
* Update docs for drop-invalid-packets and
response-origin-only-with-rfc5780.
* Multiplexpeer (#1916).
* Fix TTL/TOS type conversion (#1915).
* turnutils_uclient: sender thread pool + UDP-GSO send batching +
recv_pps reporting (#1913).
* Fix memory leak introduced by recvmmsg path (#1912).
* turnutils_uclient: multi-threaded listener (recv) pool.
* examples/turnserver.conf: update description of cli option.
* turnutils_uclient: Linux recvmmsg receive path + larger
SO_RCVBUF (#1910).
* Add UDP-GSO send path (--udp-gso) (#1907).
* turnutils_peer: Linux fast path with drain loop,
recvmmsg/sendmmsg, U… (#1908).
* Relay recvmmsg (#1906).
* fuzzing: use hex escapes for HTTP EOH dictionary entry.
* Sync turnserver man page with current CLI options (#1903).
* Remove stale --ne option from turnserver --help (#1904).
* Restore CodeQL permissions, category, and manual build mode.
- Update to version 4.11.0
* Filc harness and pointer typedefs (#1896).
* Load generator mode in turnutils_uclient (#1894).
* Cache hot lookups in TURN data-path handlers (#1893).
* Inline get_ioa_addr_len() in the header (#1891).
* Trim two redundant checks from per-packet relay hot path.
* Hoist turn_server_get_engine() out of per-packet hot path.
* Add fuzz coverage for integrity helpers (#1888).
* Add deterministic challenge-response builder to FuzzStun.
* Seed address-mapping table in fuzz initializer (#1885).
* Unblock fuzz coverage for is_http and rare STUN attributes.
* HTTP parsing fixes (#1882).
* Out of bound HTTP detection in parser (#1877).
* Delete log line per relay thread on start (#1876).
* Add Unity-based unit test scaffolding (#1875).
* Drop udp_relay_servers_number config and clean up dead UDP
id-space (#1874).
* Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux.
* Pin session origin only after MESSAGE-INTEGRITY validates.
* Abort on malformed allowed/denied-peer-ip at startup (#1872).
* Fix format-string injection in Redis DB driver (#1870).
* Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC.
- Update to version 4.10.0
* Skip response buffer allocation for STUN indications.
* WebRTC Auth optimization path (#1860).
* Fix null pointer dereferences in post_parse() (#1859).
* Extend seed corpus (#1858).
* Add Linux-only `recvmmsg` receive path for DTLS/UDP listener.
* Fix Linux build warnings (#1853).
* perf: remove mutex from per-thread super_memory allocator.
* Keep only NEV_UDP_SOCKET_PER_THREAD network engine.
* Fix stack buffer overflow in OAuth token decoding.
* Update config and Readme files about deprecated TLSv1/1.1.
* perf: eliminate mutex and reduce copies on auth message
dispatch (#1843).
* perf: replace mutex_bps with lock-free atomics for bandwidth
tracking.
* Fix uint16_t truncation overflow in stun_get_message_len_str()
causes (#1844).
* fix: restore RFC 3489 (old STUN) backward compatibility broken
since 4.7.0 (#1839).
* Change port identifiers to use uint16_t (#1752).
* Fixes: run_tests.sh and no db (#1834).
* Add session usage reporting callback to TURN database driver.
* Initialize variables before use (#1832).
* Replace perror with logging (#1831).
* CLI interface is disabled by default.
* Disable reason string in response messages to reduce
amplification factor.
* Perf: improve worst case scenario optimization.
* Fix compilation warnings (#1822).
- Drop @privileged SystemCallFilter, can prevent service from starting (status=31/SYS)
- Dropped harden_coturn.service.patch because systemd units are created from own source anyway and are proven to work
- Drop ProtectClock hardening, can cause issues if other device acceess is needed
- Added hardening to systemd service(s). Added patch(es): * harden_coturn.service.patch Modified: * coturn.service * coturn@.service
- Version 4.5.2
* Fix for CVE-2020-26262 (boo#1180764)
- Fix ipv6 ::1 loopback check
- Not allow allocate peer address 0.0.0.0/8 and ::/128
- For more details see the github security advisory:
https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p
* fix null pointer dereference in case of out of memory.
* Fix: Null pointer dereference on tcp_client_input_handler_rfc6062data function
* Fix: use-after-free vulnerability on write_to_peerchannel function
* Fix: use-after-free vulnerability on write_client_connection function
* add prometheus metrics
* Delete trailing whitespace in example configuration files
* Add architecture ppc64le to travis build
* Fix misleading option in doc (prometheus)
* Allow RFC6062 TCP relay data to look like TLS
* Add support for proxy protocol V1
* Print full date and time in logs
* Add new options: "new-log-timestamp" and "new-log-timestamp-format"
* Do not use FIPS and remove hardcode OPENSSL_VERSION_NUMBER with LibreSSL
* Add ACME redirect url
* support of --acme-redirect <URL>
* fix acme security, redundancy, consistency
* Add new --log-binding option to enable binding request logging
* Fix stale-nonce documentation
* Version number is changed to semver 2.0
* pkg-config, and various cleanups in configure file
* Add systemd notification for better systemd integration
* Fix c++ support
* Remove session id/allocation labels
* Remove per session metrics. We should later add more counters.
- AppArmor profile has ABI 3.0 and some minor changes - Modified systemd unit: * do not use daemon mode * Type=simple * added security settings - added multi-instance systemd unit
- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)
- Version 4.5.1.3:
* Remove reference to SSLv3: gh#coturn/coturn#566
* Ignore MD5 for BoringSSL: gh#coturn/coturn#579
* STUN response buffer not initialized properly; he issue found and
reported gh#coturn/coturn#583 by Felix Dörre all credits belongs to
him. CVE-2020-4067, boo#1173510
- Let coturn allow binding to ports below 1024 per default
- Extended Readme.SUSE with description on how to bind to ports below 1024
- Fixes and enhancements in service-file
- /etc/sysconfig/coturn defaults now to not show software's version to the public
- Version 4.5.1.2:
* Do not display empty CLI passwd alert if CLI is not enabled
* Removed several functions: gh#coturn/coturn#359
* Fix webadmin IP permission and possible SQL-injections: gh#coturn/coturn#386
* Fix Mongo driver crash on invalid connection string: gh#coturn/coturn#390
* enhanced fread return length check: gh#coturn/coturn#392
* disconnect database gracefully: #367
* Using SSL_get_version method for BoringSSL compatibility:
turn_session_info->tls_method returns real TLS version:
gh#coturn/coturn#382
* Added systemd service example: gh#coturn/coturn#276
* Add bandwidth usage reporting packet/bandwidth usage by peers:
gh#coturn/coturn#284
* Modifying configure to enable compile with private libraries:
gh#coturn/coturn#381
* Append to log files rather than overriding them: gh#coturn/coturn#417
* Updated incorrect string length check for 'ssh': gh#coturn/coturn#442
* Fix Dockerfile for latest Debian: gh#coturn/coturn#449
* CVE-2020-6061, CVE-2020-6062: specially crafted HTTP POST request can lead
to heap overflow which can result in information leak:
gh#coturn/coturn#489
* STUN input validation: gh#coturn/coturn#472
* Allow MD5 in FIPS mode: gh#coturn/coturn#398
* update travis config ubuntu/mac images
* added null check for second char: gh#coturn/coturn#466
* compiler warning fixes: gh#coturn/coturn#470
* Fix a memory leak when an SHATYPE isn't supported: gh#coturn/coturn#471
* fix compiler warning comparison between signed and unsigned integer expressions
* fix compiler warning string truncation
* change Diffie Hellman default key length from 1066 to 2066
* drop of supplementary group IDs: gh#coturn/coturn#522
* Unify spelling of Coturn: gh#coturn/coturn#514
* Rename "prod" config option to "no-software-attribute": gh#coturn/coturn#506
gh#coturn/coturn#478
* change sql data dir in docker-compose-all.yml: gh#coturn/coturn#516
* add flags to disable periodic use of dynamic tables: gh#coturn/coturn#525
* fix typos and grammar: gh#coturn/coturn#463, gh#coturn/coturn#488
* Update README.docker: gh#coturn/coturn#475
* fix config extension in README.docker: gh#coturn/coturn#519
* Code beautifications: gh#coturn/coturn#327, gh#coturn/coturn#455,
gh#coturn/coturn#513
- Removed patches now included in upstream: coturn-4.5.1.0-append-log.patch,
coturn-4.5.1.1-cve-2020-6061.patch, coturn-4.5.1.1-cve-2020-6062.patch and
coturn-4.5.1.1.missing-call-to-setgroups-before-setuid.patch
- added apparmor profile (coturn-apparmor-usr.bin.turnserver) - fix executable permissions in devel package by using defattr
- Use pkgconfig(systemd) for packaging
- Shorten description by stripping the long list of all RFCs. - Drop %defattr; use %autosetup.
- Initial release of coturn 4.5.1.1