root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch TURN test from -e <peer> to -y — real verification this time

Browse Source 
Not another guess: installed coturn locally (apt-get install coturn) and
ran the actual server + turnutils_uclient against it to verify this
before shipping, since the last two rounds shipped based on reading the
usage text alone and both turned out incomplete.

-e 127.0.0.1 satisfies turnutils_uclient's "-e or -y required" check, but
then fails allocation with "channel bind: error 403 (Forbidden IP)" —
services/coturn.sh never sets --allow-loopback-peers, so loopback as a
peer address is correctly rejected by a real coturn instance, and the
previous fix's own comment about "loopback is always reachable" missed
that reachable and permitted aren't the same thing.

-y ("client-to-client") sidesteps this: it negotiates both ends of a real
relay through the server itself, needs no separate peer address, and
works fine over loopback. Verified directly against a real local
instance: exits 0 with real packet-loss/RTT stats on valid credentials,
and correctly fails ("Cannot complete Allocation", exit 255) on a wrong
password — so it's still a meaningful pass/fail, not just "didn't crash."

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn
This commit is contained in:
Claude
2026-08-12 02:28:22 +00:00
parent c12d0d6cb1
commit 1624b76a82
2 changed files with 29 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/coturn-test-check.sh
+13 -5
View File
@@ -167,11 +167,19 @@ else
# matching comment — confirmed live this was the actual cause of a # matching comment — confirmed live this was the actual cause of a
# "Cannot complete Allocation" failure, not a real coturn problem. # "Cannot complete Allocation" failure, not a real coturn problem.
# #
# -e <peer> is also required — turnutils_uclient refuses to run at # -y ("client-to-client"), not -e <peer>: turnutils_uclient refuses
# all without either -e or -y ("Either -e peer_address or -y must # to run at all without one of the two ("Either -e peer_address or
# be specified", confirmed live). Loopback is fine since this runs # -y must be specified", confirmed live), but -e needs an actual
# via `docker exec` inside the coturn container itself. # reachable, non-loopback peer — services/coturn.sh never sets
OUT="$(docker exec coturn timeout 10 turnutils_uclient -u "$_u" -w "$_p" -e 127.0.0.1 "$TEST_HOST" -p "$COTURN_PORT" 2>&1)" # --allow-loopback-peers, so -e 127.0.0.1 gets rejected with
# "channel bind: error 403 (Forbidden IP)" (confirmed live against
# a real local coturn instance built specifically to test this).
# -y negotiates both ends of a real relay through the server
# itself, no separate peer needed, and works over loopback —
# confirmed correctly reporting success (exit 0, real packet-loss
# stats) with valid credentials and failure ("Cannot complete
# Allocation", exit 255) with a wrong password.
OUT="$(docker exec coturn timeout 10 turnutils_uclient -u "$_u" -w "$_p" -y "$TEST_HOST" -p "$COTURN_PORT" 2>&1)"
RC=$? RC=$?
if [ "$RC" -eq 0 ]; then if [ "$RC" -eq 0 ]; then
ok "$c: TURN allocation succeeded (credentials + relay range + reachability all confirmed working)" ok "$c: TURN allocation succeeded (credentials + relay range + reachability all confirmed working)"
tools/pstn-test-check.sh
+16 -9
View File
@@ -217,15 +217,22 @@ else
# cause of a "Cannot complete Allocation" failure against an # cause of a "Cannot complete Allocation" failure against an
# otherwise fully working coturn instance. # otherwise fully working coturn instance.
# #
# -e <peer> is required too — turnutils_uclient refuses to run at # turnutils_uclient also refuses to run at all without either -e
# all without either -e or -y ("Either -e peer_address or -y must # <peer> or -y ("Either -e peer_address or -y must be specified",
# be specified", confirmed live), since without a peer address it # confirmed live). -e needs an actual reachable, non-loopback peer
# has nothing to relay data to/from and there'd be no way to prove # to relay through — services/coturn.sh never sets
# the allocation actually works end to end, not just that auth # --allow-loopback-peers, so -e 127.0.0.1 gets rejected with
# succeeded. Loopback is fine here — the test runs via `docker exec` # "channel bind: error 403 (Forbidden IP)" (also confirmed live,
# inside the coturn container itself, so 127.0.0.1 is always # against a real local coturn instance built to test this exact
# reachable regardless of what's actually listening there. # invocation). -y ("client-to-client") sidesteps this entirely: it
OUT="$(docker exec "$COTURN_CONTAINER" timeout 10 turnutils_uclient -u "$TURN_USERNAME" -w "$TURN_PASSWORD" -e 127.0.0.1 127.0.0.1 -p "${TURN_PORT:-3478}" 2>&1)" # negotiates both ends of a real relay through the server itself,
# no separate peer needed, and works fine over loopback since nothing
# about it is treated as an external peer address. Confirmed against
# a real coturn instance: -y correctly reports success (exit 0, real
# packet-loss stats) with valid credentials and correctly fails
# ("Cannot complete Allocation", exit 255) with a wrong password —
# a real pass/fail signal, not just "didn't crash."
OUT="$(docker exec "$COTURN_CONTAINER" timeout 10 turnutils_uclient -u "$TURN_USERNAME" -w "$TURN_PASSWORD" -y 127.0.0.1 -p "${TURN_PORT:-3478}" 2>&1)"
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
ok "Live TURN allocation succeeded with Asterisk's own configured credentials (user '$TURN_USERNAME')" ok "Live TURN allocation succeeded with Asterisk's own configured credentials (user '$TURN_USERNAME')"
else else