From 1624b76a8243654ab9f4671fb1647c20f829d513 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 02:28:22 +0000 Subject: [PATCH] =?UTF-8?q?Switch=20TURN=20test=20from=20-e=20=20to?= =?UTF-8?q?=20-y=20=E2=80=94=20real=20verification=20this=20time?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Not another guess: installed coturn locally (apt-get install coturn) and ran the actual server + turnutils_uclient against it to verify this before shipping, since the last two rounds shipped based on reading the usage text alone and both turned out incomplete. -e 127.0.0.1 satisfies turnutils_uclient's "-e or -y required" check, but then fails allocation with "channel bind: error 403 (Forbidden IP)" — services/coturn.sh never sets --allow-loopback-peers, so loopback as a peer address is correctly rejected by a real coturn instance, and the previous fix's own comment about "loopback is always reachable" missed that reachable and permitted aren't the same thing. -y ("client-to-client") sidesteps this: it negotiates both ends of a real relay through the server itself, needs no separate peer address, and works fine over loopback. Verified directly against a real local instance: exits 0 with real packet-loss/RTT stats on valid credentials, and correctly fails ("Cannot complete Allocation", exit 255) on a wrong password — so it's still a meaningful pass/fail, not just "didn't crash." Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn --- tools/coturn-test-check.sh | 18 +++++++++++++----- tools/pstn-test-check.sh | 25 ++++++++++++++++--------- 2 files changed, 29 insertions(+), 14 deletions(-) diff --git a/tools/coturn-test-check.sh b/tools/coturn-test-check.sh index 6b85479..87e87e7 100755 --- a/tools/coturn-test-check.sh +++ b/tools/coturn-test-check.sh @@ -167,11 +167,19 @@ else # matching comment — confirmed live this was the actual cause of a # "Cannot complete Allocation" failure, not a real coturn problem. # - # -e is also required — turnutils_uclient refuses to run at - # all without either -e or -y ("Either -e peer_address or -y must - # be specified", confirmed live). Loopback is fine since this runs - # via `docker exec` inside the coturn container itself. - OUT="$(docker exec coturn timeout 10 turnutils_uclient -u "$_u" -w "$_p" -e 127.0.0.1 "$TEST_HOST" -p "$COTURN_PORT" 2>&1)" + # -y ("client-to-client"), not -e : turnutils_uclient refuses + # to run at all without one of the two ("Either -e peer_address or + # -y must be specified", confirmed live), but -e needs an actual + # reachable, non-loopback peer — services/coturn.sh never sets + # --allow-loopback-peers, so -e 127.0.0.1 gets rejected with + # "channel bind: error 403 (Forbidden IP)" (confirmed live against + # a real local coturn instance built specifically to test this). + # -y negotiates both ends of a real relay through the server + # itself, no separate peer needed, and works over loopback — + # confirmed correctly reporting success (exit 0, real packet-loss + # stats) with valid credentials and failure ("Cannot complete + # Allocation", exit 255) with a wrong password. + OUT="$(docker exec coturn timeout 10 turnutils_uclient -u "$_u" -w "$_p" -y "$TEST_HOST" -p "$COTURN_PORT" 2>&1)" RC=$? if [ "$RC" -eq 0 ]; then ok "$c: TURN allocation succeeded (credentials + relay range + reachability all confirmed working)" diff --git a/tools/pstn-test-check.sh b/tools/pstn-test-check.sh index 87663a9..58f781a 100755 --- a/tools/pstn-test-check.sh +++ b/tools/pstn-test-check.sh @@ -217,15 +217,22 @@ else # cause of a "Cannot complete Allocation" failure against an # otherwise fully working coturn instance. # - # -e is required too — turnutils_uclient refuses to run at - # all without either -e or -y ("Either -e peer_address or -y must - # be specified", confirmed live), since without a peer address it - # has nothing to relay data to/from and there'd be no way to prove - # the allocation actually works end to end, not just that auth - # succeeded. Loopback is fine here — the test runs via `docker exec` - # inside the coturn container itself, so 127.0.0.1 is always - # reachable regardless of what's actually listening there. - OUT="$(docker exec "$COTURN_CONTAINER" timeout 10 turnutils_uclient -u "$TURN_USERNAME" -w "$TURN_PASSWORD" -e 127.0.0.1 127.0.0.1 -p "${TURN_PORT:-3478}" 2>&1)" + # turnutils_uclient also refuses to run at all without either -e + # or -y ("Either -e peer_address or -y must be specified", + # confirmed live). -e needs an actual reachable, non-loopback peer + # to relay through — services/coturn.sh never sets + # --allow-loopback-peers, so -e 127.0.0.1 gets rejected with + # "channel bind: error 403 (Forbidden IP)" (also confirmed live, + # against a real local coturn instance built to test this exact + # invocation). -y ("client-to-client") sidesteps this entirely: it + # negotiates both ends of a real relay through the server itself, + # no separate peer needed, and works fine over loopback since nothing + # about it is treated as an external peer address. Confirmed against + # a real coturn instance: -y correctly reports success (exit 0, real + # packet-loss stats) with valid credentials and correctly fails + # ("Cannot complete Allocation", exit 255) with a wrong password — + # a real pass/fail signal, not just "didn't crash." + OUT="$(docker exec "$COTURN_CONTAINER" timeout 10 turnutils_uclient -u "$TURN_USERNAME" -w "$TURN_PASSWORD" -y 127.0.0.1 -p "${TURN_PORT:-3478}" 2>&1)" if [ $? -eq 0 ]; then ok "Live TURN allocation succeeded with Asterisk's own configured credentials (user '$TURN_USERNAME')" else