This update for coturn fixes the following issues: Changes in coturn: - Update to version 4.14.0 New * No more dependency on prometheus-client-c * HTTPS support for prometheus client (optional) * TLS support for redis - now compatible with managed redis (optional). * Rate limiting "401 Unauthorized" responses - reduces reflection attacks off the coturn server. This is an experimental feature - not fully tested on production scale deployment and massive DDoS attacks. New prometheus counters should help shed some light on real life behavior and performance. The feature is off by default. What's Changed * validate hmackey length in sqlite_get_user_key before hex decode. * Add out-of-tree patch to restore deprecated OpenSSL 1.1.1. * Add optional TLS transport for Redis connections. * Fix relay threads override. * Flush prometheus hot-path counters once per second to kill lock contention. * fix signed-char index out-of-bounds read in base64_decode. * Build Prometheus exporter from vendored local sources. * Prom https. * Fix realm quota data race and warnings. * Add per-source rate-limiting of UDP 401 Unauthorized responses - Update to version 4.13.1 * null-terminate server_name in stun_is_challenge_response_str. * Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks. * Auto-deny coturn's own database backend endpoints as relay peers. * Deny link-local / ULA / site-local relay peers by default. - Update to version 4.13.0 * Wrap atomic everywhere. * Fix sendmmsg stride bug in multiplex-peer UDP batch flush. * Reap TURN permissions/channels via a per-thread sweep instead of per-object timers. * Add --udp-sendmmsg-log to observe egress sendmmsg/UDP-GSO batching. * Expose recvmmsg/sendmmsg UDP batch sizes as Prometheus metrics * Restrict recvmmsg fast path to shared fan-in sockets (make --udp-recvmmsg useful standalone). * Enable --udp-recvmmsg by default on Linux. * Security hardening: port parsing, admin brute-force throttle, credential log redaction, constant-time compare, OAuth bounds checks, permission cap (#1932). * Add continuous latency mode to stunclient. * Fix test_redis_format link failure. * Fix configure MANPREFIX typo. * Fix missing sqlite3 dependendcy. * Fix UDP receive buffer ownership. - Update to version 4.12.0 * Update khash to the latest version (#1919). * Update readme to match latest changes (#1920). * Update docs for drop-invalid-packets and response-origin-only-with-rfc5780. * Multiplexpeer (#1916). * Fix TTL/TOS type conversion (#1915). * turnutils_uclient: sender thread pool + UDP-GSO send batching + recv_pps reporting (#1913). * Fix memory leak introduced by recvmmsg path (#1912). * turnutils_uclient: multi-threaded listener (recv) pool. * examples/turnserver.conf: update description of cli option. * turnutils_uclient: Linux recvmmsg receive path + larger SO_RCVBUF (#1910). * Add UDP-GSO send path (--udp-gso) (#1907). * turnutils_peer: Linux fast path with drain loop, recvmmsg/sendmmsg, U… (#1908). * Relay recvmmsg (#1906). * fuzzing: use hex escapes for HTTP EOH dictionary entry. * Sync turnserver man page with current CLI options (#1903). * Remove stale --ne option from turnserver --help (#1904). * Restore CodeQL permissions, category, and manual build mode. - Update to version 4.11.0 * Filc harness and pointer typedefs (#1896). * Load generator mode in turnutils_uclient (#1894). * Cache hot lookups in TURN data-path handlers (#1893). * Inline get_ioa_addr_len() in the header (#1891). * Trim two redundant checks from per-packet relay hot path. * Hoist turn_server_get_engine() out of per-packet hot path. * Add fuzz coverage for integrity helpers (#1888). * Add deterministic challenge-response builder to FuzzStun. * Seed address-mapping table in fuzz initializer (#1885). * Unblock fuzz coverage for is_http and rare STUN attributes. * HTTP parsing fixes (#1882). * Out of bound HTTP detection in parser (#1877). * Delete log line per relay thread on start (#1876). * Add Unity-based unit test scaffolding (#1875). * Drop udp_relay_servers_number config and clean up dead UDP id-space (#1874). * Fix build failure: define _GNU_SOURCE for recvmmsg() on Linux. * Pin session origin only after MESSAGE-INTEGRITY validates. * Abort on malformed allowed/denied-peer-ip at startup (#1872). * Fix format-string injection in Redis DB driver (#1870). * Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC. - Update to version 4.10.0 * Skip response buffer allocation for STUN indications. * WebRTC Auth optimization path (#1860). * Fix null pointer dereferences in post_parse() (#1859). * Extend seed corpus (#1858). * Add Linux-only `recvmmsg` receive path for DTLS/UDP listener. * Fix Linux build warnings (#1853). * perf: remove mutex from per-thread super_memory alloc