nextcloud / nextcloud/spreed

TURN server check fails

Open
#18,111 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Needs triage
Dominant language
JavaScript
Stars
2.2k
Forks
586
Avg merge
18h 27m
Merged PRs (30d)
333

Description

[!TIP]

How to use GitHub
  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Steps to reproduce

  1. Configure Talk app to use our coturn installation.
Expected behaviour

TURN server connection should be verified

Actual behaviour

The "pulse" icon changes to a a red exclamation mark in a red octagon.

Talk app

Talk app version: 23.0.4

Custom Signaling server configured: yes, 4e6bfc963c7350940023f3af4ac9c8cd0400cb4f

Custom TURN server configured: yes

Custom STUN server configured: yes

Browser

Microphone available: yes

Camera available: yes

Operating system: Fedora

Browser name: Vivaldi

Browser version: Version 8.0.4033.34 (Offizieller Build) (64-Bit)
Chromium Version 148.0.7778.183

Browser log
``` Creating PeerConnection with {iceServers: Array(1), iceTransportPolicy: 'relay'}iceServers: Array(1)0: {username: '1779792926:turn-test-user', credential: '2VyXLMqbaM54DwwPQsX/D5x6IV4=', urls: Array(4)}length: 1[[Prototype]]: Array(0)iceTransportPolicy: "relay"[[Prototype]]: Object TurnServer.vue:342 Received candidates []length: 0[[Prototype]]: Array(0) ```

Server configuration

root@wolke-nextcloud:~# time sudo -u www-data php /var/www/wolke.wikimedia.de/occ app:install issuetemplate
Error: App "Issue Template" cannot be installed because it is not compatible with this version of the server.

Operating system: Debian GNU/Linux 13 (trixie)

Web server: Nginx

Database: Maria

PHP version: 8.4

Nextcloud Version: 33.0.3

List of activated apps:

Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - app_api: 33.0.0
  - appointments: 2.7.3
  - bruteforcesettings: 6.0.0
  - calendar: 6.4.2
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contacts: 8.5.0
  - contactsinteraction: 1.14.1
  - cospend: 4.0.0
  - dashboard: 7.13.0
  - dav: 1.36.0
  - deck: 1.17.1
  - doom_nextcloud: 1.0.8
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_downloadlimit: 5.1.0
  - files_external: 1.25.1
  - files_lock: 33.0.3
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - firstrunwizard: 6.0.0
  - forms: 5.2.8
  - groupfolders: 21.0.7
  - impersonate: 4.0.0
  - integration_mattermost: 3.1.0
  - ldap_write_support: 1.15.0
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - mail: 5.8.0
  - nextcloud_announcements: 5.0.0
  - notes: 5.0.0
  - notifications: 6.0.0
  - oauth2: 1.21.0
  - ownershiptransfer: 1.4.0
  - password_policy: 5.0.0
  - photos: 6.0.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - qownnotesapi: 26.2.2
  - recommendations: 6.0.0
  - related_resources: 4.0.0
  - richdocuments: 10.1.3
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - spreed: 23.0.4
  - support: 5.0.0
  - survey_client: 5.0.0
  - systemtags: 1.23.0
  - tasks: 0.17.1
  - text: 7.0.1
  - theming: 2.8.0
  - timemanager: 0.3.23
  - twofactor_backupcodes: 1.22.0
  - twofactor_nextcloud_notification: 7.0.0
  - twofactor_totp: 15.0.0
  - updatenotification: 1.23.0
  - user_ldap: 1.24.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - whiteboard: 1.5.8
  - workflowengine: 2.15.0

Nextcloud configuration:

{
    "system": {
        "trashbin_retention_obligation": "auto, 30",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "wolke.wikimedia.de",
            "cloud.wikimedia.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/wolke.wikimedia.de",
        "overwriteprotocol": "https",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "dbtype": "mysql",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "version": "33.0.3.2",
        "installed": true,
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "app_install_overwrite": {
            "0": "whiteboard",
            "2": "fulltextsearch",
            "3": "fulltextsearch_elasticsearch",
            "4": "files_fulltextsearch",
            "5": "dashboardcharts",
            "6": "ownpad",
            "7": "timetracker",
            "8": "keeweb",
            "9": "documents",
            "10": "ldap_write_support"
        },
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "theme": "",
        "loglevel": 1,
        "has_rebuilt_cache": true,
        "default_language": "de_DE",
        "htaccess.RewriteBase": "\/",
        "maintenance": false,
        "encryption.legacy_format_support": false,
        "encryption.key_storage_migrated": false,
        "maintenance_window_start": 1,
        "mysql.utf8mb4": true,
        "serverid": 1,
        "default_phone_region": "DE",
        "mail_smtpport": "25",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": true
            }
        },
        "allow_local_remote_servers": true
    }
}
Server log (data/nextcloud.log)

There's nothing logged by Nextcloud. But there are logs of coturn.

May 26 10:58:03 stunning turnserver[837807]: 6997: : session 000000000000000804: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:03 stunning turnserver[837807]: 6997: : session 001000000000000747: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:03 stunning turnserver[837807]: 6997: : session 000000000000000805: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:03 stunning turnserver[837807]: 6997: : session 000000000000000806: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:03 stunning turnserver[837807]: 6997: : session 000000000000000807: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:03 stunning turnserver[837807]: 6997: : session 001000000000000748: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:03 stunning turnserver[837807]: 6997: : session 001000000000000749: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:03 stunning turnserver[837807]: 6997: : session 000000000000000808: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:04 stunning turnserver[837807]: 6997: : ERROR: check_stun_auth: Cannot find credentials of user <1779793383:turn-test-user>
May 26 10:58:04 stunning turnserver[837807]: 6997: : session 001000000000000747: realm <headturning.wikimedia.de> user <1779793383:turn-test-user>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:04 stunning turnserver[837807]: 6997: : ERROR: check_stun_auth: Cannot find credentials of user <1779793383:turn-test-user>
May 26 10:58:04 stunning turnserver[837807]: 6997: : session 000000000000000806: realm <headturning.wikimedia.de> user <1779793383:turn-test-user>: incoming packet message processed, error 401: Unauthorized
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 000000000000000776: peer usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=0, rb=0, sp=0, sb=0
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 000000000000000776: closed (2nd stage), user <1779793319:turn-test-user> realm <headturning.wikimedia.de> origin <>, local [2a01:4f8:c012:9c34::1]:443, remote [2003:a:6d:dd00:9a4b:b1a0:375e:f31d]:52071, reason: allocation watchdog determined stale session state
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000725: usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=3, rb=180, sp=3, sb=388
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000725: peer usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=0, rb=0, sp=0, sb=0
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000725: closed (2nd stage), user <1779793319:turn-test-user> realm <headturning.wikimedia.de> origin <>, local [2a01:4f8:c012:9c34::1]:443, remote [2003:a:6d:dd01:e8c5:de67:cd9b:43d4]:38802, reason: allocation watchdog determined stale session state
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000726: usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=3, rb=180, sp=3, sb=388
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000726: peer usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=0, rb=0, sp=0, sb=0
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000726: closed (2nd stage), user <1779793319:turn-test-user> realm <headturning.wikimedia.de> origin <>, local [2a01:4f8:c012:9c34::1]:443, remote [2003:a:6d:dd00:9a4b:b1a0:375e:f31d]:50342, reason: allocation watchdog determined stale session state
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000727: usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=3, rb=180, sp=3, sb=388
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000727: peer usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=0, rb=0, sp=0, sb=0
May 26 10:58:04 stunning turnserver[837807]: 6997: : IPv6. tcp or tls connected to: 2003:a:6d:dd00:9a4b:b1a0:375e:f31d:42998
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000727: closed (2nd stage), user <1779793319:turn-test-user> realm <headturning.wikimedia.de> origin <>, local [2a01:4f8:c012:9c34::1]:443, remote [2003:a:6d:dd01:e8c5:de67:cd9b:43d4]:57056, reason: allocation watchdog determined stale session state
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000728: usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=3, rb=180, sp=3, sb=340
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000728: peer usage: realm=<headturning.wikimedia.de>, username=<1779793319:turn-test-user>, rp=0, rb=0, sp=0, sb=0
May 26 10:58:04 stunning turnserver[837807]: 6993: : session 001000000000000728: closed (2nd stage), user <1779793319:turn-test-user> realm <headturning.wikimedia.de> origin <>, local 46.224.136.35:443, remote 104.151.103.93:19501, reason: allocation watchdog determined stale session state
[…]
I shortened it a bit. When I use `turnutils_uclient -p 443 -W shared-auth-secret -v -y headturning.wikimedia.de` it looks like this: 
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000836: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:59:58 stunning turnserver[837807]: 7112: : IPv4. Local relay addr: 46.224.136.35:57440
May 26 10:59:58 stunning turnserver[837807]: 7112: : IPv4. Local reserved relay addr: 46.224.136.35:57441
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000836: new, realm=<headturning.wikimedia.de>, username=<1779879598>, lifetime=777
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000836: realm <headturning.wikimedia.de> user <1779879598>: incoming packet ALLOCATE processed, success
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000836: refreshed, realm=<headturning.wikimedia.de>, username=<1779879598>, lifetime=777
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000836: realm <headturning.wikimedia.de> user <1779879598>: incoming packet REFRESH processed, success
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 001000000000000773: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:59:58 stunning turnserver[837807]: 7112: : IPv4. Local relay addr (RTCP): 46.224.136.35:57441
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 001000000000000773: new, realm=<headturning.wikimedia.de>, username=<1779879598>, lifetime=777
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 001000000000000773: realm <headturning.wikimedia.de> user <1779879598>: incoming packet ALLOCATE processed, success
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 001000000000000773: refreshed, realm=<headturning.wikimedia.de>, username=<1779879598>, lifetime=777
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 001000000000000773: realm <headturning.wikimedia.de> user <1779879598>: incoming packet REFRESH processed, success
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000837: realm <headturning.wikimedia.de> user <>: incoming packet message processed, error 401: Unauthorized
May 26 10:59:58 stunning turnserver[837807]: 7112: : IPv4. Local relay addr: 46.224.136.35:55312
May 26 10:59:58 stunning turnserver[837807]: 7112: : IPv4. Local reserved relay addr: 46.224.136.35:55313
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000837: new, realm=<headturning.wikimedia.de>, username=<1779879598>, lifetime=777
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000837: realm <headturning.wikimedia.de> user <1779879598>: incoming packet ALLOCATE processed, success
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000837: refreshed, realm=<headturning.wikimedia.de>, username=<1779879598>, lifetime=777
May 26 10:59:58 stunning turnserver[837807]: 7112: : session 000000000000000837: realm <headturning.wikimedia.de> user <1779879598>: incoming packet REFRESH processed, success
May 26 10:59:58 stunning turnserver[837807]: 7075: : session 000000000000000831: usage: realm=<headturning.wikimedia.de>, username=<>, rp=386, rb=7720, sp=386, sb=38600
May 26 10:59:58 stunning turnserver[837807]: 7075: : session 000000000000000831: peer usage: realm=<headturning.wikimedia.de>, username=<>, rp=0, rb=0, sp=0, sb=0
May 26 10:59:58 stunning turnserver[837807]: 7075: : session 000000000000000831: closed (2nd stage), user <> realm <headturning.wikimedia.de> origin <>, local 46.224.136.35:3478, remote 13.76.102.115:17500, reason: allocation watchdog determined stale session state
May 26 10:59:58 stunning turnserver[837807]: 7094: : session 000000000000000832: usage: realm=<headturning.wikimedia.de>, username=<>, rp=103, rb=2060, sp=103, sb=10300
May 26 10:59:58 stunning turnserver[837807]: 7094: : session 000000000000000832: peer usage: realm=<headturning.wikimedia.de>, username=<>, rp=0, rb=0, sp=0, sb=0
May 26 10:59:58 stunning turnserver[837807]: 7094: : session 000000000000000832: closed (2nd stage), user <> realm <headturning.wikimedia.de> origin <>, local 46.224.136.35:3478, remote 213.32.19.46:5060, reason: allocation watchdog determined stale session state
May 26 10:59:58 stunning turnserver[837807]: 7102: : session 000000000000000833: usage: realm=<headturning.wikimedia.de>, username=<>, rp=386, rb=7720, sp=386, sb=38600
May 26 10:59:58 stunning turnserver[837807]: 7102: : session 000000000000000833: peer usage: realm=<headturning.wikimedia.de>, username=<>, rp=0, rb=0, sp=0, sb=0
May 26 10:59:58 stunning turnserver[837807]: 7102: : session 000000000000000833: closed (2nd stage), user <> realm <headturning.wikimedia.de> origin <>, local 46.224.136.35:3478, remote 34.0.14.87:23957, reason: allocation watchdog determined stale session state
May 26 10:59:58 stunning turnserver[837807]: 7108: : session 000000000000000834: usage: realm=<headturning.wikimedia.de>, username=<>, rp=193, rb=3860, sp=193, sb=19300
May 26 10:59:58 stunning turnserver[837807]: 7108: : session 000000000000000834: peer usage: realm=<headturning.wikimedia.de>, username=<>, rp=0, rb=0, sp=0, sb=0
May 26 10:59:58 stunning turnserver[837807]: 7108: : session 000000000000000834: closed (2nd stage), user <> realm <headturning.wikimedia.de> origin <>, local 46.224.136.35:3478, remote 185.97.253.250:7707, reason: allocation watchdog determined stale session state
The most glaring difference is that Nextcloud Talk tests with username while `turnutils_uclient` only uses . And coturn complains about not finding any credentials for the user supplied by Nextcloud Talk. So I guess the cause lies there somewhere.

I tried to debug using https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ but this page fails with me not providing a username.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at TurnServer.vue around line 342 and reproduce the TURN check with the reported Talk, browser, and coturn configurations. Compare the browser's empty candidate list with the coturn 401 Unauthorized and missing-credentials logs; done means a valid TURN connection is verified and the pulse indicator no longer shows an error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
audio-video-rtc, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.