Update turn-howto #8779
Update turn-howto #8779
Conversation
richvdh
force-pushed
the
rav/turn_docs
branch
from
1f3c893 to
2bcf56c
Compare
docs/turn-howto.md
Outdated
| port 12345). | ||
|
|
||
| We are not aware of anyone who has successfully configured a TURN server | ||
| behind NAT. If you get it working, let us know! |
There was a problem hiding this comment.
It fees like we should be more actively discouraging running turn servers behind NATs? I'm not sure if it'll work if the client is behind a particularly aggressive NAT too?
There was a problem hiding this comment.
welll... I think it should work, if the NAT server is correctly configured, so I'm reluctant to say "thou shalt absolutely not do this". I was hoping for a compromise which basically amounts to: if you want to try this, you're on your own and you better be a networking guru.
There was a problem hiding this comment.
Running a service to punch holes through NATs behind a NAT feels like it might turn out to be painful TBH. Can we maybe start the section with "We are not aware of anyone successfully running a TURN server behind a NAT. However, if you're attempting to then you'll need to at least do the following...", or something. Perhaps also pointing at the coturn docs?
There was a problem hiding this comment.
Running a service to punch holes through NATs behind a NAT feels like it might turn out to be painful TBH.
well yes, but plenty of people try it.
coturn's docs are... not terribly accessible here.
I'll reshuffle the section as you suggest.
There was a problem hiding this comment.
Just wanted to let you know I followed the instructions and got it working successfully behind a NAT on my first try, no issue whatsoever. I just forwarded the mentioned ports to the local IP running the turn server, opened the same ports to incoming traffic on that machine, and it just worked...
Maybe it's just me, but this warning seems to scare people off unnecessarily for no good reason.
There was a problem hiding this comment.
yes, I'd be happy for us to downgrade this warning to "it's an advanced topic". I'm glad to hear that you got it working, but the fact you did suggests that you have slightly more networking experience than the average person that tries to set up synapse :)
anyway if you'd like to send a PR to update the doc, I'd be glad to look at it :)
There was a problem hiding this comment.
but the fact you did suggests that you have slightly more networking experience than the average person that tries to set up synapse :)
I would argue that anyone that tries to setup anything behind a NAT needs to have an above average network experience, it's nothing specific to a turn server 😉
There was a problem hiding this comment.
I would argue that anyone that tries to setup anything behind a NAT needs to have an above average network experience
well this is rather the point. If you don't have above average network experience, please don't start by complaining to us that your TURN doesn't work ;)
In any case: TURN is definitely harder than average, on account of needing to map all of the external ports to the same internal ports, and then getting the "public IP address" right. My experience is that getting TURN working reliably is a black art at the best of times. Throwing NAT into the mix adds a whole lot more complication.
docs/turn-howto.md
Outdated
| @@ -139,7 +170,7 @@ Your home server configuration file needs the following extra keys: | |||
|
|
|||
| As an example, here is the relevant section of the config file for matrix.org: | |||
There was a problem hiding this comment.
Can we expand this briefly to say that this is for configurations with default port and using TURN (rather than TURNs)?
There was a problem hiding this comment.
done, though it does rather lead to the question: shouldn't we be using TLS on matrix.org?
docs/turn-howto.md
Outdated
| traffic (remember to allow both TCP and UDP traffic), and ports 49152-65535 | ||
| for the UDP relay.) | ||
| you've configured it to listen on (By default: 3478 for TURN and 5349 for | ||
| TURNs traffic (remember to allow both TCP and UDP traffic), and ports |
There was a problem hiding this comment.
A typo, I think?
| TURNs traffic (remember to allow both TCP and UDP traffic), and ports | |
| TURNS traffic (remember to allow both TCP and UDP traffic), and ports |
There was a problem hiding this comment.
it was somewhat deliberate. I should probably rephrase though.
Synapse 1.24.0 (2020-12-09) =========================== Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild. Security advisory ----------------- The following issues are fixed in v1.23.1 and v1.24.0. - There is a denial of service attack ([CVE-2020-26257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26257)) against the federation APIs in which future events will not be correctly sent to other servers over federation. This affects all servers that participate in open federation. (Fixed in [#8776](matrix-org/synapse#8776)). - Synapse may be affected by OpenSSL [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). Synapse administrators should ensure that they have the latest versions of the cryptography Python package installed. To upgrade Synapse along with the cryptography package: * Administrators using the [`matrix.org` Docker image](https://hub.docker.com/r/matrixdotorg/synapse/) or the [Debian/Ubuntu packages from `matrix.org`](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#matrixorg-packages) should ensure that they have version 1.24.0 or 1.23.1 installed: these images include the updated packages. * Administrators who have [installed Synapse from source](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#installing-from-source) should upgrade the cryptography package within their virtualenv by running: ```sh <path_to_virtualenv>/bin/pip install 'cryptography>=3.3' ``` * Administrators who have installed Synapse from distribution packages should consult the information from their distributions. Internal Changes ---------------- - Add a maximum version for pysaml2 on Python 3.5. ([\#8898](matrix-org/synapse#8898)) Synapse 1.24.0rc2 (2020-12-04) ============================== Bugfixes -------- - Fix a regression in v1.24.0rc1 which failed to allow SAML mapping providers which were unable to redirect users to an additional page. ([\#8878](matrix-org/synapse#8878)) Internal Changes ---------------- - Add support for the `prometheus_client` newer than 0.9.0. Contributed by Jordan Bancino. ([\#8875](matrix-org/synapse#8875)) Synapse 1.24.0rc1 (2020-12-02) ============================== Features -------- - Add admin API for logging in as a user. ([\#8617](matrix-org/synapse#8617)) - Allow specification of the SAML IdP if the metadata returns multiple IdPs. ([\#8630](matrix-org/synapse#8630)) - Add support for re-trying generation of a localpart for OpenID Connect mapping providers. ([\#8801](matrix-org/synapse#8801), [\#8855](matrix-org/synapse#8855)) - Allow the `Date` header through CORS. Contributed by Nicolas Chamo. ([\#8804](matrix-org/synapse#8804)) - Add a config option, `push.group_by_unread_count`, which controls whether unread message counts in push notifications are defined as "the number of rooms with unread messages" or "total unread messages". ([\#8820](matrix-org/synapse#8820)) - Add `force_purge` option to delete-room admin api. ([\#8843](matrix-org/synapse#8843)) Bugfixes -------- - Fix a bug where appservices may be sent an excessive amount of read receipts and presence. Broke in v1.22.0. ([\#8744](matrix-org/synapse#8744)) - Fix a bug in some federation APIs which could lead to unexpected behaviour if different parameters were set in the URI and the request body. ([\#8776](matrix-org/synapse#8776)) - Fix a bug where synctl could spawn duplicate copies of a worker. Contributed by Waylon Cude. ([\#8798](matrix-org/synapse#8798)) - Allow per-room profiles to be used for the server notice user. ([\#8799](matrix-org/synapse#8799)) - Fix a bug where logging could break after a call to SIGHUP. ([\#8817](matrix-org/synapse#8817)) - Fix `register_new_matrix_user` failing with "Bad Request" when trailing slash is included in server URL. Contributed by @angdraug. ([\#8823](matrix-org/synapse#8823)) - Fix a minor long-standing bug in login, where we would offer the `password` login type if a custom auth provider supported it, even if password login was disabled. ([\#8835](matrix-org/synapse#8835)) - Fix a long-standing bug which caused Synapse to require unspecified parameters during user-interactive authentication. ([\#8848](matrix-org/synapse#8848)) - Fix a bug introduced in v1.20.0 where the user-agent and IP address reported during user registration for CAS, OpenID Connect, and SAML were of the wrong form. ([\#8784](matrix-org/synapse#8784)) Improved Documentation ---------------------- - Clarify the usecase for a msisdn delegate. Contributed by Adrian Wannenmacher. ([\#8734](matrix-org/synapse#8734)) - Remove extraneous comma from JSON example in User Admin API docs. ([\#8771](matrix-org/synapse#8771)) - Update `turn-howto.md` with troubleshooting notes. ([\#8779](matrix-org/synapse#8779)) - Fix the example on how to set the `Content-Type` header in nginx for the Client Well-Known URI. ([\#8793](matrix-org/synapse#8793)) - Improve the documentation for the admin API to list all media in a room with respect to encrypted events. ([\#8795](matrix-org/synapse#8795)) - Update the formatting of the `push` section of the homeserver config file to better align with the [code style guidelines](https://github.com/matrix-org/synapse/blob/develop/docs/code_style.md#configuration-file-format). ([\#8818](matrix-org/synapse#8818)) - Improve documentation how to configure prometheus for workers. ([\#8822](matrix-org/synapse#8822)) - Update example prometheus console. ([\#8824](matrix-org/synapse#8824)) Deprecations and Removals ------------------------- - Remove old `/_matrix/client/*/admin` endpoints which were deprecated since Synapse 1.20.0. ([\#8785](matrix-org/synapse#8785)) - Disable pretty printing JSON responses for curl. Users who want pretty-printed output should use [jq](https://stedolan.github.io/jq/) in combination with curl. Contributed by @tulir. ([\#8833](matrix-org/synapse#8833)) Internal Changes ---------------- - Simplify the way the `HomeServer` object caches its internal attributes. ([\#8565](matrix-org/synapse#8565), [\#8851](matrix-org/synapse#8851)) - Add an example and documentation for clock skew to the SAML2 sample configuration to allow for clock/time difference between the homserver and IdP. Contributed by @localguru. ([\#8731](matrix-org/synapse#8731)) - Generalise `RoomMemberHandler._locally_reject_invite` to apply to more flows than just invite. ([\#8751](matrix-org/synapse#8751)) - Generalise `RoomStore.maybe_store_room_on_invite` to handle other, non-invite membership events. ([\#8754](matrix-org/synapse#8754)) - Refactor test utilities for injecting HTTP requests. ([\#8757](matrix-org/synapse#8757), [\#8758](matrix-org/synapse#8758), [\#8759](matrix-org/synapse#8759), [\#8760](matrix-org/synapse#8760), [\#8761](matrix-org/synapse#8761), [\#8777](matrix-org/synapse#8777)) - Consolidate logic between the OpenID Connect and SAML code. ([\#8765](matrix-org/synapse#8765)) - Use `TYPE_CHECKING` instead of magic `MYPY` variable. ([\#8770](matrix-org/synapse#8770)) - Add a commandline script to sign arbitrary json objects. ([\#8772](matrix-org/synapse#8772)) - Minor log line improvements for the SSO mapping code used to generate Matrix IDs from SSO IDs. ([\#8773](matrix-org/synapse#8773)) - Add additional error checking for OpenID Connect and SAML mapping providers. ([\#8774](matrix-org/synapse#8774), [\#8800](matrix-org/synapse#8800)) - Add type hints to HTTP abstractions. ([\#8806](matrix-org/synapse#8806), [\#8812](matrix-org/synapse#8812)) - Remove unnecessary function arguments and add typing to several membership replication classes. ([\#8809](matrix-org/synapse#8809)) - Optimise the lookup for an invite from another homeserver when trying to reject it. ([\#8815](matrix-org/synapse#8815)) - Add tests for `password_auth_provider`s. ([\#8819](matrix-org/synapse#8819)) - Drop redundant database index on `event_json`. ([\#8845](matrix-org/synapse#8845)) - Simplify `uk.half-shot.msc2778.login.application_service` login handler. ([\#8847](matrix-org/synapse#8847)) - Refactor `password_auth_provider` support code. ([\#8849](matrix-org/synapse#8849)) - Add missing `ordering` to background database updates. ([\#8850](matrix-org/synapse#8850)) - Allow for specifying a room version when creating a room in unit tests via `RestHelper.create_room_as`. ([\#8854](matrix-org/synapse#8854))
Some hopefully-useful notes on setting up a turnserver.