Follow TURN 300 Try Alternate redirect for Realm connections - #29

Thanks @Pix3lPirat3 — the comparison against native WebRTC and the successful Realm join/reconnect make the diagnosis convincing. CI is green on all three platforms, and the four new URL/cache tests also pass locally. A temporary workaround through ICE configuration is reasonable, but I would fix these issues before merging this PoC:

1. Validate the probe response before accepting a redirect (src/turnRedirect.js:47–55). The request transaction ID is discarded, and the first received datagram ends the probe without checking sender, message type, magic cookie, transaction ID, or declared message/attribute bounds. I reproduced acceptance of a fabricated 300 response sent by a different local UDP socket, with a zero cookie, zero transaction ID and invalid response type; it returned the supplied alternate address. Preserve the request ID, match the queried endpoint and Allocate response, check framing, and ignore unrelated/malformed datagrams until a valid response or timeout. This is ordinary STUN response matching, not optional extra validation. Add local UDP tests that actually exercise the probe; the current tests seed the cache and never run it.

2. Cancel or discard stale pre-resolution (src/client.js:228). The new await occurs before a peer exists, so close() cannot dispose of anything yet. After it resolves, createOffer() still creates a peer without checking whether the client closed, negotiation timed out, or a newer attempt replaced it. I reproduced a peer-constructor call after client.close() using a silent local TURN endpoint and valid dummy TURN credentials. Tie the probe to the attempt's lifetime, recheck that attempt after awaiting, and keep rewritten ICE servers local to it instead of assigning an old asynchronous result back into this.credentials. Cover close and timeout/retry during probing.

3. Respect the selected backend and TURN transport (src/client.js:225–228, src/turnRedirect.js:67–73). turn: also permits ?transport=tcp; this implementation probes it over UDP and can rewrite it using a UDP-only alternate. I reproduced a TCP URL being rewritten from the host:port cache. Skip TCP/TLS/unsupported address forms in this UDP-specific workaround, and apply it only when the selected backend is Werift (including auto resolving to Werift). Native currently also waits for and consumes the pre-resolution, so it is not actually unaffected. The existing REQUESTED-TRANSPORT=UDP attribute describes the relay allocation; it does not make the client-to-TURN transport UDP.

4. Avoid permanent caching of failures and stale alternates (src/turnRedirect.js:70–79). A single timeout is cached as null for the entire process, so future Realm attempts never retry the lookup even after the network recovers. Positive results also never expire. At minimum do not cache probe failures; give successful redirects a bounded lifetime (and keep any cache bounded). Add a test where an initial failed probe is followed by a successful redirect.

Please retain the live Realm join/reconnect check after these changes. I also support a proper Werift upstream fix so this workaround can eventually disappear; we do not need to implement a general TURN client here.

Reviewed at 892aad0. These local checks establish the edge cases above; I have not independently repeated the authenticated Realm test.

— OpenAI Astra