Apple设备WebRTC经Coturn服务器连接5分钟后断开问题

问题现象 #

为WebRTC应用部署的Coturn TURN服务器在Windows和Android设备上运行正常，但在部分iOS/macOS的Safari浏览器中，WebRTC连接初始可正常建立，约5分钟后会断开，断开时TURN服务器日志出现TLS/TCP socket buffer operation error (callback)。

断开时的TURN服务器日志 #

746: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1767, rb=1642473, sp=281, sb=45819
750: : session 001000000000000006: peer 192.168.100.100 lifetime updated: 300
750: : session 001000000000000006: realm <metasim.io> user <testname>: incoming packet CREATE_PERMISSION processed, success
750: : session 001000000000000006: peer 37.63.64.9 lifetime updated: 300
750: : session 001000000000000006: realm <metasim.io> user <testname>: incoming packet CREATE_PERMISSION processed, success
750: : session 000000000000000003: peer 10.154.0.14 lifetime updated: 300
750: : session 000000000000000003: realm <metasim.io> user <testname>: incoming packet CREATE_PERMISSION processed, success
750: : session 000000000000000003: peer 10.154.0.14 lifetime updated: 600
750: : session 000000000000000003: realm <metasim.io> user <testname>: incoming packet CHANNEL_BIND processed, success
750: : session 000000000000000003: usage: realm=<metasim.io>, username=<testname>, rp=285, rb=47449, sp=1765, sb=1642092
750: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1763, rb=1632229, sp=283, sb=46101
755: : session 000000000000000003: usage: realm=<metasim.io>, username=<testname>, rp=289, rb=47974, sp=1759, sb=1630876
755: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1759, rb=1621207, sp=289, sb=46818
759: : session 000000000000000003: usage: realm=<metasim.io>, username=<testname>, rp=285, rb=47375, sp=1763, sb=1645836
759: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1763, rb=1636011, sp=285, sb=46235
763: : session 000000000000000003: usage: realm=<metasim.io>, username=<testname>, rp=286, rb=47229, sp=1762, sb=1650592
763: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1762, rb=1640926, sp=286, sb=46085
767: : session 000000000000000003: usage: realm=<metasim.io>, username=<testname>, rp=286, rb=47549, sp=1762, sb=1641564
767: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1762, rb=1631749, sp=286, sb=46405
771: : session 000000000000000003: usage: realm=<metasim.io>, username=<testname>, rp=283, rb=47488, sp=1765, sb=1648212
771: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1765, rb=1638599, sp=283, sb=46356
775: : session 000000000000000003: usage: realm=<metasim.io>, username=<testname>, rp=279, rb=47039, sp=1769, sb=1649852
775: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1769, rb=1640051, sp=279, sb=45923
779: : session 000000000000000003: usage: realm=<metasim.io>, username=<testname>, rp=285, rb=47248, sp=1763, sb=1639700
779: : session 000000000000000003: peer usage: realm=<metasim.io>, username=<testname>, rp=1763, rb=1630019, sp=285, sb=46108
780: : session 001000000000000006: refreshed, realm=<metasim.io>, username=<testname>, lifetime=0, cipher=ECDHE-RSA-AES256-GCM-SHA384, method=TLSv1.2
780: : session 001000000000000006: realm <metasim.io> user <testname>: incoming packet REFRESH processed, success
780: : session 001000000000000006: TLS/TCP socket disconnected: 34.147.162.187:1090
780: : session 001000000000000006: usage: realm=<metasim.io>, username=<testname>, rp=8, rb=748, sp=8, sb=732
780: : session 001000000000000006: peer usage: realm=<metasim.io>, username=<testname>, rp=0, rb=0, sp=0, sb=0
780: : session 001000000000000006: closed (2nd stage), user <testname> realm <metasim.io> origin <>, local 0.0.0.0:3478, remote 34.147.162.187:1090, reason: TLS/TCP socket buffer operation error (callback)
780: : session 001000000000000006: delete: realm=<metasim.io>, username=<testname>
780: : session 001000000000000006: peer 37.63.64.9 deleted
780: : session 001000000000000006: peer 192.168.100.100 deleted

TURN服务器配置（turn.conf） #

# Realm settings
realm=<domain>

# Name
server-name=turnserver

fingerprint

# The TURN server IP address to be sent to external peers
external-ip=<ip>
listening-ip=0.0.0.0
listening-port=3478
min-port=10000
max-port=20000

# Validate credentials
lt-cred-mech
cli-password=<pass>

# Designate username and password
user=<user>:<pass>

# Certificate
cert=<path/to/certificate.crt>
pkey=<path/to/certificate.key>

# Logs
simple-log
verbose
log-file=/var/log/turn.log

# Possible fixes for 5-minutes bug, currently no success
#no-tlsv1
#no-tlsv1_1
#max-allocate-lifetime=36000
#permission-lifetime=36000
#stale-nonce=36000

已尝试的无效方案 #

• 调整turn.conf中的各类超时参数（包括注释中列出的max-allocate-lifetime、permission-lifetime等）
• 启用/禁用证书启动TURN服务器
• 仅保留TLS v3版本

期望与实际结果 #

• 期望：所有设备通过TURN服务器实现WebRTC连接稳定无中断
• 实际：部分Apple设备（iOS/macOS Safari）上连接约5分钟后断开

可能的解决方向 #

1. 调整TCP keepalive参数
   在turn.conf中添加以下配置，强制TCP连接保持活跃，避免Apple设备的TCP超时机制触发断开：

   tcp-keepalive-idle=300
   tcp-keepalive-interval=60
   tcp-keepalive-count=5
   

   这些参数会让TURN服务器定期发送keepalive探测包，维持TCP连接。

2. 强制使用UDP传输
   Safari在TLS/TCP模式下的TURN连接可能存在底层兼容性问题，可以在WebRTC的ICE配置中优先使用UDP类型的TURN候选，避免TCP模式：
   在构建RTCIceServer时，指定transport: 'udp'，例如：

   const iceServers = [
     {
       urls: 'turn:<你的TURN服务器地址>:3478',
       username: '<用户名>',
       credential: '<密码>',
       transport: 'udp'
     }
   ];
   

3. 更新Coturn版本
   部分旧版本Coturn存在与Apple设备TLS交互的bug，建议升级到最新稳定版，修复已知的兼容性问题。

4. 检查证书链完整性
   确保使用的SSL证书包含完整的链（包括中间证书），Apple设备对证书链的校验更严格，不完整的证书链可能导致TLS连接在一段时间后被强制断开。

5. 调整TLS cipher套件
   在turn.conf中指定Apple设备兼容性更好的cipher套件，例如：

   cipher-list=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
   

   避免使用Apple设备不支持或存在问题的套件。

内容的提问来源于stack exchange，提问作者Tsvetan Vasilev