werift 0.24.3 → 0.25.0-alpha.0

package/lib/ice/src/turn/protocol.d.ts

@@ -3,6 +3,13 @@ import { type Address, Event, type InterfaceAddresses, type TlsConnectionOptions
 import { Message } from "../stun/message";
 import { Transaction } from "../stun/transaction";
 import type { Protocol, TransactionRequestOptions } from "../types/model";
+/** Channel binding state for a single peer transport address. */
+export interface TurnChannel {
+    number: number;
+    address: Address;
+    /** Unix seconds when this channel should be refreshed. */
+    refreshAt: number;
+}
 export declare class StunOverTurnProtocol implements Protocol {
     turn: TurnProtocol;
     static type: string;
@@ -20,6 +27,7 @@ export declare class StunOverTurnProtocol implements Protocol {
     close(): Promise<void>;
 }
 export declare class TurnProtocol implements Protocol {
+    /** TURN server as configured; the host may be a hostname. */
     server: Address;
     username: string;
     password: string;
@@ -49,12 +57,30 @@ export declare class TurnProtocol implements Protocol {
     private addrByChannel;
     /**sec */
     private channelRefreshTime;
-    private channelBinding?;
-    private channelRefreshAt;
+    /**
+     * Serializes ChannelBind requests so allocation-wide auth state
+     * (nonce/realm/integrityKey) is not updated concurrently. Rejections
+     * must not poison this tail — see channelBindQueue assignment sites.
+     */
+    private channelBindQueue;
+    /** In-flight ChannelBind per peer transport address (dedupe concurrent). */
+    private channelBindingByAddr;
     private tcpBuffer;
+    /** Permission cache keyed by peer IP only (RFC 8656). */
     private permissionByAddr;
-    private creatingPermission;
-    constructor(server: Address, username: string, password: string, lifetime: number, transport: Transport, options?: {
+    /**
+     * Serializes CreatePermission requests (auth state race avoidance).
+     * Rejections must not poison this tail.
+     */
+    private permissionQueue;
+    /** In-flight CreatePermission per peer IP (dedupe concurrent). */
+    private creatingPermissionByAddr;
+    /** Concrete TURN server address the allocation lives on, once selected. */
+    private pinnedServerEndpoint?;
+    private serverEndpointSelection?;
+    constructor(
+    /** TURN server as configured; the host may be a hostname. */
+    server: Address, username: string, password: string, lifetime: number, transport: Transport, options?: {
         /**sec */
         channelRefreshTime?: number;
     });
@@ -66,13 +92,47 @@ export declare class TurnProtocol implements Protocol {
     private createPermission;
     private refresh;
     request(request: Message, addr: Address, _integrityKey?: Buffer, retransmissionsOrOptions?: number | TransactionRequestOptions, onRequestSent?: (attempt: number) => void): Promise<[Message, Address]>;
-    requestWithRetry(request: Message, addr: Address): Promise<[Message, Address]>;
+    /**
+     * The concrete TURN server address, selected on the first request and
+     * pinned for the rest of the allocation, so a later DNS answer can never
+     * move REFRESH, CREATE_PERMISSION, CHANNEL_BIND or data to another server.
+     */
+    get serverEndpoint(): Address | undefined;
+    /**
+     * Address a request to `addr` is sent to, and the address its response
+     * must come from. A stream carries every request to the peer it is
+     * connected to, so it always uses the server endpoint.
+     */
+    private resolveRequestTarget;
+    private serverDestination;
+    private selectServerEndpoint;
+    /**
+     * UDP: resolve the configured server in the bound socket's family; a udp4
+     * socket cannot send to an IPv6 answer. TCP/TLS: use the peer the socket
+     * actually connected to. Looking the hostname up again could return a
+     * different A/AAAA record, and responses from the real peer would then be
+     * dropped as coming from an unexpected address.
+     */
+    private resolveServerEndpoint;
+    requestWithRetry(request: Message, addr: Address, signal?: AbortSignal): Promise<[Message, Address]>;
     sendData(data: Buffer, addr: Address): Promise<void>;
+    /**
+     * Ensure a CreatePermission exists for the peer IP.
+     * Peer failures are isolated: a rejection for peer A does not poison peer B.
+     */
     getPermission(addr: Address): Promise<void>;
-    getChannel(addr: Address): Promise<{
-        number: number;
-        address: Address;
-    }>;
+    /**
+     * Ensure a ChannelBind exists for the peer transport address.
+     * Peer failures are isolated; concurrent same-peer calls share one Promise.
+     */
+    getChannel(addr: Address): Promise<TurnChannel>;
+    /**
+     * Create or refresh a channel for addr. Provisional mapping is installed
+     * before the request so early ChannelData can be decoded; only a failed
+     * *initial* bind rolls the mapping back. Failed channel numbers are never
+     * reused.
+     */
+    private ensureChannel;
     private channelBind;
     sendStun(message: Message, addr: Address): Promise<void>;
     close(): Promise<void>;
@@ -89,18 +149,15 @@ export interface TurnClientOptions {
     tlsOptions?: TlsConnectionOptions;
     portRange?: [number, number];
     interfaceAddresses?: InterfaceAddresses;
+    /** Maximum time to wait for TCP/TLS connection establishment, in milliseconds. */
+    connectTimeoutMs?: number;
+    /**
+     * Preferred IP family of the UDP socket, applied only when the server
+     * address is a hostname. Ignored for an IP literal server address, whose
+     * own family always selects the socket. Defaults to 4.
+     */
+    udpFamily?: 4 | 6;
 }
-export declare function createTurnClient({ address, username, password }: TurnClientConfig, { lifetime, portRange, interfaceAddresses, ssl, tlsOptions, transport: transportType, }?: TurnClientOptions): Promise<TurnProtocol>;
-export declare function createStunOverTurnClient({ address, username, password, }: {
-    address: Address;
-    username: string;
-    password: string;
-}, { lifetime, portRange, interfaceAddresses, ssl, tlsOptions, transport: transportType, }?: {
-    lifetime?: number;
-    ssl?: boolean;
-    transport?: "udp" | "tcp" | "tls";
-    tlsOptions?: TlsConnectionOptions;
-    portRange?: [number, number];
-    interfaceAddresses?: InterfaceAddresses;
-}): Promise<StunOverTurnProtocol>;
+export declare function createTurnClient({ address, username, password }: TurnClientConfig, { lifetime, portRange, interfaceAddresses, ssl, tlsOptions, transport: transportType, connectTimeoutMs, udpFamily, }?: TurnClientOptions): Promise<TurnProtocol>;
+export declare function createStunOverTurnClient(config: TurnClientConfig, options?: TurnClientOptions): Promise<StunOverTurnProtocol>;
 export declare function makeIntegrityKey(username: string, realm: string, password: string): Buffer<ArrayBufferLike>;

package/lib/ice/src/turn/protocol.js

@@ -4,6 +4,7 @@ exports.TurnProtocol = exports.StunOverTurnProtocol = void 0;
 exports.createTurnClient = createTurnClient;
 exports.createStunOverTurnClient = createStunOverTurnClient;
 exports.makeIntegrityKey = makeIntegrityKey;
+const node_net_1 = require("node:net");
 const promises_1 = require("timers/promises");
 const auth_1 = require("../../../ice-server/src/turn/auth");
 const exceptions_1 = require("../exceptions");
@@ -20,6 +21,14 @@ const UDP_TRANSPORT = 0x11000000;
 function isStreamTransport(transport) {
     return transport.type === "tcp" || transport.type === "tls";
 }
+/** Permission is peer-IP scoped (RFC 8656). */
+function permissionKey(addr) {
+    return addr[0];
+}
+/** ChannelBind is peer transport-address scoped (IP + port). */
+function channelKey(addr) {
+    return JSON.stringify(addr);
+}
 class StunOverTurnProtocol {
     constructor(turn) {
         Object.defineProperty(this, "turn", {
@@ -144,7 +153,9 @@ Object.defineProperty(StunOverTurnProtocol, "type", {
     value: "turn"
 });
 class TurnProtocol {
-    constructor(server, username, password, lifetime, transport, options = {}) {
+    constructor(
+    /** TURN server as configured; the host may be a hostname. */
+    server, username, password, lifetime, transport, options = {}) {
         Object.defineProperty(this, "server", {
             enumerable: true,
             configurable: true,
@@ -278,17 +289,23 @@ class TurnProtocol {
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "channelBinding", {
+        /**
+         * Serializes ChannelBind requests so allocation-wide auth state
+         * (nonce/realm/integrityKey) is not updated concurrently. Rejections
+         * must not poison this tail — see channelBindQueue assignment sites.
+         */
+        Object.defineProperty(this, "channelBindQueue", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: void 0
+            value: Promise.resolve()
         });
-        Object.defineProperty(this, "channelRefreshAt", {
+        /** In-flight ChannelBind per peer transport address (dedupe concurrent). */
+        Object.defineProperty(this, "channelBindingByAddr", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: 0
+            value: new Map()
         });
         Object.defineProperty(this, "tcpBuffer", {
             enumerable: true,
@@ -296,41 +313,80 @@ class TurnProtocol {
             writable: true,
             value: Buffer.alloc(0)
         });
+        /** Permission cache keyed by peer IP only (RFC 8656). */
         Object.defineProperty(this, "permissionByAddr", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: {}
         });
-        Object.defineProperty(this, "creatingPermission", {
+        /**
+         * Serializes CreatePermission requests (auth state race avoidance).
+         * Rejections must not poison this tail.
+         */
+        Object.defineProperty(this, "permissionQueue", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: Promise.resolve()
         });
+        /** In-flight CreatePermission per peer IP (dedupe concurrent). */
+        Object.defineProperty(this, "creatingPermissionByAddr", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        /** Concrete TURN server address the allocation lives on, once selected. */
+        Object.defineProperty(this, "pinnedServerEndpoint", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "serverEndpointSelection", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "refresh", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: (exp) => {
                 this.refreshHandle = (0, helper_1.cancelable)(async (_, __, onCancel) => {
-                    let run = true;
+                    const abort = new AbortController();
                     onCancel.once(() => {
-                        run = false;
+                        abort.abort();
                     });
-                    while (run) {
+                    while (!abort.signal.aborted) {
                         // refresh before expire
                         const delay = (5 / 6) * exp * 1000;
                         log("refresh delay", delay, { exp });
-                        await (0, promises_1.setTimeout)(delay);
+                        try {
+                            await (0, promises_1.setTimeout)(delay, undefined, { signal: abort.signal });
+                        }
+                        catch (error) {
+                            if (abort.signal.aborted) {
+                                return;
+                            }
+                            throw error;
+                        }
+                        if (abort.signal.aborted) {
+                            return;
+                        }
                         const request = new message_1.Message(const_1.methods.REFRESH, const_1.classes.REQUEST);
                         request.setAttribute("LIFETIME", exp);
                         try {
-                            const [message] = await this.requestWithRetry(request, this.server);
+                            const [message] = await this.requestWithRetry(request, this.server, abort.signal);
                             exp = message.getAttributeValue("LIFETIME");
                             log("refresh", { exp });
                         }
                         catch (error) {
+                            if (abort.signal.aborted) {
+                                return;
+                            }
                             log("refresh error", error);
                         }
                     }
@@ -432,10 +488,8 @@ class TurnProtocol {
             .setAttribute("USERNAME", this.username)
             .setAttribute("REALM", this.realm)
             .setAttribute("NONCE", this.nonce);
-        await this.request(request, this.server).catch((e) => {
-            request;
-            throw e;
-        });
+        // Use requestWithRetry for stale-nonce (438) consistency with ChannelBind.
+        await this.requestWithRetry(request, this.server);
     }
     async request(request, addr, _integrityKey, retransmissionsOrOptions, onRequestSent) {
         if (this.transactions[request.transactionIdHex]) {
@@ -452,7 +506,7 @@ class TurnProtocol {
         // TURN server allocation/refresh uses default STUN retry policy unless
         // callers pass explicit options. Peer consent goes through StunOverTurnProtocol.
         // Prefer the TURN session integrity key for response verification.
-        const resolvedAddr = await (0, transaction_1.resolveRequestAddress)(addr);
+        const resolvedAddr = await this.resolveRequestTarget(addr);
         const options = (0, transaction_1.buildTransactionOptions)(this.integrityKey, retransmissionsOrOptions, onRequestSent);
         const transaction = new transaction_1.Transaction(request, resolvedAddr, this, options);
         this.transactions[request.transactionIdHex] = transaction;
@@ -466,18 +520,74 @@ class TurnProtocol {
             delete this.transactions[request.transactionIdHex];
         }
     }
-    async requestWithRetry(request, addr) {
+    /**
+     * The concrete TURN server address, selected on the first request and
+     * pinned for the rest of the allocation, so a later DNS answer can never
+     * move REFRESH, CREATE_PERMISSION, CHANNEL_BIND or data to another server.
+     */
+    get serverEndpoint() {
+        return this.pinnedServerEndpoint;
+    }
+    /**
+     * Address a request to `addr` is sent to, and the address its response
+     * must come from. A stream carries every request to the peer it is
+     * connected to, so it always uses the server endpoint.
+     */
+    async resolveRequestTarget(addr) {
+        if (isStreamTransport(this.transport) || (0, transaction_1.addressEquals)(addr, this.server)) {
+            return this.selectServerEndpoint();
+        }
+        return (0, transaction_1.resolveRequestAddress)(addr, this.transport.addressFamily ?? 0);
+    }
+    async serverDestination() {
+        return this.pinnedServerEndpoint ?? this.selectServerEndpoint();
+    }
+    selectServerEndpoint() {
+        this.serverEndpointSelection ?? (this.serverEndpointSelection = this.resolveServerEndpoint().then((endpoint) => {
+            this.pinnedServerEndpoint = endpoint;
+            return endpoint;
+        }, (error) => {
+            // Let a later request try again, e.g. after a transient DNS failure.
+            this.serverEndpointSelection = undefined;
+            throw error;
+        }));
+        return this.serverEndpointSelection;
+    }
+    /**
+     * UDP: resolve the configured server in the bound socket's family; a udp4
+     * socket cannot send to an IPv6 answer. TCP/TLS: use the peer the socket
+     * actually connected to. Looking the hostname up again could return a
+     * different A/AAAA record, and responses from the real peer would then be
+     * dropped as coming from an unexpected address.
+     */
+    async resolveServerEndpoint() {
+        const transport = this.transport;
+        if (!isStreamTransport(transport)) {
+            return (0, transaction_1.resolveRequestAddress)(this.server, transport.addressFamily ?? 0);
+        }
+        if (transport.remoteAddress) {
+            return transport.remoteAddress;
+        }
+        if (transport instanceof common_1.TcpTransport ||
+            transport instanceof common_1.TlsTransport) {
+            throw new Error(`${transport.type} transport has no remote address`);
+        }
+        // A custom stream transport that does not report its peer: fall back to
+        // a lookup with no family preference.
+        return (0, transaction_1.resolveRequestAddress)(this.server);
+    }
+    async requestWithRetry(request, addr, signal) {
         let message, address;
         try {
-            [message, address] = await this.request(request, addr);
+            [message, address] = await this.request(request, addr, undefined, {
+                signal,
+            });
         }
         catch (error) {
             if (error instanceof exceptions_1.TransactionFailed == false) {
                 log("requestWithRetry error", error);
                 throw error;
             }
-            // resolve dns address
-            this.server = error.addr;
             const [errorCode] = error.response.getAttributeValue("ERROR-CODE");
             const nonce = error.response.getAttributeValue("NONCE");
             const realm = error.response.getAttributeValue("REALM");
@@ -490,7 +600,7 @@ class TurnProtocol {
                 }
                 this.integrityKey = makeIntegrityKey(this.username, this.realm, this.password);
                 request.transactionId = (0, helper_1.randomTransactionId)();
-                [message, address] = await this.request(request, this.server);
+                [message, address] = await this.request(request, this.server, undefined, { signal });
             }
             else {
                 throw error;
@@ -499,63 +609,134 @@ class TurnProtocol {
         return [message, address];
     }
     async sendData(data, addr) {
-        const channel = await this.getChannel(addr).catch((e) => {
-            return new Error("channelBind error");
-        });
-        if (channel instanceof Error) {
+        let channel;
+        try {
+            channel = await this.getChannel(addr);
+        }
+        catch (e) {
+            // Keep original ChannelBind error for diagnostics (403/438/timeout).
+            log("channelBind error; falling back to Send Indication", e);
+        }
+        if (!channel) {
             await this.getPermission(addr);
             const indicate = new message_1.Message(const_1.methods.SEND, const_1.classes.INDICATION)
                 .setAttribute("DATA", data)
                 .setAttribute("XOR-PEER-ADDRESS", addr);
-            await this.sendStun(indicate, this.server);
+            await this.sendStun(indicate, await this.serverDestination());
             return;
         }
-        await this.send((0, frame_1.encodeChannelData)(channel.number, data), this.server);
+        await this.send((0, frame_1.encodeChannelData)(channel.number, data), await this.serverDestination());
     }
+    /**
+     * Ensure a CreatePermission exists for the peer IP.
+     * Peer failures are isolated: a rejection for peer A does not poison peer B.
+     */
     async getPermission(addr) {
-        await this.creatingPermission;
-        const permitted = this.permissionByAddr[addr.join(":")];
-        if (!permitted) {
-            this.creatingPermission = this.createPermission(addr);
-            this.permissionByAddr[addr.join(":")] = true;
-            await this.creatingPermission.catch((e) => {
-                log("createPermission error", e);
-                throw e;
-            });
+        const key = permissionKey(addr);
+        if (this.permissionByAddr[key]) {
+            return;
+        }
+        const existing = this.creatingPermissionByAddr.get(key);
+        if (existing) {
+            return existing;
+        }
+        const operation = this.permissionQueue.then(async () => {
+            // Another caller may have succeeded while we waited on the queue.
+            if (this.permissionByAddr[key]) {
+                return;
+            }
+            await this.createPermission(addr);
+            // Cache only after successful CreatePermission.
+            this.permissionByAddr[key] = true;
+        });
+        // Do not let rejection poison subsequent peers on the shared queue.
+        this.permissionQueue = operation.then(() => undefined, () => undefined);
+        this.creatingPermissionByAddr.set(key, operation);
+        try {
+            await operation;
+        }
+        catch (error) {
+            log("createPermission error", error);
+            throw error;
+        }
+        finally {
+            if (this.creatingPermissionByAddr.get(key) === operation) {
+                this.creatingPermissionByAddr.delete(key);
+            }
         }
     }
+    /**
+     * Ensure a ChannelBind exists for the peer transport address.
+     * Peer failures are isolated; concurrent same-peer calls share one Promise.
+     */
     async getChannel(addr) {
-        if (this.channelBinding) {
-            await this.channelBinding;
+        const key = channelKey(addr);
+        const existing = this.channelBindingByAddr.get(key);
+        if (existing) {
+            return existing;
+        }
+        // Fast path: bound and not due for refresh.
+        const cached = this.channelByAddr[key];
+        const now = (0, common_1.int)(Date.now() / 1000);
+        if (cached && cached.refreshAt > now) {
+            return cached;
+        }
+        const operation = this.channelBindQueue.then(() => this.ensureChannel(addr));
+        // Do not let rejection poison subsequent peers on the shared queue.
+        this.channelBindQueue = operation.then(() => undefined, () => undefined);
+        this.channelBindingByAddr.set(key, operation);
+        try {
+            return await operation;
+        }
+        catch (error) {
+            log("channelBind error", error);
+            throw error;
+        }
+        finally {
+            if (this.channelBindingByAddr.get(key) === operation) {
+                this.channelBindingByAddr.delete(key);
+            }
+        }
+    }
+    /**
+     * Create or refresh a channel for addr. Provisional mapping is installed
+     * before the request so early ChannelData can be decoded; only a failed
+     * *initial* bind rolls the mapping back. Failed channel numbers are never
+     * reused.
+     */
+    async ensureChannel(addr) {
+        const key = channelKey(addr);
+        const now = (0, common_1.int)(Date.now() / 1000);
+        let channel = this.channelByAddr[key];
+        if (channel && channel.refreshAt > now) {
+            return channel;
         }
-        let channel = this.channelByAddr[addr.join(":")];
+        const isNew = !channel;
         if (!channel) {
-            this.channelByAddr[addr.join(":")] = {
+            channel = {
                 number: this.channelNumber++,
                 address: addr,
+                refreshAt: 0,
             };
-            channel = this.channelByAddr[addr.join(":")];
+            // Provisional mapping for ChannelData that may arrive before success.
+            this.channelByAddr[key] = channel;
             this.addrByChannel[channel.number] = addr;
-            this.channelBinding = this.channelBind(channel.number, addr);
-            await this.channelBinding.catch((e) => {
-                log("channelBind error", e);
-                throw e;
-            });
-            this.channelRefreshAt = (0, common_1.int)(Date.now() / 1000) + this.channelRefreshTime;
-            this.channelBinding = undefined;
-            log("channelBind", channel);
-        }
-        else if (this.channelRefreshAt < (0, common_1.int)(Date.now() / 1000)) {
-            this.channelBinding = this.channelBind(channel.number, addr);
-            this.channelRefreshAt = (0, common_1.int)(Date.now() / 1000) + this.channelRefreshTime;
-            await this.channelBinding.catch((e) => {
-                log("channelBind error", e);
-                throw e;
-            });
-            this.channelBinding = undefined;
-            log("channelBind refresh", channel);
         }
-        return channel;
+        try {
+            await this.channelBind(channel.number, addr);
+            channel.refreshAt = (0, common_1.int)(Date.now() / 1000) + this.channelRefreshTime;
+            log(isNew ? "channelBind" : "channelBind refresh", channel);
+            return channel;
+        }
+        catch (error) {
+            if (isNew) {
+                // Roll back provisional mapping only for a failed initial bind.
+                delete this.channelByAddr[key];
+                delete this.addrByChannel[channel.number];
+                // Do not reuse the channel number (no channelNumber--).
+            }
+            throw error;
+        }
     }
     async channelBind(channelNumber, addr) {
         const request = new message_1.Message(const_1.methods.CHANNEL_BIND, const_1.classes.REQUEST);
@@ -582,31 +763,54 @@ Object.defineProperty(TurnProtocol, "type", {
     writable: true,
     value: "turn"
 });
-async function createTurnClient({ address, username, password }, { lifetime, portRange, interfaceAddresses, ssl, tlsOptions, transport: transportType, } = {}) {
+/**
+ * Select the UDP socket type for a TURN server.
+ * Precedence: IP literal family > udpFamily > 4.
+ * An IP literal fixes the destination family, so a conflicting udpFamily is
+ * ignored (and logged) rather than making the server unreachable.
+ */
+function selectTurnUdpSocketType(address, udpFamily) {
+    const literalFamily = (0, node_net_1.isIP)(address[0]);
+    if (literalFamily === 4 || literalFamily === 6) {
+        if (udpFamily && udpFamily !== literalFamily) {
+            log("udpFamily ignored for IP literal TURN server", {
+                address,
+                udpFamily,
+                literalFamily,
+            });
+        }
+        return literalFamily === 6 ? "udp6" : "udp4";
+    }
+    return (udpFamily ?? 4) === 6 ? "udp6" : "udp4";
+}
+async function createTurnClient({ address, username, password }, { lifetime, portRange, interfaceAddresses, ssl, tlsOptions, transport: transportType, connectTimeoutMs, udpFamily, } = {}) {
     lifetime ?? (lifetime = DEFAULT_ALLOCATION_LIFETIME);
     transportType ?? (transportType = ssl ? "tls" : "udp");
     const transport = transportType === "udp"
-        ? await common_1.UdpTransport.init("udp4", { portRange, interfaceAddresses })
+        ? await common_1.UdpTransport.init(selectTurnUdpSocketType(address, udpFamily), {
+            portRange,
+            interfaceAddresses,
+        })
         : transportType === "tcp"
-            ? await common_1.TcpTransport.init(address)
-            : await common_1.TlsTransport.init(address, tlsOptions);
+            ? await common_1.TcpTransport.init(address, { connectTimeoutMs })
+            : await common_1.TlsTransport.init(address, tlsOptions, { connectTimeoutMs });
     const turn = new TurnProtocol(address, username, password, lifetime, transport);
-    await turn.connectionMade();
+    try {
+        await turn.connectionMade();
+    }
+    catch (error) {
+        try {
+            await turn.close();
+        }
+        catch (closeError) {
+            log("failed to close TURN client after allocation failure", closeError);
+        }
+        throw error;
+    }
     return turn;
 }
-async function createStunOverTurnClient({ address, username, password, }, { lifetime, portRange, interfaceAddresses, ssl, tlsOptions, transport: transportType, } = {}) {
-    const turn = await createTurnClient({
-        address,
-        username,
-        password,
-    }, {
-        lifetime,
-        portRange,
-        interfaceAddresses,
-        ssl,
-        tlsOptions,
-        transport: transportType,
-    });
+async function createStunOverTurnClient(config, options = {}) {
+    const turn = await createTurnClient(config, options);
     const turnTransport = new StunOverTurnProtocol(turn);
     return turnTransport;
 }