1
/* $Id: sess_auth.c 3553 2011-05-05 06:14:19Z nanang $ */
3
* Copyright (C) 2008-2011 Teluu Inc. (http://www.teluu.com)
4
* Copyright (C) 2003-2008 Benny Prijono <benny@prijono.org>
6
* This program is free software; you can redistribute it and/or modify
7
* it under the terms of the GNU General Public License as published by
8
* the Free Software Foundation; either version 2 of the License, or
9
* (at your option) any later version.
11
* This program is distributed in the hope that it will be useful,
12
* but WITHOUT ANY WARRANTY; without even the implied warranty of
13
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14
* GNU General Public License for more details.
16
* You should have received a copy of the GNU General Public License
17
* along with this program; if not, write to the Free Software
18
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22
#define THIS_FILE "sess_auth.c"
24
#define REALM "STUN session test"
25
#define USERNAME "theusername"
26
#define PASSWORD "thepassword"
27
#define NONCE "thenonce"
31
static pj_stun_config stun_cfg;
34
//////////////////////////////////////////////////////////////////////////////////////////
45
pj_stun_session *sess;
49
pj_stun_auth_type auth_type;
58
static pj_status_t server_send_msg(pj_stun_session *sess,
62
const pj_sockaddr_t *dst_addr,
65
pj_ssize_t len = pkt_size;
70
return pj_sock_sendto(server->sock, pkt, &len, 0, dst_addr, addr_len);
73
static pj_status_t server_on_rx_request(pj_stun_session *sess,
74
const pj_uint8_t *pkt,
76
const pj_stun_rx_data *rdata,
78
const pj_sockaddr_t *src_addr,
79
unsigned src_addr_len)
82
PJ_UNUSED_ARG(pkt_len);
85
return pj_stun_session_respond(sess, rdata, 0, NULL, NULL, PJ_TRUE,
86
src_addr, src_addr_len);
90
static pj_status_t server_get_auth(void *user_data,
95
PJ_UNUSED_ARG(user_data);
98
if (server->auth_type == PJ_STUN_AUTH_SHORT_TERM) {
99
realm->slen = nonce->slen = 0;
101
*realm = pj_str(REALM);
102
*nonce = pj_str(NONCE);
109
static pj_status_t server_get_password( const pj_stun_msg *msg,
111
const pj_str_t *realm,
112
const pj_str_t *username,
114
pj_stun_passwd_type *data_type,
118
PJ_UNUSED_ARG(user_data);
121
if (server->auth_type == PJ_STUN_AUTH_SHORT_TERM) {
122
if (realm && realm->slen) {
123
PJ_LOG(4,(THIS_FILE, " server expecting short term"));
127
if (realm==NULL || realm->slen==0) {
128
PJ_LOG(4,(THIS_FILE, " realm not present"));
133
if (pj_strcmp2(username, USERNAME) != 0) {
134
PJ_LOG(4,(THIS_FILE, " wrong username"));
138
*data_type = PJ_STUN_PASSWD_PLAIN;
139
*data = pj_str(PASSWORD);
145
static pj_bool_t server_verify_nonce(const pj_stun_msg *msg,
147
const pj_str_t *realm,
148
const pj_str_t *username,
149
const pj_str_t *nonce)
152
PJ_UNUSED_ARG(user_data);
153
PJ_UNUSED_ARG(realm);
154
PJ_UNUSED_ARG(username);
156
if (pj_strcmp2(nonce, NONCE) != 0)
163
static int server_thread(void *unused)
165
PJ_UNUSED_ARG(unused);
167
PJ_LOG(5,("", " server thread started"));
169
while (!server->quit) {
171
pj_time_val delay = {0, 10};
173
PJ_FD_ZERO(&readset);
174
PJ_FD_SET(server->sock, &readset);
176
if (pj_sock_select(server->sock+1, &readset, NULL, NULL, &delay)==1 &&
177
PJ_FD_ISSET(server->sock, &readset))
182
pj_sockaddr src_addr;
186
src_addr_len = sizeof(src_addr);
188
status = pj_sock_recvfrom(server->sock, pkt, &len, 0, &src_addr, &src_addr_len);
189
if (status != PJ_SUCCESS)
192
/* Increment server's receive count */
193
server->recv_count++;
195
/* Only pass to server if we allow to respond */
196
if (!server->responding)
199
pj_stun_session_on_rx_pkt(server->sess, pkt, len,
200
PJ_STUN_CHECK_PACKET | PJ_STUN_IS_DATAGRAM,
201
NULL, NULL, &src_addr, src_addr_len);
210
static void destroy_server(void)
212
if (server->thread) {
213
server->quit = PJ_TRUE;
214
pj_thread_join(server->thread);
215
pj_thread_destroy(server->thread);
219
pj_sock_close(server->sock);
223
pj_stun_session_destroy(server->sess);
226
pj_pool_release(server->pool);
230
/* Instantiate standard server */
231
static int create_std_server(pj_stun_auth_type auth_type,
232
pj_bool_t responding)
235
pj_stun_session_cb sess_cb;
236
pj_stun_auth_cred cred;
240
pool = pj_pool_create(mem, "server", 1000, 1000, NULL);
241
server = PJ_POOL_ZALLOC_T(pool, struct server);
243
server->auth_type = auth_type;
244
server->responding = responding;
246
/* Create STUN session */
247
pj_bzero(&sess_cb, sizeof(sess_cb));
248
sess_cb.on_rx_request = &server_on_rx_request;
249
sess_cb.on_send_msg = &server_send_msg;
250
status = pj_stun_session_create(&stun_cfg, "server", &sess_cb, PJ_FALSE, &server->sess);
251
if (status != PJ_SUCCESS) {
256
/* Configure credential */
257
pj_bzero(&cred, sizeof(cred));
258
cred.type = PJ_STUN_AUTH_CRED_DYNAMIC;
259
cred.data.dyn_cred.get_auth = &server_get_auth;
260
cred.data.dyn_cred.get_password = &server_get_password;
261
cred.data.dyn_cred.verify_nonce = &server_verify_nonce;
262
status = pj_stun_session_set_credential(server->sess, auth_type, &cred);
263
if (status != PJ_SUCCESS) {
269
status = pj_sock_socket(pj_AF_INET(), pj_SOCK_DGRAM(), 0, &server->sock);
270
if (status != PJ_SUCCESS) {
276
pj_sockaddr_in_init(&server->addr.ipv4, NULL, 0);
277
status = pj_sock_bind(server->sock, &server->addr, pj_sockaddr_get_len(&server->addr));
278
if (status != PJ_SUCCESS) {
282
/* Get the bound IP address */
283
int namelen = sizeof(server->addr);
286
status = pj_sock_getsockname(server->sock, &server->addr, &namelen);
287
if (status != PJ_SUCCESS) {
292
status = pj_gethostip(pj_AF_INET(), &addr);
293
if (status != PJ_SUCCESS) {
298
pj_sockaddr_copy_addr(&server->addr, &addr);
302
/* Create worker thread */
303
status = pj_thread_create(pool, "server", &server_thread, 0, 0, 0, &server->thread);
304
if (status != PJ_SUCCESS) {
313
//////////////////////////////////////////////////////////////////////////////////////////
321
pj_stun_session *sess;
322
pj_sem_t *test_complete;
325
pj_bool_t responding;
328
pj_status_t response_status;
329
pj_stun_msg *response;
336
static pj_status_t client_send_msg(pj_stun_session *sess,
340
const pj_sockaddr_t *dst_addr,
343
pj_ssize_t len = pkt_size;
346
PJ_UNUSED_ARG(token);
348
return pj_sock_sendto(client->sock, pkt, &len, 0, dst_addr, addr_len);
352
static void client_on_request_complete( pj_stun_session *sess,
355
pj_stun_tx_data *tdata,
356
const pj_stun_msg *response,
357
const pj_sockaddr_t *src_addr,
358
unsigned src_addr_len)
361
PJ_UNUSED_ARG(token);
362
PJ_UNUSED_ARG(tdata);
363
PJ_UNUSED_ARG(src_addr);
364
PJ_UNUSED_ARG(src_addr_len);
366
client->response_status = status;
368
client->response = pj_stun_msg_clone(client->pool, response);
370
pj_sem_post(client->test_complete);
374
static int client_thread(void *unused)
376
PJ_UNUSED_ARG(unused);
378
while (!client->quit) {
380
pj_time_val delay = {0, 10};
382
/* Also poll the timer heap */
383
pj_timer_heap_poll(stun_cfg.timer_heap, NULL);
385
/* Poll client socket */
386
PJ_FD_ZERO(&readset);
387
PJ_FD_SET(client->sock, &readset);
389
if (pj_sock_select(client->sock+1, &readset, NULL, NULL, &delay)==1 &&
390
PJ_FD_ISSET(client->sock, &readset))
395
pj_sockaddr src_addr;
399
src_addr_len = sizeof(src_addr);
401
status = pj_sock_recvfrom(client->sock, pkt, &len, 0, &src_addr, &src_addr_len);
402
if (status != PJ_SUCCESS)
405
/* Increment client's receive count */
406
client->recv_count++;
408
/* Only pass to client if we allow to respond */
409
if (!client->responding)
412
pj_stun_session_on_rx_pkt(client->sess, pkt, len,
413
PJ_STUN_CHECK_PACKET | PJ_STUN_IS_DATAGRAM,
414
NULL, NULL, &src_addr, src_addr_len);
423
static void destroy_client_server(void)
425
if (client->thread) {
427
pj_thread_join(client->thread);
428
pj_thread_destroy(client->thread);
432
pj_stun_session_destroy(client->sess);
435
pj_sock_close(client->sock);
437
if (client->test_complete)
438
pj_sem_destroy(client->test_complete);
444
static int run_client_test(const char *title,
446
pj_bool_t server_responding,
447
pj_stun_auth_type server_auth_type,
449
pj_stun_auth_type client_auth_type,
451
const char *username,
453
const char *password,
456
pj_bool_t expected_error,
457
pj_status_t expected_code,
458
const char *expected_realm,
459
const char *expected_nonce,
461
int (*more_check)(void))
464
pj_stun_session_cb sess_cb;
465
pj_stun_auth_cred cred;
466
pj_stun_tx_data *tdata;
470
PJ_LOG(3,(THIS_FILE, " %s test", title));
473
pool = pj_pool_create(mem, "client", 1000, 1000, NULL);
474
client = PJ_POOL_ZALLOC_T(pool, struct client);
476
client->responding = PJ_TRUE;
478
/* Create STUN session */
479
pj_bzero(&sess_cb, sizeof(sess_cb));
480
sess_cb.on_request_complete = &client_on_request_complete;
481
sess_cb.on_send_msg = &client_send_msg;
482
status = pj_stun_session_create(&stun_cfg, "client", &sess_cb, PJ_FALSE, &client->sess);
483
if (status != PJ_SUCCESS) {
484
destroy_client_server();
488
/* Create semaphore */
489
status = pj_sem_create(pool, "client", 0, 1, &client->test_complete);
490
if (status != PJ_SUCCESS) {
491
destroy_client_server();
495
/* Create client socket */
496
status = pj_sock_socket(pj_AF_INET(), pj_SOCK_DGRAM(), 0, &client->sock);
497
if (status != PJ_SUCCESS) {
498
destroy_client_server();
502
/* Bind client socket */
503
status = pj_sock_bind_in(client->sock, 0, 0);
504
if (status != PJ_SUCCESS) {
505
destroy_client_server();
509
/* Create client thread */
510
status = pj_thread_create(pool, "client", &client_thread, NULL, 0, 0, &client->thread);
511
if (status != PJ_SUCCESS) {
512
destroy_client_server();
516
/* Initialize credential */
517
pj_bzero(&cred, sizeof(cred));
518
cred.type = PJ_STUN_AUTH_CRED_STATIC;
519
if (realm) cred.data.static_cred.realm = pj_str((char*)realm);
520
if (username) cred.data.static_cred.username = pj_str((char*)username);
521
if (nonce) cred.data.static_cred.nonce = pj_str((char*)nonce);
522
if (password) cred.data.static_cred.data = pj_str((char*)password);
523
cred.data.static_cred.data_type = PJ_STUN_PASSWD_PLAIN;
524
status = pj_stun_session_set_credential(client->sess, client_auth_type, &cred);
525
if (status != PJ_SUCCESS) {
526
destroy_client_server();
530
/* Create the server */
531
status = create_std_server(server_auth_type, server_responding);
533
destroy_client_server();
538
status = pj_stun_session_create_req(client->sess, PJ_STUN_BINDING_REQUEST,
539
PJ_STUN_MAGIC, NULL, &tdata);
540
if (status != PJ_SUCCESS) {
541
destroy_client_server();
545
/* Add our own attributes if client authentication is set to none */
546
if (client_auth_type == PJ_STUN_AUTH_NONE) {
549
pj_stun_msg_add_string_attr(tdata->pool, tdata->msg, PJ_STUN_ATTR_REALM, pj_cstr(&tmp, realm));
551
pj_stun_msg_add_string_attr(tdata->pool, tdata->msg, PJ_STUN_ATTR_USERNAME, pj_cstr(&tmp, username));
553
pj_stun_msg_add_string_attr(tdata->pool, tdata->msg, PJ_STUN_ATTR_NONCE, pj_cstr(&tmp, nonce));
558
pj_stun_msgint_attr *mi;
560
pj_stun_msgint_attr_create(tdata->pool, &mi);
561
pj_stun_msg_add_attr(tdata->msg, &mi->hdr);
566
/* Send the request */
567
status = pj_stun_session_send_msg(client->sess, NULL, PJ_FALSE, PJ_TRUE, &server->addr,
568
pj_sockaddr_get_len(&server->addr), tdata);
569
if (status != PJ_SUCCESS) {
570
destroy_client_server();
574
/* Wait until test complete */
575
pj_sem_wait(client->test_complete);
578
/* Verify response */
579
if (expected_error) {
580
if (expected_code != client->response_status) {
581
char e1[PJ_ERR_MSG_SIZE], e2[PJ_ERR_MSG_SIZE];
583
pj_strerror(expected_code, e1, sizeof(e1));
584
pj_strerror(client->response_status, e2, sizeof(e2));
586
PJ_LOG(3,(THIS_FILE, " err: expecting %d (%s) but got %d (%s) response",
587
expected_code, e1, client->response_status, e2));
593
pj_stun_realm_attr *arealm;
594
pj_stun_nonce_attr *anonce;
596
if (client->response_status != 0) {
597
PJ_LOG(3,(THIS_FILE, " err: expecting successful operation but got error %d",
598
client->response_status));
603
if (PJ_STUN_IS_ERROR_RESPONSE(client->response->hdr.type)) {
604
pj_stun_errcode_attr *aerr = NULL;
606
aerr = (pj_stun_errcode_attr*)
607
pj_stun_msg_find_attr(client->response,
608
PJ_STUN_ATTR_ERROR_CODE, 0);
610
PJ_LOG(3,(THIS_FILE, " err: received error response without ERROR-CODE"));
615
res_code = aerr->err_code;
620
/* Check that code matches */
621
if (expected_code != res_code) {
622
PJ_LOG(3,(THIS_FILE, " err: expecting response code %d but got %d",
623
expected_code, res_code));
628
/* Find REALM and NONCE attributes */
629
arealm = (pj_stun_realm_attr*)
630
pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_REALM, 0);
631
anonce = (pj_stun_nonce_attr*)
632
pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_NONCE, 0);
634
if (expected_realm) {
635
if (arealm == NULL) {
636
PJ_LOG(3,(THIS_FILE, " err: expecting REALM in esponse"));
640
if (pj_strcmp2(&arealm->value, expected_realm)!=0) {
641
PJ_LOG(3,(THIS_FILE, " err: REALM mismatch in response"));
646
if (arealm != NULL) {
647
PJ_LOG(3,(THIS_FILE, " err: non expecting REALM in response"));
653
if (expected_nonce) {
654
if (anonce == NULL) {
655
PJ_LOG(3,(THIS_FILE, " err: expecting NONCE in esponse"));
659
if (pj_strcmp2(&anonce->value, expected_nonce)!=0) {
660
PJ_LOG(3,(THIS_FILE, " err: NONCE mismatch in response"));
665
if (anonce != NULL) {
666
PJ_LOG(3,(THIS_FILE, " err: non expecting NONCE in response"));
673
/* Our tests are okay so far. Let caller do some more tests if
676
if (rc==0 && more_check) {
677
rc = (*more_check)();
682
destroy_client_server();
687
//////////////////////////////////////////////////////////////////////////////////////////
692
/* Retransmission test */
693
static int retransmit_check(void)
696
if (server->recv_count != PJ_STUN_MAX_TRANSMIT_COUNT) {
697
PJ_LOG(3,("", " expecting %d retransmissions, got %d",
698
PJ_STUN_MAX_TRANSMIT_COUNT, server->recv_count));
701
if (client->recv_count != 0)
707
static int long_term_check1(void)
709
/* SHOULD NOT contain USERNAME or MESSAGE-INTEGRITY */
710
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_USERNAME, 0))
712
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_MESSAGE_INTEGRITY, 0))
718
static int long_term_check2(void)
720
/* response SHOULD NOT include a USERNAME, NONCE, REALM or
721
* MESSAGE-INTEGRITY attribute.
723
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_USERNAME, 0))
725
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_NONCE, 0))
727
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_REALM, 0))
729
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_MESSAGE_INTEGRITY, 0))
735
static int long_term_check3(void)
737
/* response SHOULD NOT include a USERNAME, NONCE, and REALM */
738
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_USERNAME, 0))
740
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_NONCE, 0))
742
if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_REALM, 0))
748
//////////////////////////////////////////////////////////////////////////////////////////
754
int sess_auth_test(void)
759
PJ_LOG(3,(THIS_FILE, " STUN session authentication test"));
761
/* Init STUN config */
762
pj_stun_config_init(&stun_cfg, mem, 0, NULL, NULL);
764
/* Create pool and timer heap */
765
pool = pj_pool_create(mem, "authtest", 200, 200, NULL);
766
if (pj_timer_heap_create(pool, 20, &stun_cfg.timer_heap)) {
767
pj_pool_release(pool);
771
/* Basic retransmission test */
772
rc = run_client_test("Retransmission", // title
773
PJ_FALSE, // server responding
774
PJ_STUN_AUTH_NONE, // server auth
775
PJ_STUN_AUTH_NONE, // client auth
780
PJ_FALSE, // dummy MI
781
PJ_TRUE, // expected error
782
PJNATH_ESTUNTIMEDOUT,// expected code
783
NULL, // expected realm
784
NULL, // expected nonce
785
&retransmit_check // more check
792
* Short term credential.
793
* draft-ietf-behave-rfc3489bis-15#section-10.1.2
797
* If the message does not contain both a MESSAGE-INTEGRITY and a
798
* USERNAME attribute, If the message is a request, the server MUST
799
* reject the request with an error response. This response MUST
800
* use an error code of 400 (Bad Request).
802
rc = run_client_test("Missing MESSAGE-INTEGRITY (short term)", // title
803
PJ_TRUE, // server responding
804
PJ_STUN_AUTH_SHORT_TERM, // server auth
805
PJ_STUN_AUTH_NONE, // client auth
810
PJ_FALSE, // dummy MI
811
PJ_TRUE, // expected error
812
PJ_STATUS_FROM_STUN_CODE(400),// expected code
813
NULL, // expected realm
814
NULL, // expected nonce
821
/* If the USERNAME does not contain a username value currently valid
822
* within the server: If the message is a request, the server MUST
823
* reject the request with an error response. This response MUST use
824
* an error code of 401 (Unauthorized).
826
rc = run_client_test("USERNAME mismatch (short term)", // title
827
PJ_TRUE, // server responding
828
PJ_STUN_AUTH_SHORT_TERM, // server auth
829
PJ_STUN_AUTH_SHORT_TERM, // client auth
831
"anotheruser", // username
833
"anotherpass", // password
834
PJ_FALSE, // dummy MI
835
PJ_TRUE, // expected error
836
PJ_STATUS_FROM_STUN_CODE(401),// expected code
837
NULL, // expected realm
838
NULL, // expected nonce
845
/* Using the password associated with the username, compute the value
846
* for the message-integrity as described in Section 15.4. If the
847
* resulting value does not match the contents of the MESSAGE-
848
* INTEGRITY attribute:
850
* - If the message is a request, the server MUST reject the request
851
* with an error response. This response MUST use an error code
852
* of 401 (Unauthorized).
854
rc = run_client_test("MESSAGE-INTEGRITY mismatch (short term)", // title
855
PJ_TRUE, // server responding
856
PJ_STUN_AUTH_SHORT_TERM, // server auth
857
PJ_STUN_AUTH_SHORT_TERM, // client auth
859
USERNAME, // username
861
"anotherpass", // password
862
PJ_FALSE, // dummy MI
863
PJ_TRUE, // expected error
864
PJ_STATUS_FROM_STUN_CODE(401),// expected code
865
NULL, // expected realm
866
NULL, // expected nonce
873
/* USERNAME is not present, server must respond with 400 (Bad
876
rc = run_client_test("Missing USERNAME (short term)",// title
877
PJ_TRUE, // server responding
878
PJ_STUN_AUTH_SHORT_TERM, // server auth
879
PJ_STUN_AUTH_NONE, // client auth
885
PJ_TRUE, // expected error
886
PJ_STATUS_FROM_STUN_CODE(400), // expected code
887
NULL, // expected realm
888
NULL, // expected nonce
895
/* Successful short term authentication */
896
rc = run_client_test("Successful scenario (short term)", // title
897
PJ_TRUE, // server responding
898
PJ_STUN_AUTH_SHORT_TERM, // server auth
899
PJ_STUN_AUTH_SHORT_TERM, // client auth
901
USERNAME, // username
903
PASSWORD, // password
904
PJ_FALSE, // dummy MI
905
PJ_FALSE, // expected error
906
PJ_SUCCESS, // expected code
907
NULL, // expected realm
908
NULL, // expected nonce
916
* (our own) Extended tests for long term credential
919
/* When server wants to use short term credential, but request has
920
* REALM, reject with .... 401 ???
922
rc = run_client_test("Unwanted REALM (short term)", // title
923
PJ_TRUE, // server responding
924
PJ_STUN_AUTH_SHORT_TERM, // server auth
925
PJ_STUN_AUTH_NONE, // client auth
927
USERNAME, // username
929
PASSWORD, // password
931
PJ_TRUE, // expected error
932
PJ_STATUS_FROM_STUN_CODE(401), // expected code
933
NULL, // expected realm
934
NULL, // expected nonce
935
&long_term_check2 // more check
943
* Long term credential.
944
* draft-ietf-behave-rfc3489bis-15#section-10.2.2
947
/* If the message does not contain a MESSAGE-INTEGRITY attribute, the
948
* server MUST generate an error response with an error code of 401
949
* (Unauthorized). This response MUST include a REALM value. It is
950
* RECOMMENDED that the REALM value be the domain name of the
951
* provider of the STUN server. The response MUST include a NONCE,
952
* selected by the server. The response SHOULD NOT contain a
953
* USERNAME or MESSAGE-INTEGRITY attribute.
955
rc = run_client_test("Missing M-I (long term)", // title
956
PJ_TRUE, // server responding
957
PJ_STUN_AUTH_LONG_TERM, // server auth
958
PJ_STUN_AUTH_NONE, // client auth
959
NULL, // client realm
960
NULL, // client username
961
NULL, // client nonce
962
NULL, // client password
963
PJ_FALSE, // client dummy MI
964
PJ_TRUE, // expected error
965
PJ_STATUS_FROM_STUN_CODE(401), // expected code
966
REALM, // expected realm
967
NONCE, // expected nonce
968
&long_term_check1 // more check
974
/* If the message contains a MESSAGE-INTEGRITY attribute, but is
975
* missing the USERNAME, REALM or NONCE attributes, the server MUST
976
* generate an error response with an error code of 400 (Bad
977
* Request). This response SHOULD NOT include a USERNAME, NONCE,
978
* REALM or MESSAGE-INTEGRITY attribute.
980
/* Missing USERNAME */
981
rc = run_client_test("Missing USERNAME (long term)", // title
982
PJ_TRUE, // server responding
983
PJ_STUN_AUTH_LONG_TERM, // server auth
984
PJ_STUN_AUTH_NONE, // client auth
985
REALM, // client realm
986
NULL, // client username
987
NONCE, // client nonce
988
PASSWORD, // client password
989
PJ_TRUE, // client dummy MI
990
PJ_TRUE, // expected error
991
PJ_STATUS_FROM_STUN_CODE(400), // expected code
992
NULL, // expected realm
993
NULL, // expected nonce
994
&long_term_check2 // more check
1001
rc = run_client_test("Missing REALM (long term)", // title
1002
PJ_TRUE, // server responding
1003
PJ_STUN_AUTH_LONG_TERM, // server auth
1004
PJ_STUN_AUTH_NONE, // client auth
1005
NULL, // client realm
1006
USERNAME, // client username
1007
NONCE, // client nonce
1008
PASSWORD, // client password
1009
PJ_TRUE, // client dummy MI
1010
PJ_TRUE, // expected error
1011
PJ_STATUS_FROM_STUN_CODE(400), // expected code
1012
NULL, // expected realm
1013
NULL, // expected nonce
1014
&long_term_check2 // more check
1021
rc = run_client_test("Missing NONCE (long term)", // title
1022
PJ_TRUE, // server responding
1023
PJ_STUN_AUTH_LONG_TERM, // server auth
1024
PJ_STUN_AUTH_NONE, // client auth
1025
REALM, // client realm
1026
USERNAME, // client username
1027
NULL, // client nonce
1028
PASSWORD, // client password
1029
PJ_TRUE, // client dummy MI
1030
PJ_TRUE, // expected error
1031
PJ_STATUS_FROM_STUN_CODE(400), // expected code
1032
NULL, // expected realm
1033
NULL, // expected nonce
1034
&long_term_check2 // more check
1040
/* If the NONCE is no longer valid, the server MUST generate an error
1041
* response with an error code of 438 (Stale Nonce). This response
1042
* MUST include a NONCE and REALM attribute and SHOULD NOT incude the
1043
* USERNAME or MESSAGE-INTEGRITY attribute. Servers can invalidate
1044
* nonces in order to provide additional security. See Section 4.3
1045
* of [RFC2617] for guidelines.
1049
/* If the username in the USERNAME attribute is not valid, the server
1050
* MUST generate an error response with an error code of 401
1051
* (Unauthorized). This response MUST include a REALM value. It is
1052
* RECOMMENDED that the REALM value be the domain name of the
1053
* provider of the STUN server. The response MUST include a NONCE,
1054
* selected by the server. The response SHOULD NOT contain a
1055
* USERNAME or MESSAGE-INTEGRITY attribute.
1057
rc = run_client_test("Invalid username (long term)", // title
1058
PJ_TRUE, // server responding
1059
PJ_STUN_AUTH_LONG_TERM, // server auth
1060
PJ_STUN_AUTH_LONG_TERM, // client auth
1061
REALM, // client realm
1062
"anotheruser", // client username
1063
"a nonce", // client nonce
1064
"somepassword", // client password
1065
PJ_FALSE, // client dummy MI
1066
PJ_TRUE, // expected error
1067
PJ_STATUS_FROM_STUN_CODE(401), // expected code
1068
REALM, // expected realm
1069
NONCE, // expected nonce
1070
&long_term_check1 // more check
1076
/* Successful long term authentication */
1077
rc = run_client_test("Successful scenario (long term)", // title
1078
PJ_TRUE, // server responding
1079
PJ_STUN_AUTH_LONG_TERM, // server auth
1080
PJ_STUN_AUTH_LONG_TERM, // client auth
1081
REALM, // client realm
1082
USERNAME, // client username
1083
"anothernonce", // client nonce
1084
PASSWORD, // client password
1085
PJ_FALSE, // client dummy MI
1086
PJ_FALSE, // expected error
1088
NULL, // expected realm
1089
NULL, // expected nonce
1090
&long_term_check3 // more check
1097
* (our own) Extended tests for long term credential
1100
/* If REALM doesn't match, server must respond with 401
1103
// STUN session now will just use the realm sent in the
1104
// response, so this test will fail because it will
1105
// authenticate successfully.
1107
rc = run_client_test("Invalid REALM (long term)", // title
1108
PJ_TRUE, // server responding
1109
PJ_STUN_AUTH_LONG_TERM, // server auth
1110
PJ_STUN_AUTH_LONG_TERM, // client auth
1111
"anotherrealm", // client realm
1112
USERNAME, // client username
1113
NONCE, // client nonce
1114
PASSWORD, // client password
1115
PJ_FALSE, // client dummy MI
1116
PJ_TRUE, // expected error
1117
PJ_STATUS_FROM_STUN_CODE(401), // expected code
1118
REALM, // expected realm
1119
NONCE, // expected nonce
1120
&long_term_check1 // more check
1129
/* Valid static short term, without NONCE */
1131
/* Valid static short term, WITH NONCE */
1133
/* Valid static long term (with NONCE */
1135
/* Valid dynamic short term (without NONCE) */
1137
/* Valid dynamic short term (with NONCE) */
1139
/* Valid dynamic long term (with NONCE) */
1143
pj_timer_heap_destroy(stun_cfg.timer_heap);
1144
pj_pool_release(pool);