Index: pjproject/trunk/pjnath/build/Makefile
===================================================================
--- pjproject/trunk/pjnath/build/Makefile	(revision 1876)
+++ pjproject/trunk/pjnath/build/Makefile	(revision 1877)
@@ -39,5 +39,5 @@
 #
 export PJNATH_TEST_SRCDIR = ../src/pjnath-test
-export PJNATH_TEST_OBJS += ice_test.o stun.o test.o
+export PJNATH_TEST_OBJS += ice_test.o stun.o sess_auth.o test.o
 export PJNATH_TEST_CFLAGS += $(_CFLAGS)
 export PJNATH_TEST_LDFLAGS += $(_LDFLAGS)
Index: pjproject/trunk/pjnath/build/pjnath_test.dsp
===================================================================
--- pjproject/trunk/pjnath/build/pjnath_test.dsp	(revision 1876)
+++ pjproject/trunk/pjnath/build/pjnath_test.dsp	(revision 1877)
@@ -96,4 +96,8 @@
 # Begin Source File
 
+SOURCE="..\src\pjnath-test\sess_auth.c"
+# End Source File
+# Begin Source File
+
 SOURCE="..\src\pjnath-test\stun.c"
 # End Source File
Index: pjproject/trunk/pjnath/include/pjnath/stun_auth.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/stun_auth.h	(revision 1876)
+++ pjproject/trunk/pjnath/include/pjnath/stun_auth.h	(revision 1877)
@@ -40,4 +40,27 @@
 
 /**
+ * Type of authentication.
+ */
+typedef enum pj_stun_auth_type
+{ 
+    /**
+     * No authentication.
+     */
+    PJ_STUN_AUTH_NONE = 0,
+
+    /**
+     * Authentication using short term credential.
+     */
+    PJ_STUN_AUTH_SHORT_TERM = 1,
+
+    /**
+     * Authentication using long term credential.
+     */
+    PJ_STUN_AUTH_LONG_TERM = 2
+
+} pj_stun_auth_type;
+
+
+/**
  * Type of authentication data in the credential.
  */
@@ -60,4 +83,24 @@
 
 } pj_stun_auth_cred_type;
+
+
+/**
+ * Type of encoding applied to the password stored in the credential.
+ */
+typedef enum pj_stun_passwd_type
+{
+    /**
+     * Plain text password.
+     */
+    PJ_STUN_PASSWD_PLAIN    = 0,
+
+    /**
+     * Hashed password, valid for long term credential only. The hash value
+     * of the password is calculated as MD5(USERNAME ":" REALM ":" PASSWD)
+     * with all quotes removed from the username and realm values.
+     */
+    PJ_STUN_PASSWD_HASHED = 1
+
+} pj_stun_passwd_type;
 
 
@@ -90,17 +133,15 @@
 	     * If not-empty, it indicates that this is a long term credential.
 	     */
-	    pj_str_t	  realm;
+	    pj_str_t		realm;
 
 	    /** 
 	     * The username of the credential.
 	     */
-	    pj_str_t	  username;
+	    pj_str_t		username;
 
 	    /**
 	     * Data type to indicate the type of password in the \a data field.
-	     * Value zero indicates that the data contains a plaintext
-	     * password.
-	     */
-	    int		  data_type;
+	     */
+	    pj_stun_passwd_type	data_type;
 
 	    /** 
@@ -109,10 +150,10 @@
 	     * plaintext password.
 	     */
-	    pj_str_t	  data;
+	    pj_str_t		data;
 
 	    /** 
 	     * Optional NONCE.
 	     */
-	    pj_str_t	  nonce;
+	    pj_str_t		nonce;
 
 	} static_cred;
@@ -157,5 +198,5 @@
 
 	    /**
-	     * Get the credential to be put in outgoing message.
+	     * Get the credential to be put in outgoing request.
 	     *
 	     * @param msg	The outgoing message where the credential is
@@ -187,5 +228,5 @@
 				    pj_str_t *username,
 				    pj_str_t *nonce,
-				    int *data_type,
+				    pj_stun_passwd_type *data_type,
 				    pj_str_t *data);
 
@@ -218,5 +259,5 @@
 				        const pj_str_t *username,
 					pj_pool_t *pool,
-					int *data_type,
+					pj_stun_passwd_type *data_type,
 					pj_str_t *data);
 
@@ -251,4 +292,38 @@
 
 /**
+ * This structure contains the credential information that is found and
+ * used to authenticate incoming requests. Application may use this
+ * information when generating authentication for the outgoing response.
+ */
+typedef struct pj_stun_req_cred_info
+{
+    /**
+     * The REALM value found in the incoming request. If short term 
+     * credential is used, the value will be empty.
+     */
+    pj_str_t	realm;
+
+    /**
+     * The USERNAME value found in the incoming request.
+     */
+    pj_str_t	username;
+
+    /**
+     * Optional NONCE.
+     */
+    pj_str_t	nonce;
+
+    /**
+     * Authentication key that was used to authenticate the incoming 
+     * request. This key is created with #pj_stun_create_key(), and
+     * it can be used to encode the credential of the outgoing
+     * response.
+     */
+    pj_str_t	auth_key;
+
+} pj_stun_req_cred_info;
+
+
+/**
  * Duplicate authentication credential.
  *
@@ -261,4 +336,38 @@
 				      const pj_stun_auth_cred *src);
 
+/**
+ * Duplicate request credential.
+ *
+ * @param pool		Pool to be used to allocate memory.
+ * @param dst		Destination credential.
+ * @param src		Source credential.
+ */
+PJ_DECL(void) pj_stun_req_cred_info_dup(pj_pool_t *pool,
+					pj_stun_req_cred_info *dst,
+					const pj_stun_req_cred_info *src);
+
+
+/**
+ * Create authentication key to be used for encoding the message with
+ * MESSAGE-INTEGRITY. If short term credential is used (i.e. the realm
+ * argument is NULL or empty), the key will be copied from the password.
+ * If long term credential is used, the key will be calculated from the
+ * MD5 hash of the realm, username, and password.
+ *
+ * @param pool		Pool to allocate memory for the key.
+ * @param key		String to receive the key.
+ * @param realm		The realm of the credential, if long term credential
+ *			is to be used. If short term credential is wanted,
+ *			application can put NULL or empty string here.
+ * @param username	The username.
+ * @param data_type	Password encoding.
+ * @param data		The password.
+ */
+PJ_DECL(void) pj_stun_create_key(pj_pool_t *pool,
+				 pj_str_t *key,
+				 const pj_str_t *realm,
+				 const pj_str_t *username,
+				 pj_stun_passwd_type data_type,
+				 const pj_str_t *data);
 
 /**
@@ -278,7 +387,7 @@
  * @param pool		If response is to be created, then memory will
  *			be allocated from this pool.
- * @param auth_key	Optional pointer to receive authentication key to
- *			calculate MESSAGE-INTEGRITY of the response, if
- *			the response needs to be authenticated.
+ * @param info		Optional pointer to receive authentication information
+ *			found in the request and the credential that is used
+ *			to authenticate the request.
  * @param p_response	Optional pointer to receive the response message
  *			then the credential in the request fails to
@@ -295,5 +404,5 @@
 					          pj_stun_auth_cred *cred,
 					          pj_pool_t *pool,
-						  pj_str_t *auth_key,
+						  pj_stun_req_cred_info *info,
 					          pj_stun_msg **p_response);
 
Index: pjproject/trunk/pjnath/include/pjnath/stun_msg.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/stun_msg.h	(revision 1876)
+++ pjproject/trunk/pjnath/include/pjnath/stun_msg.h	(revision 1877)
@@ -1226,4 +1226,15 @@
 
 /**
+ * Clone a STUN message with all of its attributes.
+ *
+ * @param pool		Pool to allocate memory for the new message.
+ * @param msg		The message to be cloned.
+ *
+ * @return		The duplicate message.
+ */
+PJ_DECL(pj_stun_msg*) pj_stun_msg_clone(pj_pool_t *pool,
+					const pj_stun_msg *msg);
+
+/**
  * Create STUN response message. 
  *
@@ -1300,28 +1311,4 @@
 					const pj_str_t *key,
 				        unsigned *p_msg_len);
-
-
-/**
- * Create authentication key to be used for encoding the message with
- * MESSAGE-INTEGRITY. If short term credential is used (i.e. the realm
- * argument is NULL or empty), the key will be copied from the password.
- * If long term credential is used, the key will be calculated from the
- * MD5 hash of the realm, username, and password.
- *
- * @param pool		Pool to allocate memory for the key.
- * @param key		String to receive the key.
- * @param realm		The realm of the credential, if long term credential
- *			is to be used. If short term credential is wanted,
- *			application can put NULL or empty string here.
- * @param username	The username.
- * @param passwd	The clear text password.
- */
-PJ_DECL(void) pj_stun_create_key(pj_pool_t *pool,
-				 pj_str_t *key,
-				 const pj_str_t *realm,
-				 const pj_str_t *username,
-				 const pj_str_t *passwd);
-
-
 
 /**
@@ -1418,4 +1405,16 @@
 
 /**
+ * Clone a STUN attribute.
+ *
+ * @param pool		Pool to allocate memory.
+ * @param attr		Attribute to clone.
+ *
+ * @return		Duplicate attribute.
+ */
+PJ_DECL(pj_stun_attr_hdr*) pj_stun_attr_clone(pj_pool_t *pool,
+					      const pj_stun_attr_hdr *attr);
+
+
+/**
  * Create a generic STUN IP address attribute. The \a addr_len and
  * \a addr parameters specify whether the address is IPv4 or IPv4
Index: pjproject/trunk/pjnath/include/pjnath/stun_session.h
===================================================================
--- pjproject/trunk/pjnath/include/pjnath/stun_session.h	(revision 1876)
+++ pjproject/trunk/pjnath/include/pjnath/stun_session.h	(revision 1877)
@@ -46,4 +46,7 @@
 /** Forward declaration for pj_stun_tx_data */
 typedef struct pj_stun_tx_data pj_stun_tx_data;
+
+/** Forward declaration for pj_stun_rx_data */
+typedef struct pj_stun_rx_data pj_stun_rx_data;
 
 /** Forward declaration for pj_stun_session */
@@ -86,5 +89,5 @@
      * @param pkt	    Pointer to the original STUN packet.
      * @param pkt_len	    Length of the STUN packet.
-     * @param msg	    The parsed STUN request.
+     * @param rdata	    Data containing incoming request message.
      * @param src_addr	    Source address of the packet.
      * @param src_addr_len  Length of the source address.
@@ -97,5 +100,5 @@
 				 const pj_uint8_t *pkt,
 				 unsigned pkt_len,
-				 const pj_stun_msg *msg,
+				 const pj_stun_rx_data *rdata,
 				 const pj_sockaddr_t *src_addr,
 				 unsigned src_addr_len);
@@ -145,4 +148,23 @@
 
 /**
+ * This structure describes incoming request message.
+ */
+struct pj_stun_rx_data
+{
+    /**
+     * The parsed request message.
+     */
+    pj_stun_msg		    *msg;
+
+    /**
+     * Credential information that is found and used to authenticate 
+     * incoming request. Application may use this information when 
+     * generating  authentication for the outgoing response.
+     */
+    pj_stun_req_cred_info   info;
+};
+
+
+/**
  * This structure describe the outgoing STUN transmit data to carry the
  * message to be sent.
@@ -162,5 +184,5 @@
     pj_uint8_t		 msg_key[12];	/**< Message/transaction key.	    */
 
-    pj_str_t		 auth_key;	/**< Auth key.			    */
+    pj_stun_req_cred_info auth_info;	/**< Credential info		    */
 
     void		*pkt;		/**< The STUN packet.		    */
@@ -260,4 +282,5 @@
  *
  * @param sess	    The STUN session instance.
+ * @param auth_type Type of authentication.
  * @param cred	    The credential to be used by this session. If NULL
  *		    is specified, authentication will be disabled.
@@ -265,6 +288,7 @@
  * @return	    PJ_SUCCESS on success, or the appropriate error code.
  */
-PJ_DECL(void) pj_stun_session_set_credential(pj_stun_session *sess,
-					     const pj_stun_auth_cred *cred);
+PJ_DECL(pj_status_t) pj_stun_session_set_credential(pj_stun_session *sess,
+						pj_stun_auth_type auth_type,
+						const pj_stun_auth_cred *cred);
 
 /**
@@ -329,5 +353,5 @@
  */
 PJ_DECL(pj_status_t) pj_stun_session_create_res(pj_stun_session *sess,
-						const pj_stun_msg *req,
+						const pj_stun_rx_data *rdata,
 						unsigned err_code,
 						const pj_str_t *err_msg,
@@ -363,5 +387,5 @@
  *
  * @param sess	    The STUN session instance.
- * @param req	    The STUN request message to be responded.
+ * @param rdata	    The STUN request message to be responded.
  * @param err_code  Error code to be set in the response, if error response
  *		    is to be created, according to pj_stun_status enumeration.
@@ -383,5 +407,5 @@
  */
 PJ_DECL(pj_status_t) pj_stun_session_respond(pj_stun_session *sess, 
-					     const pj_stun_msg *req,
+					     const pj_stun_rx_data *rdata,
 					     unsigned code, 
 					     const char *err_msg,
Index: pjproject/trunk/pjnath/src/pjnath-test/sess_auth.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath-test/sess_auth.c	(revision 1877)
+++ pjproject/trunk/pjnath/src/pjnath-test/sess_auth.c	(revision 1877)
@@ -0,0 +1,1125 @@
+/* $Id$ */
+/* 
+ * Copyright (C) 2003-2007 Benny Prijono <benny@prijono.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
+ */
+#include "test.h"
+
+#define THIS_FILE   "sess_auth.c"
+
+#define REALM	    "STUN session test"
+#define USERNAME    "theusername"
+#define PASSWORD    "thepassword"
+#define NONCE	    "thenonce"
+
+
+/* STUN config */
+static pj_stun_config stun_cfg;
+
+
+//////////////////////////////////////////////////////////////////////////////////////////
+//
+// SERVER PART
+//
+
+
+/* Server instance */
+static struct server
+{
+    pj_pool_t		*pool;
+    pj_sockaddr		 addr;
+    pj_stun_session	*sess;
+
+    pj_bool_t		 responding;
+    unsigned		 recv_count;
+    pj_stun_auth_type	 auth_type;
+
+    pj_sock_t		 sock;
+
+    pj_bool_t		 quit;
+    pj_thread_t		*thread;
+} *server;
+
+
+static pj_status_t server_send_msg(pj_stun_session *sess,
+				   const void *pkt,
+				   pj_size_t pkt_size,
+				   const pj_sockaddr_t *dst_addr,
+				   unsigned addr_len)
+{
+    pj_ssize_t len = pkt_size;
+
+    PJ_UNUSED_ARG(sess);
+
+    return pj_sock_sendto(server->sock, pkt, &len, 0, dst_addr, addr_len);
+}
+
+static pj_status_t server_on_rx_request(pj_stun_session *sess,
+					const pj_uint8_t *pkt,
+					unsigned pkt_len,
+					const pj_stun_rx_data *rdata,
+					const pj_sockaddr_t *src_addr,
+					unsigned src_addr_len)
+{
+    PJ_UNUSED_ARG(pkt);
+    PJ_UNUSED_ARG(pkt_len);
+
+    return pj_stun_session_respond(sess, rdata, 0, NULL, PJ_TRUE, 
+				   src_addr, src_addr_len);
+}
+
+
+static pj_status_t server_get_auth(void *user_data,
+				   pj_pool_t *pool,
+				   pj_str_t *realm,
+				   pj_str_t *nonce)
+{
+    PJ_UNUSED_ARG(user_data);
+    PJ_UNUSED_ARG(pool);
+
+    if (server->auth_type == PJ_STUN_AUTH_SHORT_TERM) {
+	realm->slen = nonce->slen = 0;
+    } else {
+	*realm = pj_str(REALM);
+	*nonce = pj_str(NONCE);
+    }
+
+    return PJ_SUCCESS;
+}
+
+
+static pj_status_t server_get_password( const pj_stun_msg *msg,
+					void *user_data, 
+				        const pj_str_t *realm,
+				        const pj_str_t *username,
+					pj_pool_t *pool,
+					pj_stun_passwd_type *data_type,
+					pj_str_t *data)
+{
+    PJ_UNUSED_ARG(msg);
+    PJ_UNUSED_ARG(user_data);
+    PJ_UNUSED_ARG(pool);
+
+    if (server->auth_type == PJ_STUN_AUTH_SHORT_TERM) {
+	if (realm && realm->slen) {
+	    PJ_LOG(4,(THIS_FILE, "    server expecting short term"));
+	    return -1;
+	}
+    } else {
+	if (realm==NULL || realm->slen==0) {
+	    PJ_LOG(4,(THIS_FILE, "    realm not present"));
+	    return -1;
+	}
+    }
+
+    if (pj_strcmp2(username, USERNAME) != 0) {
+	PJ_LOG(4,(THIS_FILE, "    wrong username"));
+	return -1;
+    }
+
+    *data_type = PJ_STUN_PASSWD_PLAIN;
+    *data = pj_str(PASSWORD);
+
+    return PJ_SUCCESS;
+}
+
+
+static pj_bool_t server_verify_nonce(const pj_stun_msg *msg,
+				     void *user_data,
+				     const pj_str_t *realm,
+				     const pj_str_t *username,
+				     const pj_str_t *nonce)
+{
+    PJ_UNUSED_ARG(msg);
+    PJ_UNUSED_ARG(user_data);
+    PJ_UNUSED_ARG(realm);
+    PJ_UNUSED_ARG(username);
+
+    if (pj_strcmp2(nonce, NONCE) != 0)
+	return PJ_FALSE;
+
+    return PJ_TRUE;
+}
+
+
+static int server_thread(void *unused)
+{
+    PJ_UNUSED_ARG(unused);
+
+    while (!server->quit) {
+	pj_fd_set_t readset;
+	pj_time_val delay = {0, 10};
+
+	PJ_FD_ZERO(&readset);
+	PJ_FD_SET(server->sock, &readset);
+
+	if (pj_sock_select(server->sock, &readset, NULL, NULL, &delay)==1 &&
+	    PJ_FD_ISSET(server->sock, &readset)) 
+	{
+	    char pkt[1000];
+	    pj_ssize_t len;
+	    pj_status_t status;
+	    pj_sockaddr src_addr;
+	    int src_addr_len;
+
+	    len = sizeof(pkt);
+	    src_addr_len = sizeof(src_addr);
+
+	    status = pj_sock_recvfrom(server->sock, pkt, &len, 0, &src_addr, &src_addr_len);
+	    if (status != PJ_SUCCESS)
+		continue;
+
+	    /* Increment server's receive count */
+	    server->recv_count++;
+
+	    /* Only pass to server if we allow to respond */
+	    if (!server->responding)
+		continue;
+
+	    pj_stun_session_on_rx_pkt(server->sess, pkt, len, 
+				      PJ_STUN_CHECK_PACKET | PJ_STUN_IS_DATAGRAM,
+				      NULL, &src_addr, src_addr_len);
+	}
+    }
+
+    return 0;
+}
+
+
+/* Destroy server */
+static void destroy_server(void)
+{
+    if (server->thread) {
+	server->quit = PJ_TRUE;
+	pj_thread_join(server->thread);
+	pj_thread_destroy(server->thread);
+    }
+
+    if (server->sock) {
+	pj_sock_close(server->sock);
+    }
+
+    if (server->sess) {
+	pj_stun_session_destroy(server->sess);
+    }
+
+    pj_pool_release(server->pool);
+    server = NULL;
+}
+
+/* Instantiate standard server */
+static int create_std_server(pj_stun_auth_type auth_type,
+			     pj_bool_t responding)
+{
+    pj_pool_t *pool;
+    pj_stun_session_cb sess_cb;
+    pj_stun_auth_cred cred;
+    pj_status_t status;
+    
+    /* Create server */
+    pool = pj_pool_create(mem, "server", 1000, 1000, NULL);
+    server = PJ_POOL_ZALLOC_T(pool, struct server);
+    server->pool = pool;
+    server->auth_type = auth_type;
+    server->responding = responding;
+
+    /* Create STUN session */
+    pj_bzero(&sess_cb, sizeof(sess_cb));
+    sess_cb.on_rx_request = &server_on_rx_request;
+    sess_cb.on_send_msg = &server_send_msg;
+    status = pj_stun_session_create(&stun_cfg, "server", &sess_cb, PJ_FALSE, &server->sess);
+    if (status != PJ_SUCCESS) {
+	destroy_server();
+	return -10;
+    }
+
+    /* Configure credential */
+    pj_bzero(&cred, sizeof(cred));
+    cred.type = PJ_STUN_AUTH_CRED_DYNAMIC;
+    cred.data.dyn_cred.get_auth = &server_get_auth;
+    cred.data.dyn_cred.get_password = &server_get_password;
+    cred.data.dyn_cred.verify_nonce = &server_verify_nonce;
+    status = pj_stun_session_set_credential(server->sess, auth_type, &cred);
+    if (status != PJ_SUCCESS) {
+	destroy_server();
+	return -20;
+    }
+
+    /* Create socket */
+    status = pj_sock_socket(pj_AF_INET(), pj_SOCK_DGRAM(), 0, &server->sock);
+    if (status != PJ_SUCCESS) {
+	destroy_server();
+	return -30;
+    }
+
+    /* Bind */
+    pj_sockaddr_in_init(&server->addr.ipv4, NULL, 0);
+    status = pj_sock_bind(server->sock, &server->addr, pj_sockaddr_get_len(&server->addr));
+    if (status != PJ_SUCCESS) {
+	destroy_server();
+	return -40;
+    } else {
+	/* Get the bound IP address */
+	int namelen = sizeof(server->addr);
+	pj_sockaddr addr;
+
+	status = pj_sock_getsockname(server->sock, &server->addr, &namelen);
+	if (status != PJ_SUCCESS) {
+	    destroy_server();
+	    return -43;
+	}
+
+	status = pj_gethostip(pj_AF_INET(), &addr);
+	if (status != PJ_SUCCESS) {
+	    destroy_server();
+	    return -45;
+	}
+
+	pj_sockaddr_copy_addr(&server->addr, &addr);
+    }
+
+
+    /* Create worker thread */
+    status = pj_thread_create(pool, "server", &server_thread, 0, 0, 0, &server->thread);
+    if (status != PJ_SUCCESS) {
+	destroy_server();
+	return -30;
+    }
+
+    return 0;
+}
+
+
+//////////////////////////////////////////////////////////////////////////////////////////
+//
+// CLIENT PART
+//
+
+static struct client
+{
+    pj_pool_t	    *pool;
+    pj_stun_session *sess;
+    pj_sem_t	    *test_complete;
+    pj_sock_t	     sock;
+
+    pj_bool_t	     responding;
+    unsigned	     recv_count;
+
+    pj_status_t	     response_status;
+    pj_stun_msg	    *response;
+
+    pj_bool_t	     quit;
+    pj_thread_t	    *thread;
+} *client;
+
+
+static pj_status_t client_send_msg(pj_stun_session *sess,
+				   const void *pkt,
+				   pj_size_t pkt_size,
+				   const pj_sockaddr_t *dst_addr,
+				   unsigned addr_len)
+{
+    pj_ssize_t len = pkt_size;
+
+    PJ_UNUSED_ARG(sess);
+
+    return pj_sock_sendto(client->sock, pkt, &len, 0, dst_addr, addr_len);
+}
+
+
+static void client_on_request_complete( pj_stun_session *sess,
+					pj_status_t status,
+					pj_stun_tx_data *tdata,
+					const pj_stun_msg *response,
+					const pj_sockaddr_t *src_addr,
+					unsigned src_addr_len)
+{
+    PJ_UNUSED_ARG(sess);
+    PJ_UNUSED_ARG(tdata);
+    PJ_UNUSED_ARG(src_addr);
+    PJ_UNUSED_ARG(src_addr_len);
+
+    client->response_status = status;
+    if (response)
+	client->response = pj_stun_msg_clone(client->pool, response);
+
+    pj_sem_post(client->test_complete);
+}
+
+
+static int client_thread(void *unused)
+{
+    PJ_UNUSED_ARG(unused);
+
+    while (!client->quit) {
+	pj_fd_set_t readset;
+	pj_time_val delay = {0, 10};
+
+	/* Also poll the timer heap */
+	pj_timer_heap_poll(stun_cfg.timer_heap, NULL);
+
+	/* Poll client socket */
+	PJ_FD_ZERO(&readset);
+	PJ_FD_SET(client->sock, &readset);
+
+	if (pj_sock_select(client->sock, &readset, NULL, NULL, &delay)==1 &&
+	    PJ_FD_ISSET(client->sock, &readset)) 
+	{
+	    char pkt[1000];
+	    pj_ssize_t len;
+	    pj_status_t status;
+	    pj_sockaddr src_addr;
+	    int src_addr_len;
+
+	    len = sizeof(pkt);
+	    src_addr_len = sizeof(src_addr);
+
+	    status = pj_sock_recvfrom(client->sock, pkt, &len, 0, &src_addr, &src_addr_len);
+	    if (status != PJ_SUCCESS)
+		continue;
+
+	    /* Increment client's receive count */
+	    client->recv_count++;
+
+	    /* Only pass to client if we allow to respond */
+	    if (!client->responding)
+		continue;
+
+	    pj_stun_session_on_rx_pkt(client->sess, pkt, len, 
+				      PJ_STUN_CHECK_PACKET | PJ_STUN_IS_DATAGRAM,
+				      NULL, &src_addr, src_addr_len);
+	}
+ 
+    }
+
+    return 0;
+}
+
+
+static void destroy_client_server(void)
+{
+    if (client->thread) {
+	client->quit = 1;
+	pj_thread_join(client->thread);
+	pj_thread_destroy(client->thread);
+    }
+
+    if (client->sess)
+	pj_stun_session_destroy(client->sess);
+
+    if (client->sock)
+	pj_sock_close(client->sock);
+
+    if (client->test_complete)
+	pj_sem_destroy(client->test_complete);
+
+    if (server)
+	destroy_server();
+}
+
+static int run_client_test(const char *title,
+
+			   pj_bool_t server_responding,
+			   pj_stun_auth_type server_auth_type,
+
+			   pj_stun_auth_type client_auth_type,
+			   const char *realm,
+			   const char *username,
+			   const char *nonce,
+			   const char *password,
+			   pj_bool_t dummy_mi,
+
+			   pj_stun_status expected_error,
+			   pj_stun_status expected_code,
+			   const char *expected_realm,
+			   const char *expected_nonce,
+			   
+			   int (*more_check)(void))
+{
+    pj_pool_t *pool;
+    pj_stun_session_cb sess_cb;
+    pj_stun_auth_cred cred;
+    pj_stun_tx_data *tdata;
+    pj_status_t status;
+    int rc = 0;
+    
+    PJ_LOG(3,(THIS_FILE, "   %s test", title));
+
+    /* Create client */
+    pool = pj_pool_create(mem, "client", 1000, 1000, NULL);
+    client = PJ_POOL_ZALLOC_T(pool, struct client);
+    client->pool = pool;
+    client->responding = PJ_TRUE;
+
+    /* Create STUN session */
+    pj_bzero(&sess_cb, sizeof(sess_cb));
+    sess_cb.on_request_complete = &client_on_request_complete;
+    sess_cb.on_send_msg = &client_send_msg;
+    status = pj_stun_session_create(&stun_cfg, "client", &sess_cb, PJ_FALSE, &client->sess);
+    if (status != PJ_SUCCESS) {
+	destroy_client_server();
+	return -200;
+    }
+
+    /* Create semaphore */
+    status = pj_sem_create(pool, "client", 0, 1, &client->test_complete);
+    if (status != PJ_SUCCESS) {
+	destroy_client_server();
+	return -205;
+    }
+
+    /* Create client socket */
+    status = pj_sock_socket(pj_AF_INET(), pj_SOCK_DGRAM(), 0, &client->sock);
+    if (status != PJ_SUCCESS) {
+	destroy_client_server();
+	return -210;
+    }
+
+    /* Bind client socket */
+    status = pj_sock_bind_in(client->sock, 0, 0);
+    if (status != PJ_SUCCESS) {
+	destroy_client_server();
+	return -220;
+    }
+
+    /* Create client thread */
+    status = pj_thread_create(pool, "client", &client_thread, NULL, 0, 0, &client->thread);
+    if (status != PJ_SUCCESS) {
+	destroy_client_server();
+	return -230;
+    }
+
+    /* Initialize credential */
+    pj_bzero(&cred, sizeof(cred));
+    cred.type = PJ_STUN_AUTH_CRED_STATIC;
+    if (realm) cred.data.static_cred.realm = pj_str((char*)realm);
+    if (username) cred.data.static_cred.username = pj_str((char*)username);
+    if (nonce) cred.data.static_cred.nonce = pj_str((char*)nonce);
+    if (password) cred.data.static_cred.data = pj_str((char*)password);
+    cred.data.static_cred.data_type = PJ_STUN_PASSWD_PLAIN;
+    status = pj_stun_session_set_credential(client->sess, client_auth_type, &cred);
+    if (status != PJ_SUCCESS) {
+	destroy_client_server();
+	return -240;
+    }
+
+    /* Create the server */
+    status = create_std_server(server_auth_type, server_responding);
+    if (status != 0) {
+	destroy_client_server();
+	return status;
+    }
+
+    /* Create request */
+    status = pj_stun_session_create_req(client->sess, PJ_STUN_BINDING_REQUEST, 
+					PJ_STUN_MAGIC, NULL, &tdata);
+    if (status != PJ_SUCCESS) {
+	destroy_client_server();
+	return -250;
+    }
+
+    /* Add our own attributes if client authentication is set to none */
+    if (client_auth_type == PJ_STUN_AUTH_NONE) {
+	pj_str_t tmp;
+	if (realm)
+	    pj_stun_msg_add_string_attr(tdata->pool, tdata->msg, PJ_STUN_ATTR_REALM, pj_cstr(&tmp, realm));
+	if (username)
+	    pj_stun_msg_add_string_attr(tdata->pool, tdata->msg, PJ_STUN_ATTR_USERNAME, pj_cstr(&tmp, username));
+	if (nonce)
+	    pj_stun_msg_add_string_attr(tdata->pool, tdata->msg, PJ_STUN_ATTR_NONCE, pj_cstr(&tmp, nonce));
+	if (password) {
+	    // ignored
+	}
+	if (dummy_mi) {
+	    pj_stun_msgint_attr *mi;
+
+	    pj_stun_msgint_attr_create(tdata->pool, &mi);
+	    pj_stun_msg_add_attr(tdata->msg, &mi->hdr);
+	}
+	   
+    }
+
+    /* Send the request */
+    status = pj_stun_session_send_msg(client->sess, PJ_FALSE, &server->addr,
+				      pj_sockaddr_get_len(&server->addr), tdata);
+    if (status != PJ_SUCCESS) {
+	destroy_client_server();
+	return -270;
+    }
+
+    /* Wait until test complete */
+    pj_sem_wait(client->test_complete);
+
+
+    /* Verify response */
+    if (expected_error) {
+	if (expected_code != client->response_status) {
+	    char e1[PJ_ERR_MSG_SIZE], e2[PJ_ERR_MSG_SIZE];
+
+	    pj_strerror(expected_code, e1, sizeof(e1));
+	    pj_strerror(client->response_status, e2, sizeof(e2));
+
+	    PJ_LOG(3,(THIS_FILE, "    err: expecting %d (%s) but got %d (%s) response",
+		      expected_code, e1, client->response_status, e2));
+	    rc = -500;
+	} 
+
+    } else {
+	int res_code = 0;
+	pj_stun_realm_attr *arealm;
+	pj_stun_nonce_attr *anonce;
+
+	if (client->response_status != 0) {
+	    PJ_LOG(3,(THIS_FILE, "    err: expecting successful operation but got error %d", 
+		      client->response_status));
+	    rc = -600;
+	    goto done;
+	} 
+
+	if (PJ_STUN_IS_ERROR_RESPONSE(client->response->hdr.type)) {
+	    pj_stun_errcode_attr *aerr = NULL;
+
+	    aerr = (pj_stun_errcode_attr*)
+		   pj_stun_msg_find_attr(client->response, 
+					 PJ_STUN_ATTR_ERROR_CODE, 0);
+	    if (aerr == NULL) {
+		PJ_LOG(3,(THIS_FILE, "    err: received error response without ERROR-CODE"));
+		rc = -610;
+		goto done;
+	    }
+
+	    res_code = aerr->err_code;
+	} else {
+	    res_code = 0;
+	}
+
+	/* Check that code matches */
+	if (expected_code != res_code) {
+	    PJ_LOG(3,(THIS_FILE, "    err: expecting response code %d but got %d",
+		      expected_code, res_code));
+	    rc = -620;
+	    goto done;
+	}
+
+	/* Find REALM and NONCE attributes */
+	arealm = (pj_stun_realm_attr*)
+	         pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_REALM, 0);
+	anonce = (pj_stun_nonce_attr*)
+	         pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_NONCE, 0);
+
+	if (expected_realm) {
+	    if (arealm == NULL) {
+		PJ_LOG(3,(THIS_FILE, "    err: expecting REALM in esponse"));
+		rc = -630;
+		goto done;
+	    }
+	    if (pj_strcmp2(&arealm->value, expected_realm)!=0) {
+		PJ_LOG(3,(THIS_FILE, "    err: REALM mismatch in response"));
+		rc = -640;
+		goto done;
+	    }
+	} else {
+	    if (arealm != NULL) {
+		PJ_LOG(3,(THIS_FILE, "    err: non expecting REALM in response"));
+		rc = -650;
+		goto done;
+	    }
+	}
+
+	if (expected_nonce) {
+	    if (anonce == NULL) {
+		PJ_LOG(3,(THIS_FILE, "    err: expecting NONCE in esponse"));
+		rc = -660;
+		goto done;
+	    }
+	    if (pj_strcmp2(&anonce->value, expected_nonce)!=0) {
+		PJ_LOG(3,(THIS_FILE, "    err: NONCE mismatch in response"));
+		rc = -670;
+		goto done;
+	    }
+	} else {
+	    if (anonce != NULL) {
+		PJ_LOG(3,(THIS_FILE, "    err: non expecting NONCE in response"));
+		rc = -680;
+		goto done;
+	    }
+	}
+    }
+
+    /* Our tests are okay so far. Let caller do some more tests if
+     * it wants to.
+     */
+    if (rc==0 && more_check) {
+	rc = (*more_check)();
+    }
+
+
+done:
+    destroy_client_server();
+    return rc;
+}
+
+
+//////////////////////////////////////////////////////////////////////////////////////////
+//
+// More verification
+//
+
+/* Retransmission test */
+static int retransmit_check(void)
+{
+    if (server->recv_count != PJ_STUN_MAX_TRANSMIT_COUNT)
+	return -700;
+    if (client->recv_count != 0)
+	return -710;
+
+    return 0;
+}
+
+static int long_term_check1(void)
+{
+    /* SHOULD NOT contain USERNAME or MESSAGE-INTEGRITY */
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_USERNAME, 0))
+	return -800;
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_MESSAGE_INTEGRITY, 0))
+	return -800;
+
+    return 0;
+}
+
+static int long_term_check2(void)
+{
+    /* response SHOULD NOT include a USERNAME, NONCE, REALM or 
+     * MESSAGE-INTEGRITY attribute. 
+     */
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_USERNAME, 0))
+	return -900;
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_NONCE, 0))
+	return -910;
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_REALM, 0))
+	return -920;
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_MESSAGE_INTEGRITY, 0))
+	return -930;
+
+    return 0;
+}
+
+static int long_term_check3(void)
+{
+    /* response SHOULD NOT include a USERNAME, NONCE, and REALM */
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_USERNAME, 0))
+	return -1000;
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_NONCE, 0))
+	return -1010;
+    if (pj_stun_msg_find_attr(client->response, PJ_STUN_ATTR_REALM, 0))
+	return -1020;
+
+    return 0;
+}
+
+//////////////////////////////////////////////////////////////////////////////////////////
+//
+// TEST MAIN
+//
+
+
+int sess_auth_test(void)
+{
+    pj_pool_t *pool;
+    int rc;
+
+    PJ_LOG(3,(THIS_FILE, "  STUN session authentication test"));
+
+    /* Init STUN config */
+    pj_stun_config_init(&stun_cfg, mem, 0, NULL, NULL);
+
+    /* Create pool and timer heap */
+    pool = pj_pool_create(mem, "authtest", 200, 200, NULL);
+    if (pj_timer_heap_create(pool, 20, &stun_cfg.timer_heap)) {
+	pj_pool_release(pool);
+	return -5;
+    }
+
+    /* Basic retransmission test */
+    rc = run_client_test("Retransmission",  // title
+			 PJ_FALSE,	    // server responding
+			 PJ_STUN_AUTH_NONE, // server auth
+			 PJ_STUN_AUTH_NONE, // client auth
+			 NULL,		    // realm
+			 NULL,		    // username
+			 NULL,		    // nonce
+			 NULL,		    // password
+			 PJ_FALSE,	    // dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJNATH_ESTUNTIMEDOUT,// expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 &retransmit_check  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /*
+     * Short term credential.
+     * draft-ietf-behave-rfc3489bis-15#section-10.1.2
+     */
+
+    /*
+     * If the message does not contain both a MESSAGE-INTEGRITY and a
+     * USERNAME attribute, If the message is a request, the server MUST
+     * reject the request with an error response.  This response MUST
+     * use an error code of 400 (Bad Request).
+     */
+    rc = run_client_test("Missing MESSAGE-INTEGRITY (short term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_SHORT_TERM, // server auth
+			 PJ_STUN_AUTH_NONE, // client auth
+			 NULL,		    // realm
+			 NULL,		    // username
+			 NULL,		    // nonce
+			 NULL,		    // password
+			 PJ_FALSE,	    // dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(400),// expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 NULL		    // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* If the USERNAME does not contain a username value currently valid
+     * within the server: If the message is a request, the server MUST 
+     * reject the request with an error response.  This response MUST use
+     * an error code of 401 (Unauthorized).
+     */
+    rc = run_client_test("USERNAME mismatch (short term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_SHORT_TERM, // server auth
+			 PJ_STUN_AUTH_SHORT_TERM, // client auth
+			 NULL,		    // realm
+			 "anotheruser",	    // username
+			 NULL,		    // nonce
+			 "anotherpass",	    // password
+			 PJ_FALSE,	    // dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(401),// expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 NULL		    // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* Using the password associated with the username, compute the value
+     * for the message-integrity as described in Section 15.4.  If the
+     * resulting value does not match the contents of the MESSAGE-
+     * INTEGRITY attribute:
+     *
+     * - If the message is a request, the server MUST reject the request
+     *   with an error response.  This response MUST use an error code
+     *   of 401 (Unauthorized).
+     */
+    rc = run_client_test("MESSAGE-INTEGRITY mismatch (short term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_SHORT_TERM, // server auth
+			 PJ_STUN_AUTH_SHORT_TERM, // client auth
+			 NULL,		    // realm
+			 USERNAME,	    // username
+			 NULL,		    // nonce
+			 "anotherpass",	    // password
+			 PJ_FALSE,	    // dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(401),// expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 NULL		    // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* USERNAME is not present, server must respond with 400 (Bad
+     * Request).
+     */
+    rc = run_client_test("Missing USERNAME (short term)",// title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_SHORT_TERM, // server auth
+			 PJ_STUN_AUTH_NONE, // client auth
+			 NULL,		    // realm
+			 NULL,		    // username
+			 NULL,		    // nonce
+			 NULL,		    // password
+			 PJ_TRUE,	    // dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(400),	    // expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 NULL		    // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* Successful short term authentication */
+    rc = run_client_test("Successful scenario (short term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_SHORT_TERM, // server auth
+			 PJ_STUN_AUTH_SHORT_TERM, // client auth
+			 NULL,		    // realm
+			 USERNAME,	    // username
+			 NULL,		    // nonce
+			 PASSWORD,	    // password
+			 PJ_FALSE,	    // dummy MI
+			 PJ_FALSE,	    // expected error
+			 PJ_SUCCESS,	    // expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 NULL		    // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /*
+     * (our own) Extended tests for long term credential
+     */
+
+    /* When server wants to use short term credential, but request has
+     * REALM, reject with .... 401 ???
+     */
+    rc = run_client_test("Unwanted REALM (short term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_SHORT_TERM, // server auth
+			 PJ_STUN_AUTH_NONE, // client auth
+			 REALM,		    // realm
+			 USERNAME,	    // username
+			 NULL,		    // nonce
+			 PASSWORD,	    // password
+			 PJ_TRUE,	    // dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(401),	    // expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 &long_term_check2  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+
+    /*
+     * Long term credential.
+     * draft-ietf-behave-rfc3489bis-15#section-10.2.2
+     */
+
+    /* If the message does not contain a MESSAGE-INTEGRITY attribute, the
+     * server MUST generate an error response with an error code of 401
+     * (Unauthorized).  This response MUST include a REALM value.  It is
+     * RECOMMENDED that the REALM value be the domain name of the
+     * provider of the STUN server.  The response MUST include a NONCE,
+     * selected by the server.  The response SHOULD NOT contain a
+     * USERNAME or MESSAGE-INTEGRITY attribute.
+     */
+    rc = run_client_test("Missing M-I (long term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_LONG_TERM, // server auth
+			 PJ_STUN_AUTH_NONE, // client auth
+			 NULL,		    // client realm
+			 NULL,		    // client username
+			 NULL,		    // client nonce
+			 NULL,		    // client password
+			 PJ_FALSE,	    // client dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(401), // expected code
+			 REALM,		    // expected realm
+			 NONCE,		    // expected nonce
+			 &long_term_check1  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* If the message contains a MESSAGE-INTEGRITY attribute, but is
+     * missing the USERNAME, REALM or NONCE attributes, the server MUST
+     * generate an error response with an error code of 400 (Bad
+     * Request).  This response SHOULD NOT include a USERNAME, NONCE,
+     * REALM or MESSAGE-INTEGRITY attribute.
+     */
+    /* Missing USERNAME */
+    rc = run_client_test("Missing USERNAME (long term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_LONG_TERM, // server auth
+			 PJ_STUN_AUTH_NONE, // client auth
+			 REALM,		    // client realm
+			 NULL,		    // client username
+			 NONCE,		    // client nonce
+			 PASSWORD,	    // client password
+			 PJ_TRUE,	    // client dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(400), // expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 &long_term_check2  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* Missing REALM */
+    rc = run_client_test("Missing REALM (long term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_LONG_TERM, // server auth
+			 PJ_STUN_AUTH_NONE, // client auth
+			 NULL,		    // client realm
+			 USERNAME,	    // client username
+			 NONCE,		    // client nonce
+			 PASSWORD,	    // client password
+			 PJ_TRUE,	    // client dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(400), // expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 &long_term_check2  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* Missing NONCE */
+    rc = run_client_test("Missing NONCE (long term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_LONG_TERM, // server auth
+			 PJ_STUN_AUTH_NONE, // client auth
+			 REALM,		    // client realm
+			 USERNAME,	    // client username
+			 NULL,		    // client nonce
+			 PASSWORD,	    // client password
+			 PJ_TRUE,	    // client dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(400), // expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 &long_term_check2  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* If the NONCE is no longer valid, the server MUST generate an error
+     * response with an error code of 438 (Stale Nonce).  This response
+     * MUST include a NONCE and REALM attribute and SHOULD NOT incude the
+     * USERNAME or MESSAGE-INTEGRITY attribute.  Servers can invalidate
+     * nonces in order to provide additional security.  See Section 4.3
+     * of [RFC2617] for guidelines.    
+     */
+    // how??
+
+    /* If the username in the USERNAME attribute is not valid, the server
+     * MUST generate an error response with an error code of 401
+     * (Unauthorized).  This response MUST include a REALM value.  It is
+     * RECOMMENDED that the REALM value be the domain name of the
+     * provider of the STUN server.  The response MUST include a NONCE,
+     * selected by the server.  The response SHOULD NOT contain a
+     * USERNAME or MESSAGE-INTEGRITY attribute.
+     */
+    rc = run_client_test("Invalid username (long term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_LONG_TERM, // server auth
+			 PJ_STUN_AUTH_LONG_TERM, // client auth
+			 REALM,		    // client realm
+			 "anotheruser",	    // client username
+			 "a nonce",	    // client nonce
+			 "somepassword",    // client password
+			 PJ_FALSE,	    // client dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(401), // expected code
+			 REALM,		    // expected realm
+			 NONCE,		    // expected nonce
+			 &long_term_check1  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* Successful long term authentication */
+    rc = run_client_test("Successful scenario (long term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_LONG_TERM, // server auth
+			 PJ_STUN_AUTH_LONG_TERM, // client auth
+			 REALM,		    // client realm
+			 USERNAME,	    // client username
+			 "anothernonce",    // client nonce
+			 PASSWORD,	    // client password
+			 PJ_FALSE,	    // client dummy MI
+			 PJ_FALSE,	    // expected error
+			 0,		    // expected code
+			 NULL,		    // expected realm
+			 NULL,		    // expected nonce
+			 &long_term_check3  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /*
+     * (our own) Extended tests for long term credential
+     */
+
+    /* If REALM doesn't match, server must respond with 401
+     */
+    rc = run_client_test("Invalid REALM (long term)",  // title
+			 PJ_TRUE,	    // server responding
+			 PJ_STUN_AUTH_LONG_TERM, // server auth
+			 PJ_STUN_AUTH_LONG_TERM, // client auth
+			 "anotherrealm",    // client realm
+			 USERNAME,	    // client username
+			 NONCE,		    // client nonce
+			 PASSWORD,	    // client password
+			 PJ_FALSE,	    // client dummy MI
+			 PJ_TRUE,	    // expected error
+			 PJ_STATUS_FROM_STUN_CODE(401), // expected code
+			 REALM,		    // expected realm
+			 NONCE,		    // expected nonce
+			 &long_term_check1  // more check
+			 );
+    if (rc != 0) {
+	goto done;
+    }
+
+    /* Invalid HMAC */
+
+    /* Valid static short term, without NONCE */
+
+    /* Valid static short term, WITH NONCE */
+
+    /* Valid static long term (with NONCE */
+
+    /* Valid dynamic short term (without NONCE) */
+
+    /* Valid dynamic short term (with NONCE) */
+
+    /* Valid dynamic long term (with NONCE) */
+
+
+done:
+    pj_timer_heap_destroy(stun_cfg.timer_heap);
+    pj_pool_release(pool);
+    return rc;
+}
Index: pjproject/trunk/pjnath/src/pjnath-test/stun.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath-test/stun.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjnath-test/stun.c	(revision 1877)
@@ -270,5 +270,5 @@
 
 	/* Try to encode message */
-	pj_stun_create_key(pool, &key, NULL, &USERNAME, &PASSWORD);
+	pj_stun_create_key(pool, &key, NULL, &USERNAME, PJ_STUN_PASSWD_PLAIN, &PASSWORD);
 	status = pj_stun_msg_encode(msg, buf, sizeof(buf), 0, &key, &len);
 	if (status != PJ_SUCCESS) {
@@ -406,53 +406,4 @@
 {
     /* Decode all attribute types */
-    return 0;
-}
-
-static int auth_test(void)
-{
-    /* REALM and USERNAME is present, but MESSAGE-INTEGRITY is not present.
-     * For short term, must with reply 401 without REALM.
-     * For long term, must reply with 401 with REALM.
-     */
-
-    /* USERNAME is not present, server must respond with 432 (Missing
-     * Username).
-     */
-
-    /* If long term credential is wanted and REALM is not present, server 
-     * must respond with 434 (Missing Realm) 
-     */
-
-    /* If REALM doesn't match, server must respond with 434 (Missing Realm)
-     * too, containing REALM and NONCE attribute.
-     */
-
-    /* When long term authentication is wanted and NONCE is NOT present,
-     * server must respond with 435 (Missing Nonce), containing REALM and
-     * NONCE attribute.
-     */
-
-    /* Simulate 438 (Stale Nonce) */
-    
-    /* Simulate 436 (Unknown Username) */
-
-    /* When server wants to use short term credential, but request has
-     * REALM, reject with .... ???
-     */
-
-    /* Invalid HMAC */
-
-    /* Valid static short term, without NONCE */
-
-    /* Valid static short term, WITH NONCE */
-
-    /* Valid static long term (with NONCE */
-
-    /* Valid dynamic short term (without NONCE) */
-
-    /* Valid dynamic short term (with NONCE) */
-
-    /* Valid dynamic long term (with NONCE) */
-
     return 0;
 }
@@ -615,5 +566,5 @@
 
 	    pj_stun_create_key(pool, &key, NULL, pj_cstr(&s1, v->username), 
-			       pj_cstr(&s2, v->password));
+			       PJ_STUN_PASSWD_PLAIN, pj_cstr(&s2, v->password));
 	    pj_stun_msg_encode(msg, buf, sizeof(buf), 0, &key, &len);
 
@@ -752,8 +703,4 @@
 	goto on_return;
 
-    rc = auth_test();
-    if (rc != 0)
-	goto on_return;
-
     rc = fingerprint_test_vector();
     if (rc != 0)
Index: pjproject/trunk/pjnath/src/pjnath-test/test.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath-test/test.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjnath-test/test.c	(revision 1877)
@@ -69,4 +69,5 @@
 #if INCLUDE_STUN_TEST
     DO_TEST(stun_test());
+    DO_TEST(sess_auth_test());
 #endif
 
Index: pjproject/trunk/pjnath/src/pjnath-test/test.h
===================================================================
--- pjproject/trunk/pjnath/src/pjnath-test/test.h	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjnath-test/test.h	(revision 1877)
@@ -24,7 +24,8 @@
 #define INCLUDE_ICE_TEST	    1
 
-extern int stun_test(void);
-extern int ice_test(void);
-extern int test_main(void);
+int stun_test(void);
+int sess_auth_test(void);
+int ice_test(void);
+int test_main(void);
 
 extern void app_perror(const char *title, pj_status_t rc);
Index: pjproject/trunk/pjnath/src/pjnath/ice_session.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/ice_session.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjnath/ice_session.c	(revision 1877)
@@ -121,5 +121,5 @@
 				      const pj_uint8_t *pkt,
 				      unsigned pkt_len,
-				      const pj_stun_msg *msg,
+				      const pj_stun_rx_data *rdata,
 				      const pj_sockaddr_t *src_addr,
 				      unsigned src_addr_len);
@@ -148,5 +148,5 @@
 				      pj_str_t *username,
 				      pj_str_t *nonce,
-				      int *data_type,
+				      pj_stun_passwd_type *data_type,
 				      pj_str_t *data);
 static pj_status_t stun_auth_get_password(const pj_stun_msg *msg,
@@ -155,5 +155,5 @@
 					  const pj_str_t *username,
 					  pj_pool_t *pool,
-					  int *data_type,
+					  pj_stun_passwd_type *data_type,
 					  pj_str_t *data);
 
@@ -233,5 +233,6 @@
     auth_cred.data.dyn_cred.get_password = &stun_auth_get_password;
     auth_cred.data.dyn_cred.user_data = comp->stun_sess;
-    pj_stun_session_set_credential(comp->stun_sess, &auth_cred);
+    pj_stun_session_set_credential(comp->stun_sess, PJ_STUN_AUTH_SHORT_TERM,
+				   &auth_cred);
 
     return PJ_SUCCESS;
@@ -447,5 +448,5 @@
 				      pj_str_t *username,
 				      pj_str_t *nonce,
-				      int *data_type,
+				      pj_stun_passwd_type *data_type,
 				      pj_str_t *data)
 {
@@ -462,10 +463,10 @@
 	 */
 	*username = ice->rx_uname;
-	*data_type = 0;
+	*data_type = PJ_STUN_PASSWD_PLAIN;
 	*data = ice->rx_pass;
     }
     else {
 	*username = ice->tx_uname;
-	*data_type = 0;
+	*data_type = PJ_STUN_PASSWD_PLAIN;
 	*data = ice->tx_pass;
     }
@@ -480,5 +481,5 @@
 					  const pj_str_t *username,
 					  pj_pool_t *pool,
-					  int *data_type,
+					  pj_stun_passwd_type *data_type,
 					  pj_str_t *data)
 {
@@ -497,5 +498,5 @@
 	if (pj_strcmp(username, &ice->tx_uname) != 0)
 	    return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_UNAUTHORIZED);
-	*data_type = 0;
+	*data_type = PJ_STUN_PASSWD_PLAIN;
 	*data = ice->tx_pass;
 
@@ -522,5 +523,5 @@
 	    return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_UNAUTHORIZED);
 
-	*data_type = 0;
+	*data_type = PJ_STUN_PASSWD_PLAIN;
 	*data = ice->rx_pass;
 
@@ -1904,9 +1905,10 @@
 				      const pj_uint8_t *pkt,
 				      unsigned pkt_len,
-				      const pj_stun_msg *msg,
+				      const pj_stun_rx_data *rdata,
 				      const pj_sockaddr_t *src_addr,
 				      unsigned src_addr_len)
 {
     stun_data *sd;
+    const pj_stun_msg *msg = rdata->msg;
     pj_ice_sess *ice;
     pj_stun_priority_attr *prio_attr;
@@ -1922,5 +1924,5 @@
     /* Reject any requests except Binding request */
     if (msg->hdr.type != PJ_STUN_BINDING_REQUEST) {
-	status = pj_stun_session_create_res(sess, msg, 
+	status = pj_stun_session_create_res(sess, rdata, 
 					    PJ_STUN_SC_BAD_REQUEST,
 					    NULL, &tdata);
@@ -1993,5 +1995,5 @@
 	} else {
 	    /* Generate 487 response */
-	    status = pj_stun_session_create_res(sess, msg, 
+	    status = pj_stun_session_create_res(sess, rdata, 
 					        PJ_STUN_SC_ROLE_CONFLICT,
 						NULL, &tdata);
@@ -2009,5 +2011,5 @@
 	if (pj_cmp_timestamp(&ice->tie_breaker, &role_attr->value) < 0) {
 	    /* Generate 487 response */
-	    status = pj_stun_session_create_res(sess, msg, 
+	    status = pj_stun_session_create_res(sess, rdata, 
 					        PJ_STUN_SC_ROLE_CONFLICT,
 						NULL, &tdata);
@@ -2029,5 +2031,5 @@
      * First send response to this request 
      */
-    status = pj_stun_session_create_res(sess, msg, 0, NULL, &tdata);
+    status = pj_stun_session_create_res(sess, rdata, 0, NULL, &tdata);
     if (status != PJ_SUCCESS) {
 	pj_mutex_unlock(ice->mutex);
Index: pjproject/trunk/pjnath/src/pjnath/stun_auth.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/stun_auth.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjnath/stun_auth.c	(revision 1877)
@@ -20,7 +20,9 @@
 #include <pjnath/errno.h>
 #include <pjlib-util/hmac_sha1.h>
+#include <pjlib-util/md5.h>
 #include <pjlib-util/sha1.h>
 #include <pj/assert.h>
 #include <pj/log.h>
+#include <pj/pool.h>
 #include <pj/string.h>
 
@@ -54,4 +56,97 @@
 
 
+/*
+ * Duplicate request credential.
+ */
+PJ_DEF(void) pj_stun_req_cred_info_dup( pj_pool_t *pool,
+					pj_stun_req_cred_info *dst,
+					const pj_stun_req_cred_info *src)
+{
+    pj_strdup(pool, &dst->realm, &src->realm);
+    pj_strdup(pool, &dst->username, &src->username);
+    pj_strdup(pool, &dst->nonce, &src->nonce);
+    pj_strdup(pool, &dst->auth_key, &src->auth_key);
+}
+
+
+/* Calculate HMAC-SHA1 key for long term credential, by getting
+ * MD5 digest of username, realm, and password. 
+ */
+static void calc_md5_key(pj_uint8_t digest[16],
+			 const pj_str_t *realm,
+			 const pj_str_t *username,
+			 const pj_str_t *passwd)
+{
+    /* The 16-byte key for MESSAGE-INTEGRITY HMAC is formed by taking
+     * the MD5 hash of the result of concatenating the following five
+     * fields: (1) The username, with any quotes and trailing nulls
+     * removed, (2) A single colon, (3) The realm, with any quotes and
+     * trailing nulls removed, (4) A single colon, and (5) The 
+     * password, with any trailing nulls removed.
+     */
+    pj_md5_context ctx;
+    pj_str_t s;
+
+    pj_md5_init(&ctx);
+
+#define REMOVE_QUOTE(s)	if (s.slen && *s.ptr=='"') \
+			    s.ptr++, s.slen--; \
+			if (s.slen && s.ptr[s.slen-1]=='"') \
+			    s.slen--;
+
+    /* Add username */
+    s = *username;
+    REMOVE_QUOTE(s);
+    pj_md5_update(&ctx, (pj_uint8_t*)s.ptr, s.slen);
+
+    /* Add single colon */
+    pj_md5_update(&ctx, (pj_uint8_t*)":", 1);
+
+    /* Add realm */
+    s = *realm;
+    REMOVE_QUOTE(s);
+    pj_md5_update(&ctx, (pj_uint8_t*)s.ptr, s.slen);
+
+#undef REMOVE_QUOTE
+
+    /* Another colon */
+    pj_md5_update(&ctx, (pj_uint8_t*)":", 1);
+
+    /* Add password */
+    pj_md5_update(&ctx, (pj_uint8_t*)passwd->ptr, passwd->slen);
+
+    /* Done */
+    pj_md5_final(&ctx, digest);
+}
+
+
+/*
+ * Create authentication key to be used for encoding the message with
+ * MESSAGE-INTEGRITY. 
+ */
+PJ_DEF(void) pj_stun_create_key(pj_pool_t *pool,
+				pj_str_t *key,
+				const pj_str_t *realm,
+				const pj_str_t *username,
+				pj_stun_passwd_type data_type,
+				const pj_str_t *data)
+{
+    PJ_ASSERT_ON_FAIL(pool && key && username && data, return);
+
+    if (realm && realm->slen) {
+	if (data_type == PJ_STUN_PASSWD_PLAIN) {
+	    key->ptr = (char*) pj_pool_alloc(pool, 16);
+	    calc_md5_key((pj_uint8_t*)key->ptr, realm, username, data);
+	    key->slen = 16;
+	} else {
+	    pj_strdup(pool, key, data);
+	}
+    } else {
+	pj_assert(data_type == PJ_STUN_PASSWD_PLAIN);
+	pj_strdup(pool, key, data);
+    }
+}
+
+
 PJ_INLINE(pj_uint16_t) GET_VAL16(const pj_uint8_t *pdu, unsigned pos)
 {
@@ -87,6 +182,6 @@
 	return rc;
 
-
-    if (realm && realm->slen) {
+    /* SHOULD NOT add REALM, NONCE, USERNAME, and M-I on 400 response */
+    if (err_code!=400 && realm && realm->slen) {
 	rc = pj_stun_msg_add_string_attr(pool, response,
 					 PJ_STUN_ATTR_REALM, 
@@ -102,5 +197,5 @@
     }
 
-    if (nonce && nonce->slen) {
+    if (err_code!=400 && nonce && nonce->slen) {
 	rc = pj_stun_msg_add_string_attr(pool, response,
 					 PJ_STUN_ATTR_NONCE, 
@@ -122,18 +217,18 @@
 					         pj_stun_auth_cred *cred,
 					         pj_pool_t *pool,
-						 pj_str_t *auth_key,
+						 pj_stun_req_cred_info *p_info,
 					         pj_stun_msg **p_response)
 {
-    pj_str_t realm, nonce, password;
+    pj_stun_req_cred_info tmp_info;
     const pj_stun_msgint_attr *amsgi;
     unsigned i, amsgi_pos;
     pj_bool_t has_attr_beyond_mi;
     const pj_stun_username_attr *auser;
-    pj_bool_t username_ok;
     const pj_stun_realm_attr *arealm;
     const pj_stun_realm_attr *anonce;
     pj_hmac_sha1_context ctx;
     pj_uint8_t digest[PJ_SHA1_DIGEST_SIZE];
-    pj_str_t key;
+    pj_stun_status err_code;
+    const char *err_text = NULL;
     pj_status_t status;
 
@@ -150,16 +245,22 @@
 	p_response = NULL;
 
+    if (p_info == NULL)
+	p_info = &tmp_info;
+
+    pj_bzero(p_info, sizeof(pj_stun_req_cred_info));
+
     /* Get realm and nonce from credential */
-    realm.slen = nonce.slen = 0;
+    p_info->realm.slen = p_info->nonce.slen = 0;
     if (cred->type == PJ_STUN_AUTH_CRED_STATIC) {
-	realm = cred->data.static_cred.realm;
-	nonce = cred->data.static_cred.nonce;
+	p_info->realm = cred->data.static_cred.realm;
+	p_info->nonce = cred->data.static_cred.nonce;
     } else if (cred->type == PJ_STUN_AUTH_CRED_DYNAMIC) {
 	status = cred->data.dyn_cred.get_auth(cred->data.dyn_cred.user_data,
-					      pool, &realm, &nonce);
+					      pool, &p_info->realm, 
+					      &p_info->nonce);
 	if (status != PJ_SUCCESS)
 	    return status;
     } else {
-	pj_assert(!"Unexpected");
+	pj_assert(!"Invalid credential type");
 	return PJ_EBUG;
     }
@@ -185,12 +286,7 @@
 	   The rule has been changed from rfc3489bis-06
 	*/
-	int code;
-
-	code = realm.slen ? PJ_STUN_SC_UNAUTHORIZED : PJ_STUN_SC_BAD_REQUEST;
-	if (p_response) {
-	    create_challenge(pool, msg, code, NULL,
-			     &realm, &nonce, p_response);
-	}
-	return PJ_STATUS_FROM_STUN_CODE(code);
+	err_code = p_info->realm.slen ? PJ_STUN_SC_UNAUTHORIZED : 
+		    PJ_STUN_SC_BAD_REQUEST;
+	goto on_auth_failed;
     }
 
@@ -203,10 +299,7 @@
 	   The rule has been changed from rfc3489bis-06
 	*/
-	int code = PJ_STUN_SC_BAD_REQUEST;
-	if (p_response) {
-	    create_challenge(pool, msg, code, "Missing USERNAME",
-			     &realm, &nonce, p_response);
-	}
-	return PJ_STATUS_FROM_STUN_CODE(code);
+	err_code = PJ_STUN_SC_BAD_REQUEST;
+	err_text = "Missing USERNAME";
+	goto on_auth_failed;
     }
 
@@ -215,12 +308,37 @@
 	     pj_stun_msg_find_attr(msg, PJ_STUN_ATTR_REALM, 0);
 
+    /* Reject with 400 if we have long term credential and the request
+     * is missing REALM attribute.
+     */
+    if (p_info->realm.slen && arealm==NULL) {
+	err_code = PJ_STUN_SC_BAD_REQUEST;
+	err_text = "Missing REALM";
+	goto on_auth_failed;
+    }
+
     /* Check if username match */
     if (cred->type == PJ_STUN_AUTH_CRED_STATIC) {
+	pj_bool_t username_ok;
 	username_ok = !pj_strcmp(&auser->value, 
 				 &cred->data.static_cred.username);
-	password = cred->data.static_cred.data;
+	if (username_ok) {
+	    pj_strdup(pool, &p_info->username, 
+		      &cred->data.static_cred.username);
+	    pj_stun_create_key(pool, &p_info->auth_key, &p_info->realm,
+			       &auser->value, cred->data.static_cred.data_type,
+			       &cred->data.static_cred.data);
+	} else {
+	    /* Username mismatch */
+	    /* According to rfc3489bis-10 Sec 10.1.2/10.2.2, we should 
+	     * return 401 
+	     */
+	    err_code = PJ_STUN_SC_UNAUTHORIZED;
+	    goto on_auth_failed;
+	}
     } else if (cred->type == PJ_STUN_AUTH_CRED_DYNAMIC) {
-	int data_type = 0;
+	pj_stun_passwd_type data_type = PJ_STUN_PASSWD_PLAIN;
+	pj_str_t password;
 	pj_status_t rc;
+
 	rc = cred->data.dyn_cred.get_password(msg, 
 					      cred->data.dyn_cred.user_data,
@@ -228,21 +346,18 @@
 					      &auser->value, pool,
 					      &data_type, &password);
-	username_ok = (rc == PJ_SUCCESS);
+	if (rc == PJ_SUCCESS) {
+	    pj_strdup(pool, &p_info->username, &auser->value);
+	    pj_stun_create_key(pool, &p_info->auth_key, 
+			       (arealm?&arealm->value:NULL), &auser->value, 
+			       data_type, &password);
+	} else {
+	    err_code = PJ_STUN_SC_UNAUTHORIZED;
+	    goto on_auth_failed;
+	}
     } else {
-	username_ok = PJ_TRUE;
-	password.slen = 0;
-    }
-
-    if (!username_ok) {
-	/* Username mismatch */
-	/* According to rfc3489bis-10 Sec 10.1.2/10.2.2, we should 
-	 * return 401 
-	 */
-	if (p_response) {
-	    create_challenge(pool, msg, PJ_STUN_SC_UNAUTHORIZED, NULL,
-			     &realm, &nonce, p_response);
-	}
-	return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_UNAUTHORIZED);
-    }
+	pj_assert(!"Invalid credential type");
+	return PJ_EBUG;
+    }
+
 
 
@@ -252,38 +367,31 @@
 
     /* Check for long term/short term requirements. */
-    if (realm.slen != 0 && arealm == NULL) {
+    if (p_info->realm.slen != 0 && arealm == NULL) {
 	/* Long term credential is required and REALM is not present */
-	if (p_response) {
-	    create_challenge(pool, msg, PJ_STUN_SC_BAD_REQUEST, 
-			     "Missing REALM",
-			     &realm, &nonce, p_response);
-	}
-	return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_BAD_REQUEST);
-
-    } else if (realm.slen != 0 && arealm != NULL) {
+	err_code = PJ_STUN_SC_BAD_REQUEST;
+	err_text = "Missing REALM";
+	goto on_auth_failed;
+
+    } else if (p_info->realm.slen != 0 && arealm != NULL) {
 	/* We want long term, and REALM is present */
 
 	/* NONCE must be present. */
-	if (anonce == NULL && nonce.slen) {
-	    if (p_response) {
-		create_challenge(pool, msg, PJ_STUN_SC_BAD_REQUEST, 
-				 "Missing NONCE", &realm, &nonce, p_response);
-	    }
-	    return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_BAD_REQUEST);
+	if (anonce == NULL && p_info->nonce.slen) {
+	    err_code = PJ_STUN_SC_BAD_REQUEST;
+	    err_text = "Missing NONCE";
+	    goto on_auth_failed;
 	}
 
 	/* Verify REALM matches */
-	if (pj_stricmp(&arealm->value, &realm)) {
+	if (pj_stricmp(&arealm->value, &p_info->realm)) {
 	    /* REALM doesn't match */
-	    if (p_response) {
-		create_challenge(pool, msg, PJ_STUN_SC_UNAUTHORIZED, 
-				 "Invalid REALM", &realm, &nonce, p_response);
-	    }
-	    return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_UNAUTHORIZED);
+	    err_code = PJ_STUN_SC_UNAUTHORIZED;
+	    err_text = "Invalid REALM";
+	    goto on_auth_failed;
 	}
 
 	/* Valid case, will validate the message integrity later */
 
-    } else if (realm.slen == 0 && arealm != NULL) {
+    } else if (p_info->realm.slen == 0 && arealm != NULL) {
 	/* We want to use short term credential, but client uses long
 	 * term credential. The draft doesn't mention anything about
@@ -294,14 +402,12 @@
 	 * cause wrong message integrity value later.
 	 */
-    } else if (realm.slen==0 && arealm == NULL) {
+    } else if (p_info->realm.slen==0 && arealm == NULL) {
 	/* Short term authentication is wanted, and one is supplied */
 
 	/* Application MAY request NONCE to be supplied */
-	if (nonce.slen != 0) {
-	    if (p_response) {
-		create_challenge(pool, msg, PJ_STUN_SC_UNAUTHORIZED, 
-				 "NONCE required", &realm, &nonce, p_response);
-	    }
-	    return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_UNAUTHORIZED);
+	if (p_info->nonce.slen != 0) {
+	    err_code = PJ_STUN_SC_UNAUTHORIZED;
+	    err_text = "NONCE required";
+	    goto on_auth_failed;
 	}
     }
@@ -322,6 +428,6 @@
 	    ok = PJ_TRUE;
 	} else {
-	    if (nonce.slen) {
-		ok = !pj_strcmp(&anonce->value, &nonce);
+	    if (p_info->nonce.slen) {
+		ok = !pj_strcmp(&anonce->value, &p_info->nonce);
 	    } else {
 		ok = PJ_TRUE;
@@ -330,21 +436,12 @@
 
 	if (!ok) {
-	    if (p_response) {
-		create_challenge(pool, msg, PJ_STUN_SC_STALE_NONCE, 
-				 NULL, &realm, &nonce, p_response);
-	    }
-	    if (auth_key) {
-		pj_stun_create_key(pool, auth_key, &realm, 
-				   &auser->value, &password);
-	    }
-	    return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_STALE_NONCE);
-	}
-    }
-
-    /* Calculate key */
-    pj_stun_create_key(pool, &key, &realm, &auser->value, &password);
+	    err_code = PJ_STUN_SC_STALE_NONCE;
+	    goto on_auth_failed;
+	}
+    }
 
     /* Now calculate HMAC of the message. */
-    pj_hmac_sha1_init(&ctx, (pj_uint8_t*)key.ptr, key.slen);
+    pj_hmac_sha1_init(&ctx, (pj_uint8_t*)p_info->auth_key.ptr, 
+		      p_info->auth_key.slen);
 
 #if PJ_STUN_OLD_STYLE_MI_FINGERPRINT
@@ -383,13 +480,18 @@
 	/* HMAC value mismatch */
 	/* According to rfc3489bis-10 Sec 10.1.2 we should return 401 */
-	if (p_response) {
-	    create_challenge(pool, msg, PJ_STUN_SC_UNAUTHORIZED,
-			     NULL, &realm, &nonce, p_response);
-	}
-	return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_UNAUTHORIZED);
+	err_code = PJ_STUN_SC_UNAUTHORIZED;
+	err_text = "MESSAGE-INTEGRITY mismatch";
+	goto on_auth_failed;
     }
 
     /* Everything looks okay! */
     return PJ_SUCCESS;
+
+on_auth_failed:
+    if (p_response) {
+	create_challenge(pool, msg, err_code, err_text,
+			 &p_info->realm, &p_info->nonce, p_response);
+    }
+    return PJ_STATUS_FROM_STUN_CODE(err_code);
 }
 
@@ -426,9 +528,8 @@
     case PJ_STUN_SC_BAD_REQUEST:	    /* 400 (Bad Request)	    */
     case PJ_STUN_SC_UNAUTHORIZED:	    /* 401 (Unauthorized)	    */
-    //case PJ_STUN_SC_STALE_CREDENTIALS:    /* 430 (Stale Credential)	    */
-    //case PJ_STUN_SC_MISSING_USERNAME:	    /* 432 (Missing Username)	    */
-    //case PJ_STUN_SC_MISSING_REALM:	    /* 434 (Missing Realm)	    */
-    //case PJ_STUN_SC_UNKNOWN_USERNAME:	    /* 436 (Unknown Username)	    */
-    //case PJ_STUN_SC_INTEGRITY_CHECK_FAILURE:/* 431 (Integrity Check Fail) */
+
+    /* Due to the way this response is generated here, we can't really
+     * authenticate 420 (Unknown Attribute) response			    */
+    case PJ_STUN_SC_UNKNOWN_ATTRIBUTE:
 	return PJ_FALSE;
     default:
Index: pjproject/trunk/pjnath/src/pjnath/stun_msg.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/stun_msg.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjnath/stun_msg.c	(revision 1877)
@@ -21,5 +21,4 @@
 #include <pjlib-util/crc32.h>
 #include <pjlib-util/hmac_sha1.h>
-#include <pjlib-util/md5.h>
 #include <pj/assert.h>
 #include <pj/log.h>
@@ -91,4 +90,5 @@
     pj_status_t (*encode_attr)(const void *a, pj_uint8_t *buf, 
 			       unsigned len, unsigned *printed);
+    void*       (*clone_attr)(pj_pool_t *pool, const void *src);
 };
 
@@ -102,4 +102,5 @@
 				       unsigned len, 
 				       unsigned *printed);
+static void*       clone_sockaddr_attr(pj_pool_t *pool, const void *src);
 static pj_status_t decode_string_attr(pj_pool_t *pool, 
 				      const pj_uint8_t *buf, 
@@ -107,4 +108,5 @@
 static pj_status_t encode_string_attr(const void *a, pj_uint8_t *buf, 
 				      unsigned len, unsigned *printed);
+static void*       clone_string_attr(pj_pool_t *pool, const void *src);
 static pj_status_t decode_msgint_attr(pj_pool_t *pool, 
 				      const pj_uint8_t *buf,
@@ -112,4 +114,5 @@
 static pj_status_t encode_msgint_attr(const void *a, pj_uint8_t *buf, 
 				      unsigned len, unsigned *printed);
+static void*       clone_msgint_attr(pj_pool_t *pool, const void *src);
 static pj_status_t decode_errcode_attr(pj_pool_t *pool, 
 				       const pj_uint8_t *buf,
@@ -117,4 +120,5 @@
 static pj_status_t encode_errcode_attr(const void *a, pj_uint8_t *buf, 
 				       unsigned len, unsigned *printed);
+static void*       clone_errcode_attr(pj_pool_t *pool, const void *src);
 static pj_status_t decode_unknown_attr(pj_pool_t *pool, 
 				       const pj_uint8_t *buf, 
@@ -122,4 +126,5 @@
 static pj_status_t encode_unknown_attr(const void *a, pj_uint8_t *buf, 
 				       unsigned len, unsigned *printed);
+static void*       clone_unknown_attr(pj_pool_t *pool, const void *src);
 static pj_status_t decode_uint_attr(pj_pool_t *pool, 
 				    const pj_uint8_t *buf, 
@@ -127,4 +132,5 @@
 static pj_status_t encode_uint_attr(const void *a, pj_uint8_t *buf, 
 				    unsigned len, unsigned *printed);
+static void*       clone_uint_attr(pj_pool_t *pool, const void *src);
 static pj_status_t decode_uint64_attr(pj_pool_t *pool, 
 				      const pj_uint8_t *buf, 
@@ -132,4 +138,5 @@
 static pj_status_t encode_uint64_attr(const void *a, pj_uint8_t *buf, 
 				      unsigned len, unsigned *printed);
+static void*       clone_uint64_attr(pj_pool_t *pool, const void *src);
 static pj_status_t decode_binary_attr(pj_pool_t *pool, 
 				      const pj_uint8_t *buf,
@@ -137,4 +144,5 @@
 static pj_status_t encode_binary_attr(const void *a, pj_uint8_t *buf, 
 				      unsigned len, unsigned *printed);
+static void*       clone_binary_attr(pj_pool_t *pool, const void *src);
 static pj_status_t decode_empty_attr(pj_pool_t *pool, 
 				     const pj_uint8_t *buf, 
@@ -142,5 +150,5 @@
 static pj_status_t encode_empty_attr(const void *a, pj_uint8_t *buf, 
 				     unsigned len, unsigned *printed);
-
+static void*       clone_empty_attr(pj_pool_t *pool, const void *src);
 
 static struct attr_desc mandatory_attr_desc[] = 
@@ -148,4 +156,5 @@
     {
 	/* type zero */
+	NULL,
 	NULL,
 	NULL,
@@ -156,5 +165,6 @@
 	"MAPPED-ADDRESS",
 	&decode_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -162,5 +172,6 @@
 	"RESPONSE-ADDRESS",
 	&decode_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -168,5 +179,6 @@
 	"CHANGE-REQUEST",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -174,5 +186,6 @@
 	"SOURCE-ADDRESS",
 	&decode_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -180,5 +193,6 @@
 	"CHANGED-ADDRESS",
 	&decode_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -186,5 +200,6 @@
 	"USERNAME",
 	&decode_string_attr,
-	&encode_string_attr
+	&encode_string_attr,
+	&clone_string_attr
     },
     {
@@ -192,5 +207,6 @@
 	"PASSWORD",
 	&decode_string_attr,
-	&encode_string_attr
+	&encode_string_attr,
+	&clone_string_attr
     },
     {
@@ -198,5 +214,6 @@
 	"MESSAGE-INTEGRITY",
 	&decode_msgint_attr,
-	&encode_msgint_attr
+	&encode_msgint_attr,
+	&clone_msgint_attr
     },
     {
@@ -204,5 +221,6 @@
 	"ERROR-CODE",
 	&decode_errcode_attr,
-	&encode_errcode_attr
+	&encode_errcode_attr,
+	&clone_errcode_attr
     },
     {
@@ -210,5 +228,6 @@
 	"UNKNOWN-ATTRIBUTES",
 	&decode_unknown_attr,
-	&encode_unknown_attr
+	&encode_unknown_attr,
+	&clone_unknown_attr
     },
     {
@@ -216,5 +235,6 @@
 	"REFLECTED-FROM",
 	&decode_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -222,5 +242,6 @@
 	"CHANNEL-NUMBER",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -228,8 +249,10 @@
 	"LIFETIME",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
 	/* ID 0x000E is not assigned */
+	NULL,
 	NULL,
 	NULL,
@@ -240,5 +263,6 @@
 	"MAGIC-COOKIE",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -246,8 +270,10 @@
 	"BANDWIDTH",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
 	/* ID 0x0011 is not assigned */
+	NULL,
 	NULL,
 	NULL,
@@ -258,5 +284,6 @@
 	"PEER-ADDRESS",
 	&decode_xored_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -264,5 +291,6 @@
 	"DATA",
 	&decode_binary_attr,
-	&encode_binary_attr
+	&encode_binary_attr,
+	&clone_binary_attr
     },
     {
@@ -270,5 +298,6 @@
 	"REALM",
 	&decode_string_attr,
-	&encode_string_attr
+	&encode_string_attr,
+	&clone_string_attr
     },
     {
@@ -276,5 +305,6 @@
 	"NONCE",
 	&decode_string_attr,
-	&encode_string_attr
+	&encode_string_attr,
+	&clone_string_attr
     },
     {
@@ -282,5 +312,6 @@
 	"RELAY-ADDRESS",
 	&decode_xored_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -288,5 +319,6 @@
 	"REQUESTED-ADDRESS-TYPE",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -294,5 +326,6 @@
 	"REQUESTED-PROPS",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -300,5 +333,6 @@
 	"REQUESTED-TRANSPORT",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -306,4 +340,5 @@
 	NULL,
 	NULL,
+	NULL,
 	NULL
     },
@@ -312,4 +347,5 @@
 	NULL,
 	NULL,
+	NULL,
 	NULL
     },
@@ -318,4 +354,5 @@
 	NULL,
 	NULL,
+	NULL,
 	NULL
     },
@@ -324,4 +361,5 @@
 	NULL,
 	NULL,
+	NULL,
 	NULL
     },
@@ -330,8 +368,10 @@
 	NULL,
 	NULL,
+	NULL,
 	NULL
     },
     {
 	/* ID 0x001F is not assigned */
+	NULL,
 	NULL,
 	NULL,
@@ -342,5 +382,6 @@
 	"XOR-MAPPED-ADDRESS",
 	&decode_xored_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -348,5 +389,6 @@
 	"TIMER-VAL",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -354,5 +396,6 @@
 	"RESERVATION-TOKEN",
 	&decode_uint64_attr,
-	&encode_uint64_attr
+	&encode_uint64_attr,
+	&clone_uint64_attr
     },
     {
@@ -360,5 +403,6 @@
 	"XOR-REFLECTED-FROM",
 	&decode_xored_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -366,5 +410,6 @@
 	"PRIORITY",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -372,5 +417,6 @@
 	"USE-CANDIDATE",
 	&decode_empty_attr,
-	&encode_empty_attr
+	&encode_empty_attr,
+	&clone_empty_attr
     },
     {
@@ -378,5 +424,6 @@
 	"XOR-INTERNAL-ADDRESS",
 	&decode_xored_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
 
@@ -386,4 +433,5 @@
 	NULL,
 	NULL,
+	NULL,
 	NULL
     }
@@ -394,4 +442,5 @@
     {
 	/* ID 0x8021 is not assigned */
+	NULL,
 	NULL,
 	NULL,
@@ -402,5 +451,6 @@
 	"SERVER",
 	&decode_string_attr,
-	&encode_string_attr
+	&encode_string_attr,
+	&clone_string_attr
     },
     {
@@ -408,5 +458,6 @@
 	"ALTERNATE-SERVER",
 	&decode_sockaddr_attr,
-	&encode_sockaddr_attr
+	&encode_sockaddr_attr,
+	&clone_sockaddr_attr
     },
     {
@@ -414,5 +465,6 @@
 	"REFRESH-INTERVAL",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -420,4 +472,5 @@
 	NULL,
 	NULL,
+	NULL,
 	NULL
     },
@@ -426,8 +479,10 @@
 	NULL,
 	NULL,
+	NULL,
 	NULL
     },
     {
 	/* CACHE-TIMEOUT, 0x8027 */
+	NULL,
 	NULL,
 	NULL,
@@ -438,5 +493,6 @@
 	"FINGERPRINT",
 	&decode_uint_attr,
-	&encode_uint_attr
+	&encode_uint_attr,
+	&clone_uint_attr
     },
     {
@@ -444,5 +500,6 @@
 	"ICE-CONTROLLED",
 	&decode_uint64_attr,
-	&encode_uint64_attr
+	&encode_uint64_attr,
+	&clone_uint64_attr
     },
     {
@@ -450,5 +507,6 @@
 	"ICE-CONTROLLING",
 	&decode_uint64_attr,
-	&encode_uint64_attr
+	&encode_uint64_attr,
+	&clone_uint64_attr
     }
 };
@@ -827,4 +885,11 @@
 
 
+static void* clone_sockaddr_attr(pj_pool_t *pool, const void *src)
+{
+    pj_stun_sockaddr_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_sockaddr_attr);
+    pj_memcpy(dst, src, sizeof(pj_stun_sockaddr_attr));
+    return (void*)dst;
+}
+
 //////////////////////////////////////////////////////////////////////////////
 /*
@@ -935,4 +1000,15 @@
 
 
+static void* clone_string_attr(pj_pool_t *pool, const void *src)
+{
+    const pj_stun_string_attr *asrc = (const pj_stun_string_attr*)src;
+    pj_stun_string_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_string_attr);
+
+    pj_memcpy(dst, src, sizeof(pj_stun_attr_hdr));
+    pj_strdup(pool, &dst->value, &asrc->value);
+
+    return (void*)dst;
+}
+
 //////////////////////////////////////////////////////////////////////////////
 /*
@@ -1018,4 +1094,13 @@
 }
 
+
+static void* clone_empty_attr(pj_pool_t *pool, const void *src)
+{
+    pj_stun_empty_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_empty_attr);
+
+    pj_memcpy(dst, src, sizeof(pj_stun_empty_attr));
+
+    return (void*) dst;
+}
 
 //////////////////////////////////////////////////////////////////////////////
@@ -1104,4 +1189,14 @@
 }
 
+
+static void* clone_uint_attr(pj_pool_t *pool, const void *src)
+{
+    pj_stun_uint_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_uint_attr);
+
+    pj_memcpy(dst, src, sizeof(pj_stun_uint_attr));
+
+    return (void*)dst;
+}
+
 //////////////////////////////////////////////////////////////////////////////
 
@@ -1190,4 +1285,14 @@
 
 
+static void* clone_uint64_attr(pj_pool_t *pool, const void *src)
+{
+    pj_stun_uint64_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_uint64_attr);
+
+    pj_memcpy(dst, src, sizeof(pj_stun_uint64_attr));
+
+    return (void*)dst;
+}
+
+
 //////////////////////////////////////////////////////////////////////////////
 /*
@@ -1270,4 +1375,14 @@
 
     return PJ_SUCCESS;
+}
+
+
+static void* clone_msgint_attr(pj_pool_t *pool, const void *src)
+{
+    pj_stun_msgint_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_msgint_attr);
+
+    pj_memcpy(dst, src, sizeof(pj_stun_msgint_attr));
+
+    return (void*) dst;
 }
 
@@ -1382,4 +1497,16 @@
 }
 
+
+static void* clone_errcode_attr(pj_pool_t *pool, const void *src)
+{
+    const pj_stun_errcode_attr *asrc = (const pj_stun_errcode_attr*)src;
+    pj_stun_errcode_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_errcode_attr);
+
+    pj_memcpy(dst, src, sizeof(pj_stun_errcode_attr));
+    pj_strdup(pool, &dst->reason, &asrc->reason);
+
+    return (void*)dst;
+}
+
 //////////////////////////////////////////////////////////////////////////////
 /*
@@ -1500,4 +1627,13 @@
 
 
+static void* clone_unknown_attr(pj_pool_t *pool, const void *src)
+{
+    pj_stun_unknown_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_unknown_attr);
+
+    pj_memcpy(dst, src, sizeof(pj_stun_unknown_attr));
+    
+    return (void*)dst;
+}
+
 //////////////////////////////////////////////////////////////////////////////
 /*
@@ -1597,4 +1733,19 @@
 }
 
+
+static void* clone_binary_attr(pj_pool_t *pool, const void *src)
+{
+    const pj_stun_binary_attr *asrc = (const pj_stun_binary_attr*)src;
+    pj_stun_binary_attr *dst = PJ_POOL_ALLOC_T(pool, pj_stun_binary_attr);
+
+    pj_memcpy(dst, src, sizeof(pj_stun_binary_attr));
+
+    if (asrc->length) {
+	dst->data = (pj_uint8_t*) pj_pool_alloc(pool, asrc->length);
+	pj_memcpy(dst->data, asrc->data, asrc->length);
+    }
+
+    return (void*)dst;
+}
 
 //////////////////////////////////////////////////////////////////////////////
@@ -1638,4 +1789,29 @@
 
     return PJ_SUCCESS;
+}
+
+
+/*
+ * Clone a STUN message with all of its attributes.
+ */
+PJ_DEF(pj_stun_msg*) pj_stun_msg_clone( pj_pool_t *pool,
+					const pj_stun_msg *src)
+{
+    pj_stun_msg *dst;
+    unsigned i;
+
+    PJ_ASSERT_RETURN(pool && src, NULL);
+
+    dst = PJ_POOL_ZALLOC_T(pool, pj_stun_msg);
+    pj_memcpy(dst, src, sizeof(pj_stun_msg));
+
+    /* Duplicate the attributes */
+    for (i=0, dst->attr_count=0; i<src->attr_count; ++i) {
+	dst->attr[dst->attr_count] = pj_stun_attr_clone(pool, src->attr[i]);
+	if (dst->attr[dst->attr_count])
+	    ++dst->attr_count;
+    }
+
+    return dst;
 }
 
@@ -1982,77 +2158,4 @@
 }
 
-/* Calculate HMAC-SHA1 key for long term credential, by getting
- * MD5 digest of username, realm, and password. 
- */
-static void calc_md5_key(pj_uint8_t digest[16],
-			 const pj_str_t *realm,
-			 const pj_str_t *username,
-			 const pj_str_t *passwd)
-{
-    /* The 16-byte key for MESSAGE-INTEGRITY HMAC is formed by taking
-     * the MD5 hash of the result of concatenating the following five
-     * fields: (1) The username, with any quotes and trailing nulls
-     * removed, (2) A single colon, (3) The realm, with any quotes and
-     * trailing nulls removed, (4) A single colon, and (5) The 
-     * password, with any trailing nulls removed.
-     */
-    pj_md5_context ctx;
-    pj_str_t s;
-
-    pj_md5_init(&ctx);
-
-#define REMOVE_QUOTE(s)	if (s.slen && *s.ptr=='"') \
-			    s.ptr++, s.slen--; \
-			if (s.slen && s.ptr[s.slen-1]=='"') \
-			    s.slen--;
-
-    /* Add username */
-    s = *username;
-    REMOVE_QUOTE(s);
-    pj_md5_update(&ctx, (pj_uint8_t*)s.ptr, s.slen);
-
-    /* Add single colon */
-    pj_md5_update(&ctx, (pj_uint8_t*)":", 1);
-
-    /* Add realm */
-    s = *realm;
-    REMOVE_QUOTE(s);
-    pj_md5_update(&ctx, (pj_uint8_t*)s.ptr, s.slen);
-
-#undef REMOVE_QUOTE
-
-    /* Another colon */
-    pj_md5_update(&ctx, (pj_uint8_t*)":", 1);
-
-    /* Add password */
-    pj_md5_update(&ctx, (pj_uint8_t*)passwd->ptr, passwd->slen);
-
-    /* Done */
-    pj_md5_final(&ctx, digest);
-}
-
-
-/*
- * Create authentication key to be used for encoding the message with
- * MESSAGE-INTEGRITY. 
- */
-PJ_DEF(void) pj_stun_create_key(pj_pool_t *pool,
-				pj_str_t *key,
-				const pj_str_t *realm,
-				const pj_str_t *username,
-				const pj_str_t *passwd)
-{
-    PJ_ASSERT_ON_FAIL(pool && key && username && passwd, return);
-
-    if (realm && realm->slen) {
-	key->ptr = (char*) pj_pool_alloc(pool, 16);
-	calc_md5_key((pj_uint8_t*)key->ptr, realm, username, passwd);
-	key->slen = 16;
-    } else {
-	pj_strdup(pool, key, passwd);
-    }
-}
-
-
 /*
 static char *print_binary(const pj_uint8_t *data, unsigned data_len)
@@ -2208,5 +2311,5 @@
 	 * the last attribute before FINGERPRINT.
 	 */
-	if (i < msg->attr_count-2) {
+	if (msg->attr_count>1 && i < msg->attr_count-2) {
 	    /* Should not happen for message generated by us */
 	    pj_assert(PJ_FALSE);
@@ -2299,2 +2402,19 @@
 }
 
+
+/*
+ * Clone a STUN attribute.
+ */
+PJ_DEF(pj_stun_attr_hdr*) pj_stun_attr_clone( pj_pool_t *pool,
+					      const pj_stun_attr_hdr *attr)
+{
+    const struct attr_desc *adesc;
+
+    /* Get the attribute descriptor */
+    adesc = find_attr_desc(attr->type);
+    PJ_ASSERT_RETURN(adesc != NULL, NULL);
+
+    return (pj_stun_attr_hdr*) (*adesc->clone_attr)(pool, attr);
+}
+
+
Index: pjproject/trunk/pjnath/src/pjnath/stun_session.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/stun_session.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjnath/stun_session.c	(revision 1877)
@@ -18,4 +18,5 @@
  */
 #include <pjnath/stun_session.h>
+#include <pjnath/errno.h>
 #include <pjlib.h>
 
@@ -30,5 +31,12 @@
 
     pj_bool_t		 use_fingerprint;
-    pj_stun_auth_cred	*cred;
+
+    char		 dump_buf[1000];
+
+    pj_stun_auth_type	 auth_type;
+    pj_stun_auth_cred	 cred;
+    int			 auth_retry;
+    pj_str_t		 next_nonce;
+
     pj_str_t		 srv_name;
 
@@ -126,37 +134,4 @@
 }
 
-static pj_status_t create_request_tdata(pj_stun_session *sess,
-					unsigned msg_type,
-					pj_uint32_t magic,
-					const pj_uint8_t tsx_id[12],
-					pj_stun_tx_data **p_tdata)
-{
-    pj_status_t status;
-    pj_stun_tx_data *tdata;
-
-    status = create_tdata(sess, &tdata);
-    if (status != PJ_SUCCESS)
-	return status;
-
-    /* Create STUN message */
-    status = pj_stun_msg_create(tdata->pool, msg_type,  magic, 
-				tsx_id, &tdata->msg);
-    if (status != PJ_SUCCESS) {
-	pj_pool_release(tdata->pool);
-	return status;
-    }
-
-    /* copy the request's transaction ID as the transaction key. */
-    pj_assert(sizeof(tdata->msg_key)==sizeof(tdata->msg->hdr.tsx_id));
-    tdata->msg_magic = tdata->msg->hdr.magic;
-    pj_memcpy(tdata->msg_key, tdata->msg->hdr.tsx_id,
-	      sizeof(tdata->msg->hdr.tsx_id));
-
-    *p_tdata = tdata;
-
-    return PJ_SUCCESS;
-}
-
-
 static void stun_tsx_on_destroy(pj_stun_client_tsx *tsx)
 {
@@ -216,53 +191,11 @@
 }
 
-static pj_status_t get_key(pj_stun_session *sess, pj_pool_t *pool,
-			   const pj_stun_msg *msg, pj_str_t *auth_key)
-{
-    if (sess->cred == NULL) {
-	auth_key->slen = 0;
-	return PJ_SUCCESS;
-    } else if (sess->cred->type == PJ_STUN_AUTH_CRED_STATIC) {
-	pj_stun_create_key(pool, auth_key, 
-			   &sess->cred->data.static_cred.realm,
-			   &sess->cred->data.static_cred.username,
-			   &sess->cred->data.static_cred.data);
-	return PJ_SUCCESS;
-    } else if (sess->cred->type == PJ_STUN_AUTH_CRED_DYNAMIC) {
-	pj_str_t realm, username, nonce;
-	pj_str_t *password;
-	void *user_data = sess->cred->data.dyn_cred.user_data;
-	int data_type = 0;
-	pj_status_t status;
-
-	realm.slen = username.slen = nonce.slen = 0;
-	password = PJ_POOL_ZALLOC_T(pool, pj_str_t);
-	status = (*sess->cred->data.dyn_cred.get_cred)(msg, user_data, pool,
-						       &realm, &username,
-						       &nonce, &data_type,
-						       password);
-	if (status != PJ_SUCCESS)
-	    return status;
-
-	pj_stun_create_key(pool, auth_key, 
-			   &realm, &username, password);
-
-	return PJ_SUCCESS;
-
-    } else {
-	pj_assert(!"Unknown credential type");
-	return PJ_EBUG;
-    }
-}
-
 static pj_status_t apply_msg_options(pj_stun_session *sess,
 				     pj_pool_t *pool,
+				     const pj_stun_req_cred_info *auth_info,
 				     pj_stun_msg *msg)
 {
     pj_status_t status = 0;
-    pj_bool_t need_auth;
-    pj_str_t realm, username, nonce, password;
-    int data_type = 0;
-
-    realm.slen = username.slen = nonce.slen = password.slen = 0;
+    pj_str_t realm, username, nonce, auth_key;
 
     /* The server SHOULD include a SERVER attribute in all responses */
@@ -272,30 +205,14 @@
     }
 
-    need_auth = pj_stun_auth_valid_for_msg(msg);
-
-    if (sess->cred && sess->cred->type == PJ_STUN_AUTH_CRED_STATIC &&
-	need_auth)
-    {
-	realm = sess->cred->data.static_cred.realm;
-	username = sess->cred->data.static_cred.username;
-	data_type = sess->cred->data.static_cred.data_type;
-	password = sess->cred->data.static_cred.data;
-	nonce = sess->cred->data.static_cred.nonce;
-
-    } else if (sess->cred && sess->cred->type == PJ_STUN_AUTH_CRED_DYNAMIC &&
-	       need_auth) 
-    {
-	void *user_data = sess->cred->data.dyn_cred.user_data;
-
-	status = (*sess->cred->data.dyn_cred.get_cred)(msg, user_data, pool,
-						       &realm, &username,
-						       &nonce, &data_type,
-						       &password);
-	if (status != PJ_SUCCESS)
-	    return status;
-    }
-
-
-    /* Create and add USERNAME attribute for */
+    if (pj_stun_auth_valid_for_msg(msg) && auth_info) {
+	realm = auth_info->realm;
+	username = auth_info->username;
+	nonce = auth_info->nonce;
+	auth_key = auth_info->auth_key;
+    } else {
+	realm.slen = username.slen = nonce.slen = auth_key.slen = 0;
+    }
+
+    /* Create and add USERNAME attribute if needed */
     if (username.slen && PJ_STUN_IS_REQUEST(msg->hdr.type)) {
 	status = pj_stun_msg_add_string_attr(pool, msg,
@@ -324,5 +241,5 @@
 
     /* Add MESSAGE-INTEGRITY attribute */
-    if (username.slen && need_auth) {
+    if (username.slen && auth_key.slen) {
 	status = pj_stun_msg_add_msgint_attr(pool, msg);
 	PJ_ASSERT_RETURN(status==PJ_SUCCESS, status);
@@ -340,4 +257,103 @@
 }
 
+static pj_status_t handle_auth_challenge(pj_stun_session *sess,
+					 const pj_stun_tx_data *request,
+					 const pj_stun_msg *response,
+					 const pj_sockaddr_t *src_addr,
+					 unsigned src_addr_len,
+					 pj_bool_t *notify_user)
+{
+    const pj_stun_errcode_attr *ea;
+
+    *notify_user = PJ_TRUE;
+
+    if (sess->auth_type != PJ_STUN_AUTH_LONG_TERM)
+	return PJ_SUCCESS;
+    
+    if (!PJ_STUN_IS_ERROR_RESPONSE(response->hdr.type))
+	return PJ_SUCCESS;
+
+    ea = (const pj_stun_errcode_attr*)
+	 pj_stun_msg_find_attr(response, PJ_STUN_ATTR_ERROR_CODE, 0);
+    if (!ea) {
+	PJ_LOG(4,(SNAME(sess), "Invalid error response: no ERROR-CODE"
+		  " attribute"));
+	*notify_user = PJ_FALSE;
+	return PJNATH_EINSTUNMSG;
+    }
+
+    if (ea->err_code == PJ_STUN_SC_UNAUTHORIZED || 
+	ea->err_code == PJ_STUN_SC_STALE_NONCE)
+    {
+	const pj_stun_nonce_attr *anonce;
+	pj_stun_tx_data *tdata;
+	unsigned i;
+	pj_status_t status;
+
+	anonce = (const pj_stun_nonce_attr*)
+		 pj_stun_msg_find_attr(response, PJ_STUN_ATTR_NONCE, 0);
+	if (!anonce) {
+	    PJ_LOG(4,(SNAME(sess), "Invalid response: missing NONCE"));
+	    *notify_user = PJ_FALSE;
+	    return PJNATH_EINSTUNMSG;
+	}
+
+	/* Bail out if we've supplied the correct nonce */
+	if (pj_strcmp(&anonce->value, &sess->next_nonce)==0) {
+	    return PJ_SUCCESS;
+	}
+
+	/* Bail out if we've tried too many */
+	if (++sess->auth_retry > 3) {
+	    PJ_LOG(4,(SNAME(sess), "Error: authentication failed (too "
+		      "many retries)"));
+	    return PJ_STATUS_FROM_STUN_CODE(401);
+	}
+
+	/* Save next_nonce */
+	pj_strdup(sess->pool, &sess->next_nonce, &anonce->value);
+
+	/* Create new request */
+	status = pj_stun_session_create_req(sess, request->msg->hdr.type,
+					    request->msg->hdr.magic,
+					    NULL, &tdata);
+	if (status != PJ_SUCCESS)
+	    return status;
+
+	/* Duplicate all the attributes in the old request, except
+	 * USERNAME, REALM, M-I, and NONCE 
+	 */
+	for (i=0; i<request->msg->attr_count; ++i) {
+	    const pj_stun_attr_hdr *asrc = request->msg->attr[i];
+
+	    if (asrc->type == PJ_STUN_ATTR_USERNAME ||
+		asrc->type == PJ_STUN_ATTR_REALM ||
+		asrc->type == PJ_STUN_ATTR_MESSAGE_INTEGRITY ||
+		asrc->type == PJ_STUN_ATTR_NONCE)
+	    {
+		continue;
+	    }
+
+	    tdata->msg->attr[tdata->msg->attr_count++] = 
+		pj_stun_attr_clone(tdata->pool, asrc);
+	}
+
+	/* Will retry the request with authentication, no need to
+	 * notify user.
+	 */
+	*notify_user = PJ_FALSE;
+
+	PJ_LOG(4,(SNAME(sess), "Retrying request with new authentication"));
+
+	/* Retry the request */
+	status = pj_stun_session_send_msg(sess, PJ_TRUE, src_addr, 
+					  src_addr_len, tdata);
+
+    } else {
+	sess->auth_retry = 0;
+    }
+
+    return PJ_SUCCESS;
+}
 
 static void stun_tsx_on_complete(pj_stun_client_tsx *tsx,
@@ -347,12 +363,19 @@
 				 unsigned src_addr_len)
 {
+    pj_stun_session *sess;
+    pj_bool_t notify_user = PJ_TRUE;
     pj_stun_tx_data *tdata;
 
     tdata = (pj_stun_tx_data*) pj_stun_client_tsx_get_data(tsx);
-
-    if (tdata->sess->cb.on_request_complete) {
-	(*tdata->sess->cb.on_request_complete)(tdata->sess, status, tdata, 
-					       response, 
-					       src_addr, src_addr_len);
+    sess = tdata->sess;
+
+    /* Handle authentication challenge */
+    handle_auth_challenge(sess, tdata, response, src_addr,
+		          src_addr_len, &notify_user);
+
+    if (notify_user && sess->cb.on_request_complete) {
+	(*sess->cb.on_request_complete)(sess, status, tdata, 
+					response, 
+					src_addr, src_addr_len);
     }
 }
@@ -489,17 +512,62 @@
 }
 
-PJ_DEF(void) pj_stun_session_set_credential(pj_stun_session *sess,
-					    const pj_stun_auth_cred *cred)
-{
-    PJ_ASSERT_ON_FAIL(sess, return);
+PJ_DEF(pj_status_t) pj_stun_session_set_credential(pj_stun_session *sess,
+						 pj_stun_auth_type auth_type,
+						 const pj_stun_auth_cred *cred)
+{
+    PJ_ASSERT_RETURN(sess, PJ_EINVAL);
+
+    sess->auth_type = auth_type;
     if (cred) {
-	if (!sess->cred)
-	    sess->cred = PJ_POOL_ALLOC_T(sess->pool, pj_stun_auth_cred);
-	pj_stun_auth_cred_dup(sess->pool, sess->cred, cred);
+	pj_stun_auth_cred_dup(sess->pool, &sess->cred, cred);
     } else {
-	sess->cred = NULL;
-    }
-}
-
+	sess->auth_type = PJ_STUN_AUTH_NONE;
+	pj_bzero(&sess->cred, sizeof(sess->cred));
+    }
+
+    return PJ_SUCCESS;
+}
+
+
+static pj_status_t get_auth(pj_stun_session *sess,
+			    pj_stun_tx_data *tdata)
+{
+    if (sess->cred.type == PJ_STUN_AUTH_CRED_STATIC) {
+	tdata->auth_info.realm = sess->cred.data.static_cred.realm;
+	tdata->auth_info.username = sess->cred.data.static_cred.username;
+	tdata->auth_info.nonce = sess->cred.data.static_cred.nonce;
+
+	pj_stun_create_key(tdata->pool, &tdata->auth_info.auth_key, 
+			   &tdata->auth_info.realm,
+			   &tdata->auth_info.username,
+			   sess->cred.data.static_cred.data_type,
+			   &sess->cred.data.static_cred.data);
+
+    } else if (sess->cred.type == PJ_STUN_AUTH_CRED_DYNAMIC) {
+	pj_str_t password;
+	void *user_data = sess->cred.data.dyn_cred.user_data;
+	pj_stun_passwd_type data_type = PJ_STUN_PASSWD_PLAIN;
+	pj_status_t rc;
+
+	rc = (*sess->cred.data.dyn_cred.get_cred)(tdata->msg, user_data, 
+						  tdata->pool,
+						  &tdata->auth_info.realm, 
+						  &tdata->auth_info.username,
+						  &tdata->auth_info.nonce, 
+						  &data_type, &password);
+	if (rc != PJ_SUCCESS)
+	    return rc;
+
+	pj_stun_create_key(tdata->pool, &tdata->auth_info.auth_key, 
+			   &tdata->auth_info.realm, &tdata->auth_info.username,
+			   data_type, &password);
+
+    } else {
+	pj_assert(!"Unknown credential type");
+	return PJ_EBUG;
+    }
+
+    return PJ_SUCCESS;
+}
 
 PJ_DEF(pj_status_t) pj_stun_session_create_req(pj_stun_session *sess,
@@ -514,7 +582,53 @@
     PJ_ASSERT_RETURN(sess && p_tdata, PJ_EINVAL);
 
-    status = create_request_tdata(sess, method, magic, tsx_id, &tdata);
+    status = create_tdata(sess, &tdata);
     if (status != PJ_SUCCESS)
 	return status;
+
+    /* Create STUN message */
+    status = pj_stun_msg_create(tdata->pool, method,  magic, 
+				tsx_id, &tdata->msg);
+    if (status != PJ_SUCCESS) {
+	pj_pool_release(tdata->pool);
+	return status;
+    }
+
+    /* copy the request's transaction ID as the transaction key. */
+    pj_assert(sizeof(tdata->msg_key)==sizeof(tdata->msg->hdr.tsx_id));
+    tdata->msg_magic = tdata->msg->hdr.magic;
+    pj_memcpy(tdata->msg_key, tdata->msg->hdr.tsx_id,
+	      sizeof(tdata->msg->hdr.tsx_id));
+
+    
+    /* Get authentication information for the request */
+    if (sess->auth_type == PJ_STUN_AUTH_NONE) {
+	/* No authentication */
+
+    } else if (sess->auth_type == PJ_STUN_AUTH_SHORT_TERM) {
+	/* MUST put authentication in request */
+	status = get_auth(sess, tdata);
+	if (status != PJ_SUCCESS) {
+	    pj_pool_release(tdata->pool);
+	    return status;
+	}
+
+    } else if (sess->auth_type == PJ_STUN_AUTH_LONG_TERM) {
+	/* Only put authentication information if we've received
+	 * response from server.
+	 */
+	if (sess->next_nonce.slen != 0) {
+	    status = get_auth(sess, tdata);
+	    if (status != PJ_SUCCESS) {
+		pj_pool_release(tdata->pool);
+		return status;
+	    }
+	    tdata->auth_info.nonce = sess->next_nonce;
+	}
+
+    } else {
+	pj_assert(!"Invalid authentication type");
+	pj_pool_release(tdata->pool);
+	return PJ_EBUG;
+    }
 
     *p_tdata = tdata;
@@ -552,5 +666,5 @@
  */
 PJ_DEF(pj_status_t) pj_stun_session_create_res( pj_stun_session *sess,
-						const pj_stun_msg *req,
+						const pj_stun_rx_data *rdata,
 						unsigned err_code,
 						const pj_str_t *err_msg,
@@ -565,6 +679,6 @@
 
     /* Create STUN response message */
-    status = pj_stun_msg_create_response(tdata->pool, req, err_code, err_msg,
-					 &tdata->msg);
+    status = pj_stun_msg_create_response(tdata->pool, rdata->msg, 
+					 err_code, err_msg, &tdata->msg);
     if (status != PJ_SUCCESS) {
 	pj_pool_release(tdata->pool);
@@ -573,7 +687,11 @@
 
     /* copy the request's transaction ID as the transaction key. */
-    pj_assert(sizeof(tdata->msg_key)==sizeof(req->hdr.tsx_id));
-    tdata->msg_magic = req->hdr.magic;
-    pj_memcpy(tdata->msg_key, req->hdr.tsx_id, sizeof(req->hdr.tsx_id));
+    pj_assert(sizeof(tdata->msg_key)==sizeof(rdata->msg->hdr.tsx_id));
+    tdata->msg_magic = rdata->msg->hdr.magic;
+    pj_memcpy(tdata->msg_key, rdata->msg->hdr.tsx_id, 
+	      sizeof(rdata->msg->hdr.tsx_id));
+
+    /* copy the credential found in the request */
+    pj_stun_req_cred_info_dup(tdata->pool, &tdata->auth_info, &rdata->info);
 
     *p_tdata = tdata;
@@ -587,27 +705,16 @@
 			unsigned pkt_size, const pj_sockaddr_t *addr)
 {
-    const char *dst_name;
-    int dst_port;
-    const pj_sockaddr *dst = (const pj_sockaddr*)addr;
-    char buf[800];
+    char dst_name[80];
     
-    if (dst->addr.sa_family == pj_AF_INET()) {
-	dst_name = pj_inet_ntoa(dst->ipv4.sin_addr);
-	dst_port = pj_ntohs(dst->ipv4.sin_port);
-    } else if (dst->addr.sa_family == pj_AF_INET6()) {
-	dst_name = "IPv6";
-	dst_port = pj_ntohs(dst->ipv6.sin6_port);
-    } else {
-	LOG_ERR_(sess, "Invalid address family", PJ_EINVAL);
-	return;
-    }
+    pj_sockaddr_print(addr, dst_name, sizeof(dst_name), 3);
 
     PJ_LOG(5,(SNAME(sess), 
-	      "TX %d bytes STUN message to %s:%d:\n"
+	      "TX %d bytes STUN message to %s:\n"
 	      "--- begin STUN message ---\n"
 	      "%s"
 	      "--- end of STUN message ---\n",
-	      pkt_size, dst_name, dst_port,
-	      pj_stun_msg_dump(msg, buf, sizeof(buf), NULL)));
+	      pkt_size, dst_name, 
+	      pj_stun_msg_dump(msg, sess->dump_buf, sizeof(sess->dump_buf), 
+			       NULL)));
 
 }
@@ -632,5 +739,6 @@
 
     /* Apply options */
-    status = apply_msg_options(sess, tdata->pool, tdata->msg);
+    status = apply_msg_options(sess, tdata->pool, &tdata->auth_info, 
+			       tdata->msg);
     if (status != PJ_SUCCESS) {
 	pj_stun_msg_destroy_tdata(sess, tdata);
@@ -640,16 +748,8 @@
     }
 
-    status = get_key(sess, tdata->pool, tdata->msg, &tdata->auth_key);
-    if (status != PJ_SUCCESS) {
-	pj_stun_msg_destroy_tdata(sess, tdata);
-	pj_lock_release(sess->lock);
-	LOG_ERR_(sess, "Error getting creadential's key", status);
-	return status;
-    }
-
     /* Encode message */
     status = pj_stun_msg_encode(tdata->msg, (pj_uint8_t*)tdata->pkt, 
     				tdata->max_len, 0, 
-    				&tdata->auth_key,
+    				&tdata->auth_info.auth_key,
 				&tdata->pkt_size);
     if (status != PJ_SUCCESS) {
@@ -743,5 +843,5 @@
  */
 PJ_DEF(pj_status_t) pj_stun_session_respond( pj_stun_session *sess, 
-					     const pj_stun_msg *req,
+					     const pj_stun_rx_data *rdata,
 					     unsigned code, 
 					     const char *errmsg,
@@ -754,5 +854,5 @@
     pj_stun_tx_data *tdata;
 
-    status = pj_stun_session_create_res(sess, req, code, 
+    status = pj_stun_session_create_res(sess, rdata, code, 
 					(errmsg?pj_cstr(&reason,errmsg):NULL), 
 					&tdata);
@@ -814,5 +914,5 @@
 static pj_status_t send_response(pj_stun_session *sess, 
 				 pj_pool_t *pool, pj_stun_msg *response,
-				 const pj_str_t *auth_key,
+				 const pj_stun_req_cred_info *auth_info,
 				 pj_bool_t retransmission,
 				 const pj_sockaddr_t *addr, unsigned addr_len)
@@ -824,5 +924,5 @@
     /* Apply options */
     if (!retransmission) {
-	status = apply_msg_options(sess, pool, response);
+	status = apply_msg_options(sess, pool, auth_info, response);
 	if (status != PJ_SUCCESS)
 	    return status;
@@ -835,5 +935,5 @@
     /* Encode */
     status = pj_stun_msg_encode(response, out_pkt, out_max_len, 0, 
-				auth_key, &out_len);
+				&auth_info->auth_key, &out_len);
     if (status != PJ_SUCCESS) {
 	LOG_ERR_(sess, "Error encoding message", status);
@@ -854,5 +954,5 @@
 				    const pj_uint8_t *pkt,
 				    unsigned pkt_len,
-				    const pj_stun_msg *msg,
+				    pj_stun_rx_data *rdata,
 				    pj_pool_t *tmp_pool,
 				    const pj_sockaddr_t *src_addr,
@@ -860,15 +960,18 @@
 {
     pj_stun_msg *response;
-    pj_str_t auth_key;
     pj_status_t status;
 
-    if (PJ_STUN_IS_ERROR_RESPONSE(msg->hdr.type) || sess->cred == NULL)
+    if (PJ_STUN_IS_ERROR_RESPONSE(rdata->msg->hdr.type) || 
+	sess->auth_type == PJ_STUN_AUTH_NONE)
+    {
 	return PJ_SUCCESS;
-
-    status = pj_stun_authenticate_request(pkt, pkt_len, msg, sess->cred,
-				          tmp_pool, &auth_key, &response);
+    }
+
+    status = pj_stun_authenticate_request(pkt, pkt_len, rdata->msg, 
+					  &sess->cred, tmp_pool, &rdata->info,
+					  &response);
     if (status != PJ_SUCCESS && response != NULL) {
 	PJ_LOG(5,(SNAME(sess), "Message authentication failed"));
-	send_response(sess, tmp_pool, response, &auth_key, PJ_FALSE, 
+	send_response(sess, tmp_pool, response, &rdata->info, PJ_FALSE, 
 		      src_addr, src_addr_len);
     }
@@ -898,12 +1001,16 @@
     }
 
+    if (sess->auth_type == PJ_STUN_AUTH_NONE)
+	options |= PJ_STUN_NO_AUTHENTICATE;
+
     /* Authenticate the message, unless PJ_STUN_NO_AUTHENTICATE
      * is specified in the option.
      */
-    if ((options & PJ_STUN_NO_AUTHENTICATE) == 0 && tdata->auth_key.slen != 0
-	&& pj_stun_auth_valid_for_msg(msg))
+    if ((options & PJ_STUN_NO_AUTHENTICATE) == 0 && 
+	tdata->auth_info.auth_key.slen != 0 && 
+	pj_stun_auth_valid_for_msg(msg))
     {
 	status = pj_stun_authenticate_response(pkt, pkt_len, msg, 
-					       &tdata->auth_key);
+					       &tdata->auth_info.auth_key);
 	if (status != PJ_SUCCESS) {
 	    PJ_LOG(5,(SNAME(sess), 
@@ -963,5 +1070,5 @@
 		 "Request retransmission, sending cached response"));
 
-	send_response(sess, tmp_pool, t->msg, &t->auth_key, PJ_TRUE, 
+	send_response(sess, tmp_pool, t->msg, &t->auth_info, PJ_TRUE, 
 		      src_addr, src_addr_len);
 	return PJ_SUCCESS;
@@ -977,9 +1084,17 @@
 				       const pj_uint8_t *in_pkt,
 				       unsigned in_pkt_len,
-				       const pj_stun_msg *msg,
+				       pj_stun_msg *msg,
 				       const pj_sockaddr_t *src_addr,
 				       unsigned src_addr_len)
 {
+    pj_stun_rx_data rdata;
     pj_status_t status;
+
+    /* Init rdata */
+    rdata.msg = msg;
+    pj_bzero(&rdata.info, sizeof(rdata.info));
+
+    if (sess->auth_type == PJ_STUN_AUTH_NONE)
+	options |= PJ_STUN_NO_AUTHENTICATE;
 
     /* Authenticate the message, unless PJ_STUN_NO_AUTHENTICATE
@@ -988,5 +1103,5 @@
     if ((options & PJ_STUN_NO_AUTHENTICATE) == 0) {
 	status = authenticate_req(sess, (const pj_uint8_t*) in_pkt, in_pkt_len,
-				  msg, tmp_pool, src_addr, src_addr_len);
+				  &rdata, tmp_pool, src_addr, src_addr_len);
 	if (status != PJ_SUCCESS) {
 	    return status;
@@ -996,12 +1111,14 @@
     /* Distribute to handler, or respond with Bad Request */
     if (sess->cb.on_rx_request) {
-	status = (*sess->cb.on_rx_request)(sess, in_pkt, in_pkt_len, msg,
+	status = (*sess->cb.on_rx_request)(sess, in_pkt, in_pkt_len, &rdata,
 					   src_addr, src_addr_len);
     } else {
+	pj_str_t err_text;
 	pj_stun_msg *response;
 
+	err_text = pj_str("Callback is not set to handle request");
 	status = pj_stun_msg_create_response(tmp_pool, msg, 
-					     PJ_STUN_SC_BAD_REQUEST, NULL,
-					     &response);
+					     PJ_STUN_SC_BAD_REQUEST, 
+					     &err_text, &response);
 	if (status == PJ_SUCCESS && response) {
 	    status = send_response(sess, tmp_pool, response, 
Index: pjproject/trunk/pjnath/src/pjnath/turn_session.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/turn_session.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjnath/turn_session.c	(revision 1877)
@@ -522,5 +522,5 @@
     pj_lock_acquire(sess->lock);
 
-    pj_stun_session_set_credential(sess->stun, cred);
+    pj_stun_session_set_credential(sess->stun, PJ_STUN_AUTH_LONG_TERM, cred);
 
     pj_lock_release(sess->lock);
Index: pjproject/trunk/pjnath/src/pjturn-srv/allocation.c
===================================================================
--- pjproject/trunk/pjnath/src/pjturn-srv/allocation.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjturn-srv/allocation.c	(revision 1877)
@@ -73,5 +73,5 @@
 				      const pj_uint8_t *pkt,
 				      unsigned pkt_len,
-				      const pj_stun_msg *msg,
+				      const pj_stun_rx_data *rdata,
 				      const pj_sockaddr_t *src_addr,
 				      unsigned src_addr_len);
@@ -98,8 +98,9 @@
 static pj_status_t parse_allocate_req(alloc_request *cfg,
 				      pj_stun_session *sess,
-				      const pj_stun_msg *req,
+				      const pj_stun_rx_data *rdata,
 				      const pj_sockaddr_t *src_addr,
 				      unsigned src_addr_len)
 {
+    const pj_stun_msg *req = rdata->msg;
     pj_stun_bandwidth_attr *attr_bw;
     pj_stun_req_transport_attr *attr_req_tp;
@@ -121,5 +122,6 @@
     /* Check if we can satisfy the bandwidth */
     if (cfg->bandwidth > MAX_CLIENT_BANDWIDTH) {
-	pj_stun_session_respond(sess, req, PJ_STUN_SC_ALLOCATION_QUOTA_REACHED,
+	pj_stun_session_respond(sess, rdata, 
+				PJ_STUN_SC_ALLOCATION_QUOTA_REACHED,
 			        "Invalid bandwidth", PJ_TRUE,
 				src_addr, src_addr_len);
@@ -131,5 +133,5 @@
 	          pj_stun_msg_find_attr(req, PJ_STUN_ATTR_REQ_TRANSPORT, 0);
     if (attr_req_tp == NULL) {
-	pj_stun_session_respond(sess, req, PJ_STUN_SC_BAD_REQUEST,
+	pj_stun_session_respond(sess, rdata, PJ_STUN_SC_BAD_REQUEST,
 			        "Missing REQUESTED-TRANSPORT attribute", 
 				PJ_TRUE, src_addr, src_addr_len);
@@ -141,5 +143,5 @@
     /* Can only support UDP for now */
     if (cfg->tp_type != PJ_TURN_TP_UDP) {
-	pj_stun_session_respond(sess, req, PJ_STUN_SC_UNSUPP_TRANSPORT_PROTO,
+	pj_stun_session_respond(sess, rdata, PJ_STUN_SC_UNSUPP_TRANSPORT_PROTO,
 				NULL, PJ_TRUE, src_addr, src_addr_len);
 	return PJ_STATUS_FROM_STUN_CODE(PJ_STUN_SC_UNSUPP_TRANSPORT_PROTO);
@@ -152,5 +154,5 @@
     if (attr_res_token) {
 	/* We don't support RESERVATION-TOKEN for now */
-	pj_stun_session_respond(sess, req, 
+	pj_stun_session_respond(sess, rdata, 
 				PJ_STUN_SC_BAD_REQUEST,
 				"RESERVATION-TOKEN is not supported", PJ_TRUE, 
@@ -164,5 +166,5 @@
     if (attr_rpp) {
 	/* We don't support REQUESTED-PROPS for now */
-	pj_stun_session_respond(sess, req, 
+	pj_stun_session_respond(sess, rdata, 
 				PJ_STUN_SC_BAD_REQUEST,
 				"REQUESTED-PROPS is not supported", PJ_TRUE, 
@@ -177,5 +179,5 @@
 	cfg->lifetime = attr_lifetime->value;
 	if (cfg->lifetime < MIN_LIFETIME) {
-	    pj_stun_session_respond(sess, req, PJ_STUN_SC_BAD_REQUEST,
+	    pj_stun_session_respond(sess, rdata, PJ_STUN_SC_BAD_REQUEST,
 				    "LIFETIME too short", PJ_TRUE, 
 				    src_addr, src_addr_len);
@@ -195,5 +197,5 @@
 static pj_status_t send_allocate_response(pj_turn_allocation *alloc,
 					  pj_stun_session *srv_sess,
-					  const pj_stun_msg *msg)
+					  const pj_stun_rx_data *rdata)
 {
     pj_stun_tx_data *tdata;
@@ -201,5 +203,5 @@
 
     /* Respond the original ALLOCATE request */
-    status = pj_stun_session_create_res(srv_sess, msg, 0, NULL, &tdata);
+    status = pj_stun_session_create_res(srv_sess, rdata, 0, NULL, &tdata);
     if (status != PJ_SUCCESS)
 	return status;
@@ -285,9 +287,10 @@
 					      const pj_sockaddr_t *src_addr,
 					      unsigned src_addr_len,
-					      const pj_stun_msg *msg,
+					      const pj_stun_rx_data *rdata,
 					      pj_stun_session *srv_sess,
 					      pj_turn_allocation **p_alloc)
 {
     pj_turn_srv *srv = listener->server;
+    const pj_stun_msg *msg = rdata->msg;
     pj_pool_t *pool;
     alloc_request req;
@@ -298,5 +301,5 @@
 
     /* Parse ALLOCATE request */
-    status = parse_allocate_req(&req, srv_sess, msg, src_addr, src_addr_len);
+    status = parse_allocate_req(&req, srv_sess, rdata, src_addr, src_addr_len);
     if (status != PJ_SUCCESS)
 	return status;
@@ -355,5 +358,6 @@
 
     /* Attach authentication credential to STUN session */
-    pj_stun_session_set_credential(alloc->sess, &alloc->cred);
+    pj_stun_session_set_credential(alloc->sess, PJ_STUN_AUTH_LONG_TERM,
+				   &alloc->cred);
 
     /* Create the relay resource */
@@ -367,5 +371,5 @@
 
     /* Respond to ALLOCATE request */
-    status = send_allocate_response(alloc, srv_sess, msg);
+    status = send_allocate_response(alloc, srv_sess, rdata);
     if (status != PJ_SUCCESS)
 	goto on_error;
@@ -384,5 +388,5 @@
     /* Send reply to the ALLOCATE request */
     pj_strerror(status, str_tmp, sizeof(str_tmp));
-    pj_stun_session_respond(srv_sess, msg, PJ_STUN_SC_BAD_REQUEST, str_tmp, 
+    pj_stun_session_respond(srv_sess, rdata, PJ_STUN_SC_BAD_REQUEST, str_tmp, 
 			    PJ_TRUE, src_addr, src_addr_len);
 
@@ -710,5 +714,5 @@
 /* Create and send error response */
 static void send_reply_err(pj_turn_allocation *alloc,
-			   const pj_stun_msg *req,
+			   const pj_stun_rx_data *rdata,
 			   pj_bool_t cache, 
 			   int code, const char *errmsg)
@@ -716,5 +720,5 @@
     pj_status_t status;
 
-    status = pj_stun_session_respond(alloc->sess, req, code, errmsg, cache,
+    status = pj_stun_session_respond(alloc->sess, rdata, code, errmsg, cache,
 				     &alloc->hkey.clt_addr,
 				     pj_sockaddr_get_len(&alloc->hkey.clt_addr.addr));
@@ -727,5 +731,5 @@
 /* Create and send successful response */
 static void send_reply_ok(pj_turn_allocation *alloc,
-		          const pj_stun_msg *req)
+		          const pj_stun_rx_data *rdata)
 {
     pj_status_t status;
@@ -733,5 +737,5 @@
     pj_stun_tx_data *tdata;
 
-    status = pj_stun_session_create_res(alloc->sess, req, 0, NULL, &tdata);
+    status = pj_stun_session_create_res(alloc->sess, rdata, 0, NULL, &tdata);
     if (status != PJ_SUCCESS) {
 	alloc_err(alloc, "Error creating STUN success response", status);
@@ -1073,8 +1077,9 @@
 				      const pj_uint8_t *pkt,
 				      unsigned pkt_len,
-				      const pj_stun_msg *msg,
+				      const pj_stun_rx_data *rdata,
 				      const pj_sockaddr_t *src_addr,
 				      unsigned src_addr_len)
 {
+    const pj_stun_msg *msg = rdata->msg;
     pj_turn_allocation *alloc;
 
@@ -1089,5 +1094,5 @@
     if (alloc->relay.lifetime == 0) {
 	/* Reject with 437 if we're shutting down */
-	send_reply_err(alloc, msg, PJ_TRUE, 
+	send_reply_err(alloc, rdata, PJ_TRUE, 
 		       PJ_STUN_SC_ALLOCATION_MISMATCH, NULL);
 	return PJ_SUCCESS;
@@ -1116,5 +1121,5 @@
 
 	    /* Respond first */
-	    send_reply_ok(alloc, msg);
+	    send_reply_ok(alloc, rdata);
 
 	    /* Shutdown allocation */
@@ -1142,5 +1147,5 @@
 
 	    /* Send reply */
-	    send_reply_ok(alloc, msg);
+	    send_reply_ok(alloc, rdata);
 	}
 
@@ -1159,5 +1164,6 @@
 
 	if (!ch_attr || !peer_attr) {
-	    send_reply_err(alloc, msg, PJ_TRUE, PJ_STUN_SC_BAD_REQUEST, NULL);
+	    send_reply_err(alloc, rdata, PJ_TRUE, 
+			   PJ_STUN_SC_BAD_REQUEST, NULL);
 	    return PJ_SUCCESS;
 	}
@@ -1172,5 +1178,5 @@
 	    if (pj_sockaddr_cmp(&p1->hkey.peer_addr, &peer_attr->sockaddr)) {
 		/* Address mismatch. Send 400 */
-		send_reply_err(alloc, msg, PJ_TRUE, 
+		send_reply_err(alloc, rdata, PJ_TRUE, 
 			       PJ_STUN_SC_BAD_REQUEST, 
 			       "Peer address mismatch");
@@ -1191,5 +1197,5 @@
 				       pj_sockaddr_get_len(&peer_attr->sockaddr));
 	if (p2 && p2->channel != PJ_TURN_INVALID_CHANNEL) {
-	    send_reply_err(alloc, msg, PJ_TRUE, PJ_STUN_SC_BAD_REQUEST, 
+	    send_reply_err(alloc, rdata, PJ_TRUE, PJ_STUN_SC_BAD_REQUEST, 
 			   "Peer address already assigned a channel number");
 	    return PJ_SUCCESS;
@@ -1211,5 +1217,5 @@
 
 	/* Reply */
-	send_reply_ok(alloc, msg);
+	send_reply_ok(alloc, rdata);
 
 	return PJ_SUCCESS;
@@ -1218,10 +1224,11 @@
 
 	/* Respond with 437 (section 6.3 turn-07) */
-	send_reply_err(alloc, msg, PJ_TRUE, PJ_STUN_SC_ALLOCATION_MISMATCH, NULL);
+	send_reply_err(alloc, rdata, PJ_TRUE, PJ_STUN_SC_ALLOCATION_MISMATCH,
+		       NULL);
 
     } else {
 
 	/* Respond with Bad Request? */
-	send_reply_err(alloc, msg, PJ_TRUE, PJ_STUN_SC_BAD_REQUEST, NULL);
+	send_reply_err(alloc, rdata, PJ_TRUE, PJ_STUN_SC_BAD_REQUEST, NULL);
 
     }
Index: pjproject/trunk/pjnath/src/pjturn-srv/auth.c
===================================================================
--- pjproject/trunk/pjnath/src/pjturn-srv/auth.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjturn-srv/auth.c	(revision 1877)
@@ -56,27 +56,4 @@
 {
     /* Nothing to do */
-}
-
-
-PJ_DEF(pj_status_t) pj_turn_get_cred( const pj_stun_msg *msg,
-				      void *user_data,
-				      pj_pool_t *pool,
-				      pj_str_t *realm,
-				      pj_str_t *username,
-				      pj_str_t *nonce,
-				      int *data_type,
-				      pj_str_t *data)
-{
-    PJ_UNUSED_ARG(msg);
-    PJ_UNUSED_ARG(pool);
-    PJ_UNUSED_ARG(user_data);
-
-    *realm = pj_str(g_realm);
-    *username = pj_str(g_cred[0].username);
-    *nonce = pj_str(THE_NONCE);
-    *data_type = 0;
-    *data = pj_str(g_cred[0].passwd);
-
-    return PJ_SUCCESS;
 }
 
Index: pjproject/trunk/pjnath/src/pjturn-srv/auth.h
===================================================================
--- pjproject/trunk/pjnath/src/pjturn-srv/auth.h	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjturn-srv/auth.h	(revision 1877)
@@ -62,16 +62,4 @@
 
 /**
- * Get credential.
- */
-PJ_DECL(pj_status_t) pj_turn_get_cred(const pj_stun_msg *msg,
-				      void *user_data,
-				      pj_pool_t *pool,
-				      pj_str_t *realm,
-				      pj_str_t *username,
-				      pj_str_t *nonce,
-				      int *data_type,
-				      pj_str_t *data);
-
-/**
  * This function is called to get the password for the specified username.
  * This function is also used to check whether the username is valid.
Index: pjproject/trunk/pjnath/src/pjturn-srv/server.c
===================================================================
--- pjproject/trunk/pjnath/src/pjturn-srv/server.c	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjturn-srv/server.c	(revision 1877)
@@ -41,5 +41,5 @@
 				      const pj_uint8_t *pkt,
 				      unsigned pkt_len,
-				      const pj_stun_msg *msg,
+				      const pj_stun_rx_data *rdata,
 				      const pj_sockaddr_t *src_addr,
 				      unsigned src_addr_len);
@@ -148,5 +148,4 @@
     srv->core.cred.data.dyn_cred.user_data = srv;
     srv->core.cred.data.dyn_cred.get_auth = &pj_turn_get_auth;
-    srv->core.cred.data.dyn_cred.get_cred = &pj_turn_get_cred;
     srv->core.cred.data.dyn_cred.get_password = &pj_turn_get_password;
     srv->core.cred.data.dyn_cred.verify_nonce = &pj_turn_verify_nonce;
@@ -369,5 +368,6 @@
 
     pj_stun_session_set_user_data(sess, lis);
-    pj_stun_session_set_credential(sess, &srv->core.cred);
+    pj_stun_session_set_credential(sess, PJ_STUN_AUTH_LONG_TERM, 
+				   &srv->core.cred);
 
     srv->core.stun_sess[index] = sess;
@@ -484,7 +484,6 @@
 
 /* Respond to STUN request */
-static pj_status_t stun_respond(pj_turn_srv *srv,
-				pj_stun_session *sess, 
-				const pj_stun_msg *req,
+static pj_status_t stun_respond(pj_stun_session *sess, 
+				const pj_stun_rx_data *rdata,
 				unsigned code, 
 				const char *errmsg,
@@ -498,5 +497,5 @@
 
     /* Create response */
-    status = pj_stun_session_create_res(sess, req, code, 
+    status = pj_stun_session_create_res(sess, rdata, code, 
 					(errmsg?pj_cstr(&reason,errmsg):NULL),
 					&tdata);
@@ -504,103 +503,6 @@
 	return status;
 
-    /* Store the credential for future lookup. */
-    if (pj_stun_auth_valid_for_msg(tdata->msg)) {
-	pj_turn_srv_put_cred(srv, req, tdata);
-    }
-
     /* Send the response */
     return pj_stun_session_send_msg(sess, cache, dst_addr,  addr_len, tdata);
-}
-
-
-/*
- * Store the credential to put placed for the specified message for
- * future retrieval.
- */
-PJ_DEF(pj_status_t) pj_turn_srv_put_cred(pj_turn_srv *srv,
-				         const pj_stun_msg *req,
-					 pj_stun_tx_data *response)
-{
-    pj_stun_username_attr *user;
-    pj_stun_realm_attr *realm;
-    pj_stun_nonce_attr *nonce;
-    struct saved_cred *saved_cred;
-    pj_status_t status;
-
-    realm = (pj_stun_realm_attr*)
-	    pj_stun_msg_find_attr(req, PJ_STUN_ATTR_REALM, 0);
-    PJ_ASSERT_RETURN(realm != NULL, PJ_EBUG);
-
-    user = (pj_stun_username_attr*)
-	   pj_stun_msg_find_attr(req, PJ_STUN_ATTR_USERNAME, 0);
-    PJ_ASSERT_RETURN(user != NULL, PJ_EBUG);
-
-    nonce = (pj_stun_nonce_attr*)
-	    pj_stun_msg_find_attr(req, PJ_STUN_ATTR_NONCE, 0);
-    PJ_ASSERT_RETURN(nonce != NULL, PJ_EBUG);
-
-    saved_cred = PJ_POOL_ALLOC_T(response->pool, struct saved_cred);
-
-    /* Lookup the password */
-    status = pj_turn_get_password(response->msg, NULL, &realm->value, 
-				  &user->value, response->pool, 
-				  &saved_cred->data_type, 
-				  &saved_cred->data);
-    if (status != PJ_SUCCESS)
-	return status;
-
-    /* Store credential */
-    pj_strdup(response->pool, &saved_cred->username, &user->value);
-    pj_strdup(response->pool, &saved_cred->realm, &realm->value);
-    pj_strdup(response->pool, &saved_cred->nonce, &nonce->value);
-
-    pj_thread_local_set(srv->core.tls_key, response->msg);
-    pj_thread_local_set(srv->core.tls_data, saved_cred);
-
-    return PJ_SUCCESS;
-}
-
-
-/**
- * Retrieve previously stored credential for the specified message.
- */
-PJ_DEF(pj_status_t) pj_turn_srv_get_cred(const pj_stun_msg *msg,
-					 void *user_data,
-					 pj_pool_t *pool,
-					 pj_str_t *realm,
-					 pj_str_t *username,
-					 pj_str_t *nonce,
-					 int *data_type,
-					 pj_str_t *data)
-{
-    pj_turn_srv *srv;
-    const pj_stun_msg *saved_msg;
-    struct saved_cred *saved_cred;
-
-    PJ_UNUSED_ARG(pool);
-
-    srv = (pj_turn_srv*)user_data;
-
-    /* Lookup stored message and make sure it's for the same message */
-    saved_msg = (const pj_stun_msg*)
-	        pj_thread_local_get(srv->core.tls_key);
-    PJ_ASSERT_RETURN(saved_msg==msg, PJ_ENOTFOUND);
-
-    /* Lookup saved credential */
-    saved_cred = (struct saved_cred*) 
-		 pj_thread_local_get(srv->core.tls_data);
-    PJ_ASSERT_RETURN(saved_cred != NULL, PJ_ENOTFOUND);
-
-
-    *realm = saved_cred->realm;
-    *username = saved_cred->username;
-    *nonce = saved_cred->nonce;
-    *data_type = saved_cred->data_type;
-    *data = saved_cred->data;
-
-
-    /* Don't clear saved_cred as this may be called more than once */
-
-    return PJ_SUCCESS;
 }
 
@@ -613,9 +515,10 @@
 				      const pj_uint8_t *pkt,
 				      unsigned pkt_len,
-				      const pj_stun_msg *msg,
+				      const pj_stun_rx_data *rdata,
 				      const pj_sockaddr_t *src_addr,
 				      unsigned src_addr_len)
 {
     pj_turn_listener *listener;
+    const pj_stun_msg *msg = rdata->msg;
     pj_turn_srv *srv;
     pj_turn_allocation *alloc;
@@ -630,5 +533,5 @@
     /* Respond any requests other than ALLOCATE with 437 response */
     if (msg->hdr.type != PJ_STUN_ALLOCATE_REQUEST) {
-	stun_respond(srv, sess, msg, PJ_STUN_SC_ALLOCATION_MISMATCH,
+	stun_respond(sess, rdata, PJ_STUN_SC_ALLOCATION_MISMATCH,
 		     NULL, PJ_FALSE, src_addr, src_addr_len);
 	return PJ_SUCCESS;
@@ -639,5 +542,5 @@
      */
     status = pj_turn_allocation_create(listener, src_addr, src_addr_len,
-				       msg, sess, &alloc);
+				       rdata, sess, &alloc);
     if (status != PJ_SUCCESS) {
 	/* STUN response has been sent, no need to reply here */
Index: pjproject/trunk/pjnath/src/pjturn-srv/turn.h
===================================================================
--- pjproject/trunk/pjnath/src/pjturn-srv/turn.h	(revision 1876)
+++ pjproject/trunk/pjnath/src/pjturn-srv/turn.h	(revision 1877)
@@ -205,5 +205,5 @@
 					      const pj_sockaddr_t *src_addr,
 					      unsigned src_addr_len,
-					      const pj_stun_msg *msg,
+					      const pj_stun_rx_data *rdata,
 					      pj_stun_session *srv_sess,
 					      pj_turn_allocation **p_alloc);
@@ -460,25 +460,4 @@
 
 
-/**
- * Store the credential to put placed for the specified message for
- * future retrieval.
- */
-PJ_DECL(pj_status_t) pj_turn_srv_put_cred(pj_turn_srv *srv,
-					  const pj_stun_msg *request,
-					  pj_stun_tx_data *response);
-
-/**
- * Retrieve previously stored credential for the specified message.
- */
-PJ_DECL(pj_status_t) pj_turn_srv_get_cred(const pj_stun_msg *msg,
-					  void *user_data,
-					  pj_pool_t *pool,
-					  pj_str_t *realm,
-					  pj_str_t *username,
-					  pj_str_t *nonce,
-					  int *data_type,
-					  pj_str_t *data);
-
-
 #endif	/* __PJ_TURN_SRV_TURN_H__ */
 
