Changeset 1924

Timestamp:

Apr 13, 2008 9:48:44 PM (16 years ago)

Author:

bennylp

Message:

More ticket #485: fixed TURN server permission not allowing peer with the same IP to get through, and added option to disable FINGERPRINT verification in TURN server since it is currently broken when TURN is used with ICE (which has a FINGERPRINT in its Binding Request)

Location:

pjproject/trunk/pjnath

Files:

• include/pjnath/stun_msg.h (modified) (1 diff)
• src/pjnath/stun_msg.c (modified) (1 diff)
• src/pjturn-srv/allocation.c (modified) (4 diffs)
• src/pjturn-srv/auth.c (modified) (1 diff)
• src/pjturn-srv/main.c (modified) (2 diffs)
• src/pjturn-srv/server.c (modified) (1 diff)

pjproject/trunk/pjnath/include/pjnath/stun_msg.h

@@ -1159 +1159 @@
      * message.
      */
-    PJ_STUN_NO_AUTHENTICATE = 4
+    PJ_STUN_NO_AUTHENTICATE = 4,
+
+    /**
+     * Disable FINGERPRINT verification. This option can be used when calling
+     * #pj_stun_msg_check() and #pj_stun_msg_decode() to disable the 
+     * verification of FINGERPRINT, for example when the STUN usage says when
+     * FINGERPRINT mechanism shall not * be used.
+     */
+    PJ_STUN_NO_FINGERPRINT_CHECK = 8
 };
 

pjproject/trunk/pjnath/src/pjnath/stun_msg.c

@@ -1869 +1869 @@
 
         /* Check if FINGERPRINT attribute is present */
-        if (GETVAL16H(pdu, msg_len + 20 - 8) == PJ_STUN_ATTR_FINGERPRINT) {
+        if ((options & PJ_STUN_NO_FINGERPRINT_CHECK )==0 && 
+            GETVAL16H(pdu, msg_len + 20 - 8) == PJ_STUN_ATTR_FINGERPRINT) 
+        {
             pj_uint16_t attr_len = GETVAL16H(pdu, msg_len + 20 - 8 + 2);
             pj_uint32_t fingerprint = GETVAL32H(pdu, msg_len + 20 - 8 + 4);

pjproject/trunk/pjnath/src/pjturn-srv/allocation.c

@@ -826 +826 @@
     perm->expiry.sec += PJ_TURN_PERM_TIMEOUT;
 
-    /* Register to hash table */
-    pj_hash_set(alloc->pool, alloc->peer_table, &perm->hkey.peer_addr, 
-                pj_sockaddr_get_len(&perm->hkey.peer_addr), 0, perm);
+    /* Register to hash table (only the address part!) */
+    pj_hash_set(alloc->pool, alloc->peer_table, 
+                pj_sockaddr_get_addr(&perm->hkey.peer_addr), 
+                pj_sockaddr_get_addr_len(&perm->hkey.peer_addr), 0, perm);
 
     return perm;
@@ -846 +847 @@
 
     /* Remove from permission hash table */
-    pj_hash_set(NULL, alloc->peer_table, &perm->hkey.peer_addr, 
-                pj_sockaddr_get_len(&perm->hkey.peer_addr), 0, NULL);
+    pj_hash_set(NULL, alloc->peer_table, 
+                pj_sockaddr_get_addr(&perm->hkey.peer_addr), 
+                pj_sockaddr_get_addr_len(&perm->hkey.peer_addr), 0, NULL);
 
     /* Remove from channel hash table, if assigned a channel number */
@@ -866 +868 @@
     pj_turn_permission *perm;
 
+    PJ_UNUSED_ARG(addr_len);
+
     /* Lookup in peer hash table */
-    perm = (pj_turn_permission*) pj_hash_get(alloc->peer_table, peer_addr,
-                                             addr_len, NULL);
+    perm = (pj_turn_permission*) 
+           pj_hash_get(alloc->peer_table, 
+                       pj_sockaddr_get_addr(peer_addr),
+                       pj_sockaddr_get_addr_len(peer_addr), 
+                       NULL);
     return perm ? check_permission_expiry(perm) : NULL;
 }
@@ -921 +928 @@
          * our stun_on_rx_request() or stun_on_rx_indication()
          * callbacks.
+         *
+         * Note: currently it is necessary to specify the 
+         * PJ_STUN_NO_FINGERPRINT_CHECK otherwise the FINGERPRINT
+         * attribute inside STUN Send Indication message will mess up
+         * with fingerprint checking.
          */
-        unsigned options = PJ_STUN_CHECK_PACKET;
+        unsigned options = PJ_STUN_CHECK_PACKET | PJ_STUN_NO_FINGERPRINT_CHECK;
         unsigned parsed_len = 0;
 

pjproject/trunk/pjnath/src/pjturn-srv/auth.c

@@ -34 +34 @@
 } g_cred[] = 
 {
-    { "user", "passwd" },
+    { "100", "100" },
+    { "700", "700" },
+    { "701", "701" },
+    { "702", "702" }
 };
 

pjproject/trunk/pjnath/src/pjturn-srv/main.c

@@ -20 +20 @@
 #include "auth.h"
 
-#define REALM   "pjsip.org"
+#define REALM           "pjsip.org"
+#define TURN_PORT       PJ_STUN_TURN_PORT
+//#define TURN_PORT     34780
+
 
 static pj_caching_pool g_cp;
@@ -139 +142 @@
 
     status = pj_turn_listener_create_udp(srv, pj_AF_INET(), NULL, 
-                                         PJ_STUN_PORT, 1, 0, &listener);
+                                         TURN_PORT, 1, 0, &listener);
     if (status != PJ_SUCCESS)
         return err("Error creating UDP listener", status);
 
     status = pj_turn_listener_create_tcp(srv, pj_AF_INET(), NULL, 
-                                         PJ_STUN_PORT, 1, 0, &listener);
+                                         TURN_PORT, 1, 0, &listener);
     if (status != PJ_SUCCESS)
         return err("Error creating listener", status);

pjproject/trunk/pjnath/src/pjturn-srv/server.c

@@ -582 +582 @@
 
         /* Check that this is a STUN message */
-        options = PJ_STUN_CHECK_PACKET;
+        options = PJ_STUN_CHECK_PACKET | PJ_STUN_NO_FINGERPRINT_CHECK;
         if (pkt->transport->listener->tp_type == PJ_TURN_TP_UDP)
             options |= PJ_STUN_IS_DATAGRAM;