ccding / go-stun

A go implementation of the STUN client (RFC 3489 and RFC 5389)
Apache License 2.0
675 stars 120 forks source link

go-stun can't support coturn-4.5.0.6 #26

Closed lxlenovostar closed 6 years ago

lxlenovostar commented 6 years ago

go-stun send binding request to coturn-4.5.0.6 will fail.

The binding request packet will drop for fingerprint. I have debug it in coturn. packet check will fail in stun_is_command_message_full_check_str.

stun_is_command_message_full_check_str in src/client/ns_turn_msg.c
int stun_is_command_message_full_check_str(const u08bits* buf, size_t blen, int must_check_fingerprint, int *fingerprint_present) {
    if(!stun_is_command_message_str(buf,blen))
        return 0;

    stun_attr_ref sar = stun_attr_get_first_by_type_str(buf, blen, STUN_ATTRIBUTE_FINGERPRINT);
    if(!sar) {
        if(fingerprint_present)
            *fingerprint_present = 0; 
        if(stun_get_method_str(buf,blen) == STUN_METHOD_BINDING) {
            return 1;
        }    
        return !must_check_fingerprint;
    }    

    if(stun_attr_get_len(sar) != 4)
        return 0;

    const u32bits* fingerprint = (const u32bits*)stun_attr_get_value(sar);
    if(!fingerprint)
        return !must_check_fingerprint;

    u32bits crc32len = (u32bits)((((const u08bits*)fingerprint)-buf)-4);
    int ret = (*fingerprint == nswap32(ns_crc32(buf,crc32len) ^ ((u32bits)0x5354554e)));
    if(ret && fingerprint_present)
        *fingerprint_present = ret;

    return ret;
}   

I can use chrome send binding request to coturn-4.5.0.6 。So, this is bug in go-stun? Thank you for reply.

ccding commented 6 years ago

which line does it fail on?

lxlenovostar commented 6 years ago
 u32bits crc32len = (u32bits)((((const u08bits*)fingerprint)-buf)-4);
    int ret = (*fingerprint == nswap32(ns_crc32(buf,crc32len) ^ ((u32bits)0x5354554e)));
    if(ret && fingerprint_present)
        *fingerprint_present = ret;
ccding commented 6 years ago

I didn't mange to see any incompatibility in this code with the go-stun code. https://github.com/ccding/go-stun/blob/master/stun/attribute.go#L39

Can you do more test to see why the fingerprints can't be verified?

I would appreciate it if you could submit a pull request to fix this.