Commit 7c714c52 authored by Youness Alaoui's avatar Youness Alaoui

Make a difference between an unauthorized validation because username/password...

Make a difference between an unauthorized validation because username/password do not exist and with the unauthorized when the key doesn't match. Also commented the validation return values
parent 4bf742ec
...@@ -106,6 +106,7 @@ StunValidationStatus stun_agent_validate (StunAgent *agent, StunMessage *msg, ...@@ -106,6 +106,7 @@ StunValidationStatus stun_agent_validate (StunAgent *agent, StunMessage *msg,
uint16_t hlen; uint16_t hlen;
int sent_id_idx = -1; int sent_id_idx = -1;
uint16_t unknown; uint16_t unknown;
int error_code;
len = stun_message_validate_buffer_length (buffer, buffer_len); len = stun_message_validate_buffer_length (buffer, buffer_len);
if (len == STUN_MESSAGE_BUFFER_INVALID) { if (len == STUN_MESSAGE_BUFFER_INVALID) {
...@@ -168,19 +169,24 @@ StunValidationStatus stun_agent_validate (StunAgent *agent, StunMessage *msg, ...@@ -168,19 +169,24 @@ StunValidationStatus stun_agent_validate (StunAgent *agent, StunMessage *msg,
} }
} }
if ((agent->usage_flags & STUN_AGENT_USAGE_SHORT_TERM_CREDENTIALS &&
(!stun_message_has_attribute (msg, STUN_ATTRIBUTE_USERNAME) || if (key == NULL &&
!stun_message_has_attribute (msg, STUN_ATTRIBUTE_MESSAGE_INTEGRITY))) || !(stun_message_get_class (msg) == STUN_ERROR &&
(agent->usage_flags & STUN_AGENT_USAGE_LONG_TERM_CREDENTIALS && stun_message_find_error (msg, &error_code) == 0 &&
stun_message_get_class (msg) != STUN_INDICATION && (error_code == 400 || error_code == 401)) &&
((agent->usage_flags & STUN_AGENT_USAGE_SHORT_TERM_CREDENTIALS &&
(!stun_message_has_attribute (msg, STUN_ATTRIBUTE_USERNAME) || (!stun_message_has_attribute (msg, STUN_ATTRIBUTE_USERNAME) ||
!stun_message_has_attribute (msg, STUN_ATTRIBUTE_MESSAGE_INTEGRITY) || !stun_message_has_attribute (msg, STUN_ATTRIBUTE_MESSAGE_INTEGRITY))) ||
!stun_message_has_attribute (msg, STUN_ATTRIBUTE_NONCE) || (agent->usage_flags & STUN_AGENT_USAGE_LONG_TERM_CREDENTIALS &&
!stun_message_has_attribute (msg, STUN_ATTRIBUTE_REALM))) || stun_message_get_class (msg) != STUN_INDICATION &&
((agent->usage_flags & STUN_AGENT_USAGE_IGNORE_CREDENTIALS) == 0 && (!stun_message_has_attribute (msg, STUN_ATTRIBUTE_USERNAME) ||
stun_message_has_attribute (msg, STUN_ATTRIBUTE_USERNAME) && !stun_message_has_attribute (msg, STUN_ATTRIBUTE_MESSAGE_INTEGRITY) ||
!stun_message_has_attribute (msg, STUN_ATTRIBUTE_MESSAGE_INTEGRITY))) { !stun_message_has_attribute (msg, STUN_ATTRIBUTE_NONCE) ||
return STUN_VALIDATION_UNAUTHORIZED; !stun_message_has_attribute (msg, STUN_ATTRIBUTE_REALM))) ||
((agent->usage_flags & STUN_AGENT_USAGE_IGNORE_CREDENTIALS) == 0 &&
stun_message_has_attribute (msg, STUN_ATTRIBUTE_USERNAME) &&
!stun_message_has_attribute (msg, STUN_ATTRIBUTE_MESSAGE_INTEGRITY)))) {
return STUN_VALIDATION_UNAUTHORIZED_BAD_REQUEST;
} }
if ((agent->usage_flags & STUN_AGENT_USAGE_IGNORE_CREDENTIALS) == 0 && if ((agent->usage_flags & STUN_AGENT_USAGE_IGNORE_CREDENTIALS) == 0 &&
......
...@@ -51,14 +51,31 @@ typedef enum { ...@@ -51,14 +51,31 @@ typedef enum {
typedef enum { typedef enum {
/* The message is validated */
STUN_VALIDATION_SUCCESS, STUN_VALIDATION_SUCCESS,
/* This is not a valid STUN message */
STUN_VALIDATION_NOT_STUN, STUN_VALIDATION_NOT_STUN,
/* The message seems to be valid but incomplete */
STUN_VALIDATION_INCOMPLETE_STUN, STUN_VALIDATION_INCOMPLETE_STUN,
/* The message does not have the cookie or the fingerprint
* while the agent needs it with its usage */
STUN_VALIDATION_BAD_REQUEST, STUN_VALIDATION_BAD_REQUEST,
/* The message is valid but unauthorized with no username and message-integrity
attributes. A BAD_REQUEST error must be generated */
STUN_VALIDATION_UNAUTHORIZED_BAD_REQUEST,
/* The message is valid but unauthorized as the username/password do not match.
An UNAUTHORIZED error must be generated */
STUN_VALIDATION_UNAUTHORIZED, STUN_VALIDATION_UNAUTHORIZED,
/* The message is valid but this is a response/error that doesn't match
* a previously sent request */
STUN_VALIDATION_UNMATCHED_RESPONSE, STUN_VALIDATION_UNMATCHED_RESPONSE,
/* The message is valid but contains one or more unknown comprehension
* attributes. stun_agent_build_unknown_attributes_error should be called */
STUN_VALIDATION_UNKNOWN_REQUEST_ATTRIBUTE,
/* The message is valid but contains one or more unknown comprehension
* attributes. This is a response, or error, or indication message
* and no error response should be sent */
STUN_VALIDATION_UNKNOWN_ATTRIBUTE, STUN_VALIDATION_UNKNOWN_ATTRIBUTE,
STUN_VALIDATION_UNKNOWN_REQUEST_ATTRIBUTE
} StunValidationStatus; } StunValidationStatus;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment