Commit c395f5c6 authored by Youness Alaoui's avatar Youness Alaoui

Add proper long term credentials support

parent 8338ac59
......@@ -214,8 +214,30 @@ StunValidationStatus stun_agent_validate (StunAgent *agent, StunMessage *msg,
if (hash) {
/* We must give the size from start to the end of the attribute
because you might have a FINGERPRINT attribute after it... */
if (agent->usage_flags & STUN_AGENT_USAGE_LONG_TERM_CREDENTIALS) {
uint8_t *realm = NULL;
uint8_t *username = NULL;
uint16_t realm_len;
uint16_t username_len;
uint8_t md5[16];
realm = (uint8_t *) stun_message_find (msg, STUN_ATTRIBUTE_REALM, &realm_len);
username = (uint8_t *) stun_message_find (msg,
STUN_ATTRIBUTE_USERNAME, &username_len);
if (username == NULL || realm == NULL) {
return STUN_VALIDATION_UNAUTHORIZED;
}
stun_hash_creds (realm, realm_len,
username, username_len,
key, key_len, md5);
stun_sha1 (msg->buffer, hash + 20 - msg->buffer, sha, md5, sizeof(md5),
agent->compatibility == STUN_COMPATIBILITY_RFC3489 ? TRUE : FALSE);
} else {
stun_sha1 (msg->buffer, hash + 20 - msg->buffer, sha, key, key_len,
agent->compatibility == STUN_COMPATIBILITY_RFC3489 ? TRUE : FALSE);
}
stun_debug (" Message HMAC-SHA1 fingerprint:");
stun_debug ("\nkey : ");
stun_debug_bytes (key, key_len);
......@@ -424,8 +446,29 @@ size_t stun_agent_finish_message (StunAgent *agent, StunMessage *msg,
return 0;
}
if (agent->usage_flags & STUN_AGENT_USAGE_LONG_TERM_CREDENTIALS) {
uint8_t *realm = NULL;
uint8_t *username = NULL;
uint16_t realm_len;
uint16_t username_len;
uint8_t md5[16];
realm = (uint8_t *) stun_message_find (msg, STUN_ATTRIBUTE_REALM, &realm_len);
username = (uint8_t *) stun_message_find (msg,
STUN_ATTRIBUTE_USERNAME, &username_len);
if (username == NULL || realm == NULL) {
return 0;
}
stun_hash_creds (realm, realm_len,
username, username_len,
key, key_len, md5);
stun_sha1 (msg->buffer, stun_message_length (msg), ptr, md5, sizeof(md5),
agent->compatibility == STUN_COMPATIBILITY_RFC3489 ? TRUE : FALSE);
} else {
stun_sha1 (msg->buffer, stun_message_length (msg), ptr, key, key_len,
agent->compatibility == STUN_COMPATIBILITY_RFC3489 ? TRUE : FALSE);
}
stun_debug (" Message HMAC-SHA1 message integrity:"
"\n key : ");
......@@ -436,7 +479,8 @@ size_t stun_agent_finish_message (StunAgent *agent, StunMessage *msg,
}
if (agent->compatibility == STUN_COMPATIBILITY_3489BIS) {
if (agent->compatibility == STUN_COMPATIBILITY_3489BIS &&
agent->usage_flags & STUN_AGENT_USAGE_USE_FINGERPRINT) {
ptr = stun_message_append (msg, STUN_ATTRIBUTE_FINGERPRINT, 4);
if (ptr == NULL) {
return 0;
......
......@@ -81,21 +81,40 @@ void stun_sha1 (const uint8_t *msg, size_t len, uint8_t *sha,
HMAC_CTX_cleanup (&ctx);
}
static const uint8_t *priv_trim_var (const uint8_t *var, size_t *var_len)
{
const uint8_t *ptr = var;
while (*ptr == '"') {
ptr++;
(*var_len)--;
}
while(ptr[*var_len] == '"' ||
ptr[*var_len] == 0) {
(*var_len)--;
}
void stun_hash_creds (const char *realm, const char *login, const char *pw,
return ptr;
}
void stun_hash_creds (const uint8_t *realm, size_t realm_len,
const uint8_t *username, size_t username_len,
const uint8_t *password, size_t password_len,
unsigned char md5[16])
{
EVP_MD_CTX ctx;
assert (realm && login && pw && md5);
const uint8_t *username_trimmed = priv_trim_var (username, &username_len);
const uint8_t *password_trimmed = priv_trim_var (password, &password_len);;
const uint8_t *realm_trimmed = priv_trim_var (realm, &realm_len);;
EVP_MD_CTX_init (&ctx);
EVP_DigestInit_ex (&ctx, EVP_md5 (), NULL);
EVP_DigestUpdate (&ctx, realm, strlen (realm));
EVP_DigestUpdate (&ctx, username_trimmed, username_len);
EVP_DigestUpdate (&ctx, ":", 1);
EVP_DigestUpdate (&ctx, login, strlen (login));
EVP_DigestUpdate (&ctx, realm_trimmed, realm_len);
EVP_DigestUpdate (&ctx, ":", 1);
EVP_DigestUpdate (&ctx, pw, strlen (pw));
EVP_DigestUpdate (&ctx, password_trimmed, password_len);
EVP_DigestFinal (&ctx, md5, NULL);
}
......
......@@ -54,9 +54,11 @@ void stun_sha1 (const uint8_t *msg, size_t len,
/**
* SIP H(A1) computation
*/
void stun_hash_creds (const char *realm, const char *login, const char *pw,
unsigned char md5[16]);
void stun_hash_creds (const uint8_t *realm, size_t realm_len,
const uint8_t *username, size_t username_len,
const uint8_t *password, size_t password_len,
unsigned char md5[16]);
/**
* Generates a pseudo-random secure STUN transaction ID.
*/
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment