RFC8489

Session Traversal Utilities for NAT (STUN)

M. Petit-Huguenin (Impedance Mismatch)

G. Salgueiro (Cisco)

J. Rosenberg (Five9)

D. Wing (Citrix)

R. Mahy (Unaffiliated)

P. Matthews (Nokia)

February 2020

​

組員：陳姿綾,陳嘉璐,沈家正

1

2

Outline

➤ What Is NAT?

➤ STUN

➤ Binding

➤ Definitions

➤ STUN Message Structure

➤ Base Protocol Procedures

➤ Comparison of old and new versions

➤ STUN attribute

➤ Common attributes

➤ Lab Time

What Is NAT?

• Network Address Translation
• NAT 是一種將內部IP address + port 與外部IP address + port 互相轉換之技術
• 起源是因為 IPv4 位址 稀少
• 讓一個外部 IP address + port 給多個電腦使用

​

3

172.16.0.1:400

172.16.0.2:500

172.16.0.3:600

172.16.0.254:12345

244.46.1.1:10

Why do we need STUN ?

4

Client

Server

Client

NAT

​

Private Network

Public Network

Who am I?

(1)

Private IP address + port : 172.16.0.1:500

Private IP address + port : 172.16.0.1:500 -> Public IP address + port : 244.46.1.1:1234

(2)

You are: 244.46.1.1:1234

(3) Connection

Mapping table:

172.16.0.1:500 <->244.46.1.1:1234

map : 映射

STUN

• STUN is a client-server protocol.
• Request/response transaction
• A client sends a request to a STUN server, and the STUN server returns a response.
• Indication transaction
• Either client or STUN server sends an indication that generates no response.

​

​

​

​

5

transaction:交易

Binding

• Request/response transaction
• The Binding method can be used to determine the particular binding a NAT has allocated to a STUN client.
• Indication transaction
• The Binding method can also be used to keep these bindings alive.

6

Binding - Request/response transaction

• (1) Sending binding request
• (2) Modifying the source transport address
• Private IP address -> Public IP address
• (3) Sending Binding response
• MAPPED-ADDRESS
• (4) Modifying the destination transport address
• Public IP address -> Private IP address
• STUN response will remain untouched mapped-address(from request).

7

Transport address = IP address + port number

172.16.0.1:500 <->244.46.1.1:1234

MAPPED-ADDRESS

Definitions

• STUN Client (Clinet)
• STUN Server (Server)
• Transport Address
• IP address + port number
• Mapped Address
• The mapped address allocated to the client on the public side of the NAT.
• Attribute
• A Type-Length-Value (TLV) object.
• Added to a STUN message.
• Two types : required and optional

8

172.16.0.1

172.16.0.2

172.16.0.3

172.16.0.254:12345

244.46.1.1:10

STUN Message Structure

• STUN messages are encoded in binary => big endian
• 20 bytes header and followed by zero or more attributes
• 2 bits zero

​

9

STUN Message Structure

• STUN Message type
• The message class : 2-bit encoding
• 0b00 => request
• 0b01 => indication
• 0b10 => success response
• 0b11 => error response
• The message method : 12-bit encoding
• Binding
• EX, a Binding request : class=0b00 (request) + method=0b000000000001 (Binding) = 0x0001

10

STUN Message Structure

• Message length :
• STUN attributes are padded to a multiple of 4 bytes, the last 2 bits of this field are always zero.

11

• length = 16*3 + 8 = 56 = attributes

pad : 填充

STUN Message Structure

• Magic cookie
• Fixed value 0x2112A442 in network byte order.
• It aids in distinguishing STUN packets from packets of other protocols when STUN is multiplexed with those other protocols on the same port.
• XOR-MAPPED-ADDRESS attribute

​

12

STUN Message Structure

• Transcation ID
• 96-bit identifier、uniquely、randomly
• Success and error responses MUST carry the same transaction ID as their corresponding request.

​

13

Sending over UDP or DTLS-over-UDP

• It is possible that the STUN message might be dropped by the network.

-> Retransmissions of the request message.

-> STUN indications are not retransmitted.

• Indication transactions over UDP or DTLS-over-UDP are not reliable.
• A client SHOULD retransmit a STUN request message starting with an interval of RTO ("Retransmission TimeOut"), doubling after each retransmission.

14

Base Protocol Procedures

• Receiving a STUN Message
• Processing a Request
• Forming a Success or Error Response
• Processing an Indication
• Processing a Success or Error Response

15

Receiving a STUN Message

• Is it a really STUN message?
• Check the Rules :
• The first two bits are 0.
• The Magic Cookie field has the correct value. (0x2112A442)
• The message length is sensible.(multiple of 4 bytes and last 2-bit are zero)
• The method value is a supported method.(Binding)
• If the message class is "Success Response" or "Error Response", the agent checks that the transaction ID matches a transaction that is still in progress.
• If the FINGERPRINT extension is being used, the agent checks that the FINGERPRINT attribute is present and contains the correct value.

16

Processing a Request

​

17

error code : 420 (Unknown attribute)

unknown required attributes:

.

.

.

.

.

.

unknown required attributes

Forming a Success or Error Response

18

Client

Request

Error Response

Server

ERROR-CODE attribute + error code

​

Success Response

XOR-MAPPED-ADDRESS attribute : This attribute contains the source transport address of the request message.

​

​

Processing an Indication

19

unknown required attributes

Discard + cease processing

Processing a Success or Error Response

20

Client

Request

Success Response

Server

unknown required attributes

Discard + Fail

Error Response ( or it’s not contain an ERROR-CODE attribute)

Fail or

Try a new transaction:

Authentication mechanism processing 、 error code

Basic STUN behavior

舊版 STUN [RFC 3489]

​

21

"classic STUN" only defined the behavior of a server that was providing clients with server mapped addresses by receiving and replying to STUN Binding requests.

Basic STUN behavior

22

新版 STUN [RFC 5389]

redefined the protocol as an extensible framework

23

STUN attribute

TLV encode

24

25

common attributes

MAPPED-ADDRESS

26

mapped address

27

XOR-MAPPED-ADDRESS

This value is created from the exclusive-or of the source port with the most significant 16 bits of the Transaction ID.

Application Layer Gateway，縮寫為ALG， 是一種NAT穿越技術。就應用層面來說，它允許修改Gatway上的NAT穿越的過濾規則，完成特定網路傳輸協定上的address和port的轉換。

​

28

USERNAME

29

MESSAGE-INTEGRITY

30

FINGERPRINT

31

ERROR-CODE

32

error code

33

34

[RFC 7616]

35

UNKNOWN-ATTRIBUTES

The attribute contains a list of 16-bit values, each of which represents an attribute type that was not understood by the server.

From 大智學長:

Why the value of Magic Cookie is 0x2112A442 ?

​

36

37

LAB time

Observe STUN in PJSUA

1. In WireShark, Ctrl-K to open Capture Options, use capture filter:

host 23.21.92.55

or use Display filter: ip.dst == 23.21.92.55|| ip.src == 23.21.92.55

(23.21.92.55 is the IPv4 address of stun.sip.us)

2. Open PJSUA with extra argument

pjsua.exe --stun-srv=stun.sip.us:3478

38

Lab 1: Observe Transaction ID, Message Cookie

​

​

39

Request

Response

Lab 2: Verify XOR-MAPPED-ADDR by calculator

1. 打開小算盤 / 計算機工具程式 (Win10, Ubuntu, macOS皆有，或網頁版)

2. 調成程式設計模式，輸入 16 進位

3. 拿 XOR-d IP / Port 跟 Message Cookie XOR 後，得到 MAPPED-ADDR

40

CLASSIC-STUN?

RFC 3489 obsoleted, but still implemented in PJNATH

​

41

File:STUN Algorithm3.svg. (2020, 9月 12). Wikimedia Commons. Retrieved 16:28, 7月 26, 2023

NAT Variation (1)

42

圖片取自 http://www.cs.nccu.edu.tw/~lien/Writing/NGN/firewall.htm

​

NAT Variation (2)

43

圖片取自 http://www.cs.nccu.edu.tw/~lien/Writing/NGN/firewall.htm

​

RFC 3489

44

RFC 3489

45

"change IP" flag

​

"change port" flag

​

Observe MESSAGE-INTEGRITY, FINGERPRINT

1. Join a Google Meet room

2. No capture filter, but display filter: stun

3. Get a lot of STUN packet that has integrity and fingerprint attribute

46

Lab 3: Verify FINGERPRINT

1. WireShark 選中 Session Traversal Utilities for NAT

2. 右鍵 -> Copy -> As a Hex Stream

3. 刪掉 FINGERPRINT attribute header 及之後

3. 貼上到這個計算 CRC-32 的網站

4. 把得到的 CRC-32 值 XOR 0x5354554e

47

Lab 4: Observe initial REGISTER request with and without STUN

1. pjsua.exe --no-tcp --id=sip:xxx@sip.ncnu.net --registrar=sip:sip.ncnu.net

2. pjsua.exe --no-tcp --id=sip:xxx@sip.ncnu.net --registrar=sip:sip.ncnu.net --stun-srv=stun.sip.us:3478

​

48

Before

After

Lab 4: Not using STUN but subsequent request has my public IP

In PJSIP document: IPAddressChange – pjsip

PJSUA-LIB has the capability to detect the (SIP) IP address change based on the response of REGISTER request and automatically update the registration with the correct IP if it detects that the IP/port seen by the server is different than the address specified in the Contact URI.

49

50

Thank you

51

PJSUA time

52

Outline

➤ 更改magic cookie的值

➤ 讓xor-mapped-address的family變成IPv6

➤ Keep alive for UDP transport

​

​

更改magic cookie的值

53

• 還未更改magic cookie前

• 更改magic cookie後

位置：stun_msg.h L 46

只會抓到舊版的stun封包

讓xor-mapped-address的family變成IPv6

54

• 還沒更動前

stun封包傳送的address都是IPv4的樣式，且xor-mapped-address這個屬性的family也是標IPv4

55

• 更動後

位置：stun_msg.c L 953

在 L955 加中斷點

attribute的address已經成功變成IPv6了

port也成功改變

56

但xor-mapped-address的family並未被更改掉

綁定用IPv6傳送 --bound-addr [自己的IPv6 address:port] --no-tcp

57

查我們當初選的server支不支援IPv6

我們發現他只支援IPv4，所以不管我們怎麼改他都用IPv4傳封包

58

STUN 沒有使用 indication

• STUN、TURN、ICE 都有 pj_stun_session_create_ind(...)
• 觀察 : 只有 TURN、ICE 有使用到
• 推測 :
• STUN 使用 UDP keep-alive (#407 (Keep alive for UDP transport) – pjsip Open source SIP, media, and NAT traversal stacks/libraries for smartphones)
• TURN、ICE 是 STURN 後來推出解決 NAT Traversal 問題的工具，所以 keep-alive 直接用 STUN 的 indication function

• *sess -> The STUN session
• msg type -> class 的類型 (request、response、indication)
• **p_tdata -> 接收

59

STUN 沒有使用 indication

​

• ICE

60

STUN 沒有使用 indication

​

• TURN

61

STUN 沒有使用 indication

​

• STUN

62

keep-alive

• pjsua_core.c
• pjsua_acc_config_default
• 修改 cfg -> ka_interval
• wireshark -> capture filter -> ‘udp port 5060’

63

transaction ID

• stun_sock.c -> pj_stun_sock_create()
• random numbers to be used as STUN transaction ID
• Ctrl-F 上面這段話來找到修改處
• 把 transaction ID 改掉，並在 Wireshark 裡看到效果

​

64

刪掉 SOFTWARE attribute

• stun_session.c
• PJ_STUN_ATTR_SOFTWARE
• Ctrl-F 上面 keyword 來找到修改處
• 註解掉兩行，並在 Wireshark 裡看到效果

​

65

Use FINGERPRINT

• stun_session.c
• use_fingerprint
• Ctrl-F 上面這 keyword 來找到修改處
• 想辦法讓 PJSUA 會發出 FINGERPRINT attribute

​

66

Thank you