Innovaphone stun implementation BUG
hi.
Look like innovaphone embedded inside their soft old open source STUN client and server which have a mistake in stun implementation.
Due to it all innovaphone devices can work only with buggy implemented stun.innovaphone.com server and cannot work with any another RFC compatible STUN server.
It accept only stun responses which contain XOR_MAPPED_ADDRESS described in RFC 5389 but send bind requests like described on old RFC 3489.
In accordance with RFC :
bind request with magic cookie (0x2112A442) - > response have to be WITH XOR_MAPPED_ADDRESS
bind request without magic cookie - > response have to be WITHOUT XOR_MAPPED_ADDRESS
Extraction from RFC 5389:
The magic cookie field MUST contain the fixed value 0x2112A442 in
network byte order. In RFC 3489 [RFC3489], this field was part of
the transaction ID; placing the magic cookie in this location allows
a server to detect if the client will understand certain attributes
that were added in this revised specification.
Innovaphone STUN request example to innovaphone STUN server:
Simple Traversal of UDP Through NAT (this is typical RFC 3489 stun client bind request because no magic cookie 0x2112A442)
Message Type: Binding Request (0x0001)
Message Length: 0x0000
Message Transaction ID: 2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
Simple Traversal of UDP Through NAT (this is like RFC 5389 answer. WHAT ?????. Here MUST be RFC 3489 answer. But it accepted by innovaphone device)
Message Type: Binding Response (0x0101)
Message Length: 0x0024
Message Transaction ID: 2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
Attributes
Attribute: MAPPED-ADDRESS
Attribute: XOR_MAPPED_ADDRESS
Attribute: CHANGED-ADDRESS
Innovaphone STUN request example to RFC compatible stun servers :
Simple Traversal of UDP Through NAT (this is typical RFC 3489 stun client bind request)
Message Type: Binding Request (0x0001)
Message Length: 0x0000
Message Transaction ID: 2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
Simple Traversal of UDP Through NAT (this is typical RFC 3489 stun server response. But it ignored by innovaphone device)
Message Type: Binding Response (0x0101)
Message Length: 0x004c
Message Transaction ID: 2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
Attributes
Attribute: MAPPED-ADDRESS
Attribute: SOURCE-ADDRESS
Attribute: CHANGED-ADDRESS
Attribute: SERVER
What you think about it ?
