nodertc / stun

Low-level Session Traversal Utilities for NAT (STUN) client and server

nodertc

WebRTC for Node.js

Support

UNDER DEVELOPMENT

Current stage: working prototype. Send your feedback and usage ideas to speed up development.

Usage

1. git clone and npm i
2. type npm start to run demo
3. open localhost:7007 in your browser (Chrome).

stun's Issues

Keep server alive, do not throw exceptions.

Emit error event for brocken messages.

• Create InvalidMessageError class for brocken messages?
• Add prop packet for this type error?
• Use separate argument packet for for this type error?

Can't connect using stun in some cases that google's stun server can facilitate

I did a test with 3 different node.js stun servers: stun, node-stun, and ministun. All had the same properties on the cases I tested on. The case they all failed was when I tried to connect a phone on its mobile network to a desktop client (which was also the machine hosting the stun server and coordination server). This case worked fine when I used stun:stun.l.google.com:19302 however, so I'm not sure if there's some functionality these modules aren't implementing, if they all have similar bugs, or if something else is going on. In any case, it feels like a rather large hole in the abilities of all of these stun server modules and finding a way to support that case would be a great way to differentiate this module vs the rest.

Here's the code I was testing with, and a readme that detailed the cases and the restults for each module:

stun-code.zip

I created similar issues on the other repos as well:

• enobufs/stun#28
• noahlevenson/ministun#3

stun-xor-address-attribute.js

according to nodejs Buffer.concat(list[, totalLength])
it seems seems that

function xorIPv6(address, transactionId) {
  return xor(address, Buffer.concat(constants.kStunMagicCookieBuffer, transactionId))
}

should rather be written as

function xorIPv6(address, transactionId) {
  return xor(address, Buffer.concat([constants.kStunMagicCookieBuffer, transactionId]))
}

Add support for STUN-over-ANY interface

createServer({ type: 'udp' });
createServer({ type: 'tcp' });
createServer({ type: 'tls' });
createServer({ type: 'dtls' });

Cannot destructure property 'address' of 'res.getXorAddress(...)' as it is undefined

Description: Address in some responses is undefined.
OS: 10.15.6 (19G73)
Node.js: v14.4.0
Stun: 2.1.0

const stun = require('stun');

const freeStunServers = [
    // google
    "stun1.l.google.com:19302",
    "stun2.l.google.com:19302",
    "stun3.l.google.com:19302",
    "stun4.l.google.com:19302",

    // others
    "stun.ekiga.net:3478",
    "stun.schlund.de:3478",
    "stun.xten.com:3478",
]
freeStunServers.forEach( stunURL => {
    stun.request(stunURL, (err, res) => {
        if (err) {
          console.error(err);
        } else {
          let add = res.getXorAddress();
          if (add) {
            const { address, port } = res.getXorAddress();
            console.log(`Res from ${stunURL} : Your IP is ${address} PORT is ${port}.`);
          }else{
            console.log(`Res from ${stunURL} : address is undefined.`);
          }
        }
      });
})

Output：

Res from stun1.l.google.com:19302 : Your IP is 120.236.163.98 PORT is 12422.
Res from stun2.l.google.com:19302 : Your IP is 120.236.163.98 PORT is 8165.
Res from stun.ekiga.net:3478 : address is undefined.
Res from stun.xten.com:3478 : address is undefined.
Res from stun4.l.google.com:19302 : Your IP is 202.116.36.83 PORT is 12715.
Res from stun3.l.google.com:19302 : Your IP is 120.236.163.98 PORT is 8166.
Res from stun.schlund.de:3478 : Your IP is 120.236.163.98 PORT is 5170.

Support for rfc5766 (TURN).

https://tools.ietf.org/html/rfc5766

Add support for STUN-over-TCP client

const client = stun.connect({ type: 'tcp', host: 'stun.l.google.com', port: 19302 });
const request = stun.createMessage(STUN_BINDING_REQUEST);

client.on('error', (err) => {
	// ...
});

client.on(STUN_BINDING_RESPONSE, (response) => {
	// ...
});

client.send(request);

/// or

client.request(request, (err, response) => {
	// ...
});

Add type definitions.

http://definitelytyped.org/

Support for RFC5780

See #2

There are a few new attributes in this RFC that would be useful to support:

Comprehension-required range (0x0000-0x7FFF):
0x0003: CHANGE-REQUEST
0x0026: PADDING
0x0027: RESPONSE-PORT

Comprehension-optional range (0x8000-0xFFFF):
0x802b: RESPONSE-ORIGIN
0x802c: OTHER-ADDRESS

Use Map to store attributes

Any attribute type MAY appear more than once in a STUN message.
Unless specified otherwise, the order of appearance is significant:
only the first occurrence needs to be processed by a receiver, and
any duplicates MAY be ignored by a receiver.

https://tools.ietf.org/html/rfc5389#section-15

• Use Map to store only the first attribute?
• Add [[readonly]] flag for any arrived messages?
• Do not allow to add more than once any attribute?

Use with Firebase Functions

Hi Dmitriy, you are doing really great job

I was wondering how to add this package to firebase functions, because i want to implement STUN functionality inside firebase, so can this package achieve that or is it beyond it's limitation.

Compatibility with REACT

Hi, I am trying to use this library in an Electron + React project I am developing.
For some reason everything works nicely as long as I run the application in debug mode, if I try to run the production ready compiled binary of the app I get and empty blank window.
Do you have any clue on why this might be happening? I am at a loss here, can't really find a solution.
Thanks

Critical CVE with parse-url dependency

CVE-2022-2218 requires updating parse-url to 6.0.1 or higher.

Unsupported Attribute on Server.Send

Using the supplied example code, with my STUN server from https://github.com/jselbie/stunserver I get an exception on the Send() method.

My code is:
var stun = require('stun')
const { STUN_BINDING_REQUEST, STUN_ATTR_XOR_MAPPED_ADDRESS } = stun.constants

const server = stun.createServer()
const request = stun.createMessage(STUN_BINDING_REQUEST)

server.once('bindingResponse', stunMsg => {
console.log('your ip:', stunMsg.getAttribute(STUN_ATTR_XOR_MAPPED_ADDRESS).value.address)

server.close()
})

server.send(request, 3478, 'stun.mitel.io')

And the stack trace I get out is
Exception has occurred: Error Error: Unsupported attribute type "32811". at parseAttribute (c:\github\devops-udp-healthcheck\node_modules\stun\lib\message.js:289:9) at stunMsg._attrs.packet.attributes.map.attrPacket (c:\github\devops-udp-healthcheck\node_modules\stun\lib\message.js:69:7) at Array.map (native) at Function.from (c:\github\devops-udp-healthcheck\node_modules\stun\lib\message.js:68:40) at StunServer.process (c:\github\devops-udp-healthcheck\node_modules\stun\lib\server.js:31:33) at StunServer.handleMessage (c:\github\devops-udp-healthcheck\node_modules\stun\lib\server.js:61:10) at emitTwo (events.js:125:13) at Socket.emit (events.js:213:7) at UDP.onMessage [as onmessage] (dgram.js:619:8)

I'm at a bit of a loss. This seems to work fine with the supplied Google STUN servers, and in theory the STUNTMAN STUN server should be following all the appropriate RFC's.

Any guidance would be much appreciated.

`validateMessageIntegrity` fails

Take a look to

stun/src/node_modules/lib/validate.js

Line 53 in 3db7f5d

fingerprintLength = 4 + fingerprintAttr.value.length

fingerprintLength value becomes NaN; should be change to

fingerprintLength = 8 // 4 bytes of attribute header + 4 bytes of CRC32

Add more friendly attributes api

example:

message.addUsername(username);
message.addAddress(ip, port)

Export StunError and StunMessageError and add docs

Production ready?

It appears stun has implemented a subset of the specs compared to coturn (https://github.com/coturn/coturn), so I was wondering if you could comment on the specs which stun has yet to implement and what that means for production (ie. will some networks not work, etc).

Thanks for the help!

node_modules folder in src makes the package unusable in yarn workspace projects

https://github.com/serverless-stack/serverless-stack started using the package, however, this indirect dependency breaks our product. I have created a patch that solves the issue temporarily (using relative references in requires) - I suggest moving the sources out of that node_modules and use relative references when requiring project sources.

stun+2.1.0.patch.zip

Add support for STUN-over-TCP server

const server = stun.createServer({ type: 'tcp' });

server.on(STUN_EVENT_BINDING_REQUEST, (req, socket) => {
	// ...
});

// OR

server.on(STUN_EVENT_BINDING_REQUEST, (req, res) => {
	const msg = stun.createMessage();
	res.send(msg);
});

How can I open external port for able to connect to my localhost from the outside?

Hi everyone, i faced with unable to get external port for connection to my localhost from the outside.
I tried const response = await stun.request('stun.l.google.com:19302'); let xorAddress = response.getXorAddress(); //console.log(xorAddress.address + xorAddress.port) but data from method getXorAddress() is wrong.
Help me please get ip and port for able to connect to my localhost from the outside.

Add RemoteInfo to StunResponse

udp.on('message', (message, rinfo) => {
	// add rinfo to StunResponse
})

or ability to get remote info from stun.request

Fingerprint values sometimes aren't set due to negative result from bitwise xor

Due to the way JavaScript handles bitwise operands, I think the result of xor can be "negative".

This is causing the addFingerprint method to fail intermittently since the value is expected to be a positive integer. Here's the problematic line: https://github.com/reklatsmasters/stun/blob/cb84b7361d651742041f72f1ea247eb808c499e7/lib/message.js#L159

Add support for STUN-over-UDP client

const client = stun.request('stun://stun.l.google.com:19302');