from the response to test I. If the IP address and port returned in
the MAPPED-ADDRESS attribute are not the same as the ones from the
first test I, the client knows its behind a symmetric NAT. If the
address and port are the same, the client is either behind a
restricted or port restricted NAT. To make a determination about
which one it is behind, the client initiates test III. If a response
is received, its behind a restricted NAT, and if no response is
received, its behind a port restricted NAT.
This procedure yields substantial information about the operating
condition of the client application. In the event of multiple NATs
between the client and the Internet, the type that is discovered will
be the type of the most restrictive NAT between the client and the
Internet. The types of NAT, in order of restrictiveness, from most
to least, are symmetric, port restricted cone, restricted cone, and
full cone.
Typically, a client will re-do this discovery process periodically to
detect changes, or look for inconsistent results. It is important to
note that when the discovery process is redone, it should not
generally be done from the same local address and port used in the
previous discovery process. If the same local address and port are
reused, bindings from the previous test may still be in existence,
and these will invalidate the results of the test. Using a different
local address and port for subsequent tests resolves this problem.
An alternative is to wait sufficiently long to be confident that the
old bindings have expired (half an hour should more than suffice).
10.2 Binding Lifetime Discovery
STUN can also be used to discover the lifetimes of the bindings
created by the NAT. In many cases, the client will need to refresh
the binding, either through a new STUN request, or an application
packet, in order for the application to continue to use the binding.
By discovering the binding lifetime, the client can determine how
frequently it needs to refresh.
+--------+
| Test |
| I |
+--------+
|
|
V
/\ /\
N / \ Y / \ Y +--------+
UDP <-------/Resp\--------->/ IP \------------->| Test |
Blocked \ ? / \Same/ | II |
\ / \? / +--------+
\/ \/ |
| N |
| V
V /\
+--------+ Sym. N / \
| Test | UDP <---/Resp\
| II | Firewall \ ? /
+--------+ \ /
| \/
V |Y
/\ /\ |
Symmetric N / \ +--------+ N / \ V
NAT <--- / IP \<-----| Test |<--- /Resp\ Open
\Same/ | I | \ ? / Internet
\? / +--------+ \ /
\/ \/
| |Y
| |
| V
| Full
| Cone
V /\
+--------+ / \ Y
| Test |------>/Resp\---->Restricted
| III | \ ? /
+--------+ \ /
\/
|N
| Port
+------>Restricted
Figure 2: Flow for type discovery process
To determine the binding lifetime, the client first sends a Binding
Request to the server from a particular socket, X. This creates a
binding in the NAT. The response from the server contains a MAPPED-
ADDRESS attribute, providing the public address and port on the NAT.
Call this Pa and Pp, respectively. The client then starts a timer
with a value of T seconds. When this timer fires, the client sends
another Binding Request to the server, using the same destination
address and port, but from a different socket, Y. This request
contains a RESPONSE-ADDRESS address attribute, set to (Pa,Pp). This
will create a new binding on the NAT, and cause the STUN server to
send a Binding Response that would match the old binding, if it still
exists. If the client receives the Binding Response on socket X, it
knows that the binding has not expired. If the client receives the
Binding Response on socket Y (which is possible if the old binding
expired, and the NAT allocated the same public address and port to
the new binding), or receives no response at all, it knows that the
binding has expired.
The client can find the value of the binding lifetime by doing a
binary search through T, arriving eventually at the value where the
response is not received for any timer greater than T, but is
received for any timer less than T.
This discovery process takes quite a bit of time, and is something
that will typically be run in the background on a device once it
boots.
It is possible that the client can get inconsistent results each time
this process is run. For example, if the NAT should reboot, or be
reset for some reason, the process may discover a lifetime than is
shorter than the actual one. For this reason, implementations are
encouraged to run the test numerous times, and be prepared to get
inconsistent results.
10.3 Binding Acquisition
Consider once more the case of a VoIP phone. It used the discovery
process above when it started up, to discover its environment. Now,
it wants to make a call. As part of the discovery process, it
determined that it was behind a full-cone NAT.
Consider further that this phone consists of two logically separated
components - a control component that handles signaling, and a media
component that handles the audio, video, and RTP [12]. Both are
behind the same NAT. Because of this separation of control and
media, we wish to minimize the communication required between them.
In fact, they may not even run on the same host.
In order to make a voice call, the phone needs to obtain an IP
address and port that it can place in the call setup message as the
destination for receiving audio.
To obtain an address, the control component sends a Shared Secret
Request to the server, obtains a shared secret, and then sends a
Binding Request to the server. No CHANGE-REQUEST attribute is
present in the Binding Request, and neither is the RESPONSE-ADDRESS
attribute. The Binding Response contains a mapped address. The
control component then formulates a second Binding Request. This
request contains a RESPONSE-ADDRESS, which is set to the mapped
address learned from the previous Binding Response. This Binding
Request is passed to the media component, along with the IP address
and port of the STUN server. The media component sends the Binding
Request. The request goes to the STUN server, which sends the
Binding Response back to the control component. The control
component receives this, and now has learned an IP address and port
that will be routed back to the media component that sent the
request.
The client will be able to receive media from anywhere on this mapped
address.
In the case of silence suppression, there may be periods where the
client receives no media. In this case, the UDP bindings could
timeout (UDP bindings in NATs are typically short; 30 seconds is
common). To deal with this, the application can periodically
retransmit the query in order to keep the binding fresh.
It is possible that both participants in the multimedia session are
behind the same NAT. In that case, both will repeat this procedure
above, and both will obtain public address bindings. When one sends
media to the other, the media is routed to the NAT, and then turns
right back around to come back into the enterprise, where it is
translated to the private address of the recipient. This is not
particularly efficient, and unfortunately, does not work in many
commercial NATs. In such cases, the clients may need to retry using
private addresses.
11. Protocol Details
This section presents the detailed encoding of a STUN message.
STUN is a request-response protocol. Clients send a request, and the
server sends a response. There are two requests, Binding Request,
and Shared Secret Request. The response to a Binding Request can
either be the Binding Response or Binding Error Response. The
response to a Shared Secret Request can either be a Shared Secret
Response or a Shared Secret Error Response.
STUN messages are encoded using binary fields. All integer fields
are carried in network byte order, that is, most significant byte
(octet) first. This byte order is commonly known as big-endian. The
transmission order is described in detail in Appendix B of RFC791
[6]. Unless otherwise noted, numeric constants are in decimal (base
10).
11.1 Message Header
All STUN messages consist of a 20 byte header:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| STUN Message Type | Message Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Transaction ID
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The Message Types can take on the following values:
0x0001 : Binding Request
0x0101 : Binding Response
0x0111 : Binding Error Response
0x0002 : Shared Secret Request
0x0102 : Shared Secret Response
0x0112 : Shared Secret Error Response
The message length is the count, in bytes, of the size of the
message, not including the 20 byte header.
The transaction ID is a 128 bit identifier. It also serves as salt
to randomize the request and the response. All responses carry the
same identifier as the request they correspond to.
11.2 Message Attributes
After the header are 0 or more attributes. Each attribute is TLV
encoded, with a 16 bit type, 16 bit length, and variable value:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Value ....
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The following types are defined:
0x0001: MAPPED-ADDRESS
0x0002: RESPONSE-ADDRESS
0x0003: CHANGE-REQUEST
0x0004: SOURCE-ADDRESS
0x0005: CHANGED-ADDRESS
0x0006: USERNAME
0x0007: PASSWORD
0x0008: MESSAGE-INTEGRITY
0x0009: ERROR-CODE
0x000a: UNKNOWN-ATTRIBUTES
0x000b: REFLECTED-FROM
To allow future revisions of this specification to add new attributes
if needed, the attribute space is divided into optional and mandatory
ones. Attributes with values greater than 0x7fff are optional, which
means that the message can be processed by the client or server even
though the attribute is not understood. Attributes with values less
than or equal to 0x7fff are mandatory to understand, which means that
the client or server cannot process the message unless it understands
the attribute.
The MESSAGE-INTEGRITY attribute MUST be the last attribute within a
message. Any attributes that are known, but are not supposed to be
present in a message (MAPPED-ADDRESS in a request, for example) MUST
be ignored.
Table 2 indicates which attributes are present in which messages. An
M indicates that inclusion of the attribute in the message is
mandatory, O means its optional, C means it's conditional based on
some other aspect of the message, and N/A means that the attribute is
not applicable to that message type.
Binding Shared Shared Shared
Binding Binding Error Secret Secret Secret
Att. Req. Resp. Resp. Req. Resp. Error
Resp.
_____________________________________________________________________
MAPPED-ADDRESS N/A M N/A N/A N/A N/A
RESPONSE-ADDRESS O N/A N/A N/A N/A N/A
CHANGE-REQUEST O N/A N/A N/A N/A N/A
SOURCE-ADDRESS N/A M N/A N/A N/A N/A
CHANGED-ADDRESS N/A M N/A N/A N/A N/A
USERNAME O N/A N/A N/A M N/A
PASSWORD N/A N/A N/A N/A M N/A
MESSAGE-INTEGRITY O O N/A N/A N/A N/A
ERROR-CODE N/A N/A M N/A N/A M
UNKNOWN-ATTRIBUTES N/A N/A C N/A N/A C
REFLECTED-FROM N/A C N/A N/A N/A N/A
Table 2: Summary of Attributes
The length refers to the length of the value element, expressed as an
unsigned integral number of bytes.
11.2.1 MAPPED-ADDRESS
The MAPPED-ADDRESS attribute indicates the mapped IP address and
port. It consists of an eight bit address family, and a sixteen bit
port, followed by a fixed length value representing the IP address.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|x x x x x x x x| Family | Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The port is a network byte ordered representation of the mapped port.
The address family is always 0x01, corresponding to IPv4. The first
8 bits of the MAPPED-ADDRESS are ignored, for the purposes of
aligning parameters on natural boundaries. The IPv4 address is 32
bits.
11.2.2 RESPONSE-ADDRESS
The RESPONSE-ADDRESS attribute indicates where the response to a
Binding Request should be sent. Its syntax is identical to MAPPED-
ADDRESS.
11.2.3 CHANGED-ADDRESS
The CHANGED-ADDRESS attribute indicates the IP address and port where
responses would have been sent from if the "change IP" and "change
port" flags had been set in the CHANGE-REQUEST attribute of the
Binding Request. The attribute is always present in a Binding
Response, independent of the value of the flags. Its syntax is
identical to MAPPED-ADDRESS.
11.2.4 CHANGE-REQUEST
The CHANGE-REQUEST attribute is used by the client to request that
the server use a different address and/or port when sending the
response. The attribute is 32 bits long, although only two bits (A
and B) are used:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 A B 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The meaning of the flags is:
A: This is the "change IP" flag. If true, it requests the server
to send the Binding Response with a different IP address than the
one the Binding Request was received on.
B: This is the "change port" flag. If true, it requests the
server to send the Binding Response with a different port than the
one the Binding Request was received on.
11.2.5 SOURCE-ADDRESS
The SOURCE-ADDRESS attribute is present in Binding Responses. It
indicates the source IP address and port that the server is sending
the response from. Its syntax is identical to that of MAPPED-
ADDRESS.
11.2.6 USERNAME
The USERNAME attribute is used for message integrity. It serves as a
means to identify the shared secret used in the message integrity
check. The USERNAME is always present in a Shared Secret Response,
along with the PASSWORD. It is optionally present in a Binding
Request when message integrity is used.
The value of USERNAME is a variable length opaque value. Its length
MUST be a multiple of 4 (measured in bytes) in order to guarantee
alignment of attributes on word boundaries.
11.2.7 PASSWORD
The PASSWORD attribute is used in Shared Secret Responses. It is
always present in a Shared Secret Response, along with the USERNAME.
The value of PASSWORD is a variable length value that is to be used
as a shared secret. Its length MUST be a multiple of 4 (measured in
bytes) in order to guarantee alignment of attributes on word
boundaries.
11.2.8 MESSAGE-INTEGRITY
The MESSAGE-INTEGRITY attribute contains an HMAC-SHA1 [13] of the
STUN message. It can be present in Binding Requests or Binding
Responses. Since it uses the SHA1 hash, the HMAC will be 20 bytes.
The text used as input to HMAC is the STUN message, including the
header, up to and including the attribute preceding the MESSAGE-
INTEGRITY attribute. That text is then padded with zeroes so as to be
a multiple of 64 bytes. As a result, the MESSAGE-INTEGRITY attribute
MUST be the last attribute in any STUN message. The key used as
input to HMAC depends on the context.
11.2.9 ERROR-CODE
The ERROR-CODE attribute is present in the Binding Error Response and
Shared Secret Error Response. It is a numeric value in the range of
100 to 699 plus a textual reason phrase encoded in UTF-8, and is
consistent in its code assignments and semantics with SIP [10] and
HTTP [15]. The reason phrase is meant for user consumption, and can
be anything appropriate for the response code. The lengths of the
reason phrases MUST be a multiple of 4 (measured in bytes). This can
be accomplished by added spaces to the end of the text, if necessary.
Recommended reason phrases for the defined response codes are
presented below.
To facilitate processing, the class of the error code (the hundreds
digit) is encoded separately from the rest of the code.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0 |Class| Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reason Phrase (variable) ..
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The class represents the hundreds digit of the response code. The
value MUST be between 1 and 6. The number represents the response
code modulo 100, and its value MUST be between 0 and 99.
The following response codes, along with their recommended reason
phrases (in brackets) are defined at this time:
400 (Bad Request): The request was malformed. The client should not
retry the request without modification from the previous
attempt.
401 (Unauthorized): The Binding Request did not contain a MESSAGE-
INTEGRITY attribute.
420 (Unknown Attribute): The server did not understand a mandatory
attribute in the request.
430 (Stale Credentials): The Binding Request did contain a MESSAGE-
INTEGRITY attribute, but it used a shared secret that has
expired. The client should obtain a new shared secret and try
again.
431 (Integrity Check Failure): The Binding Request contained a
MESSAGE-INTEGRITY attribute, but the HMAC failed verification.
This could be a sign of a potential attack, or client
implementation error.
432 (Missing Username): The Binding Request contained a MESSAGE-
INTEGRITY attribute, but not a USERNAME attribute. Both must be
present for integrity checks.
433 (Use TLS): The Shared Secret request has to be sent over TLS, but
was not received over TLS.
500 (Server Error): The server has suffered a temporary error. The
client should try again.
600 (Global Failure:) The server is refusing to fulfill the request.
The client should not retry.
11.2.10 UNKNOWN-ATTRIBUTES
The UNKNOWN-ATTRIBUTES attribute is present only in a Binding Error
Response or Shared Secret Error Response when the response code in
the ERROR-CODE attribute is 420.
The attribute contains a list of 16 bit values, each of which
represents an attribute type that was not understood by the server.
If the number of unknown attributes is an odd number, one of the
attributes MUST be repeated in the list, so that the total length of
the list is a multiple of 4 bytes.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Attribute 1 Type | Attribute 2 Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Attribute 3 Type | Attribute 4 Type ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
11.2.11 REFLECTED-FROM
The REFLECTED-FROM attribute is present only in Binding Responses,
when the Binding Request contained a RESPONSE-ADDRESS attribute. The
attribute contains the identity (in terms of IP address) of the
source where the request came from. Its purpose is to provide
traceability, so that a STUN server cannot be used as a reflector for
denial-of-service attacks.
Its syntax is identical to the MAPPED-ADDRESS attribute.
12. Security Considerations
12.1 Attacks on STUN
Generally speaking, attacks on STUN can be classified into denial of
service attacks and eavesdropping attacks. Denial of service attacks
can be launched against a STUN server itself, or against other
elements using the STUN protocol.
STUN servers create state through the Shared Secret Request
mechanism. To prevent being swamped with traffic, a STUN server
SHOULD limit the number of simultaneous TLS connections it will hold
open by dropping an existing connection when a new connection request
arrives (based on an Least Recently Used (LRU) policy, for example).
Similarly, it SHOULD limit the number of shared secrets it will
store, in the event that the server is storing the shared secrets.
The attacks of greater interest are those in which the STUN server
and client are used to launch DOS attacks against other entities,
including the client itself.
Many of the attacks require the attacker to generate a response to a
legitimate STUN request, in order to provide the client with a faked
MAPPED-ADDRESS. The attacks that can be launched using such a
technique include:
12.1.1 Attack I: DDOS Against a Target
In this case, the attacker provides a large number of clients with
the same faked MAPPED-ADDRESS that points to the intended target.
This will trick all the STUN clients into thinking that their
addresses are equal to that of the target. The clients then hand out
that address in order to receive traffic on it (for example, in SIP
or H.323 messages). However, all of that traffic becomes focused at
the intended target. The attack can provide substantial
amplification, especially when used with clients that are using STUN
to enable multimedia applications.
12.1.2 Attack II: Silencing a Client
In this attack, the attacker seeks to deny a client access to
services enabled by STUN (for example, a client using STUN to enable
SIP-based multimedia traffic). To do that, the attacker provides
that client with a faked MAPPED-ADDRESS. The MAPPED-ADDRESS it
provides is an IP address that routes to nowhere. As a result, the
client won't receive any of the packets it expects to receive when it
hands out the MAPPED-ADDRESS.
This exploitation is not very interesting for the attacker. It
impacts a single client, which is frequently not the desired target.
Moreover, any attacker that can mount the attack could also deny
service to the client by other means, such as preventing the client
from receiving any response from the STUN server, or even a DHCP
server.
12.1.3 Attack III: Assuming the Identity of a Client
This attack is similar to attack II. However, the faked MAPPED-
ADDRESS points to the attacker themself. This allows the attacker to
receive traffic which was destined for the client.
12.1.4 Attack IV: Eavesdropping
In this attack, the attacker forces the client to use a MAPPED-
ADDRESS that routes to itself. It then forwards any packets it
receives to the client. This attack would allow the attacker to
observe all packets sent to the client. However, in order to launch
the attack, the attacker must have already been able to observe
packets from the client to the STUN server. In most cases (such as
when the attack is launched from an access network), this means that
the attacker could already observe packets sent to the client. This
attack is, as a result, only useful for observing traffic by
attackers on the path from the client to the STUN server, but not
generally on the path of packets being routed towards the client.
12.2 Launching the Attacks
It is important to note that attacks of this nature (injecting
responses with fake MAPPED-ADDRESSes) require that the attacker be
capable of eavesdropping requests sent from the client to the server
(or to act as a MITM for such attacks). This is because STUN
requests contain a transaction identifier, selected by the client,
which is random with 128 bits of entropy. The server echoes this
value in the response, and the client ignores any responses that
don't have a matching transaction ID. Therefore, in order for an
attacker to provide a faked response that is accepted by the client,
the attacker needs to know what the transaction ID in the request
was. The large amount of randomness, combined with the need to know
when the client sends a request, precludes attacks that involve
guessing the transaction ID.
Since all of the above attacks rely on this one primitive - injecting
a response with a faked MAPPED-ADDRESS - preventing the attacks is
accomplished by preventing this one operation. To prevent it, we
need to consider the various ways in which it can be accomplished.
There are several:
12.2.1 Approach I: Compromise a Legitimate STUN Server
In this attack, the attacker compromises a legitimate STUN server
through a virus or Trojan horse. Presumably, this would allow the
attacker to take over the STUN server, and control the types of
responses it generates.
Compromise of a STUN server can also lead to discovery of open ports.
Knowledge of an open port creates an opportunity for DoS attacks on
those ports (or DDoS attacks if the traversed NAT is a full cone
NAT). Discovering open ports is already fairly trivial using port
probing, so this does not represent a major threat.
12.2.2 Approach II: DNS Attacks
STUN servers are discovered using DNS SRV records. If an attacker
can compromise the DNS, it can inject fake records which map a domain
name to the IP address of a STUN server run by the attacker. This
will allow it to inject fake responses to launch any of the attacks
above.
12.2.3 Approach III: Rogue Router or NAT
Rather than compromise the STUN server, an attacker can cause a STUN
server to generate responses with the wrong MAPPED-ADDRESS by
compromising a router or NAT on the path from the client to the STUN
server. When the STUN request passes through the rogue router or
NAT, it rewrites the source address of the packet to be that of the
desired MAPPED-ADDRESS. This address cannot be arbitrary. If the
attacker is on the public Internet (that is, there are no NATs
between it and the STUN server), and the attacker doesn't modify the
STUN request, the address has to have the property that packets sent
from the STUN server to that address would route through the
compromised router. This is because the STUN server will send the
responses back to the source address of the request. With a modified
source address, the only way they can reach the client is if the
compromised router directs them there. If the attacker is on the
public Internet, but they can modify the STUN request, they can
insert a RESPONSE-ADDRESS attribute into the request, containing the
actual source address of the STUN request. This will cause the
server to send the response to the client, independent of the source
address the STUN server sees. This gives the attacker the ability to
forge an arbitrary source address when it forwards the STUN request.
If the attacker is on a private network (that is, there are NATs
between it and the STUN server), the attacker will not be able to
force the server to generate arbitrary MAPPED-ADRESSes in responses.
They will only be able force the STUN server to generate MAPPED-
ADDRESSes which route to the private network. This is because the
NAT between the attacker and the STUN server will rewrite the source
address of the STUN request, mapping it to a public address that
routes to the private network. Because of this, the attacker can
only force the server to generate faked mapped addresses that route
to the private network. Unfortunately, it is possible that a low
quality NAT would be willing to map an allocated public address to
another public address (as opposed to an internal private address),
in which case the attacker could forge the source address in a STUN
request to be an arbitrary public address. This kind of behavior
from NATs does appear to be rare.
12.2.4 Approach IV: MITM
As an alternative to approach III, if the attacker can place an
element on the path from the client to the server, the element can
act as a man-in-the-middle. In that case, it can intercept a STUN
request, and generate a STUN response directly with any desired value
of the MAPPED-ADDRESS field. Alternatively, it can forward the STUN
request to the server (after potential modification), receive the
response, and forward it to the client. When forwarding the request
and response, this attack is subject to the same limitations on the
MAPPED-ADDRESS described in Section 12.2.3.
12.2.5 Approach V: Response Injection Plus DoS
In this approach, the attacker does not need to be a MITM (as in
approaches III and IV). Rather, it only needs to be able to
eavesdrop onto a network segment that carries STUN requests. This is
easily done in multiple access networks such as ethernet or
unprotected 802.11. To inject the fake response, the attacker
listens on the network for a STUN request. When it sees one, it
simultaneously launches a DoS attack on the STUN server, and
generates its own STUN response with the desired MAPPED-ADDRESS
value. The STUN response generated by the attacker will reach the
client, and the DoS attack against the server is aimed at preventing
the legitimate response from the server from reaching the client.
Arguably, the attacker can do without the DoS attack on the server,
so long as the faked response beats the real response back to the
client, and the client uses the first response, and ignores the
second (even though it's different).
12.2.6 Approach VI: Duplication
This approach is similar to approach V. The attacker listens on the
network for a STUN request. When it sees it, it generates its own
STUN request towards the server. This STUN request is identical to
the one it saw, but with a spoofed source IP address. The spoofed
address is equal to the one that the attacker desires to have placed
in the MAPPED-ADDRESS of the STUN response. In fact, the attacker
generates a flood of such packets. The STUN server will receive the
one original request, plus a flood of duplicate fake ones. It
generates responses to all of them. If the flood is sufficiently
large for the responses to congest routers or some other equipment,
there is a reasonable probability that the one real response is lost
(along with many of the faked ones), but the net result is that only
the faked responses are received by the STUN client. These responses
are all identical and all contain the MAPPED-ADDRESS that the
attacker wanted the client to use.
The flood of duplicate packets is not needed (that is, only one faked
request is sent), so long as the faked response beats the real
response back to the client, and the client uses the first response,
and ignores the second (even though it's different).
Note that, in this approach, launching a DoS attack against the STUN
server or the IP network, to prevent the valid response from being
sent or received, is problematic. The attacker needs the STUN server
to be available to handle its own request. Due to the periodic
retransmissions of the request from the client, this leaves a very
tiny window of opportunity. The attacker must start the DoS attack
immediately after the actual request from the client, causing the
correct response to be discarded, and then cease the DoS attack in
order to send its own request, all before the next retransmission
from the client. Due to the close spacing of the retransmits (100ms
to a few seconds), this is very difficult to do.
Besides DoS attacks, there may be other ways to prevent the actual
request from the client from reaching the server. Layer 2
manipulations, for example, might be able to accomplish it.
Fortunately, Approach IV is subject to the same limitations
documented in Section 12.2.3, which limit the range of MAPPED-
ADDRESSes the attacker can cause the STUN server to generate.
12.3 Countermeasures
STUN provides mechanisms to counter the approaches described above,
and additional, non-STUN techniques can be used as well.
First off, it is RECOMMENDED that networks with STUN clients
implement ingress source filtering (RFC2827 [7]). This is
particularly important for the NATs themselves. As Section 12.2.3
explains, NATs which do not perform this check can be used as
"reflectors" in DDoS attacks. Most NATs do perform this check as a
default mode of operation. We strongly advise people that purchase
NATs to ensure that this capability is present and enabled.
Secondly, it is RECOMMENDED that STUN servers be run on hosts
dedicated to STUN, with all UDP and TCP ports disabled except for the
STUN ports. This is to prevent viruses and Trojan horses from
infecting STUN servers, in order to prevent their compromise. This
helps mitigate Approach I (Section 12.2.1).
Thirdly, to prevent the DNS attack of Section 12.2.2, Section 9.2
recommends that the client verify the credentials provided by the
server with the name used in the DNS lookup.
Finally, all of the attacks above rely on the client taking the
mapped address it learned from STUN, and using it in application
layer protocols. If encryption and message integrity are provided
within those protocols, the eavesdropping and identity assumption
attacks can be prevented. As such, applications that make use of
STUN addresses in application protocols SHOULD use integrity and
encryption, even if a SHOULD level strength is not specified for that
protocol. For example, multimedia applications using STUN addresses
to receive RTP traffic would use secure RTP [16].
The above three techniques are non-STUN mechanisms. STUN itself
provides several countermeasures.
Approaches IV (Section 12.2.4), when generating the response locally,
and V (Section 12.2.5) require an attacker to generate a faked
response. This attack is prevented using the message integrity
mechanism provided in STUN, described in Section 8.1.
Approaches III (Section 12.2.3) IV (Section 12.2.4), when using the
relaying technique, and VI (12.2.6), however, are not preventable
through server signatures. Both approaches are most potent when the
attacker can modify the request, inserting a RESPONSE-ADDRESS that
routes to the client. Fortunately, such modifications are
preventable using the message integrity techniques described in
Section 9.3. However, these three approaches are still functional
when the attacker modifies nothing but the source address of the STUN
request. Sadly, this is the one thing that cannot be protected
through cryptographic means, as this is the change that STUN itself
is seeking to detect and report. It is therefore an inherent
weakness in NAT, and not fixable in STUN. To help mitigate these
attacks, Section 9.4 provides several heuristics for the client to
follow. The client looks for inconsistent or extra responses, both
of which are signs of the attacks described above. However, these
heuristics are just that - heuristics, and cannot be guaranteed to
prevent attacks. The heuristics appear to prevent the attacks as we
know how to launch them today. Implementors should stay posted for
information on new heuristics that might be required in the future.
Such information will be distributed on the IETF MIDCOM mailing list,
midcom@ietf.org.
12.4 Residual Threats
None of the countermeasures listed above can prevent the attacks
described in Section 12.2.3 if the attacker is in the appropriate
network paths. Specifically, consider the case in which the attacker
wishes to convince client C that it has address V. The attacker
needs to have a network element on the path between A and the server
(in order to modify the request) and on the path between the server
and V so that it can forward the response to C. Furthermore, if
there is a NAT between the attacker and the server, V must also be
behind the same NAT. In such a situation, the attacker can either
gain access to all the application-layer traffic or mount the DDOS
attack described in Section 12.1.1. Note that any host which exists
in the correct topological relationship can be DDOSed. It need not
be using STUN.
13. IANA Considerations
STUN cannot be extended. Changes to the protocol are made through a
standards track revision of this specification. As a result, no IANA
registries are needed. Any future extensions will establish any
needed registries.
14. IAB Considerations
The IAB has studied the problem of "Unilateral Self Address Fixing",
which is the general process by which a client attempts to determine
its address in another realm on the other side of a NAT through a
collaborative protocol reflection mechanism (RFC3424 [17]). STUN is
an example of a protocol that performs this type of function. The
IAB has mandated that any protocols developed for this purpose
document a specific set of considerations. This section meets those
requirements.
14.1 Problem Definition
From RFC3424 [17], any UNSAF proposal must provide:
Precise definition of a specific, limited-scope problem that is to
be solved with the UNSAF proposal. A short term fix should not be
generalized to solve other problems; this is why "short term fixes
usually aren't".
The specific problems being solved by STUN are:
o Provide a means for a client to detect the presence of one or more
NATs between it and a server run by a service provider on the
public Internet. The purpose of such detection is to determine
additional steps that might be necessary in order to receive
service from that particular provider.
o Provide a means for a client to detect the presence of one or more
NATs between it and another client, where the second client is
reachable from the first, but it is not known whether the second
client resides on the public Internet.
o Provide a means for a client to obtain an address on the public
Internet from a non-symmetric NAT, for the express purpose of
receiving incoming UDP traffic from another host, targeted to that
address.
STUN does not address TCP, either incoming or outgoing, and does not
address outgoing UDP communications.
14.2 Exit Strategy
From [17], any UNSAF proposal must provide:
Description of an exit strategy/transition plan. The better short
term fixes are the ones that will naturally see less and less use
as the appropriate technology is deployed.
STUN comes with its own built in exit strategy. This strategy is the
detection operation that is performed as a precursor to the actual
UNSAF address-fixing operation. This discovery operation, documented
in Section 10.1, attempts to discover the existence of, and type of,
any NATS between the client and the service provider network. Whilst
the detection of the specific type of NAT may be brittle, the
discovery of the existence of NAT is itself quite robust. As NATs
are phased out through the deployment of IPv6, the discovery
operation will return immediately with the result that there is no
NAT, and no further operations are required. Indeed, the discovery
operation itself can be used to help motivate deployment of IPv6; if
a user detects a NAT between themselves and the public Internet, they
can call up their access provider and complain about it.
STUN can also help facilitate the introduction of midcom. As
midcom-capable NATs are deployed, applications will, instead of using
STUN (which also resides at the application layer), first allocate an
address binding using midcom. However, it is a well-known limitation
of midcom that it only works when the agent knows the middleboxes
through which its traffic will flow. Once bindings have been
allocated from those middleboxes, a STUN detection procedure can
validate that there are no additional middleboxes on the path from
the public Internet to the client. If this is the case, the
application can continue operation using the address bindings
allocated from midcom. If it is not the case, STUN provides a
mechanism for self-address fixing through the remaining midcom-
unaware middleboxes. Thus, STUN provides a way to help transition to
full midcom-aware networks.
14.3 Brittleness Introduced by STUN
From [17], any UNSAF proposal must provide:
Discussion of specific issues that may render systems more
"brittle". For example, approaches that involve using data at
multiple network layers create more dependencies, increase
debugging challenges, and make it harder to transition.
STUN introduces brittleness into the system in several ways:
o The discovery process assumes a certain classification of devices
based on their treatment of UDP. There could be other types of
NATs that are deployed that would not fit into one of these molds.
Therefore, future NATs may not be properly detected by STUN. STUN
clients (but not servers) would need to change to accommodate
that.
o The binding acquisition usage of STUN does not work for all NAT
types. It will work for any application for full cone NATs only.
For restricted cone and port restricted cone NAT, it will work for
some applications depending on the application. Application
specific processing will generally be needed. For symmetric NATs,
the binding acquisition will not yield a usable address. The
tight dependency on the specific type of NAT makes the protocol
brittle.
o STUN assumes that the server exists on the public Internet. If
the server is located in another private address realm, the user
may or may not be able to use its discovered address to
communicate with other users. There is no way to detect such a
condition.
o The bindings allocated from the NAT need to be continuously
refreshed. Since the timeouts for these bindings is very
implementation specific, the refresh interval cannot easily be
determined. When the binding is not being actively used to
receive traffic, but to wait for an incoming message, the binding
refresh will needlessly consume network bandwidth.
o The use of the STUN server as an additional network element
introduces another point of potential security attack. These
attacks are largely prevented by the security measures provided by
STUN, but not entirely.
o The use of the STUN server as an additional network element
introduces another point of failure. If the client cannot locate
a STUN server, or if the server should be unavailable due to
failure, the application cannot function.
o The use of STUN to discover address bindings will result in an
increase in latency for applications. For example, a Voice over
IP application will see an increase of call setup delays equal to
at least one RTT to the STUN server.
o The discovery of binding lifetimes is prone to error. It assumes
that the same lifetime will exist for all bindings. This may not
be true if the NAT uses dynamic binding lifetimes to handle
overload, or if the NAT itself reboots during the discovery
process.
o STUN imposes some restrictions on the network topologies for
proper operation. If client A obtains an address from STUN server
X, and sends it to client B, B may not be able to send to A using
that IP address. The address will not work if any of the
following is true:
- The STUN server is not in an address realm that is a common
ancestor (topologically) of both clients A and B. For example,
consider client A and B, both of which have residential NAT
devices. Both devices connect them to their cable operators,
but both clients have different providers. Each provider has a
NAT in front of their entire network, connecting it to the
public Internet. If the STUN server used by A is in A's cable
operator's network, an address obtained by it will not be
usable by B. The STUN server must be in the network which is a
common ancestor to both - in this case, the public Internet.
- The STUN server is in an address realm that is a common
ancestor to both clients, but both clients are behind the same
NAT connecting to that address realm. For example, if the two
clients in the previous example had the same cable operator,
that cable operator had a single NAT connecting their network
to the public Internet, and the STUN server was on the public
Internet, the address obtained by A would not be usable by B.
That is because some NATs will not accept an internal packet
sent to a public IP address which is mapped back to an internal
address. To deal with this, additional protocol mechanisms or
configuration parameters need to be introduced which detect
this case.
o Most significantly, STUN introduces potential security threats
which cannot be eliminated. This specification describes
heuristics that can be used to mitigate the problem, but it is
provably unsolvable given what STUN is trying to accomplish.
These security problems are described fully in Section 12.
14.4 Requirements for a Long Term Solution
From [17], any UNSAF proposal must provide:
Identify requirements for longer term, sound technical solutions
-- contribute to the process of finding the right longer term
solution.
Our experience with STUN has led to the following requirements for a
long term solution to the NAT problem:
Requests for bindings and control of other resources in a NAT
need to be explicit. Much of the brittleness in STUN derives from
its guessing at the parameters of the NAT, rather than telling the
NAT what parameters to use.
Control needs to be "in-band". There are far too many scenarios
in which the client will not know about the location of
middleboxes ahead of time. Instead, control of such boxes needs
to occur in-band, traveling along the same path as the data will
itself travel. This guarantees that the right set of middleboxes
are controlled. This is only true for first-party controls;
third-party controls are best handled using the midcom framework.
Control needs to be limited. Users will need to communicate
through NATs which are outside of their administrative control.
In order for providers to be willing to deploy NATs which can be
controlled by users in different domains, the scope of such
controls needs to be extremely limited - typically, allocating a
binding to reach the address where the control packets are coming
from.
Simplicity is Paramount. The control protocol will need to be
implement in very simple clients. The servers will need to
support extremely high loads. The protocol will need to be
extremely robust, being the precursor to a host of application
protocols. As such, simplicity is key.
14.5 Issues with Existing NAPT Boxes
From [17], any UNSAF proposal must provide:
Discussion of the impact of the noted practical issues with
existing, deployed NA[P]Ts and experience reports.
Several of the practical issues with STUN involve future proofing -
breaking the protocol when new NAT types get deployed. Fortunately,
this is not an issue at the current time, since most of the deployed
NATs are of the types assumed by STUN. The primary usage STUN has
found is in the area of VoIP, to facilitate allocation of addresses
for receiving RTP [12] traffic. In that application, the periodic
keepalives are provided by the RTP traffic itself. However, several
practical problems arise for RTP. First, RTP assumes that RTCP
traffic is on a port one higher than the RTP traffic. This pairing
property cannot be guaranteed through NATs that are not directly
controllable. As a result, RTCP traffic may not be properly
received. Protocol extensions to SDP have been proposed which
mitigate this by allowing the client to signal a different port for
RTCP [18]. However, there will be interoperability problems for some
time.
For VoIP, silence suppression can cause a gap in the transmission of
RTP packets. This could result in the loss of a binding in the
middle of a call, if that silence period exceeds the binding timeout.