/* packet-stun.c

 * Routines for Session Traversal Utilities for NAT (STUN) dissection

 * Copyright 2003, Shiang-Ming Huang <smhuang@pcs.csie.nctu.edu.tw>

 * Copyright 2006, Marc Petit-Huguenin <marc@petit-huguenin.org>

 * Copyright 2007-2008, 8x8 Inc. <petithug@8x8.com>

 * Copyright 2008, Gael Breard <gael@breard.org>

 * Copyright 2013, Media5 Corporation, David Bergeron <dbergeron@media5corp.com>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 *

 * Please refer to the following specs for protocol detail:

 * - RFC 3489 (Addition of deprecated attributes for diagnostics purpose)

 *             STUN - Simple Traversal of User Datagram Protocol (UDP)

 *             Through Network Address Translators (NATs) (superseded by RFC 5389)

 * - RFC 5389, formerly draft-ietf-behave-rfc3489bis-18

 *             Session Traversal Utilities for NAT (STUN) (superseded by RFC 8489)

 * - RFC 8489  Session Traversal Utilities for NAT (STUN)

 * - RFC 5780, formerly draft-ietf-behave-nat-behavior-discovery-08

 *             NAT Behavior Discovery Using Session Traversal Utilities for NAT (STUN)

 * - RFC 5766, formerly draft-ietf-behave-turn-16

 *             Traversal Using Relays around NAT (TURN) (superseded by RFC 8656)

 * - RFC 8656  Traversal Using Relays around NAT (TURN)

 * - RFC 6062  Traversal Using Relays around NAT (TURN) Extensions for TCP Allocations

 * - RFC 6156, formerly draft-ietf-behave-turn-ipv6-11

 *             Traversal Using Relays around NAT (TURN) Extension for IPv6

 * - RFC 5245, formerly draft-ietf-mmusic-ice-19

 *             Interactive Connectivity Establishment (ICE)

 * - RFC 6544  TCP Candidates with Interactive Connectivity Establishment (ICE)

 *

 * Iana registered values:

 * https://www.iana.org/assignments/stun-parameters/stun-parameters.xhtml

 *

 * From MS

 * MS-TURN: Traversal Using Relay NAT (TURN) Extensions https://docs.microsoft.com/en-us/openspecs/office_protocols/ms-turn

 * MS-TURNBWM:  Traversal using Relay NAT (TURN) Bandwidth Management Extensions https://docs.microsoft.com/en-us/openspecs/office_protocols/ms-turnbwm

 * MS-ICE: Interactive Connectivity Establishment (ICE) Extensions https://docs.microsoft.com/en-us/openspecs/office_protocols/ms-ice

 * MS-ICE2:  Interactive Connectivity Establishment ICE Extensions 2.0 https://docs.microsoft.com/en-us/openspecs/office_protocols/ms-ice2

 * MS-ICE2BWN: Interactive Connectivity Establishment (ICE) 2.0 Bandwidth Management Extensions https://docs.microsoft.com/en-us/openspecs/office_protocols/ms-ice2bwm

 */

/* TODO

 * Add information about different versions to table as we find it

 * Add/Implement missing attributes

 * Add/Implement missing message classes/methods

 * Add missing error codes

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/expert.h>

#include <epan/to_str.h>

#include <epan/crc32-tvb.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include <wsutil/ws_roundup.h>

#include "packet-tcp.h"

#include "packet-udp.h"

void proto_register_stun(void);

void proto_reg_handoff_stun(void);

/* Dissection relevant differences between STUN/TURN specification documents

 *

 *  Aspect   | MS-TURN 18.0       | RFC 3489           | RFC 5389           | RFC 8489 (*1)      |

 * ===============================================================================================

 *  Message  | 0b00+14-bit        | 16-bit             | 0b00+14-bit, type= |                    |

 *  Type     | No class or method | No class or method | class+method       |                    |

 *           | 0x0115: Data Ind   |                    | Method: 0x000-0xFFF| Method: 0x000-0x0FF|

 * -----------------------------------------------------------------------------------------------

 *  Transac- | 128 bits, seen     | 128 bits           | 32 bit Magic +     |                    |

 *  tion ID  | with MAGIC as well |                    | 96 bit Trans ID    |                    |

 * -----------------------------------------------------------------------------------------------

 *  Padding  | No Attribute Pad   | No Attribute Pad   | Pad to 32 bits     |                    |

 *           |                    |                    | Att. Len excl. Pad |                    |

 *           |                    |                    | Msg. Len incl. Pad |                    |

 *           |                    |                    |  -> MLen & 3 == 0  |                    |

 *           |                    |                    | Pad value: any     | Pad value: MBZ     |

 * -----------------------------------------------------------------------------------------------

 *  (XOR-)   | Write: Any value   | Write: Any value   | Write: MBZ         |                    |

 *  MAP-ADDR | Read : Ignored     | Read : Ignored     | Read : Ignored     |                    |

 *  1st byte |                    |                    |                    |                    |

 * -----------------------------------------------------------------------------------------------

 *  Username | Opaque             | Opaque             | UTF-8 String       |                    |

 * -----------------------------------------------------------------------------------------------

 *  Password | Opaque             | Deprecated         | Deprecated         |                    |

 * -----------------------------------------------------------------------------------------------

 *  NONCE &  | 0x0014             | 0x0015 (*2)        | 0x0015             |                    |

 *  REALM    | 0x0015             | 0x0014             | 0x0014             |                    |

 * -----------------------------------------------------------------------------------------------

 *  TURN     | RFC 5766/8656 or   | N/A                | RFC 5766:          | RFC 8656:          |

 *  Channels | Multiplexed TURN   |                    | 0x4000-0x7FFF used | 0x4000-0x4FFF used |

 *           | Channels (0xFF10)  |                    | 0x8000-0xFFFF res. | 0x5000-0xFFFF res. |

 *           |                    |                    | Reserved MUST NOT  | Reserved MUST be   |

 *           |                    |                    | be rejected        | dropped (collision)|

 * -----------------------------------------------------------------------------------------------

 * *1: Only where different from RFC 5389

 * *2: NONCE & REALM were first defined in Internet-Drafts after RFC 3489 was

 * published. Early drafts, up to draft-ietf-behave-rfc3489bis-02 and

 * draft-rosenberg-midcom-turn-08, used 0x0014 for NONCE and 0x0015 for REALM.

 * The attribute numbers were swapped in draft-ietf-behave-rfc3489bis-03 (when

 * moved from the TURN spec to the STUN spec), the same version that added the

 * fixed 32-bit magic. Since this dissector only handles packets with the magic

 * (others are rejected and processed by the classicstun dissector instead),

 * the swapped values are used for RFC 3489 mode here.

 */

enum {

        NET_VER_AUTO,

        NET_VER_MS_TURN,

        NET_VER_3489,

        NET_VER_5389

};

/* Auto-tuning. Default: NET_VER_5389; NET_VER_MS_TURN if MAGIC_COOKIE is found */

/* NET_VER_3489 is only useful for packets that conform specifically to

 * draft-ietf-behave-rfc3489bis-03; i.e. that have the 32 bit magic so that they

 * are not handled by classicstun instead, have the current (swapped) NONE and

 * REALM attribute numbers, but do not have the attribute padding that was

 * introduced in draft-ietf-behave-rfc3489bis-04.

 */

static int stun_network_version = NET_VER_5389;

static const enum_val_t stun_network_version_vals[] = {

        { "Auto", "Auto",     NET_VER_AUTO},

        { "MS-TURN",  "MS-TURN", NET_VER_MS_TURN },

        { "RFC3489", "RFC3489 and earlier",     NET_VER_3489},

        { "RFC5389",  "RFC5389 and later", NET_VER_5389 },

        { NULL, NULL, 0 }

};

static const value_string network_versions_vals[] = {

        {NET_VER_MS_TURN,  "MS-TURN"},

        {NET_VER_3489,     "RFC-3489 and earlier"},

        {NET_VER_5389,     "RFC-5389/8489"},

        {0,   NULL}

};

/* heuristic subdissectors */

static heur_dissector_list_t heur_subdissector_list;

/* stun dissector handles */

static dissector_handle_t data_handle;

static dissector_handle_t stun_tcp_handle;

static dissector_handle_t stun_udp_handle;

/* Initialize the protocol and registered fields */

static int proto_stun;

static int hf_stun_channel;

static int hf_stun_tcp_frame_length;

static int hf_stun_type;

static int hf_stun_type_class;

static int hf_stun_type_method;

static int hf_stun_type_method_assignment;

static int hf_stun_length;

static int hf_stun_cookie;

static int hf_stun_id;

static int hf_stun_attributes;

static int hf_stun_response_in;

static int hf_stun_response_to;

static int hf_stun_time;

static int hf_stun_duplicate;

static int hf_stun_attr;

static int hf_stun_att_type; /* STUN attribute fields */

static int hf_stun_att_length;

static int hf_stun_att_family;

static int hf_stun_att_type_comprehension;

static int hf_stun_att_type_assignment;

static int hf_stun_att_ipv4;

static int hf_stun_att_ipv6;

static int hf_stun_att_port;

static int hf_stun_att_username;

static int hf_stun_att_username_opaque;

static int hf_stun_att_password;

static int hf_stun_att_padding;

static int hf_stun_att_hmac;

static int hf_stun_att_crc32;

static int hf_stun_att_crc32_status;

static int hf_stun_att_error_class;

static int hf_stun_att_error_number;

static int hf_stun_att_error_reason;

static int hf_stun_att_realm;

static int hf_stun_att_nonce;

static int hf_stun_att_unknown;

static int hf_stun_att_xor_ipv4;

static int hf_stun_att_xor_ipv6;

static int hf_stun_att_xor_port;

static int hf_stun_att_icmp_type;

static int hf_stun_att_icmp_code;

static int hf_stun_att_ms_turn_unknown_8006;

static int hf_stun_att_software;

static int hf_stun_att_priority;

static int hf_stun_att_tie_breaker;

static int hf_stun_att_change_ip;

static int hf_stun_att_change_port;

static int hf_stun_att_cache_timeout;

static int hf_stun_att_token;

static int hf_stun_att_pw_alg;

static int hf_stun_att_pw_alg_param_len;

static int hf_stun_att_pw_alg_param_data;

static int hf_stun_att_reserve_next;

static int hf_stun_att_reserved;

static int hf_stun_att_value;

static int hf_stun_att_transp;

static int hf_stun_att_magic_cookie;

static int hf_stun_att_bandwidth;

static int hf_stun_att_lifetime;

static int hf_stun_att_channelnum;

static int hf_stun_att_ms_version;

static int hf_stun_att_ms_version_ice;

static int hf_stun_att_ms_connection_id;

static int hf_stun_att_ms_sequence_number;

static int hf_stun_att_ms_stream_type;

static int hf_stun_att_ms_service_quality;

static int hf_stun_att_ms_foundation;

static int hf_stun_att_ms_multiplexed_turn_session_id;

static int hf_stun_att_ms_turn_session_id;

static int hf_stun_att_bandwidth_acm_type;

static int hf_stun_att_bandwidth_rsv_id;

static int hf_stun_att_bandwidth_rsv_amount_misb;

static int hf_stun_att_bandwidth_rsv_amount_masb;

static int hf_stun_att_bandwidth_rsv_amount_mirb;

static int hf_stun_att_bandwidth_rsv_amount_marb;

static int hf_stun_att_address_rp_a;

static int hf_stun_att_address_rp_b;

static int hf_stun_att_address_rp_rsv1;

static int hf_stun_att_address_rp_rsv2;

static int hf_stun_att_address_rp_masb;

static int hf_stun_att_address_rp_marb;

static int hf_stun_att_sip_dialog_id;

static int hf_stun_att_sip_call_id;

static int hf_stun_att_lp_peer_location;

static int hf_stun_att_lp_self_location;

static int hf_stun_att_lp_federation;

static int hf_stun_att_google_network_id;

static int hf_stun_att_google_network_cost;

static int hf_stun_network_version;

/* Expert items */

static expert_field ei_stun_short_packet;

static expert_field ei_stun_wrong_msglen;

static expert_field ei_stun_long_attribute;

static expert_field ei_stun_unknown_attribute;

static expert_field ei_stun_fingerprint_bad;

/* Structure containing transaction specific information */

typedef struct _stun_transaction_t {

    uint32_t req_frame;

    uint32_t rep_frame;

    nstime_t req_time;

} stun_transaction_t;

/* Structure containing conversation specific information */

typedef struct _stun_conv_info_t {

    wmem_tree_t *transaction_pdus;

} stun_conv_info_t;

/* STUN versions RFC5389 and newer split off the leading 32 bits of the

 * transaction ID into a magic cookie (called message cookie in this

 * dissector to avoid confusion with the MAGIC_COOKIE attribute) and

 * shortens the real transaction ID to 96 bits.

 * This allows to differentiate between the legacy version of RFC3489

 * and all newer versions.

 */

#define MESSAGE_COOKIE 0x2112A442

#define TURN_MAGIC_COOKIE 0x72C64BC6

/* Message classes (2 bit) */

#define REQUEST          0

#define INDICATION       1

#define SUCCESS_RESPONSE 2

#define ERROR_RESPONSE   3

/* Methods */

/* 0x000-0x07F IETF Review */

#define BINDING                 0x0001 /* RFC8489 */

#define SHARED_SECRET           0x0002 /* RFC3489 */

#define ALLOCATE                0x0003 /* RFC8489 */

#define REFRESH                 0x0004 /* RFC8489 */

/* 0x0005 is Unassigned.

 * 0x1115 was used for DATA_INDICATION in draft-rosenberg-midcom-turn-08,

 * but this did not fit the later class+indication scheme (it would

 * indicate an error response, which it is not) and was unassigned and

 * replaced with 0x0007 before RFC5389. The MS-TURN specification lists

 * it, however, and some MS-TURN captures use it.

 */

#define SEND                    0x0006 /* RFC8656 */

#define DATA_IND                0x0007 /* RFC8656 */

#define CREATE_PERMISSION       0x0008 /* RFC8656 */

#define CHANNELBIND             0x0009 /* RFC8656 */

/* TCP specific */

#define CONNECT                 0x000a /* RFC6062 */

#define CONNECTION_BIND         0x000b /* RFC6062 */

#define CONNECTION_ATTEMPT      0x000c /* RFC6062 */

#define GOOG_PING               0x0080 /* Google undocumented */

/* MS-TURN message types use raw 16-bit values, not the RFC 5389 class/method

 * bit layout used by the values above.

 */

#define MS_TURN_SEND    0x0004

#define MS_TURN_DATA_IND 0x0115

/* 0x080-0x0FF Expert Review */

/* 0x100-0xFFF Reserved (for DTLS-SRTP multiplexing collision avoidance,

 * see RFC7983.  Cannot be made available for assignment without IETF Review.)

 */

/* Attribute Types */

/* 0x0000-0x3FFF IETF Review comprehension-required range */

#define MAPPED_ADDRESS          0x0001 /* RFC8489, MS-TURN */

#define RESPONSE_ADDRESS        0x0002 /* Deprecated, RFC3489 */

#define CHANGE_REQUEST          0x0003 /* Deprecated, RFC3489 */

#define SOURCE_ADDRESS          0x0004 /* Deprecated, RFC3489 */

#define CHANGED_ADDRESS         0x0005 /* Deprecated, RFC3489 */

#define USERNAME                0x0006 /* RFC8489, MS-TURN */

#define PASSWORD                0x0007 /* Deprecated, RFC3489 */

#define MESSAGE_INTEGRITY       0x0008 /* RFC8489, MS-TURN */

#define ERROR_CODE              0x0009 /* RFC8489, MS-TURN */

#define UNKNOWN_ATTRIBUTES      0x000a /* RFC8489, MS-TURN */

#define REFLECTED_FROM          0x000b /* Deprecated, RFC3489 */

#define CHANNEL_NUMBER          0x000c /* RFC8656 */

#define LIFETIME                0x000d /* RFC8656, MS-TURN */

#define MS_ALTERNATE_SERVER     0x000e /* MS-TURN */

/* 0x000f reserved collision */

#define MAGIC_COOKIE            0x000f /* MS-TURN */

/* 0x0010 fix reference */

#define BANDWIDTH               0x0010 /* MS-TURN */

/* 0x0011 reserved collision */

#define DESTINATION_ADDRESS     0x0011 /* MS-TURN */

#define XOR_PEER_ADDRESS        0x0012 /* RFC8656, MS-TURN */

#define DATA                    0x0013 /* RFC8656, MS-TURN */

/* Note: REALM and NONCE have swapped attribute numbers in MS-TURN */

#define REALM                   0x0014 /* RFC8489, MS-TURN uses 0x0015 */

#define NONCE                   0x0015 /* RFC8489, MS-TURN uses 0x0014 */

#define XOR_RELAYED_ADDRESS     0x0016 /* RFC8656 */

#define REQUESTED_ADDRESS_FAMILY 0x0017 /* RFC8656, MS-TURN */

#define EVEN_PORT               0x0018 /* RFC8656 */

#define REQUESTED_TRANSPORT     0x0019 /* RFC8656 */

#define DONT_FRAGMENT           0x001a /* RFC8656 */

#define ACCESS_TOKEN            0x001b /* RFC7635 */

#define MESSAGE_INTEGRITY_SHA256 0x001c /* RFC8489 */

#define PASSWORD_ALGORITHM      0x001d /* RFC8489 */

#define USERHASH                0x001e /* RFC8489 */

/* 0x001f Reserved */

#define XOR_MAPPED_ADDRESS      0x0020 /* RFC8489 */

/* 0x0021 add deprecated TIMER-VAL */

#define RESERVATION_TOKEN       0x0022 /* RFC8656 */

/* 0x0023 Reserved */

#define PRIORITY                0x0024 /* RFC8445 */

#define USE_CANDIDATE           0x0025 /* RFC8445 */

#define PADDING                 0x0026 /* RFC5780 */

/* 0x0027 collision RESPONSE-PORT RFC5780 */

#define XOR_RESPONSE_TARGET     0x0027 /* draft-ietf-behave-nat-behavior-discovery-03 */

/* 0x0028 Reserved collision */

#define XOR_REFLECTED_FROM      0x0028 /* draft-ietf-behave-nat-behavior-discovery-03 */

/* 0x0029 Reserved */

#define CONNECTION_ID           0x002a /* rfc6062 */

/* 0x002b-0x002f unassigned */

/* 0x0030 collision reserved */

#define LEGACY_ICMP             0x0030 /* Moved from TURN to 0x8004 */

/* 0x0031-0x3fff Unassigned */

/* 0x4000-0x7FFF Expert Review comprehension-required range */

/* 0x4000-0x7fff Unassigned */

/* WhatsApp is known to use 0x4000, 0x4002, and 0x4024 */

/* 0x8000-0xBFFF IETF Review comprehension-optional range */

#define ADDITIONAL_ADDRESS_FAMILY 0x8000 /* RFC8656 */

#define ADDRESS_ERROR_CODE      0x8001 /* RFC8656 */

#define PASSWORD_ALGORITHMS     0x8002 /* RFC8489 */

#define ALTERNATE_DOMAIN        0x8003 /* RFC8489 */

#define ICMP                    0x8004 /* RFC8656 */

/* Unknown attribute in MS-TURN packets */

#define MS_TURN_UNKNOWN_8006  0x8006

/* 0x8005-0x8021 Unassigned collision */

#define MS_VERSION              0x8008 /* MS-TURN */

/* collision */

#define MS_XOR_MAPPED_ADDRESS   0x8020 /* MS-TURN */

#define SOFTWARE                0x8022 /* RFC8489 */

#define ALTERNATE_SERVER        0x8023 /* RFC8489 */

/* 0x8024 Reserved */

#define TRANSACTION_TRANSMIT_COUNTER 0x8025 /* RFC7982 */

/* 0x8026 Reserved */

#define CACHE_TIMEOUT           0x8027 /* RFC5780 */

#define FINGERPRINT             0x8028 /* RFC8489 */

#define ICE_CONTROLLED          0x8029 /* RFC8445 */

#define ICE_CONTROLLING         0x802a /* RFC8445 */

#define RESPONSE_ORIGIN         0x802b /* RFC5780 */

#define OTHER_ADDRESS           0x802c /* RFC5780 */

#define ECN_CHECK_STUN          0x802d /* RFC6679 */

#define THIRD_PARTY_AUTHORIZATION 0x802e /* RFC7635 */

/* 0x802f Unassigned */

#define MOBILITY_TICKET         0x8030 /* RFC8016 */

/* 0x8031-0xBFFF Unassigned collision */

#define MS_ALTERNATE_HOST_NAME  0x8032 /* MS-TURN */

#define MS_APP_ID               0x8037 /* MS-TURN */

#define MS_SECURE_TAG           0x8039 /* MS-TURN */

#define MS_SEQUENCE_NUMBER      0x8050 /* MS-TURN */

#define MS_CANDIDATE_IDENTIFIER 0x8054 /* MS-ICE2 */

#define MS_SERVICE_QUALITY      0x8055 /* MS-TURN */

#define BANDWIDTH_ACM           0x8056 /* MS-TURNBWM */

#define BANDWIDTH_RSV_ID        0x8057 /* MS-TURNBWM */

#define BANDWIDTH_RSV_AMOUNT    0x8058 /* MS-TURNBWM */

#define REMOTE_SITE_ADDR        0x8059 /* MS-TURNBWM */

#define REMOTE_RELAY_SITE       0x805A /* MS-TURNBWM */

#define LOCAL_SITE_ADDR         0x805B /* MS-TURNBWM */

#define LOCAL_RELAY_SITE        0x805C /* MS-TURNBWM */

#define REMOTE_SITE_ADDR_RP     0x805D /* MS-TURNBWM */

#define REMOTE_RELAY_SITE_RP    0x805E /* MS-TURNBWM */

#define LOCAL_SITE_ADDR_RP      0x805F /* MS-TURNBWM */

#define LOCAL_RELAY_SITE_RP     0x8060 /* MS-TURNBWM */

#define SIP_DIALOG_ID           0x8061 /* MS-TURNBWM */

#define SIP_CALL_ID             0x8062 /* MS-TURNBWM */

#define LOCATION_PROFILE        0x8068 /* MS-TURNBWM */

#define MS_IMPLEMENTATION_VER   0x8070 /* MS-ICE2 */

#define MS_ALT_MAPPED_ADDRESS   0x8090 /* MS-TURN */

#define MS_MULTIPLEXED_TURN_SESSION_ID 0x8095 /* MS_TURN */

/* 0xC000-0xFFFF Expert Review comprehension-optional range */

#define CISCO_STUN_FLOWDATA     0xc000 /* Cisco undocumented */

#define ENF_FLOW_DESCRIPTION    0xc001 /* Cisco undocumented */

#define ENF_NETWORK_STATUS      0xc002 /* Cisco undocumented */

/* 0xc003-0xc056 Unassigned */

/* https://webrtc.googlesource.com/src/+/refs/heads/master/api/transport/stun.h */

#define GOOG_NETWORK_INFO       0xc057

#define GOOG_LAST_ICE_CHECK_RECEIVED 0xc058

#define GOOG_MISC_INFO          0xc059

/* Various IANA-registered but undocumented Google attributes follow */

#define GOOG_OBSOLETE_1         0xc05a

#define GOOG_CONNECTION_ID      0xc05b

#define GOOG_DELTA              0xc05c

#define GOOG_DELTA_ACK          0xc05d

/* 0xc05e-0xc05f Unassigned */

#define GOOG_MESSAGE_INTEGRITY_32 0xc060

/* 0xc061-0xff03 Unassigned */

/* https://webrtc.googlesource.com/src/+/refs/heads/master/p2p/base/turn_port.cc */

#define GOOG_MULTI_MAPPING      0xff04

#define GOOG_LOGGING_ID         0xff05

/* 0xff06-0xffff Unassigned */

#define MS_MULTIPLEX_TURN 0xFF10

/* Initialize the subtree pointers */

static int ett_stun;

static int ett_stun_type;

static int ett_stun_att_all;

static int ett_stun_att;

static int ett_stun_att_type;

#define UDP_PORT_STUN   3478

#define TCP_PORT_STUN   3478

#define STUN_HDR_LEN                   20 /* STUN message header length */

#define ATTR_HDR_LEN                    4 /* STUN attribute header length */

#define CHANNEL_DATA_HDR_LEN            4 /* TURN CHANNEL-DATA Message hdr length */

#define MIN_HDR_LEN                     4

#define TCP_FRAME_COOKIE_LEN           10 /* min length for cookie with TCP framing */

static const value_string transportnames[] = {

    {  6, "TCP" },

    { 17, "UDP" },

    {  0, NULL }

};

static const value_string classes[] = {

    {REQUEST         , "Request"},

    {INDICATION      , "Indication"},

    {SUCCESS_RESPONSE, "Success Response"},

    {ERROR_RESPONSE  , "Error Response"},

    {0x00            , NULL}

};

static const value_string methods[] = {

    {BINDING           , "Binding"},

    {SHARED_SECRET     , "SharedSecret"},

    {ALLOCATE          , "Allocate"},

    {REFRESH           , "Refresh"},

    {SEND              , "Send"},

    {DATA_IND          , "Data"},

    {CREATE_PERMISSION , "CreatePermission"},

    {CHANNELBIND       , "Channel-Bind"},

    {CONNECT           , "Connect"},

    {CONNECTION_BIND   , "ConnectionBind"},

    {CONNECTION_ATTEMPT, "ConnectionAttempt"},

    {GOOG_PING         , "GooglePing"},

    {0x00              , NULL}

};

static const value_string attributes[] = {

  /* 0x0000-0x3FFF IETF Review comprehension-required range */

    {MAPPED_ADDRESS        , "MAPPED-ADDRESS"},

    {RESPONSE_ADDRESS      , "RESPONSE_ADDRESS"},

    {CHANGE_REQUEST        , "CHANGE_REQUEST"},

    {SOURCE_ADDRESS        , "SOURCE_ADDRESS"},

    {CHANGED_ADDRESS       , "CHANGED_ADDRESS"},

    {USERNAME              , "USERNAME"},

    {PASSWORD              , "PASSWORD"},

    {MESSAGE_INTEGRITY     , "MESSAGE-INTEGRITY"},

    {ERROR_CODE            , "ERROR-CODE"},

    {UNKNOWN_ATTRIBUTES    , "UNKNOWN-ATTRIBUTES"},

    {REFLECTED_FROM        , "REFLECTED-FROM"},

    {CHANNEL_NUMBER        , "CHANNEL-NUMBER"},

    {LIFETIME              , "LIFETIME"},

    {MS_ALTERNATE_SERVER   , "MS-ALTERNATE-SERVER"},

    {MAGIC_COOKIE          , "MAGIC-COOKIE"},

    {BANDWIDTH             , "BANDWIDTH"},

    {DESTINATION_ADDRESS   , "DESTINATION-ADDRESS"},

    {XOR_PEER_ADDRESS      , "XOR-PEER-ADDRESS"},

    {DATA                  , "DATA"},

    {REALM                 , "REALM"},

    {NONCE                 , "NONCE"},

    {XOR_RELAYED_ADDRESS   , "XOR-RELAYED-ADDRESS"},

    {REQUESTED_ADDRESS_FAMILY, "REQUESTED-ADDRESS-FAMILY"},

    {EVEN_PORT             , "EVEN-PORT"},

    {REQUESTED_TRANSPORT   , "REQUESTED-TRANSPORT"},

    {DONT_FRAGMENT         , "DONT-FRAGMENT"},

    {ACCESS_TOKEN          , "ACCESS-TOKEN"},

    {MESSAGE_INTEGRITY_SHA256, "MESSAGE-INTEGRITY-SHA256"},

    {PASSWORD_ALGORITHM    , "PASSWORD-ALGORITHM"},

    {USERHASH              , "USERHASH"},

    {XOR_MAPPED_ADDRESS    , "XOR-MAPPED-ADDRESS"},

    {RESERVATION_TOKEN     , "RESERVATION-TOKEN"},

    {PRIORITY              , "PRIORITY"},

    {USE_CANDIDATE         , "USE-CANDIDATE"},

    {PADDING               , "PADDING"},

    {XOR_RESPONSE_TARGET   , "XOR-RESPONSE-TARGET"},

    {XOR_REFLECTED_FROM    , "XOR-REFELECTED-FROM"},

    {CONNECTION_ID         , "CONNECTION-ID"},

    {LEGACY_ICMP           , "LEGACY-ICMP"},

  /* 0x4000-0x7FFF Expert Review comprehension-required range */

  /* 0x8000-0xBFFF IETF Review comprehension-optional range */

    {ADDITIONAL_ADDRESS_FAMILY, "ADDITIONAL-ADDRESS-FAMILY"},

    {ADDRESS_ERROR_CODE    , "ADDRESS-ERROR-CODE"},

    {PASSWORD_ALGORITHMS   , "PASSWORD-ALGORITHMS"},

    {ALTERNATE_DOMAIN      , "ALTERNATE-DOMAIN"},

    {ICMP                  , "ICMP"},

    {MS_TURN_UNKNOWN_8006  , "MS-TURN UNKNOWN 8006"},

    {MS_VERSION            , "MS-VERSION"},

    {MS_XOR_MAPPED_ADDRESS , "MS-XOR-MAPPED-ADDRESS"},

    {SOFTWARE              , "SOFTWARE"},

    {ALTERNATE_SERVER      , "ALTERNATE-SERVER"},

    {TRANSACTION_TRANSMIT_COUNTER, "TRANSACTION-TRANSMIT-COUNTER"},

    {CACHE_TIMEOUT         , "CACHE-TIMEOUT"},

    {FINGERPRINT           , "FINGERPRINT"},

    {ICE_CONTROLLED        , "ICE-CONTROLLED"},

    {ICE_CONTROLLING       , "ICE-CONTROLLING"},

    {RESPONSE_ORIGIN       , "RESPONSE-ORIGIN"},

    {OTHER_ADDRESS         , "OTHER-ADDRESS"},

    {ECN_CHECK_STUN        , "ECN-CHECK-STUN"},

    {THIRD_PARTY_AUTHORIZATION, "THIRD-PARTY-AUTHORIZATION"},

    {MOBILITY_TICKET       , "MOBILITY-TICKET"},

    {MS_ALTERNATE_HOST_NAME, "MS-ALTERNATE-HOST-NAME"},

    {MS_APP_ID             , "MS-APP-ID"},

    {MS_SECURE_TAG         , "MS-SECURE-TAG"},

    {MS_SEQUENCE_NUMBER    , "MS-SEQUENCE-NUMBER"},

    {MS_CANDIDATE_IDENTIFIER, "MS-CANDIDATE-IDENTIFIER"},

    {MS_SERVICE_QUALITY    , "MS-SERVICE-QUALITY"},

    {BANDWIDTH_ACM         , "Bandwidth Admission Control Message"},

    {BANDWIDTH_RSV_ID      , "Bandwidth Reservation Identifier"},

    {BANDWIDTH_RSV_AMOUNT  , "Bandwidth Reservation Amount"},

    {REMOTE_SITE_ADDR      , "Remote Site Address"},

    {REMOTE_RELAY_SITE     , "Remote Relay Site Address"},

    {LOCAL_SITE_ADDR       , "Local Site Address"},

    {LOCAL_RELAY_SITE      , "Local Relay Site Address"},

    {REMOTE_SITE_ADDR_RP   , "Remote Site Address Response"},

    {REMOTE_RELAY_SITE_RP  , "Remote Relay Site Address Response"},

    {LOCAL_SITE_ADDR_RP    , "Local Site Address Response"},

    {LOCAL_RELAY_SITE_RP   , "Local Relay Site Address Response"},

    {SIP_DIALOG_ID         , "SIP Dialog Identifier"},

    {SIP_CALL_ID           , "SIP Call Identifier"},

    {LOCATION_PROFILE      , "Location Profile"},

    {MS_IMPLEMENTATION_VER , "MS-IMPLEMENTATION-VERSION"},

    {MS_ALT_MAPPED_ADDRESS , "MS-ALT-MAPPED-ADDRESS"},

    {MS_MULTIPLEXED_TURN_SESSION_ID, "MS-MULTIPLEXED-TURN-SESSION-ID"},

  /* 0xC000-0xFFFF Expert Review comprehension-optional range */

    {CISCO_STUN_FLOWDATA   , "CISCO-STUN-FLOWDATA"},

    {ENF_FLOW_DESCRIPTION   , "ENF-FLOW-DESCRIPTION"},

    {ENF_NETWORK_STATUS    , "ENF-NETWORK-STATUS"},

    {GOOG_NETWORK_INFO     , "GOOG-NETWORK-INFO"},

    {GOOG_LAST_ICE_CHECK_RECEIVED, "GOOG-LAST-ICE-CHECK-RECEIVED"},

    {GOOG_MISC_INFO        , "GOOG-MISC-INFO"},

    {GOOG_OBSOLETE_1       , "GOOG-OBSOLETE-1"},

    {GOOG_CONNECTION_ID    , "GOOG-CONNECTION-ID"},

    {GOOG_DELTA            , "GOOG-DELTA"},

    {GOOG_DELTA_ACK        , "GOOG-DELTA-ACK"},

    {GOOG_MESSAGE_INTEGRITY_32, "GOOG-MESSAGE_INTEGRITY-32"},

    {GOOG_MULTI_MAPPING    , "GOOG-MULTI-MAPPING"},

    {GOOG_LOGGING_ID       , "GOOG-LOGGING-ID"},

    {0x00                  , NULL}

};

static value_string_ext attributes_ext = VALUE_STRING_EXT_INIT(attributes);

static const value_string assignments[] = {

    {0x0000, "IETF Review"},

    {0x0001, "Designated Expert"},

    {0x00, NULL}

};

static const value_string comprehensions[] = {

    {0x0000, "Required"},

    {0x0001, "Optional"},

    {0x00  , NULL}

};

static const value_string attributes_reserve_next[] = {

    {0, "No reservation"},

    {1, "Reserve next port number"},

    {0x00, NULL}

};

static const value_string attributes_family[] = {

    {0x0001, "IPv4"},

    {0x0002, "IPv6"},

    {0x00, NULL}

};

/* https://www.iana.org/assignments/stun-parameters/stun-parameters.xhtml#stun-parameters-6 (2020-08-05)*/

static const value_string error_code[] = {

    {274, "Disable Candidate"},               /* MS-ICE2BWN */

    {275, "Disable Candidate Pair"},          /* MS-ICE2BWN */

    {300, "Try Alternate"},                   /* RFC8489 */

    {400, "Bad Request"},                     /* RFC8489 */

    {401, "Unauthenticated"},                 /* RFC8489, RFC3489+MS-TURN: Unauthorized */

    {403, "Forbidden"},                       /* RFC8656 */

    {405, "Mobility Forbidden"},              /* RFC8016 */

    {420, "Unknown Attribute"},               /* RFC8489 */

    {430, "Stale Credentials (legacy)"},      /* RFC3489 */

    {431, "Integrity Check Failure (legacy)"}, /* RFC3489 */

    {432, "Missing Username (legacy)"},       /* RFC3489 */

    {433, "Use TLS (legacy)"},                /* RFC3489 */

    {434, "Missing Realm (legacy)"},          /* MS-TURN */

    {435, "Missing Nonce (legacy)"},          /* MS-TURN */

    {436, "Unknown User (legacy)"},           /* MS-TURN */

    {437, "Allocation Mismatch"},             /* RFC8656 */

    {438, "Stale Nonce"},                     /* RFC8489 */

    {439, "Wrong Credentials (legacy)"},      /* turn-07 */

    {440, "Address Family not Supported"},    /* RFC8656 */

    {441, "Wrong Credentials"},               /* RFC8656 */

    {442, "Unsupported Transport Protocol"},  /* RFC8656 */

    {443, "Peer Address Family Mismatch"},    /* RFC8656 */

    {446, "Connection Already Exists"},       /* RFC6062 */

    {447, "Connection Timeout or Failure"},   /* RFC6062 */

    {481, "Connection does not exist (legacy)"}, /* nat-behavior-discovery-03 */

    {486, "Allocation Quota Reached"},        /* RFC8656 */

    {487, "Role Conflict"},                   /* RFC8445 */

    {500, "Server Error"},                    /* RFC8489 */

    {503, "Service Unavailable (legacy)"},    /* nat-behavior-discovery-03 */

    {507, "Insufficient Bandwidth Capacity (legacy)"}, /* turn-07 */

    {508, "Insufficient Port Capacity"},      /* RFC8656 */

    {600, "Global Failure"},                  /* RFC8656 */

    {0x00, NULL}

};

static value_string_ext error_code_ext = VALUE_STRING_EXT_INIT(error_code);

static const value_string ms_version_vals[] = {

    {0x00000001, "ICE"},

    {0x00000002, "MS-ICE2"},

    {0x00000003, "MS-ICE2 with SHA256"},

    {0x00000004, "MS-ICE2 with SHA256 and IPv6"},

    {0x00000005, "MULTIPLEXED TURN over UDP only"},

    {0x00000006, "MULTIPLEXED TURN over UDP and TCP"},

    {0x00, NULL}

};

static const range_string ms_version_ice_rvals[] = {

    {0x00000000, 0x00000002, "Supports only RFC3489bis-02 message formats"},

    {0x00000003, 0xFFFFFFFF, "Supports RFC5389 message formats"},

    {0x00, 0x00, NULL}

};

static const value_string ms_stream_type_vals[] = {

    {0x0001, "Audio"},

    {0x0002, "Video"},

    {0x0003, "Supplemental Video"},

    {0x0004, "Data"},

    {0x00, NULL}

};

static const value_string ms_service_quality_vals[] = {

    {0x0000, "Best effort delivery"},

    {0x0001, "Reliable delivery"},

    {0x00, NULL}

};

static const value_string bandwidth_acm_type_vals[] = {

    {0x0000, "Reservation Check"},

    {0x0001, "Reservation Commit"},

    {0x0002, "Reservation Update"},

    {0x00, NULL}

};

static const value_string location_vals[] = {

    {0x00, "Unknown"},

    {0x01, "Internet"},

    {0x02, "Intranet"},

    {0x00, NULL}

};

static const value_string federation_vals[] = {

    {0x00, "No Federation"},

    {0x01, "Enterprise Federation"},

    {0x02, "Public Cloud Federation"},

    {0x00, NULL}

};

static const value_string password_algorithm_vals[] = {

    {0x0000, "Reserved"},

    {0x0001, "MD5"},

    {0x0002, "SHA-256"},

    {0x0000, NULL}

};

/* https://webrtc.googlesource.com/src/+/refs/heads/master/rtc_base/network_constants.h */

static const value_string google_network_cost_vals[] = {

    {0,   "Min"},

    {10,  "Low"},

    {50,  "Unknown"},

    {250, "Cellular5G"},

    {500, "Cellular4G"},

    {900, "Cellular"},

    {910, "Cellular3G"},

    {980, "Cellular2G"},

    {999, "Max"},

    {0,   NULL}

};

/* Test for STUN starting at offset - note that for STUN over TCP with

 * RFC 4571/6544 framing, offset should be adjusted before passing in

 * here.

 */

static bool

test_stun(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, bool heur_check, bool is_udp)

{

    unsigned    captured_length;

    unsigned    reported_length;

    uint16_t    msg_type;

    unsigned    msg_length;

    /*

     * Check if the frame is really meant for us.

     */

    /* First, make sure we have enough data to do the check. */

    captured_length = tvb_captured_length_remaining(tvb, offset);

    if (captured_length < MIN_HDR_LEN)

        return false;

    reported_length = tvb_captured_length_remaining(tvb, offset);

    msg_type     = tvb_get_ntohs(tvb, offset);

    msg_length   = tvb_get_ntohs(tvb, offset + 2);

    /* TURN ChannelData message ? */

    if (msg_type & 0xC000) {

        /* two first bits not NULL => should be a channel-data message */

        /*

         * If the packet is being dissected through heuristics, we never match

         * TURN ChannelData because the heuristics are otherwise rather weak.

         * Instead we have to have seen another STUN message type on the same

         * 5-tuple, and then set that conversation for non-heuristic STUN

         * dissection.

         */

        if (heur_check)

            return false;

        /* RFC 5764 defined a demultiplexing scheme to allow STUN to co-exist

         * on the same 5-tuple as DTLS-SRTP (and ZRTP) by rejecting previously

         * reserved channel numbers and method types, implicitly restricting

         * channel numbers to 0x4000-0x7FFF.  RFC 5766 did not incorporate this

         * restriction, instead indicating that reserved numbers MUST NOT be

         * dropped.

         * RFCs 7983, 8489, and 8656 reconciled this and formally indicated

         * that channel numbers in the reserved range MUST be dropped, while

         * further restricting the channel numbers to 0x4000-0x4FFF.

         * Reject the range 0x8000-0xFFFF, except for the special

         * MS-TURN multiplex channel number, since no implementation has

         * used any other value in that range (that we know of).

         */

        if (msg_type & 0x8000 && msg_type != MS_MULTIPLEX_TURN) {

            return false;

        }

        /* "Over TCP and TLS-over-TCP, the ChannelData message MUST be padded to

         * a multiple of 4 bytes (not reflected in the length field)... Over UDP,

         * the padding is optional but MAY be included." - RFC 8656, 12.5

         */

        if (is_udp) {

            if (reported_length != msg_length + CHANNEL_DATA_HDR_LEN &&

                reported_length != ((msg_length + CHANNEL_DATA_HDR_LEN + 3) & ~0x3))

                return false;

        } else { /* TCP or TLS-over-TCP */

            if (reported_length != ((msg_length + CHANNEL_DATA_HDR_LEN + 3) & ~0x3))

                return false;

        }

        return true;

    }

    /* Normal STUN message */

    if (captured_length < STUN_HDR_LEN)

        return false;

    uint16_t msg_type_method = (msg_type & 0x000F) | ((msg_type & 0x00E0) >> 1) | ((msg_type & 0x3E00) >> 2);

    if (msg_type_method > 0x3FF) {

        /* All values > 0xFF are "Reserved for DTLS-SRTP multiplexing collision

         * avoidance, see RFC 7983. Cannot be made available for assignment

         * without IETF Review."

         *

         * However, values of the first byte between 4 and 15 (corresponding with

         * methods from 0x100 to 0x3FF) are not included in the multiplexing

         * scheme and explicitly dropped in RFC 9443. Some of the higher values

         * (notably 0x201, 0x202) are used by WhatsApp's implementation of STUN.

         * (#20560). Since RFC 9443 recommends dropping the packet, and no

         * other protocol as of yet has these values, if the 4-byte cookie is

         * present that should be sufficient to call it STUN.

         *

         * If that is too generous, we could allow only the methods known to

         * be used by WhatsApp.

         */

    }

    /* Check if it is really a STUN message - reject messages without the

     * RFC 5389 Magic and let the classicstun dissector handle those.

     */

    if ( tvb_get_ntohl(tvb, offset + 4) != MESSAGE_COOKIE)

        return false;

    /* check if payload enough */

    if (reported_length < (msg_length + STUN_HDR_LEN + offset))

        return false;

    /* The message seems to be a valid STUN message! */

    return true;

}

static bool

test_stun_udp_heur(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)

{

    return test_stun(pinfo, tvb, offset, true, true);

}

static bool

test_stun_udp(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)

{

    return test_stun(pinfo, tvb, offset, false, true);

}

static unsigned

get_stun_message_len(packet_info *pinfo _U_, tvbuff_t *tvb,

                     int offset, void *data _U_)

{

    uint16_t type;

    unsigned   length;

    unsigned   captured_length = tvb_captured_length(tvb);

    if ((captured_length >= TCP_FRAME_COOKIE_LEN) &&

        (tvb_get_ntohl(tvb, 6) == MESSAGE_COOKIE)) {

        /*

         * The magic cookie is off by two, so this appears to be

         * RFC 4571 framing, as per RFC 6544; use the length

         * field from that framing, rather than the STUN/TURN

         * ChannelData length field.

         */

        return (tvb_get_ntohs(tvb, offset) + 2);

    }

    type   = tvb_get_ntohs(tvb, offset);

    length = tvb_get_ntohs(tvb, offset+2);

    if (type & 0xC000)

    {

        /* two first bits not NULL => should be a channel-data message */

        /* Note: For TCP the message is padded to a 4 byte boundary    */

        return (length + CHANNEL_DATA_HDR_LEN +3) & ~0x3;

    }

    else

    {

        /* Normal STUN message */

        return length + STUN_HDR_LEN;

    }

}

/*

 * XXX: why is this done in this file by the STUN dissector? Why don't we

 * re-use the packet-turnchannel.c's dissect_turnchannel_message() function?

 */

static int

dissect_stun_message_channel_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, uint16_t msg_type, unsigned msg_length)

{

    tvbuff_t *next_tvb;

    heur_dtbl_entry_t *hdtbl_entry;

    int offset = CHANNEL_DATA_HDR_LEN;

    /* XXX: a TURN ChannelData message is not actually a STUN message. */

    col_set_str(pinfo->cinfo, COL_PROTOCOL, "STUN");

    col_set_str(pinfo->cinfo, COL_INFO, "ChannelData TURN Message");

    if (tree) {

        proto_item *ti;

        proto_tree *stun_tree;

        ti = proto_tree_add_item(

            tree, proto_stun, tvb, 0,

            CHANNEL_DATA_HDR_LEN,

            ENC_NA);

        proto_item_append_text(ti, ", TURN ChannelData Message");

        stun_tree = proto_item_add_subtree(ti, ett_stun);

        proto_tree_add_item(stun_tree, hf_stun_channel, tvb, 0, 2, ENC_BIG_ENDIAN);

        proto_tree_add_item(stun_tree, hf_stun_length,  tvb, 2, 2, ENC_BIG_ENDIAN);

        /* MS-TURN Multiplexed TURN Channel */

        if (msg_type == MS_MULTIPLEX_TURN && msg_length >= 8) {

            proto_tree_add_item(stun_tree, hf_stun_att_ms_turn_session_id, tvb, 4, 8, ENC_BIG_ENDIAN);

        }

    }

    if (msg_type == MS_MULTIPLEX_TURN && msg_length >= 8) {

        msg_length -= 8;

        offset += 8;

    }

    next_tvb = tvb_new_subset_length(tvb, offset, msg_length);

    if (!dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree, &hdtbl_entry, NULL)) {

        call_dissector_only(data_handle, next_tvb, pinfo, tree, NULL);

    }

    return tvb_reported_length(tvb);

}

static int

dissect_stun_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, bool is_udp)

{

    unsigned    captured_length;

    uint16_t    msg_type;

    unsigned    msg_length;

    proto_item *ti, *ti_length;

    proto_tree *stun_tree;

    proto_tree *stun_type_tree;

    proto_tree *att_all_tree;

    proto_tree *att_type_tree;

    proto_tree *att_tree = NULL;

    uint16_t    msg_type_method;

    uint16_t    msg_type_class;

    const char *msg_class_str;

    const char *msg_method_str;

    uint16_t    att_type, att_type_display;

    uint16_t    att_length, att_length_pad, clear_port;

    uint32_t    clear_ip[4];

    address     addr;

    unsigned    i;

    unsigned    offset;

    unsigned    magic_cookie_first_word;

    unsigned    tcp_framing_offset;

    conversation_t     *conversation=NULL;

    stun_conv_info_t   *stun_info;

    stun_transaction_t *stun_trans;

    wmem_tree_key_t     transaction_id_key[2];

    uint32_t            transaction_id[3];

    heur_dtbl_entry_t  *hdtbl_entry;

    unsigned            reported_length;

    bool                is_turn = false;

    bool                found_turn_attributes = false;

    int                 network_version; /* STUN flavour of the current message */

    /*

     * Check if the frame is really meant for us.

     */

    /* First, make sure we have enough data to do the check. */

    captured_length = tvb_captured_length(tvb);

    if (captured_length < MIN_HDR_LEN)

        return 0;

    reported_length = tvb_reported_length(tvb);

    tcp_framing_offset = 0;

    if ((!is_udp) && (captured_length >= TCP_FRAME_COOKIE_LEN) &&

       (tvb_get_ntohl(tvb, 6) == MESSAGE_COOKIE)) {

        /*

         * The magic cookie is off by two, so this appears to be

         * RFC 4571 framing, as per RFC 6544; the STUN/TURN

         * ChannelData header begins after the 2-octet

         * RFC 4571 length field.

         */

        tcp_framing_offset = 2;

    }

    msg_type     = tvb_get_ntohs(tvb, tcp_framing_offset + 0);

    msg_length   = tvb_get_ntohs(tvb, tcp_framing_offset + 2);

    /* TURN ChannelData message ? */

    if (msg_type & 0xC000) {

        /* two first bits not NULL => should be a channel-data message */

        /*

         * This is not heuristic, so we allow TURN Channel messages. Note

         * RFC 9443 specifies that if it's not a known TURN server, then

         * the packet could be QUIC instead.

         */

        /* RFC 5764 defined a demultiplexing scheme to allow STUN to co-exist

         * on the same 5-tuple as DTLS-SRTP (and ZRTP) by rejecting previously

         * reserved channel numbers and method types, implicitly restricting

         * channel numbers to 0x4000-0x7FFF.  RFC 5766 did not incorporate this

         * restriction, instead indicating that reserved numbers MUST NOT be

         * dropped.

         * RFCs 7983, 8489, and 8656 reconciled this and formally indicated

         * that channel numbers in the reserved range MUST be dropped, while

         * further restricting the channel numbers to 0x4000-0x4FFF.

         * Reject the range 0x8000-0xFFFF, except for the special

         * MS-TURN multiplex channel number, since no implementation has

         * used any other value in that range (that we know of).

         */

        if (msg_type & 0x8000 && msg_type != MS_MULTIPLEX_TURN) {

            /* XXX: As this is not heuristic, if it is over UDP then

             * the range 0x8000-0xBFFF is quite likely to be RTP/RTCP,

             * and according to RFC 7983 should be forwarded to the RTP

             * dissector. However, similar to TURN ChannelData, the heuristics

             * for RTP are fairly weak and turned off by default over UDP.

             * It would be nice to be able to ensure that for this packet

             * the RTP over UDP heuristic dissector is called while still

             * rejecting the packet and removing STUN from the list of layers.

             */

            return 0;

        }

        /* "Over TCP and TLS-over-TCP, the ChannelData message MUST be padded to

         * a multiple of 4 bytes (not reflected in the length field)... Over UDP,

         * the padding is optional but MAY be included." - RFC 8656, 12.5

         */

        if (is_udp) {

            if (reported_length != msg_length + CHANNEL_DATA_HDR_LEN &&

                reported_length != ((msg_length + CHANNEL_DATA_HDR_LEN + 3) & ~0x3))

                return 0;

        } else { /* TCP */

            if (reported_length != ((msg_length + CHANNEL_DATA_HDR_LEN + 3) & ~0x3))

                return 0;

        }

        /* XXX: why don't we invoke the turnchannel dissector instead? */

        return dissect_stun_message_channel_data(tvb, pinfo, tree, msg_type, msg_length);

    }

    /* Normal STUN message */

    if (captured_length < STUN_HDR_LEN)

        return 0;

    msg_type_class = ((msg_type & 0x0010) >> 4) | ((msg_type & 0x0100) >> 7) ;

    msg_type_method = (msg_type & 0x000F) | ((msg_type & 0x00E0) >> 1) | ((msg_type & 0x3E00) >> 2);

    if (msg_type_method > 0x3FF) {

        /* All values > 0xFF are "Reserved for DTLS-SRTP multiplexing collision

         * avoidance, see RFC 7983. Cannot be made available for assignment

         * without IETF Review."

         *

         * However, values of the first byte between 4 and 15 (corresponding with

         * methods from 0x100 to 0x3FF) are not included in the multiplexing

         * scheme and explicitly dropped in RFC 9443. Some of the higher values

         * (notably 0x201, 0x202) are used by WhatsApp's implementation of STUN.

         * (#20560). Since RFC 9443 recommends dropping the packet, and no

         * other protocol as of yet has these values, if the 4-byte cookie is

         * present that should be sufficient to call it STUN.

         *

         * If that is too generous, we could allow only the methods known to

         * be used by WhatsApp.

         */

        return 0;

    }

    /* Check if it is really a STUN message - reject messages without the

     * RFC 5389 Magic and let the classicstun dissector handle those.

     */

    if ( tvb_get_ntohl(tvb, tcp_framing_offset + 4) != MESSAGE_COOKIE)

        return 0;

    /* check if payload enough */

    if (reported_length < (msg_length + STUN_HDR_LEN + tcp_framing_offset))

        return 0;