{"record":{"id":"1f68ef2f7829dfc0","repo":"tailscale/tailscale","slug":"stun-request-had-bogus-fingerprint","errorCode":null,"errorMessage":"STUN request had bogus fingerprint","messagePattern":"STUN request had bogus fingerprint","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"net/stun/stun.go","lineNumber":131,"sourceCode":"\t}\n\tif lastAttr != attrNumFingerprint {\n\t\treturn TxID{}, ErrNoFingerprint\n\t}\n\twantFP := fingerPrint(b[:len(b)-lenFingerprint])\n\tif gotFP != wantFP {\n\t\treturn TxID{}, ErrWrongFingerprint\n\t}\n\treturn txID, nil\n}\n\nvar (\n\tErrNotSTUN            = errors.New(\"response is not a STUN packet\")\n\tErrNotSuccessResponse = errors.New(\"STUN packet is not a response\")\n\tErrMalformedAttrs     = errors.New(\"STUN response has malformed attributes\")\n\tErrNotBindingRequest  = errors.New(\"STUN request not a binding request\")\n\tErrWrongSoftware      = errors.New(\"STUN request came from non-Tailscale software\")\n\tErrNoFingerprint      = errors.New(\"STUN request didn't end in fingerprint\")\n\tErrWrongFingerprint   = errors.New(\"STUN request had bogus fingerprint\")\n)\n\nfunc foreachAttr(b []byte, fn func(attrType uint16, a []byte) error) error {\n\tfor len(b) > 0 {\n\t\tif len(b) < 4 {\n\t\t\treturn ErrMalformedAttrs\n\t\t}\n\t\tattrType := binary.BigEndian.Uint16(b[:2])\n\t\tattrLen := int(binary.BigEndian.Uint16(b[2:4]))\n\t\tattrLenWithPad := (attrLen + 3) &^ 3\n\t\tb = b[4:]\n\t\tif attrLenWithPad > len(b) {\n\t\t\treturn ErrMalformedAttrs\n\t\t}\n\t\tif err := fn(attrType, b[:attrLen]); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tb = b[attrLenWithPad:]","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/net/stun/stun.go#L113-L149","documentation":"ErrWrongFingerprint is a sentinel from ParseBindingRequest. It fires when the CRC32 fingerprint attribute at the end of the request does not match the fingerprint computed over the preceding bytes, indicating corruption or a non-conforming client.","triggerScenarios":"Thrown at net/stun/stun.go:131 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Drop the request","Investigate packet corruption on the path if it recurs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}