sprintf(ip_tmp, "%s:%u", ...) in the REGISTER_SUPER_ACK decoder can
overflow the 48-byte ip_tmp stack buffer when formatting an IPv6
address (up to 45 chars) with a port number, producing up to 52 bytes.
Replace sprintf with snprintf(ip_tmp, sizeof(ip_tmp), ...) so the
output is truncated to the buffer size.
* header_encryption: require a full common header before decrypting
packet_header_decrypt() takes header_len from the decrypted magic and
only checked header_len <= packet_len. For a packet of another
community (or a made-up one) the value is arbitrary; below 16 the
header_len - 16 argument to speck_ctr() wraps to a huge size_t and the
decryption reads and writes far past packet[]. One crafted UDP datagram
(or ~1 in 2^28 random ones per key) crashes any edge or supernode that
attempts header decryption; a supernode tries its federation key on
every non-plain header. Require at least the 24-byte common header, as
the encrypt side already does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* transform_cc20: decrypt only the ciphertext, not the IV length extra
transop_decode_cc20() passed in_len (iv + ciphertext) as the length of
the ciphertext that follows the iv, so cc20_crypt() read 16 bytes past
the input and wrote 16 past the output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Replace lzo1x_decompress() with lzo1x_decompress_safe() in
transop_decode_lzo(). The unsafe variant does not enforce the output
buffer size limit, allowing a crafted compressed payload to overflow
the N2N_PKT_BUF_SIZE (2048 byte) stack buffer in handle_PACKET().
The safe variant (already bundled in src/minilzo.c) validates output
bounds during decompression, preventing the overflow.
The post-decompression size check was ineffective because the overflow
had already occurred before the check executed.
CAN-2026-2035137
Co-authored-by: Akhil Koul <akkoul@amazon.com>
* supernode: allow -t 0 to disable the management port
* supernode: skip mgmt-socket fd_set/fd_isset when disabled
* edge: allow -t 0 to disable the management port
* edge: skip mgmt-socket fd_set/fd_isset when disabled
* docs: document -t 0 to disable the management port
decode_buf() verifies that the source packet still holds the requested
number of bytes, but not that the requested length fits the destination
buffer. The REGISTER_SUPER / UNREGISTER_SUPER / REGISTER_SUPER_ACK /
REGISTER_SUPER_NAK decoders read auth.token_size (a 16-bit field) and
num_sn (an 8-bit count) directly from the wire and pass them to
decode_buf() targeting fixed-size destinations: auth.token is
N2N_AUTH_MAX_TOKEN_SIZE (48) bytes, and the REGISTER_SUPER_ACK backup
list is bounded by REG_SUPER_ACK_PAYLOAD_SPACE.
A length field larger than its destination therefore lets a malformed
packet write past the end of the buffer. Validate token_size against
N2N_AUTH_MAX_TOKEN_SIZE and num_sn against REG_SUPER_ACK_PAYLOAD_SPACE
before calling decode_buf(), returning a decode error otherwise. A
conforming peer never sends a larger value, so well-formed traffic is
unaffected.
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Continuing to try and simplify the build system, calculate the remaining
two autoconf variables from the existing config.mak.
For the moment, leave a configure and configure.ac file in place to
allow any old build systems to continue to function without errors.
By switching to the "any" architecture, we no longer need to template
the debian/control file. This simply claims that the package can be
built on any known debian arch - which we currently think is true - so
it will help future portability.
This may impact builds on Debian 8, but that version has been out of
support for over three years. I didnt test it, but since using this
helper is the preferred method it may actually help builds on older
versions.
When building on win32 systems, simply add the win32 specific functions
to the libn2n.a, which simplifies the commands needed.
By moving the win32 source code into the src directory, the source code
is better consolidated.
If there is a way to turn off the mingw insistence that it will rewrite
the filename it was given in the "-o" options, I have not been able to
find it. I could easily handle all the moves or renames at the end of
the build process if I could turn off this feature. Especially since it
means that make often thinks that the file has not been built (the
filename that make knows about is not the file that actually gets built
by the mingw gcc, so the if-newer tests that make applies will always
fail)
It looks to me that the correct way to address this build wrinkle is
simply to add the win32 functions to the libn2n when building a win32
output, then there is no additional magic library juggling required for
the win32 case
Tristan