sprintf(ip_tmp, "%s:%u", ...) in the REGISTER_SUPER_ACK decoder can
overflow the 48-byte ip_tmp stack buffer when formatting an IPv6
address (up to 45 chars) with a port number, producing up to 52 bytes.
Replace sprintf with snprintf(ip_tmp, sizeof(ip_tmp), ...) so the
output is truncated to the buffer size.
* header_encryption: require a full common header before decrypting
packet_header_decrypt() takes header_len from the decrypted magic and
only checked header_len <= packet_len. For a packet of another
community (or a made-up one) the value is arbitrary; below 16 the
header_len - 16 argument to speck_ctr() wraps to a huge size_t and the
decryption reads and writes far past packet[]. One crafted UDP datagram
(or ~1 in 2^28 random ones per key) crashes any edge or supernode that
attempts header decryption; a supernode tries its federation key on
every non-plain header. Require at least the 24-byte common header, as
the encrypt side already does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* transform_cc20: decrypt only the ciphertext, not the IV length extra
transop_decode_cc20() passed in_len (iv + ciphertext) as the length of
the ciphertext that follows the iv, so cc20_crypt() read 16 bytes past
the input and wrote 16 past the output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Replace lzo1x_decompress() with lzo1x_decompress_safe() in
transop_decode_lzo(). The unsafe variant does not enforce the output
buffer size limit, allowing a crafted compressed payload to overflow
the N2N_PKT_BUF_SIZE (2048 byte) stack buffer in handle_PACKET().
The safe variant (already bundled in src/minilzo.c) validates output
bounds during decompression, preventing the overflow.
The post-decompression size check was ineffective because the overflow
had already occurred before the check executed.
CAN-2026-2035137
Co-authored-by: Akhil Koul <akkoul@amazon.com>
* supernode: allow -t 0 to disable the management port
* supernode: skip mgmt-socket fd_set/fd_isset when disabled
* edge: allow -t 0 to disable the management port
* edge: skip mgmt-socket fd_set/fd_isset when disabled
* docs: document -t 0 to disable the management port
decode_buf() verifies that the source packet still holds the requested
number of bytes, but not that the requested length fits the destination
buffer. The REGISTER_SUPER / UNREGISTER_SUPER / REGISTER_SUPER_ACK /
REGISTER_SUPER_NAK decoders read auth.token_size (a 16-bit field) and
num_sn (an 8-bit count) directly from the wire and pass them to
decode_buf() targeting fixed-size destinations: auth.token is
N2N_AUTH_MAX_TOKEN_SIZE (48) bytes, and the REGISTER_SUPER_ACK backup
list is bounded by REG_SUPER_ACK_PAYLOAD_SPACE.
A length field larger than its destination therefore lets a malformed
packet write past the end of the buffer. Validate token_size against
N2N_AUTH_MAX_TOKEN_SIZE and num_sn against REG_SUPER_ACK_PAYLOAD_SPACE
before calling decode_buf(), returning a decode error otherwise. A
conforming peer never sends a larger value, so well-formed traffic is
unaffected.
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
When building on win32 systems, simply add the win32 specific functions
to the libn2n.a, which simplifies the commands needed.
By moving the win32 source code into the src directory, the source code
is better consolidated.
Not all struct sockaddr are going to have the sa_family as their first field.
Since there is a named structure member, we can simply use that and let
the compiler sort it out.
This fixes a bug with at least FreeBSD and allows us to remove the
special case for Apple.
As suggested in a PR from @Legend-Master (this change is basically
unrelated to the main point of his PR, so extracted here)
Windows is a confusing and disappointing development environment. They
completely replaced all the definitions in winsock.h with exact
equivalents in winsock2.h (except for a small number of deprecated
functions).
However they didnt make them mutually exclusive - so if you include
both, you get errors. They also automatically include winsock.h from
windows.h, so you must remember to include winsock2.h first. They also
didnt just remove winsock.h and replace it with the new contents.
(Probably in the name of "compatibility", whilst swearing that the new
winsock is the same as the old one - because if you cannot believe two
inconsistent things simultaneously, you shouldnt be a windows
programmer)
All these things are totally nuts. Thanks, windows dev environment,
for not noticing that this is nuts
There is still cleanup work to be done in the headers, but this
concludes the major include-what-you-use refactoring. No functional
change is intended or expected and all tests are passing.
It is now a lot easier to see what is used from each header and work on
possible refactoring in the future.
The include-what-you-use tool is awkward to use with the current state
of the build system - and will always be difficult to use in a
multi-platform safe way. However, I hope to provide a non manual
process for running with the tool in the future.
* Add close window support for Windows
* Support logoff and shudown events as well
Without this change, when you close the terminal/shell window, it won't have the time to clean up which can cause authentication errors if you try to reconnect.
Blocking here infinitely is fine since when our main thread returns, it will shut down anyway
I found Go is doing this when I was searching, and there's a comment explained how it works: https://github.com/golang/go/issues/41884#issuecomment-706695923
Tristan