{"record":{"id":"1652b0ccef63107c","repo":"slackhq/nebula","slug":"invalid-handshake-message","errorCode":null,"errorMessage":"invalid handshake message","messagePattern":"invalid handshake message","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"handshake/payload.go","lineNumber":11,"sourceCode":"package handshake\n\nimport (\n\t\"errors\"\n\t\"math\"\n\n\t\"google.golang.org/protobuf/encoding/protowire\"\n)\n\nvar (\n\terrInvalidHandshakeMessage = errors.New(\"invalid handshake message\")\n\terrInvalidHandshakeDetails = errors.New(\"invalid handshake details\")\n)\n\n// Payload represents the decoded fields of a handshake message.\n// Wire format is protobuf-compatible with NebulaHandshake{Details: NebulaHandshakeDetails{...}}.\ntype Payload struct {\n\tCert           []byte\n\tInitiatorIndex uint32\n\tResponderIndex uint32\n\tTime           uint64\n\tCertVersion    uint32\n}\n\n// Proto field numbers for NebulaHandshakeDetails\nconst (\n\tfieldCert           = 1 // bytes\n\tfieldInitiatorIndex = 2 // uint32\n\tfieldResponderIndex = 3 // uint32","sourceCodeStart":1,"sourceCodeEnd":29,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/handshake/payload.go#L1-L29","documentation":"errInvalidHandshakeMessage is returned by UnmarshalPayload when the handshake bytes are not a well-formed protobuf wire message — specifically when protowire.ConsumeTag fails (n < 0), meaning the buffer is corrupt, truncated, or not protobuf-encoded at the field-tag level.","triggerScenarios":"Passing truncated, corrupted, or non-protobuf bytes to UnmarshalPayload; a peer speaking a different/incompatible wire format; bit flips or MTU fragmentation mangling the handshake datagram.","commonSituations":"Version skew where one peer sends the legacy Nebula struct-encoded handshake and the other expects protobuf-compatible encoding; packets corrupted in transit; tests feeding random bytes.","solutions":["Verify both peers use the same handshake wire format version (protobuf-compatible NebulaHandshake)","Check for network corruption or fragmentation issues (MTU/UDP path) between the peers","Capture the packet and validate it decodes as NebulaHandshake{Details: NebulaHandshakeDetails}"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if len(b) == 0 {\n    return fmt.Errorf(\"empty handshake payload\")\n}","typeGuard":null,"tryCatchPattern":"p, err := UnmarshalPayload(b)\nif errors.Is(err, errInvalidHandshakeMessage) {\n    // drop malformed packet / count as parse failure\n    return nil, err\n}","preventionTips":["Keep handshake wire-format versions in sync across peers","Validate packets before unmarshaling (length, version byte)","Monitor parse-failure rates to detect corruption or hostile traffic"],"tags":["handshake","protobuf","wire-format"],"backgroundTag":"malformed-packet","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}