{"record":{"id":"aee946d85d282f28","repo":"slackhq/nebula","slug":"invalid-handshake-details","errorCode":null,"errorMessage":"invalid handshake details","messagePattern":"invalid handshake details","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"handshake/payload.go","lineNumber":12,"sourceCode":"package handshake\n\nimport (\n\t\"errors\"\n\t\"math\"\n\n\t\"google.golang.org/protobuf/encoding/protowire\"\n)\n\nvar (\n\terrInvalidHandshakeMessage = errors.New(\"invalid handshake message\")\n\terrInvalidHandshakeDetails = errors.New(\"invalid handshake details\")\n)\n\n// Payload represents the decoded fields of a handshake message.\n// Wire format is protobuf-compatible with NebulaHandshake{Details: NebulaHandshakeDetails{...}}.\ntype Payload struct {\n\tCert           []byte\n\tInitiatorIndex uint32\n\tResponderIndex uint32\n\tTime           uint64\n\tCertVersion    uint32\n}\n\n// Proto field numbers for NebulaHandshakeDetails\nconst (\n\tfieldCert           = 1 // bytes\n\tfieldInitiatorIndex = 2 // uint32\n\tfieldResponderIndex = 3 // uint32\n\tfieldTime           = 5 // uint64","sourceCodeStart":1,"sourceCodeEnd":30,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/handshake/payload.go#L1-L30","documentation":"errInvalidHandshakeDetails is returned by unmarshalPayloadDetails when the details sub-message inside a handshake payload is malformed: either protowire.ConsumeTag fails, or a field (e.g. fieldCert) has the wrong wire type (not BytesType). The outer tag parsed but the nested details did not.","triggerScenarios":"A handshake payload whose Details sub-message is truncated or whose fields use wrong wire types — e.g. fieldCert encoded as varint instead of bytes — passed through UnmarshalPayload.","commonSituations":"Hand-crafted or fuzzed handshake packets; a peer with a different schema version encoding fields differently; corruption localized to the details sub-message.","solutions":["Confirm both peers encode handshake details with the same schema and field numbering","Ensure the certificate field is serialized as a length-delimited (bytes) protobuf field","Regenerate or update the peer software if it is emitting a nonstandard details payload"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if len(b) == 0 {\n    return fmt.Errorf(\"empty handshake details\")\n}","typeGuard":null,"tryCatchPattern":"err := unmarshalPayloadDetails(details, &p)\nif errors.Is(err, errInvalidHandshakeDetails) {\n    // reject packet with invalid details sub-message\n    return err\n}","preventionTips":["Serialize cert fields as length-delimited protobuf bytes","Pin the details schema/field numbers shared by all peers","Fuzz-test the details decoder against malformed input"],"tags":["handshake","protobuf","wire-format"],"backgroundTag":"malformed-packet","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}