unetd, branch master

network: keep in-memory network data when reloading from disk fails

2026-07-22T10:49:26Z

network_load_dynamic() read the saved file directly into the live net_data buffer and zeroed net_data_len on any failure, while net_data_version survived. A missing or corrupt file at reload time therefore destroyed the validated copy still held in memory and took the network down, and the stale version made the update response handler discard any re-fetched data of the same version, leaving the node broken until a restart or a version bump. Read the file into a separate buffer instead and use whichever copy of the data is valid and newer. When the in-memory copy wins, write it back to disk to restore the missing or stale file. The auth data validation requires the payload to be NUL-terminated, so the JSON in a validated in-memory blob is safe to parse directly. Signed-off-by: Felix Fietkau

network: cap dynamic data size when loading from disk

2026-07-22T10:49:26Z

Network data received via PEX is limited to UNETD_NET_DATA_SIZE_MAX, but network_load_dynamic() allocated and read whatever size the saved file had. A corrupt or foreign .bin file thus caused an unbounded allocation before validation could reject it. Apply the same limit as the receive path. Signed-off-by: Felix Fietkau

enroll: make the attribute table static

2026-07-22T10:49:26Z

The parsed attribute table was defined as a non-static global named tb, exposing a generic symbol that silently aliases with any other global of the same name in another compilation unit. Signed-off-by: Felix Fietkau

vxlan: handle missing local host in tunnel setup

2026-07-22T10:49:26Z

vxlan_tunnel_init() dereferenced net_config.local_host to read the local tunnel address, crashing when a vxlan service exists on a network the local node is not a member of, e.g. while it has not been enrolled yet. Skip the tunnel setup without a local host and gate the service reuse path on an established tunnel, so the creation is retried on the reload that adds the local host instead of being skipped as an unchanged service. Signed-off-by: Felix Fietkau

enroll: verify the confirmation hash in client accept messages

2026-07-22T10:49:26Z

The client accept message carries a hash over the auth key received in the server confirm and the server session key, but the server marked the peer as confirmed without ever checking it. Validate the hash so a peer is only reported as confirmed when it actually holds the correct network auth key. Signed-off-by: Felix Fietkau

enroll: do not update peer state from unauthenticated messages

2026-07-22T10:49:26Z

Client discovery messages carry no HMAC and a zero nonce, but looking up an existing peer for one still overwrote the stored address and reset the recorded nonce to zero. A spoofed discovery containing a known session public key could redirect the peer address and disable replay detection. Update address and nonce only for messages with verified key data. Signed-off-by: Felix Fietkau

enroll: apply replay protection to accept and confirm messages

2026-07-22T10:49:26Z

The accept and confirm handlers passed a NULL key_data to enroll_get_peer(), which skips the nonce replay check for these messages even though their HMAC and nonce were already verified. A replayed message was not only accepted, it also rewound the recorded peer nonce, reopening the replay window for messages that do get checked. Signed-off-by: Felix Fietkau

pex: do not send peer messages without an open local PEX socket

2026-07-22T10:49:26Z

network_pex_recv_update_response() notifies connected peers via the local PEX socket, but can be invoked through the global socket while the local socket is closed (no local pex_port). In that case pex_msg_send() passed fd -1 to __pex_msg_send(), which treats a negative fd as the extended-header global path: it subtracts the extended header size from a header that has none and emits the mangled packet on the global socket. Signed-off-by: Felix Fietkau

pex-msg: fix response data leak on failed continuation init

2026-07-22T10:49:26Z

When __pex_msg_init_ext() fails in pex_msg_update_response_continue(), the caller stops sending and the remaining response buffer was never freed. Signed-off-by: Felix Fietkau

pex-msg: do not drop packets when unix socket forwarding fails

2026-07-22T10:49:26Z

A transient sendmsg error (EAGAIN, ENOBUFS, EMSGSIZE) on the unix forwarding socket skipped local processing of the received packet as well. A congested or stalled consumer on the unix socket would cause incoming global PEX messages to be dropped entirely. Only skip the forwarding, local processing is independent of it. Signed-off-by: Felix Fietkau