dd056e006c
## Summary
- ipv6rwc: validate IPv6 packet length before reading the version nibble
in writePC
- config: guard the BOM check against configs shorter than two bytes
- admin: replace unchecked net.Error type assertion with errors.As;
tolerate empty unix socket paths
- multicast: log and continue on ReadFrom errors instead of panicking;
use checked type assertion on UDPAddr
- mobile: reject negative length in SendBuffer; nil-check AddrForKey in
GetPeersJSON and SummaryForConfig
- admin/get{tree,paths,sessions}: skip entries when AddrForKey returns
nil instead of dereferencing
- core/nodeinfo: validate the requested public key length in
nodeInfoAdminHandler, matching the other proto handlers
- add regression tests for the panic paths
## Why
A handful of error paths and platform-API edge cases reach fixed-size
indexing or unchecked type assertions before any length validation.
Most are reachable only locally (an empty config piped to -useconf,
a 0-byte packet from the mobile bindings, an admin DialTimeout error
that doesn't satisfy net.Error on some platforms), but they crash the
daemon hard. Have them return errors or skip the entry instead.
## Testing
- go test ./...
- go vet ./...
Yggdrasil
Introduction
Yggdrasil is an early-stage implementation of a fully end-to-end encrypted IPv6 network. It is lightweight, self-arranging, supported on multiple platforms and allows pretty much any IPv6-capable application to communicate securely with other Yggdrasil nodes. Yggdrasil does not require you to have IPv6 Internet connectivity - it also works over IPv4.
Supported Platforms
Yggdrasil works on a number of platforms, including Linux, macOS, Ubiquiti EdgeRouter, VyOS, Windows, FreeBSD, OpenBSD and OpenWrt.
Please see our Installation
page for more information. You may also find other platform-specific wrappers, scripts
or tools in the contrib folder.
Building
If you want to build from source, as opposed to installing one of the pre-built packages:
- Install Go (requires Go 1.22 or later)
- Clone this repository
- Run
./build
Note that you can cross-compile for other platforms and architectures by
specifying the GOOS and GOARCH environment variables, e.g. GOOS=windows ./build or GOOS=linux GOARCH=mipsle ./build.
Running
Generate configuration
To generate static configuration, either generate a HJSON file (human-friendly, complete with comments):
./yggdrasil -genconf > /path/to/yggdrasil.conf
... or generate a plain JSON file (which is easy to manipulate programmatically):
./yggdrasil -genconf -json > /path/to/yggdrasil.conf
You will need to edit the yggdrasil.conf file to add or remove peers, modify
other configuration such as listen addresses or multicast addresses, etc.
Run Yggdrasil
To run with the generated static configuration:
./yggdrasil -useconffile /path/to/yggdrasil.conf
To run in auto-configuration mode (which will use sane defaults and random keys at each startup, instead of using a static configuration file):
./yggdrasil -autoconf
You will likely need to run Yggdrasil as a privileged user or under sudo,
unless you have permission to create TUN/TAP adapters. On Linux this can be done
by giving the Yggdrasil binary the CAP_NET_ADMIN capability.
Documentation
Documentation is available on our website.
Communities
A number of IRC communities exist, including the #yggdrasil IRC channel on libera.chat and various others on Yggdrasil-internal IRC networks.
License
This code is released under the terms of the LGPLv3, but with an added exception that was shamelessly taken from godeb. Under certain circumstances, this exception permits distribution of binaries that are (statically or dynamically) linked with this code, without requiring the distribution of Minimal Corresponding Source or Minimal Application Code. For more details, see: LICENSE.