Pivot
20 of 20 entries
| ID | Risk | Title | CVSS | CWE |
|---|---|---|---|---|
PIVOT-001 |
INFO |
Relay Established Successfully
A pivot relay session was established between pivot-client and pivot-agent. Authentication, TLS handshake, and network p...
|
— | — |
PIVOT-002 |
INFO |
Authentication Failed — Invalid HMAC Token
The AUTH message sent by a connecting client contained an HMAC-SHA256 digest that did not match the expected value for t...
|
— | — |
PIVOT-003 |
INFO |
Replay Attack Detected — Nonce Already Used
An AUTH message was received with a nonce that has been used in a previous authentication attempt within the current ses...
|
— | — |
PIVOT-004 |
INFO |
TLS Handshake Failed
The TLS handshake between pivot-client and pivot-agent failed. Possible causes: certificate not trusted by the client's ...
|
— | — |
PIVOT-005 |
INFO |
Unauthorised Connection Attempt — IP Not in Allowlist
A connection was received from a source IP that is not present in security.allowed_peers. The connection was rejected af...
|
— | — |
PIVOT-006 |
INFO |
iptables Rule Applied Successfully
iptables FORWARD and MASQUERADE rules were successfully installed on the relay device for a network profile. IP forwardi...
|
— | — |
PIVOT-007 |
INFO |
iptables Rule Cleanup Completed
All iptables rules installed for a relay session were removed successfully. ip_forward was reset to its pre-session valu...
|
— | — |
PIVOT-008 |
INFO |
Relay Chain Established
A multi-hop relay chain was successfully established. The current agent spawned an internal chain_connector (pivot-clien...
|
— | — |
PIVOT-009 |
INFO |
Connection to Upstream Relay Failed
A chained relay attempted to connect to its configured upstream relay (pivot-agent at upstream.host) but failed. The cha...
|
— | — |
PIVOT-010 |
INFO |
Certificate Validation Failed — Agent Certificate Not Trusted
The pivot-client rejected the agent's TLS certificate because it could not be validated against the configured CA bundle...
|
— | — |
PIVOT-011 |
INFO |
mTLS Client Certificate Required
The agent is configured with require_client_cert: true (mutual TLS). Clients must present a valid certificate signed by ...
|
— | — |
PIVOT-012 |
INFO |
HMAC Verification Failed — Token Mismatch
The HMAC-SHA256 digest computed from the client's nonce and the stored shared secret did not match the digest provided i...
|
— | — |
PIVOT-013 |
INFO |
iptables Rule Application Failed
The agent could not install required iptables FORWARD or MASQUERADE rules. This prevents traffic forwarding to the targe...
|
— | — |
PIVOT-014 |
INFO |
Route Installation Failed on Scanner
pivot-client failed to install the OS route for the target CIDR on the scanner machine. The scanner cannot reach the tar...
|
— | — |
PIVOT-015 |
INFO |
Session Expired — Heartbeat Timeout
The relay session was closed because no HEARTBEAT message was received from the client within the configured heartbeat_t...
|
— | — |
PIVOT-016 |
INFO |
Maximum Concurrent Sessions Reached
A new connection was rejected because the agent has reached session.max_sessions. No additional relay clients can connec...
|
— | — |
PIVOT-017 |
INFO |
Protocol Message Too Large
A received message exceeded the maximum permitted payload size (1 MB). The connection was closed. This may indicate a ma...
|
— | — |
PIVOT-018 |
INFO |
Malformed Protocol Message Received
A message was received that could not be parsed as valid JSON, was missing the required 'type' field, or had a zero-leng...
|
— | — |
PIVOT-019 |
INFO |
sysctl ip_forward Activation Failed
The agent could not set net.ipv4.ip_forward=1 via sysctl. Without IP forwarding enabled, traffic cannot be relayed betwe...
|
— | — |
PIVOT-020 |
INFO |
Clean Session Deactivation Completed
The pivot-client sent a DEACTIVATE message and the agent responded with DEACTIVATE_RESPONSE. iptables rules, kernel rout...
|
— | — |
Detailed View
INFO PIVOT-001 — Relay Established Successfully
Description: A pivot relay session was established between pivot-client and pivot-agent. Authentication, TLS handshake, and network profile activation all succeeded. Scanner traffic can now reach the target CIDR.
INFO PIVOT-002 — Authentication Failed — Invalid HMAC Token
Description: The AUTH message sent by a connecting client contained an HMAC-SHA256 digest that did not match the expected value for the provided nonce and shared secret. The connection was rejected.
INFO PIVOT-003 — Replay Attack Detected — Nonce Already Used
Description: An AUTH message was received with a nonce that has been used in a previous authentication attempt within the current session. This is indicative of a replay attack — a captured AUTH message being retransmitted.
INFO PIVOT-004 — TLS Handshake Failed
Description: The TLS handshake between pivot-client and pivot-agent failed. Possible causes: certificate not trusted by the client's CA bundle, CN/SAN mismatch, expired certificate, or unsupported TLS version.
INFO PIVOT-005 — Unauthorised Connection Attempt — IP Not in Allowlist
Description: A connection was received from a source IP that is not present in security.allowed_peers. The connection was rejected after TLS handshake but before authentication, minimising information leakage.
INFO PIVOT-006 — iptables Rule Applied Successfully
Description: iptables FORWARD and MASQUERADE rules were successfully installed on the relay device for a network profile. IP forwarding is active. Scanner traffic will be NATted to the relay's LAN IP.
INFO PIVOT-007 — iptables Rule Cleanup Completed
Description: All iptables rules installed for a relay session were removed successfully. ip_forward was reset to its pre-session value if no other sessions are active. Relay state is fully clean.
INFO PIVOT-008 — Relay Chain Established
Description: A multi-hop relay chain was successfully established. The current agent spawned an internal chain_connector (pivot-client) to a downstream relay and received network profile activation confirmation. All intermediate routes are active.
INFO PIVOT-009 — Connection to Upstream Relay Failed
Description: A chained relay attempted to connect to its configured upstream relay (pivot-agent at upstream.host) but failed. The chain is broken and the target network is unreachable.
INFO PIVOT-010 — Certificate Validation Failed — Agent Certificate Not Trusted
Description: The pivot-client rejected the agent's TLS certificate because it could not be validated against the configured CA bundle. This may indicate a certificate mismatch or a potential MitM attack.
INFO PIVOT-011 — mTLS Client Certificate Required
Description: The agent is configured with require_client_cert: true (mutual TLS). Clients must present a valid certificate signed by the agent's CA in addition to HMAC token authentication.
INFO PIVOT-012 — HMAC Verification Failed — Token Mismatch
Description: The HMAC-SHA256 digest computed from the client's nonce and the stored shared secret did not match the digest provided in the AUTH message. Authentication was denied. Constant-time comparison was used to prevent timing oracle attacks.
INFO PIVOT-013 — iptables Rule Application Failed
Description: The agent could not install required iptables FORWARD or MASQUERADE rules. This prevents traffic forwarding to the target network. The relay session is non-functional.
INFO PIVOT-014 — Route Installation Failed on Scanner
Description: pivot-client failed to install the OS route for the target CIDR on the scanner machine. The scanner cannot reach the target network even though the relay session is active.
INFO PIVOT-015 — Session Expired — Heartbeat Timeout
Description: The relay session was closed because no HEARTBEAT message was received from the client within the configured heartbeat_timeout period. The client may have crashed or the network path was interrupted.
INFO PIVOT-016 — Maximum Concurrent Sessions Reached
Description: A new connection was rejected because the agent has reached session.max_sessions. No additional relay clients can connect until an existing session is released.
INFO PIVOT-017 — Protocol Message Too Large
Description: A received message exceeded the maximum permitted payload size (1 MB). The connection was closed. This may indicate a malformed client, a bug, or a potential memory exhaustion attempt.
INFO PIVOT-018 — Malformed Protocol Message Received
Description: A message was received that could not be parsed as valid JSON, was missing the required 'type' field, or had a zero-length payload. The connection was closed.
INFO PIVOT-019 — sysctl ip_forward Activation Failed
Description: The agent could not set net.ipv4.ip_forward=1 via sysctl. Without IP forwarding enabled, traffic cannot be relayed between the VPN and LAN interfaces.
INFO PIVOT-020 — Clean Session Deactivation Completed
Description: The pivot-client sent a DEACTIVATE message and the agent responded with DEACTIVATE_RESPONSE. iptables rules, kernel routes, and ip_forward were all cleaned up. Session state is fully removed.