{"record":{"id":"1042d75667d26a89","repo":"slackhq/nebula","slug":"errinvalidremoteindex","errorCode":"ErrInvalidRemoteIndex","errorMessage":"peer sent an invalid index in handshake payload","messagePattern":"peer sent an invalid index in handshake payload","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"handshake/errors.go","lineNumber":16,"sourceCode":"package handshake\n\nimport \"errors\"\n\nvar (\n\tErrInitiateOnResponder     = errors.New(\"initiate called on responder\")\n\tErrInitiateAlreadyCalled   = errors.New(\"initiate already called\")\n\tErrInitiateNotCalled       = errors.New(\"initiate must be called before ProcessPacket for initiators\")\n\tErrPacketTooShort          = errors.New(\"packet too short\")\n\tErrPublicKeyMismatch       = errors.New(\"public key mismatch between certificate and handshake\")\n\tErrIncompleteHandshake     = errors.New(\"handshake completed without receiving required content\")\n\tErrMachineFailed           = errors.New(\"handshake machine has failed\")\n\tErrUnknownSubtype          = errors.New(\"unknown handshake subtype\")\n\tErrMissingContent          = errors.New(\"expected handshake content but message was empty\")\n\tErrUnexpectedContent       = errors.New(\"received unexpected handshake content\")\n\tErrInvalidRemoteIndex      = errors.New(\"peer sent an invalid index in handshake payload\")\n\tErrIndexAllocation         = errors.New(\"failed to allocate local index\")\n\tErrNoCredential            = errors.New(\"no handshake credential available for cert version\")\n\tErrAsymmetricCipherKeys    = errors.New(\"noise produced only one cipher key\")\n\tErrMultiMessageUnsupported = errors.New(\"multi-message handshake patterns are not yet supported by the manager\")\n\tErrSubtypeMismatch         = errors.New(\"packet subtype does not match handshake machine subtype\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/handshake/errors.go#L1-L23","documentation":"ErrInvalidRemoteIndex is returned by processPayload when the peer's handshake payload carries a remote index of 0, which is not a valid allocated index in this protocol. Index 0 is reserved/invalid, so receiving it indicates a malformed payload from the peer; the machine is marked failed and the result's RemoteIndex stays zero.","triggerScenarios":"processPayload parses the Payload and remoteIndex == 0 at handshake/machine.go:325; reproduced in machine_test.go:237 with Payload{InitiatorIndex: 0, Time: 1}.","commonSituations":"Peer failed to allocate an index before sending (its own allocator errored); uninitialized Payload struct marshaled without setting the index field; crafted/malformed packets from a non-peer host.","solutions":["Fix the peer so it allocates a nonzero local index before marshaling its payload","Ensure the peer's index allocator is initialized and healthy (check its logs for allocation errors)","Retry the handshake; if repeated, drop connections from that peer as potentially hostile"],"exampleFix":"// before\np := handshake.Payload{Time: now} // InitiatorIndex defaults to 0\n\n// after\nidx, err := indexMgr.Alloc()\nif err != nil { return err }\np := handshake.Payload{InitiatorIndex: idx, Time: now}","handlingStrategy":"validation","validationCode":"p := handshake.Payload{InitiatorIndex: myIndex, Time: now}\nif p.InitiatorIndex == 0 {\n    return errors.New(\"refusing to send payload with zero index\")\n}","typeGuard":"func validRemoteIndex(p handshake.Payload) bool {\n    return p.InitiatorIndex != 0\n}","tryCatchPattern":"res, err := m.ProcessPacket(out, pkt)\nif errors.Is(err, handshake.ErrInvalidRemoteIndex) {\n    // peer's allocator is broken or packet is hostile\n    conn.Close()\n    metrics.Inc(\"handshake_invalid_index\")\n    return\n}","preventionTips":["Always allocate a nonzero index before marshaling handshake payloads","Check allocator health before initiating handshakes","Drop repeated offenders: zero-index payloads indicate buggy or hostile peers"],"tags":["handshake","protocol","index"],"backgroundTag":"invalid-peer-index","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}