{"record":{"id":"27449f6555e673fe","repo":"slackhq/nebula","slug":"erripv4invalidheaderlength","errorCode":"ErrIPv4InvalidHeaderLength","errorMessage":"invalid ipv4 header length","messagePattern":"invalid ipv4 header length","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"outside.go","lineNumber":313,"sourceCode":"\t\t\t}\n\t\t\treturn\n\t\t}\n\n\t\thostinfo.logger(f.l).Info(\"Host roamed to new udp ip/port.\",\n\t\t\t\"udpAddr\", curRemote,\n\t\t\t\"newAddr\", via.UdpAddr,\n\t\t)\n\t\thostinfo.lastRoam = time.Now()\n\t\thostinfo.lastRoamRemote = curRemote\n\t\thostinfo.SetRemote(via.UdpAddr)\n\t}\n\n}\n\nvar (\n\tErrPacketTooShort          = errors.New(\"packet is too short\")\n\tErrUnknownIPVersion        = errors.New(\"packet is an unknown ip version\")\n\tErrIPv4InvalidHeaderLength = errors.New(\"invalid ipv4 header length\")\n\tErrIPv4PacketTooShort      = errors.New(\"ipv4 packet is too short\")\n\tErrIPv6PacketTooShort      = errors.New(\"ipv6 packet is too short\")\n)\n\n// newPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers\nfunc newPacket(data []byte, incoming bool, fp *firewall.ParsedPacket) error {\n\t// fp is reused across packets; reset the parse byproducts so an early-error return cannot\n\t// leak the previous packet's offsets.\n\tfp.IPHdrLen = 0\n\tfp.FragAny = false\n\tif len(data) < 1 {\n\t\treturn ErrPacketTooShort\n\t}\n\n\tversion := int((data[0] >> 4) & 0x0f)\n\tswitch version {\n\tcase ipv4.Version:\n\t\treturn parseV4(data, incoming, fp)","sourceCodeStart":295,"sourceCodeEnd":331,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/outside.go#L295-L331","documentation":"parseV4 validates that the IPv4 header's IHL field yields a header length of at least ipv4.HeaderLen (20 bytes) and that the packet actually contains that many bytes. A header claiming less than the minimum, or a packet too short to contain it, is rejected with this error.","triggerScenarios":"An IPv4 packet (version nibble 4) whose IHL < 20 bytes (outside.go:420) or whose total length is less than the declared/minimum header length (outside.go:445), triggered from newPacket.","commonSituations":"Corrupted packets from lossy links, packets truncated by MTU/fragmentation mishandling, malformed packets from scanners or buggy tunnel software.","solutions":["Drop-and-log is the correct behavior; investigate the traffic source if it recurs.","Check underlay MTU so packets are not truncated in transit.","Inspect captured packets for corruption between sender and receiver."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(data) < 20 {\n    return errors.New(\"ipv4 packet below header length\")\n}\nihl := int(data[0]&0x0f) * 4\nif ihl < 20 || len(data) < ihl {\n    return errors.New(\"invalid ipv4 IHL\")\n}","typeGuard":null,"tryCatchPattern":"if errors.Is(err, outside.ErrIPv4InvalidHeaderLength) {\n    // drop malformed packet; log source\n}","preventionTips":["Check underlay MTU to prevent truncation.","Monitor for repeated malformed-packet sources.","Verify sending stacks produce IHL >= 5."],"tags":["ipv4","packet-parsing","malformed-packet"],"backgroundTag":"invalid-ip-header","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}