{"record":{"id":"60c8b99dec7898d1","repo":"cloudflare/cloudflared","slug":"failed-to-parse-icmpv6","errorCode":null,"errorMessage":"failed to parse ICMPv6","messagePattern":"failed to parse ICMPv6","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packet/decoder.go","lineNumber":171,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tmsg, err := icmp.ParseMessage(int(layers.IPProtocolICMPv4), append(pd.icmpv4.Contents, pd.icmpv4.Payload...))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, errors.Wrap(err, \"failed to parse ICMPv4 message\")\n\t\t\t}\n\t\t\treturn &ICMP{\n\t\t\t\tIP:      ipv4,\n\t\t\t\tMessage: msg,\n\t\t\t}, nil\n\t\tcase layers.LayerTypeICMPv6:\n\t\t\tipv6, err := newIPv6(pd.ipv6)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tmsg, err := icmp.ParseMessage(int(layers.IPProtocolICMPv6), append(pd.icmpv6.Contents, pd.icmpv6.Payload...))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, errors.Wrap(err, \"failed to parse ICMPv6\")\n\t\t\t}\n\t\t\treturn &ICMP{\n\t\t\t\tIP:      ipv6,\n\t\t\t\tMessage: msg,\n\t\t\t}, nil\n\t\t}\n\t}\n\tlayers := make([]string, len(decoded))\n\tfor i, l := range decoded {\n\t\tlayers[i] = l.String()\n\t}\n\treturn nil, fmt.Errorf(\"Expect to decode IP and ICMP layers, got %s\", layers)\n}\n","sourceCodeStart":153,"sourceCodeEnd":185,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/packet/decoder.go#L153-L185","documentation":"The IPv6 branch of Decoder.Decode parses the ICMPv6 header+payload with icmp.ParseMessage using the ICMPv6 protocol number. Failure means the bytes following the IPv6 header are not a valid ICMPv6 message; the error is wrapped and Decode fails for this packet.","triggerScenarios":"Decode is called on a datagram classified as LayerTypeICMPv6 whose Contents/Payload are truncated, corrupted, or not ICMPv6 (wrong protocol payload inside the IPv6 packet).","commonSituations":"Corrupt datagrams delivered over the QUIC tunnel, misrouted packets where the payload is actually TCP/UDP rather than ICMPv6, or synthetic test data that is malformed.","solutions":["Inspect the raw IPv6 packet's next-header and payload to confirm it is genuinely ICMPv6.","Drop the malformed packet and continue; the tunnel proxy can operate without decoding every ICMPv6 datagram.","Check for truncation in the path delivering packets to the decoder (MTU/fragmentation issues).","In tests, construct valid ICMPv6 with icmp.ParseMessage-compatible marshaling."],"exampleFix":"// before\nif _, err := decoder.Decode(buf); err != nil { return err }\n// after\nif _, err := decoder.Decode(buf); err != nil {\n    log.Debug().Err(err).Msg(\"skipping invalid icmpv6 packet\")\n    return nil\n}","handlingStrategy":"try-catch","validationCode":"// Sanity check before decode: IPv6 (40-byte header) + 8-byte ICMPv6 header\nfunc plausiblyICMPv6(b []byte) bool {\n    if len(b) < 48 {\n        return false\n    }\n    return b[6] == 58 // next header == ICMPv6\n}","typeGuard":null,"tryCatchPattern":"decoded, err := decoder.Decode(raw)\nif err != nil {\n    log.Debug().Err(err).Msg(\"dropping undecodable icmpv6 packet\")\n    return nil\n}","preventionTips":["Drop undecodable packets gracefully; the tunnel can keep operating.","Confirm the packet's next-header actually indicates ICMPv6 before decoding.","Watch for fragmentation/truncation upstream causing malformed payloads."],"tags":["icmpv6","packet-decoding","network"],"backgroundTag":"invalid-argument-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}