{"record":{"id":"8831e5821c3aa07e","repo":"cloudflare/cloudflared","slug":"errdatagramicmppayloadtoolarge","errorCode":"ErrDatagramICMPPayloadTooLarge","errorMessage":"datagram icmp payload exceeds %d bytes","messagePattern":"datagram icmp payload exceeds (.+?) bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"quic/v3/datagram_errors.go","lineNumber":18,"sourceCode":"package v3\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n)\n\nvar (\n\tErrInvalidDatagramType                 error = errors.New(\"invalid datagram type expected\")\n\tErrDatagramHeaderTooSmall              error = fmt.Errorf(\"datagram should have at least %d byte\", datagramTypeLen)\n\tErrDatagramPayloadTooLarge             error = errors.New(\"payload length is too large to be bundled in datagram\")\n\tErrDatagramPayloadHeaderTooSmall       error = errors.New(\"payload length is too small to fit the datagram header\")\n\tErrDatagramPayloadInvalidSize          error = errors.New(\"datagram provided is an invalid size\")\n\tErrDatagramResponseMsgInvalidSize      error = errors.New(\"datagram response message is an invalid size\")\n\tErrDatagramResponseInvalidSize         error = errors.New(\"datagram response is an invalid size\")\n\tErrDatagramResponseMsgTooLargeMaximum  error = fmt.Errorf(\"datagram response error message length exceeds the length of the datagram maximum: %d\", maxResponseErrorMessageLen)\n\tErrDatagramResponseMsgTooLargeDatagram error = fmt.Errorf(\"datagram response error message length exceeds the length of the provided datagram\")\n\tErrDatagramICMPPayloadTooLarge         error = fmt.Errorf(\"datagram icmp payload exceeds %d bytes\", maxICMPPayloadLen)\n\tErrDatagramICMPPayloadMissing          error = errors.New(\"datagram icmp payload is missing\")\n)\n\nfunc wrapMarshalErr(err error) error {\n\treturn fmt.Errorf(\"datagram marshal error: %w\", err)\n}\n\nfunc wrapUnmarshalErr(err error) error {\n\treturn fmt.Errorf(\"datagram unmarshal error: %w\", err)\n}\n","sourceCodeStart":1,"sourceCodeEnd":29,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/quic/v3/datagram_errors.go#L1-L29","documentation":"ErrDatagramICMPPayloadTooLarge indicates an ICMPDatagram payload exceeds the protocol limit maxICMPPayloadLen. MarshalBinary returns it when len(d.Payload) > maxICMPPayloadLen (refusing to serialize an oversized ICMP datagram), and UnmarshalBinary returns it when the datagram body after the type byte (data[1:]) exceeds maxDatagramPayloadLen. Both wrap it via wrapMarshalErr/wrapUnmarshalErr, so match with errors.Is.","triggerScenarios":"MarshalBinary on an ICMPDatagram whose Payload field exceeds maxICMPPayloadLen; UnmarshalBinary on an ICMP datagram whose received body (data[1:]) exceeds maxDatagramPayloadLen — e.g. an oversized ICMP probe or a peer violating the size cap.","commonSituations":"Applications proxying large ICMP packets (big ping payloads) through the tunnel; mixing maximum transfer-unit assumptions between versions; fuzzed/malicious traffic with oversized ICMP bodies; tests verifying the size cap.","solutions":["Before marshaling, check len(d.Payload) <= maxICMPPayloadLen and truncate or reject the ICMP payload.","Use errors.Is(err, v3.ErrDatagramICMPPayloadTooLarge) to drop oversized ICMP datagrams without failing the session.","Reduce the size of ICMP probes sent through the tunnel (e.g. smaller ping payload size).","Ensure the peer caps ICMP datagram bodies at the same maxDatagramPayloadLen."],"exampleFix":"// before\ndata, err := icmpDatagram.MarshalBinary()\n// after\nif len(icmpDatagram.Payload) > v3.MaxICMPPayloadLen {\n    return nil, fmt.Errorf(\"icmp payload too large: %d bytes\", len(icmpDatagram.Payload))\n}\ndata, err := icmpDatagram.MarshalBinary()","handlingStrategy":"validation","validationCode":"if len(icmpDatagram.Payload) > v3.MaxICMPPayloadLen {\n    return fmt.Errorf(\"icmp payload %d exceeds max %d\", len(icmpDatagram.Payload), v3.MaxICMPPayloadLen)\n}","typeGuard":null,"tryCatchPattern":"if errors.Is(err, v3.ErrDatagramICMPPayloadTooLarge) {\n    logger.Warn().Msg(\"oversized ICMP datagram; dropping\")\n    return nil\n}","preventionTips":["Clamp or reject ICMP payloads at ingress to maxICMPPayloadLen before constructing ICMPDatagram.","Send ICMP probes with payloads sized within the tunnel limit (e.g. ping -s below the cap).","Match the error with errors.Is since both marshal and unmarshal paths wrap it."],"tags":["quic","datagram","icmp","size-limit"],"backgroundTag":"payload-too-large","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}