{"record":{"id":"c0f611e86542004a","repo":"cilium/cilium","slug":"craft-packet-w","errorCode":null,"errorMessage":"craft packet: %w","messagePattern":"craft packet: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/linux/probes/probes.go","lineNumber":496,"sourceCode":"\t\t},\n\t\t&layers.IPv4{\n\t\t\tVersion:  4,\n\t\t\tIHL:      5,\n\t\t\tLength:   49,\n\t\t\tId:       0xCECB,\n\t\t\tTTL:      64,\n\t\t\tProtocol: layers.IPProtocolUDP,\n\t\t\tSrcIP:    net.IPv4(0xc0, 0xa8, 0xb2, 0x56),\n\t\t\tDstIP:    net.IPv4(0xc0, 0xa8, 0xb2, 0xff),\n\t\t},\n\t\t&layers.UDP{\n\t\t\tSrcPort: 23939,\n\t\t\tDstPort: 32412,\n\t\t},\n\t\tgopacket.Payload(\"M-SEARCH * HTTP/1.1\\x0d\\x0a\"),\n\t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"craft packet: %w\", err)\n\t}\n\n\tret, _, err := prog.Test(buf.Bytes())\n\tif err != nil {\n\t\treturn err\n\t}\n\tif ret != 0 {\n\t\treturn ebpf.ErrNotSupported\n\t}\n\treturn nil\n}\n\n// HaveDeadCodeElim tests whether the kernel supports dead code elimination.\nfunc HaveDeadCodeElim() error {\n\tspec := ebpf.ProgramSpec{\n\t\tName: \"test\",\n\t\tType: ebpf.XDP,\n\t\tInstructions: asm.Instructions{","sourceCodeStart":478,"sourceCodeEnd":514,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/linux/probes/probes.go#L478-L514","documentation":"HaveSKBAdjustRoomL2RoomMACSupport serializes a fixed Ethernet/IPv4/UDP packet with gopacket to feed prog.Test(), because bpf_skb_adjust_room with BPF_ADJ_ROOM_MAC needs a valid L2 packet. If gopacket.SerializeLayers fails, the error is wrapped as 'craft packet: %w'. Failure here indicates a packet-construction problem, not a kernel limitation.","triggerScenarios":"gopacket.SerializeLayers returns an error while building the hardcoded test packet — e.g. nil layer in the options, an invalid SerializeOptions (FixLengths computing an impossible length), or buffer reuse misuse.","commonSituations":"Custom patches that alter the layer stack or payload; passing a buffer already containing bytes; modifying the hardcoded layers and producing inconsistent lengths; gopacket API/version changes.","solutions":["Keep the hardcoded layer stack intact (Eth + IPv4 + UDP + payload) and lengths consistent.","Use a fresh gopacket.NewSerializeBuffer() per serialization call.","Check SerializeOptions — enable FixLengths only if all lengths can be computed; ensure IHL/Length fields remain valid.","Upgrade/align the gopacket dependency version if serialization APIs changed."],"exampleFix":"// before\nerr = gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true, ComputeChecksums: true}, layers...)\n// after\nbuf := gopacket.NewSerializeBuffer()\nerr = gopacket.SerializeLayers(buf, gopacket.SerializeOptions{},\n\t&layers.Ethernet{...}, &layers.IPv4{...}, &layers.UDP{...}, gopacket.Payload(...))","handlingStrategy":"validation","validationCode":"// ensure the layer stack is well-formed before serialization\nfunc validTestPacketLayers(eth *layers.Ethernet, ip *layers.IPv4, udp *layers.UDP) bool {\n\treturn eth != nil && ip != nil && udp != nil && ip.IHL == 5\n}","typeGuard":null,"tryCatchPattern":"err := probes.HaveSKBAdjustRoomL2RoomMACSupport(logger)\nif err != nil && !errors.Is(err, ebpf.ErrNotSupported) {\n\t// includes 'craft packet:' failures\n\tlog.Warn(\"skb_adjust_room probe failed unexpectedly\", \"err\", err)\n}","preventionTips":["Do not modify the hardcoded Eth/IPv4/UDP layer stack used by the probe","Use a fresh gopacket.NewSerializeBuffer() per call","Keep gopacket dependency version pinned and tested","Keep SerializeOptions minimal (no FixLengths/ComputeChecksums surprises)"],"tags":["gopacket","packet-crafting","ebpf-probe"],"backgroundTag":"packet-serialization-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}