{"record":{"id":"e371f5ded512b5ab","repo":"cloudflare/cloudflared","slug":"packet-with-tracing-context-should-have-at-least","errorCode":null,"errorMessage":"packet with tracing context should have at least %d bytes, got %v","messagePattern":"packet with tracing context should have at least (.+?) bytes, got (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"quic/datagramv2.go","lineNumber":209,"sourceCode":"\t\t\tSpans:           spans,\n\t\t\tTracingIdentity: tracingIdentity,\n\t\t}\n\tcase DatagramTypeUDP:\n\t\treturn fmt.Errorf(\"unexpected datagram type %d in handlePacket\", msgType)\n\tdefault:\n\t\treturn fmt.Errorf(\"unexpected datagram type %d\", msgType)\n\t}\n\tselect {\n\tcase <-ctx.Done():\n\t\treturn ctx.Err()\n\tcase dm.packetDemuxChan <- demuxedPacket:\n\t\treturn nil\n\t}\n}\n\nfunc extractTracingIdentity(pk []byte) (tracingIdentity []byte, payload []byte, err error) {\n\tif len(pk) < tracing.IdentityLength {\n\t\treturn nil, nil, fmt.Errorf(\"packet with tracing context should have at least %d bytes, got %v\", tracing.IdentityLength, pk)\n\t}\n\ttracingIdentity = pk[len(pk)-tracing.IdentityLength:]\n\tpayload = pk[:len(pk)-tracing.IdentityLength]\n\treturn tracingIdentity, payload, nil\n}\n\ntype RawPacket packet.RawPacket\n\nfunc (rw RawPacket) Type() DatagramV2Type {\n\treturn DatagramTypeIP\n}\n\nfunc (rw RawPacket) Payload() []byte {\n\treturn rw.Data\n}\n\nfunc (rw RawPacket) Metadata() []byte {\n\treturn []byte{}","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/quic/datagramv2.go#L191-L227","documentation":"This error is thrown by extractTracingIdentity in quic/datagramv2.go when a datagram packet is supposed to carry a Cloudflare tracing identity suffix but is shorter than the fixed identity length. The function slices the last tracing.IdentityLength bytes off the packet as the tracing identity; if the packet is too small to contain both identity and payload, the split is impossible. It indicates a malformed packet that reached the datagram v2 handler (extractTracingIdentity is invoked from handlePacket).","triggerScenarios":"Calling handlePacket on a datagram whose total length is less than tracing.IdentityLength, e.g. a zero-length or truncated UDP payload, or a peer sending packets without the tracing-identity trailer appended.","commonSituations":"Truncated or corrupted UDP datagrams in transit; a client implementation that omits the tracing-identity trailer; a misconfigured proxy/load balancer stripping packet suffixes; test harnesses feeding hand-crafted packets that are too short.","solutions":["Check len(packet) >= tracing.IdentityLength before invoking handlePacket/extractTracingIdentity and drop or reject short packets.","Verify the sending side appends the tracing identity trailer to every datagram (cloudflared/quic v2 protocol requirement).","Inspect the network path (NAT, proxy, MTU fragmentation) for packet truncation.","Log the offending packet length and peer address to identify the misbehaving client."],"exampleFix":"// before\ntracingIdentity, payload, err := extractTracingIdentity(rawPacket)\nif err != nil { return err }\n// after\nif len(rawPacket) < tracing.IdentityLength {\n    logger.Warn().Int(\"len\", len(rawPacket)).Msg(\"dropping short datagram without tracing identity\")\n    return nil\n}\ntracingIdentity, payload, err := extractTracingIdentity(rawPacket)","handlingStrategy":"validation","validationCode":"if len(packet) < tracing.IdentityLength {\n    return fmt.Errorf(\"packet too short for tracing identity: %d bytes\", len(packet))\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"should have at least\") {\n        logger.Warn().Int(\"len\", len(packet)).Msg(\"dropping malformed datagram\")\n        return nil\n    }\n    return err\n}","preventionTips":["Always append the tracing identity trailer before sending datagrams over QUIC v2.","Validate packet length at the UDP read boundary before dispatching to handlePacket.","Add a unit test feeding an under-length packet to assert graceful handling."],"tags":["network","quic","datagram","packet-validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}