{"record":{"id":"e544dcc8efae9213","repo":"tailscale/tailscale","slug":"packet-too-big","errorCode":null,"errorMessage":"packet too big","messagePattern":"packet too big","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"net/tstun/wrap.go","lineNumber":72,"sourceCode":"// burden.\nconst WritePacketStartOffset = device.MessageTransportHeaderSize\n\n// MaxPacketSize is the maximum size (in bytes)\n// of a packet that can be injected into a tstun.Wrapper.\nconst MaxPacketSize = device.MaxContentSize\n\n// TAPDebug is whether super verbose TAP debugging is enabled.\nconst TAPDebug = false\n\nvar (\n\t// ErrClosed is returned when attempting an operation on a closed Wrapper.\n\tErrClosed = errors.New(\"device closed\")\n\t// ErrFiltered is returned when the acted-on packet is rejected by a filter.\n\tErrFiltered = errors.New(\"packet dropped by filter\")\n)\n\nvar (\n\terrPacketTooBig   = errors.New(\"packet too big\")\n\terrOffsetTooBig   = errors.New(\"offset larger than buffer length\")\n\terrOffsetTooSmall = errors.New(\"offset smaller than WritePacketStartOffset\")\n)\n\n// parsedPacketPool holds a pool of Parsed structs for use in filtering.\n// This is needed because escape analysis cannot see that parsed packets\n// do not escape through {Pre,Post}Filter{In,Out}.\nvar parsedPacketPool = sync.Pool{New: func() any { return new(packet.Parsed) }}\n\n// FilterFunc is a packet-filtering function with access to the Wrapper device.\n// It must not hold onto the packet struct, as its backing storage will be reused.\ntype FilterFunc func(*packet.Parsed, *Wrapper) filter.Response\n\n// GROFilterFunc is a FilterFunc extended with a *gro.GRO, enabling increased\n// throughput where GRO is supported by a packet.Parsed interceptor, e.g.\n// netstack/gVisor, and we are handling a vector of packets. Callers must pass a\n// nil g for the first packet in a given vector, and continue passing the\n// returned *gro.GRO for all remaining packets in said vector. If the returned","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/tailscale/tailscale/blob/5201273aec737d6372ab7423c31c04ca3ca2a0c2/net/tstun/wrap.go#L54-L90","documentation":"errPacketTooBig is returned by InjectInboundDirect and InjectOutbound when the supplied buffer exceeds MaxPacketSize (wireguard-go's MaxContentSize). The packet cannot be carried inside a WireGuard transport message, so it is rejected before any copying.","triggerScenarios":"Thrown at net/tstun/wrap.go:70 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fragment or truncate the payload to fit within tstun.MaxPacketSize before injecting","Check the source of the oversized packet; TUN MTU should already bound it","Ensure the injected slice does not include stray trailing bytes beyond the packet"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5201273aec737d6372ab7423c31c04ca3ca2a0c2","analyzedAt":"2026-09-06T13:25:29.289Z","contentChangedAt":"2026-09-06T13:25:29.289Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}