slackhq/nebula · warning

ErrPacketTooShort

ErrPacketTooShort

Error message

packet too short

What it means

ErrPacketTooShort is returned by Machine.ProcessPacket (and packet decoding helpers like newPacket) when the received byte slice is shorter than the length declared in the packet header. The input cannot be a valid handshake packet and is discarded. Importantly, this does NOT mark the machine as failed — it is treated as a corrupt/short datagram.

Source

Thrown at handshake/errors.go:9

package handshake

import "errors"

var (
	ErrInitiateOnResponder     = errors.New("initiate called on responder")
	ErrInitiateAlreadyCalled   = errors.New("initiate already called")
	ErrInitiateNotCalled       = errors.New("initiate must be called before ProcessPacket for initiators")
	ErrPacketTooShort          = errors.New("packet too short")
	ErrPublicKeyMismatch       = errors.New("public key mismatch between certificate and handshake")
	ErrIncompleteHandshake     = errors.New("handshake completed without receiving required content")
	ErrMachineFailed           = errors.New("handshake machine has failed")
	ErrUnknownSubtype          = errors.New("unknown handshake subtype")
	ErrMissingContent          = errors.New("expected handshake content but message was empty")
	ErrUnexpectedContent       = errors.New("received unexpected handshake content")
	ErrInvalidRemoteIndex      = errors.New("peer sent an invalid index in handshake payload")
	ErrIndexAllocation         = errors.New("failed to allocate local index")
	ErrNoCredential            = errors.New("no handshake credential available for cert version")
	ErrAsymmetricCipherKeys    = errors.New("noise produced only one cipher key")
	ErrMultiMessageUnsupported = errors.New("multi-message handshake patterns are not yet supported by the manager")
	ErrSubtypeMismatch         = errors.New("packet subtype does not match handshake machine subtype")
)

View on GitHub (pinned to dd8f660c0a)

Solutions

  1. Check len(packet) >= header length before calling ProcessPacket and discard/log short packets.
  2. Fix the socket read path so full datagrams are delivered (adequate buffer size, correct recvfrom usage).
  3. Investigate network MTU/truncation if short packets appear in production traffic.

Example fix

// before
msg, _, err := m.ProcessPacket(nil, buf[:n]) // n may be < header size
// after
if n < handshake.MinPacketLen {
    return // skip short/garbage datagram
}
msg, _, err := m.ProcessPacket(nil, buf[:n])
Defensive patterns

Strategy: validation

Validate before calling

if len(packet) < handshake.MinPacketLen /* header size */ {
    // discard: not a valid handshake packet
    return nil
}

Type guard

func isPlausiblePacket(b []byte) bool {
    return len(b) > 0 && len(b) >= handshake.MinPacketLen
}

Try / catch

msg, packet, err := m.ProcessPacket(h, buf[:n])
if errors.Is(err, handshake.ErrPacketTooShort) {
    // safe to ignore; machine is still usable
    return nil
}

Prevention

When it happens

Trigger: Passing a buffer of fewer bytes than header.Len to ProcessPacket, e.g. a truncated UDP datagram, a test payload like []byte{1,2,3}, or an incorrectly sized read buffer.

Common situations: UDP packet truncation on lossy networks or MTU issues; reading a partial datagram; feeding plain (non-handshake) traffic into the handshake processor; test cases verifying malformed-packet handling.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/8ce3ccee3a23bc40. Report an issue: GitHub.