AdguardTeam/AdGuardHome · error

%q %q making header query: %w

Error message

%q %q making header query: %w

What it means

When cached properties for a set are stale/invalid (wrong family), the manager re-queries the ipset header via netlink; this wraps a failure of that re-query.

Source

Thrown at internal/ipset/ipset_linux.go:357

) (sets []props, err error) {
	for _, n := range names {
		p, ok := currentlyKnown[n]
		if !ok {
			return nil, fmt.Errorf("unknown ipset %q", n)
		}

		if p.family != netfilter.ProtoIPv4 && p.family != netfilter.ProtoIPv6 {
			m.logger.DebugContext(
				ctx,
				"got unexpected ipset family while getting set properties",
				"set_name", p.name,
				"set_type", p.typeName,
				"set_family", p.family,
			)

			p, err = m.ipsetProps(n)
			if err != nil {
				return nil, fmt.Errorf("%q %q making header query: %w", p.name, p.typeName, err)
			}
		}

		m.nameToIpset[n] = p
		sets = append(sets, p)
	}

	return sets, nil
}

// newManagerWithDialer returns a new Linux ipset manager using the provided
// dialer.
func newManagerWithDialer(ctx context.Context, conf *Config, dial dialer) (mgr Manager, err error) {
	defer func() { err = errors.Annotate(err, "ipset: %w") }()

	m := &manager{
		mu: &sync.Mutex{},

View on GitHub (pinned to b41aefbe51)

Solutions

1. Ensure sets named in config exist and are not destroyed concurrently
2. Retry service start/reload after the firewall settles
3. Check dmesg for netlink/netfilter errors

for attempt := 1; attempt <= 3; attempt++ {
	m, err = ipset.NewManager(conf)
	if err == nil || !strings.Contains(err.Error(), "header query") { break }
	time.Sleep(time.Duration(attempt) * 500 * time.Millisecond)
}

When it happens

Trigger: m.ipsetProps(n) netlink query fails: set was destroyed concurrently, netlink socket error, or permission dropped after init.

Common situations: Another process (firewall reload, ipset destroy) removes the set while the service is (re)configuring; transient netlink buffer exhaustion.

Related errors

• unexpected ipset family %q
• adding %q%s to %q %q: %w
• dialing v4: %w
• dialing v6: %w
• invalid value %q: expected one slash

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/e1856a93e13acff7. Report an issue: GitHub.