XTLS/Xray-core · error

failed to determine if address is local:

Error message

failed to determine if address is local: 

What it means

On macOS, FindProcess first checks whether the source IP belongs to this host via IsLocal; that check itself failed and the raw error is wrapped as 'failed to determine if address is local'. Note the source passes err (not a formatted string) directly as an error argument, so the message shows the underlying cause.

Source

Thrown at common/net/find_process_darwin.go:55

	darwinInSockInfoIPv6      = 0x2
	darwinSockInfoIN          = 1
	darwinSockInfoTCP         = 2
)

type darwinSocketMatchLevel int

const (
	darwinSocketNoMatch darwinSocketMatchLevel = iota
	darwinSocketPortMatch
	darwinSocketRemoteMatch
	darwinSocketLocalMatch
	darwinSocketExactMatch
)

func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (PID int, Name string, AbsolutePath string, err error) {
	isLocal, err := IsLocal(net.ParseIP(srcIP))
	if err != nil {
		return 0, "", "", errors.New("failed to determine if address is local: ", err)
	}
	if !isLocal {
		return 0, "", "", ErrNotLocal
	}
	if network != "tcp" && network != "udp" {
		panic("Unsupported network type for process lookup.")
	}

	srcAddr, err := netip.ParseAddr(srcIP)
	if err != nil {
		return 0, "", "", errors.New("invalid source IP address: ", srcIP)
	}
	srcAddr = srcAddr.Unmap()

	var dstAddr netip.Addr
	hasDstAddr := false
	if destIP != "" && destPort != 0 {
		dstAddr, err = netip.ParseAddr(destIP)

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Verify the caller passes a valid, non-empty source IP (from an accepted connection's RemoteAddr).
2. Check the wrapped error text: an interface-enumeration failure suggests sandbox/permission issues — grant network entitlements or run outside the sandbox.
3. On macOS, ensure the app has the entitlements needed for sysctl/libproc before relying on process matching.
4. Guard the call site: skip process lookup when srcIP is empty instead of passing it through.

Example fix

// before
pid, name, path, err := net.FindProcess(network, srcIP, srcPort, destIP, destPort)
// after: validate inputs first
if ip := net.ParseIP(srcIP); ip == nil {
    return // skip process lookup for invalid source
}
pid, name, path, err := net.FindProcess(network, srcIP, srcPort, destIP, destPort)

// Guard before calling FindProcess:
if srcIP == "" {
    return errors.New("no source IP available; skip process lookup")
}
if ip := net.ParseIP(srcIP); ip == nil {
    return errors.New("source is not an IP literal; skip process lookup")
}

pid, name, path, err := net.FindProcess(network, srcIP, srcPort, destIP, destPort)
if err != nil {
    if strings.Contains(err.Error(), "failed to determine if address is local") {
        // environment problem (interface enumeration); skip lookup, do not fail the request
        err = nil
    }
}

When it happens

Trigger: IsLocal(net.ParseIP(srcIP)) fails while enumerating local interface addresses (net.Interfaces error) — e.g. permission problems, or srcIP is nil/unparseable so the address never matches any interface and the helper returns an error.

Common situations: Process lookup (for routing rules or stats) invoked with an empty or malformed srcIP, or in sandboxed macOS environments where interface enumeration fails.

Related errors

• invalid source IP address:
• invalid destination IP address:
• android process lookup must be registered before use
• failed to list processes
• process not found for connection from ::: to :

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/88ceee6de3457f51. Report an issue: GitHub.