{"record":{"id":"0a4d2de9f12fb5c9","repo":"AdguardTeam/AdGuardHome","slug":"unexpected-family-s-for-ipset-q","errorCode":null,"errorMessage":"unexpected family %s for ipset %q","messagePattern":"unexpected family (.+?) for ipset %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/ipset/ipset_linux.go","lineNumber":469,"sourceCode":"\t\t}\n\n\t\tentries = append(entries, ipset.NewEntry(ipset.EntryIP(ip)))\n\t\tnewAddedEntries = append(newAddedEntries, e)\n\t}\n\n\tn = len(entries)\n\tif n == 0 {\n\t\treturn 0, nil\n\t}\n\n\tvar conn ipsetConn\n\tswitch set.family {\n\tcase netfilter.ProtoIPv4:\n\t\tconn = m.ipv4Conn\n\tcase netfilter.ProtoIPv6:\n\t\tconn = m.ipv6Conn\n\tdefault:\n\t\treturn 0, fmt.Errorf(\"unexpected family %s for ipset %q\", set.family, set.name)\n\t}\n\n\terr = conn.Add(set.name, entries...)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"adding %q%s to %q %q: %w\", host, ips, set.name, set.typeName, err)\n\t}\n\n\t// Only add these to the cache once we're sure that all of them were\n\t// actually sent to the ipset.\n\tfor _, e := range newAddedEntries {\n\t\ts := m.nameToIpset[e.ipsetName]\n\t\tif s.isPersistent {\n\t\t\tm.addedIPs.Add(e)\n\t\t}\n\t}\n\n\treturn n, nil\n}","sourceCodeStart":451,"sourceCodeEnd":487,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/ipset/ipset_linux.go#L451-L487","documentation":"addIPs selects the v4 or v6 netfilter connection based on set.family; hitting the default branch means family is neither ProtoIPv4 nor ProtoIPv6 — corrupted or stale set properties.","triggerScenarios":"A props struct in the cache was built with an invalid family (e.g. from a malformed header response) and is then used when adding entries.","commonSituations":"Internal invariant break after kernel/ipset version changes or concurrent set recreation with a different family; very unlikely in normal operation.","solutions":["Restart the service so sets are re-enumerated","Recreate the ipset with an explicit family","Report as a bug if reproducible with stock kernel"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":"func validFamily(f netfilter.ProtoFamily) bool {\n\treturn f == netfilter.ProtoIPv4 || f == netfilter.ProtoIPv6\n}","tryCatchPattern":null,"preventionTips":["Recreate sets with explicit families if this appears","Restart the service to rebuild set metadata caches"],"tags":["ipset","internal-invariant","netfilter"],"backgroundTag":"internal-invariant-violation","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}