{"record":{"id":"1097fc1c510060c2","repo":"netbirdio/netbird","slug":"get-set-s-w","errorCode":null,"errorMessage":"get set %s: %w","messagePattern":"get set (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/nftables/router_linux.go","lineNumber":1857,"sourceCode":"\t// Release the refcount only once the rules are gone from the kernel. On\n\t// failure (including the refreshRulesMap error above) the rules and their\n\t// map entries remain, keeping forwarding on until a retry removes them.\n\tif merr == nil {\n\t\tdelete(r.rules, ruleKey+dnatSuffix)\n\t\tdelete(r.rules, ruleKey+snatSuffix)\n\n\t\tif err := r.ipFwdState.ReleaseForwarding(r.af.tableFamily == nftables.TableFamilyIPv6); err != nil {\n\t\t\tlog.Errorf(\"%v\", err)\n\t\t}\n\t}\n\n\treturn nberrors.FormatErrorOrNil(merr)\n}\n\nfunc (r *router) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {\n\tnfset, err := r.conn.GetSetByName(r.workTable, set.HashedName())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get set %s: %w\", set.HashedName(), err)\n\t}\n\n\telements := r.convertPrefixesToSet(prefixes)\n\tif err := r.conn.SetAddElements(nfset, elements); err != nil {\n\t\treturn fmt.Errorf(\"add elements to set %s: %w\", set.HashedName(), err)\n\t}\n\n\tif err := r.conn.Flush(); err != nil {\n\t\treturn fmt.Errorf(flushError, err)\n\t}\n\n\tlog.Debugf(\"updated set %s with prefixes %v\", set.HashedName(), prefixes)\n\n\treturn nil\n}\n\n// AddInboundDNAT adds an inbound DNAT rule redirecting traffic from NetBird peers to local services.\nfunc (r *router) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {","sourceCodeStart":1839,"sourceCodeEnd":1875,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/nftables/router_linux.go#L1839-L1875","documentation":"UpdateSet fetches the existing nftables named set by its hashed name with GetSetByName before adding elements. The error wraps a failed NFT_MSG_GETSET lookup: most commonly ENOENT because the set was never created (sets are created lazily by the refcounter when the first referencing rule is added) or was flushed away, with netlink or permission failures as the rarer cause.","triggerScenarios":"UpdateSet called for a set whose createIpSet never ran or failed earlier; an external flush removed the netbird table's sets; GETSET blocked by missing CAP_NET_ADMIN.","commonSituations":"Route or network update events arriving before the rules that create the set; recovery after an external ruleset wipe; ordering regressions in code that updates sets independently of rule lifecycle.","solutions":["Confirm the set exists: 'sudo nft list sets' and look for the hashed set name.","Ensure the rules referencing the set are added first so createIpSet runs before UpdateSet.","Recreate state by re-applying the route/firewall configuration (network-map refresh or agent restart).","For non-ENOENT failures, check root/CAP_NET_ADMIN."],"exampleFix":"// before\nnfset, err := r.conn.GetSetByName(r.workTable, set.HashedName())\nif err != nil {\n    return fmt.Errorf(\"get set %s: %w\", set.HashedName(), err)\n}\n\n// after: lazily (re)create the set when it disappeared\nnfset, err := r.conn.GetSetByName(r.workTable, set.HashedName())\nif errors.Is(err, unix.ENOENT) {\n    nfset, err = r.createIpSet(set.HashedName(), setInput{set: set, prefixes: prefixes})\n    if err != nil {\n        return fmt.Errorf(\"recreate set %s: %w\", set.HashedName(), err)\n    }\n} else if err != nil {\n    return fmt.Errorf(\"get set %s: %w\", set.HashedName(), err)\n}","handlingStrategy":"fallback","validationCode":"// Verify the set exists before updating it\nfunc setExists(conn *nftables.Conn, table *nftables.Table, hashedName string) bool {\n    _, err := conn.GetSetByName(table, hashedName)\n    return err == nil\n}","typeGuard":null,"tryCatchPattern":"nfset, err := r.conn.GetSetByName(r.workTable, set.HashedName())\nif err != nil {\n    if !errors.Is(err, unix.ENOENT) {\n        return fmt.Errorf(\"get set %s: %w\", set.HashedName(), err)\n    }\n    // set vanished: fall back to recreating it, then continue the update\n    nfset, err = r.createIpSet(set.HashedName(), setInput{set: set})\n    if err != nil {\n        return fmt.Errorf(\"recreate set %s: %w\", set.HashedName(), err)\n    }\n}","preventionTips":["Order operations so rules that create a set are applied before set updates.","Recreate-on-missing keeps reconcilers converging after external ruleset wipes.","Alert when GetSetByName fails with something other than ENOENT; that indicates privilege or netlink problems."],"tags":["nftables","nft-set","netlink","routing"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}