{"record":{"id":"27df224f87281ffd","repo":"slackhq/nebula","slug":"failed-to-set-tun-address-s-s-27df22","errorCode":null,"errorMessage":"failed to set tun address %s: %s","messagePattern":"failed to set tun address (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_openbsd.go","lineNumber":251,"sourceCode":"\t\treq.DstAddr = unix.RawSockaddrInet4{\n\t\t\tLen:    unix.SizeofSockaddrInet4,\n\t\t\tFamily: unix.AF_INET,\n\t\t\tAddr:   cidr.Addr().As4(),\n\t\t}\n\t\treq.MaskAddr = unix.RawSockaddrInet4{\n\t\t\tLen:    unix.SizeofSockaddrInet4,\n\t\t\tFamily: unix.AF_INET,\n\t\t\tAddr:   prefixToMask(cidr).As4(),\n\t\t}\n\n\t\ts, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer syscall.Close(s)\n\n\t\tif err := ioctl(uintptr(s), unix.SIOCAIFADDR, uintptr(unsafe.Pointer(&req))); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set tun address %s: %s\", cidr.Addr(), err)\n\t\t}\n\n\t\terr = addRoute(cidr, t.vpnNetworks)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set route for vpn network %v: %w\", cidr, err)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif cidr.Addr().Is6() {\n\t\tvar req ifreqAlias6\n\t\treq.Name = t.deviceBytes()\n\t\treq.Addr = unix.RawSockaddrInet6{\n\t\t\tLen:    unix.SizeofSockaddrInet6,\n\t\t\tFamily: unix.AF_INET6,\n\t\t\tAddr:   cidr.Addr().As16(),\n\t\t}","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_openbsd.go#L233-L269","documentation":"addIp configures an IPv4 address on the tun interface via the SIOCAIFADDR ioctl. If the ioctl returns an error, it is wrapped with this message including the requested address. Typical causes are the interface not being up, an invalid/broadcast-inconsistent ifreq structure, or insufficient privileges.","triggerScenarios":"t.Activate() iterating vpnNetworks where an IPv4 prefix fails the SIOCAIFADDR ioctl — e.g. running without root, or an address conflicting with an existing assignment.","commonSituations":"Running nebula as non-root on OpenBSD; duplicate VPN addresses across hosts; netmask issues in the tun.config_l group.","solutions":["Run as root or grant the process the needed privileges (staff/daemon with appropriate perms)","Verify the IPv4 CIDR in the certificate/config is valid and unique","Confirm the tun interface exists and is up before addIp","Check the wrapped errno in the message for the specific kernel reason"],"exampleFix":"# before\n$ ./nebula -config config.yaml   # as regular user\n# after\n$ doas ./nebula -config config.yaml","handlingStrategy":"try-catch","validationCode":"cidr := cfgVpnNetworks[0]\nif !cidr.Addr().Is4() { return fmt.Errorf(\"expected IPv4 prefix\") }\nif os.Geteuid() != 0 { return fmt.Errorf(\"needs root to set interface address\") }","typeGuard":null,"tryCatchPattern":"if err := t.Activate(); err != nil {\n    var ifaceErr *fmt.Errorf\n    if errors.As(err, &ifaceErr) && strings.Contains(err.Error(), \"failed to set tun address\") {\n        log.Error(\"check privileges and CIDR validity\", \"err\", err)\n    }\n    return err\n}","preventionTips":["Run as root on OpenBSD","Ensure tun CIDRs are valid, unique, and consistent across hosts","Bring the interface up before assigning addresses"],"tags":["openbsd","tun","ioctl","ipv4","address-assignment"],"backgroundTag":"ioctl-interface-config-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}