{"record":{"id":"2aef28ba087b201d","repo":"netbirdio/netbird","slug":"could-not-generate-d-random-bytes-v","errorCode":null,"errorMessage":"could not generate %d random bytes: %v","messagePattern":"could not generate (.+?) random bytes: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/internal/auth/util.go","lineNumber":17,"sourceCode":"package auth\n\nimport (\n\t\"crypto/rand\"\n\t\"encoding/base64\"\n\t\"encoding/hex\"\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"io\"\n\t\"strings\"\n)\n\nfunc randomBytesInHex(count int) (string, error) {\n\tbuf := make([]byte, count)\n\t_, err := io.ReadFull(rand.Reader, buf)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not generate %d random bytes: %v\", count, err)\n\t}\n\n\treturn hex.EncodeToString(buf), nil\n}\n\n// validateTokenAudience checks that the token is a well-formed JWT whose\n// audience claim matches the expected audience.\n//\n// It does NOT verify the token's cryptographic signature and therefore must not\n// be treated as an authenticity check. The token is obtained by the client\n// directly from the IdP token endpoint over TLS, and its signature is verified\n// server-side by the management server against the IdP's JWKS\n// (see shared/auth/jwt/validator.go). This function is only a client-side\n// sanity check that the returned token targets the expected audience.\nfunc validateTokenAudience(token string, audience string) error {\n\tif token == \"\" {\n\t\treturn fmt.Errorf(\"token received is empty\")\n\t}","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/util.go#L1-L35","documentation":"io.ReadFull on crypto/rand.Reader failed while generating random bytes for the OAuth state (24 bytes) or PKCE code_verifier (64 bytes). crypto/rand.Reader is the OS CSPRNG; a failure or short read means the operating system's entropy source is unavailable or erroring, which is exceptional on a healthy system.","triggerScenarios":"rand.Reader.Read returns an error or fewer bytes than requested: getrandom(2) or /dev/urandom unavailable in a restricted sandbox or container, early-boot entropy starvation on embedded systems, a VM with a broken or missing hardware RNG passthrough, or file-descriptor exhaustion preventing the entropy device open on older implementations.","commonSituations":"Minimal Docker, gVisor, or custom-seccomp sandstones blocking entropy syscalls; custom-compiled kernels without the random device; userspace starting before the kernel CRNG is initialized; embedded or VM environments without virtio-rng.","solutions":["Verify the OS entropy source is reachable inside the environment: check that getrandom(2)/ /dev/urandom works from the same container or sandbox.","On VMs, attach a hardware or virtio RNG device, or seed entropy from the host.","Retry the login once - the operation is cheap and transient failures are extremely rare.","If running under a restrictive policy (seccomp, AppArmor, SELinux), allow the entropy syscall/device for the netbird process."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight: confirm the OS CSPRNG is readable in this environment\nfunc entropyAvailable() error {\n    buf := make([]byte, 8)\n    _, err := io.ReadFull(rand.Reader, buf)\n    return err\n}","typeGuard":null,"tryCatchPattern":"state, err := randomBytesInHex(24)\nif err != nil {\n    // entropy source failure is almost always environmental; retry once,\n    // then report 'OS entropy source unavailable' rather than raw error text\n    state, err = randomBytesInHex(24)\n    if err != nil {\n        return AuthFlowInfo{}, fmt.Errorf(\"OS entropy source unavailable: %w\", err)\n    }\n}","preventionTips":["In sandboxes, verify getrandom(2)/ /dev/urandom is permitted before shipping the workload.","Give VMs an RNG device (virtio-rng) or seed entropy from the host.","Run an entropy preflight in container health checks for images that start very early after boot."],"tags":["crypto","entropy","random","sandbox","environment"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}