{"record":{"id":"2dafba61746751e0","repo":"AdguardTeam/AdGuardHome","slug":"unexpected-ipset-family-q","errorCode":null,"errorMessage":"unexpected ipset family %q","messagePattern":"unexpected ipset family %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/ipset/ipset_linux.go","lineNumber":320,"sourceCode":"// TODO(s.chzhen):  Use *props.\nfunc (m *manager) ipsetProps(name string) (p props, err error) {\n\t// The family doesn't seem to matter when we use a header query, so\n\t// query only the IPv4 one.\n\t//\n\t// TODO(a.garipov): Find out if this is a bug or a feature.\n\tvar res *ipset.HeaderPolicy\n\tres, err = m.ipv4Conn.Header(name)\n\tif err != nil {\n\t\treturn props{}, err\n\t}\n\n\tif res == nil || res.Family == nil {\n\t\treturn props{}, errors.Error(\"empty response or no family data\")\n\t}\n\n\tfamily := netfilter.ProtoFamily(res.Family.Value)\n\tif family != netfilter.ProtoIPv4 && family != netfilter.ProtoIPv6 {\n\t\treturn props{}, fmt.Errorf(\"unexpected ipset family %q\", family)\n\t}\n\n\ttypeName := res.TypeName.Get()\n\n\treturn props{\n\t\tname:         name,\n\t\ttypeName:     typeName,\n\t\tfamily:       family,\n\t\tisPersistent: false,\n\t}, nil\n}\n\n// ipsets returns ipset properties of currently known ipsets.  It also makes an\n// additional ipset header data query if needed.\nfunc (m *manager) ipsets(\n\tctx context.Context,\n\tnames []string,\n\tcurrentlyKnown map[string]props,","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/ipset/ipset_linux.go#L302-L338","documentation":"When querying an ipset's header, the kernel returned a family value that is neither inet (IPv4) nor inet6 (IPv6). This is a defensive check on netfilter protocol family data.","triggerScenarios":"m.ipsetProps reads res.Family from a netlink header query and the numeric family is outside {2 (inet), 10 (inet6)} — malformed response or exotic set family.","commonSituations":"Kernel/ipset version mismatch (very new ipset types), corrupted netlink response, or a mock/test stub returning an invalid family.","solutions":["Verify with 'ipset list <name>' that the set reports family inet or inet6","Recreate the set with an explicit family","Upgrade/downgrade to a matching kernel+ipset pairing"],"exampleFix":"ipset destroy myset\nipset create myset hash:net family inet6","handlingStrategy":"fallback","validationCode":"out, err := exec.Command(\"ipset\", \"list\", name, \"-t\").Output()\nif err != nil || !strings.Contains(string(out), \"family inet\") {\n\treturn fmt.Errorf(\"set %s has unsupported family\", name)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create sets with explicit 'family inet' or 'family inet6'","Pin known-good kernel/ipset versions in deployment images"],"tags":["ipset","netlink","kernel","validation"],"backgroundTag":"kernel-protocol-mismatch","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}