{"record":{"id":"36d199876b64512a","repo":"slackhq/nebula","slug":"failed-to-set-tun-device-mode-w","errorCode":null,"errorMessage":"failed to set tun device mode: %w","messagePattern":"failed to set tun device mode: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_netbsd.go","lineNumber":307,"sourceCode":"\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer syscall.Close(s)\n\n\t\tif err := ioctl(uintptr(s), SIOCAIFADDR_IN6, uintptr(unsafe.Pointer(&req))); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set tun address %s: %s\", cidr.Addr().String(), err)\n\t\t}\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"unknown address type %v\", cidr)\n}\n\nfunc (t *tun) Activate() error {\n\tmode := int32(unix.IFF_BROADCAST)\n\terr := ioctl(uintptr(t.fd), TUNSIFMODE, uintptr(unsafe.Pointer(&mode)))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun device mode: %w\", err)\n\t}\n\n\tv := 1\n\terr = ioctl(uintptr(t.fd), TUNSIFHEAD, uintptr(unsafe.Pointer(&v)))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun device head: %w\", err)\n\t}\n\n\terr = t.doIoctlByName(unix.SIOCSIFMTU, uint32(t.MTU))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun mtu: %w\", err)\n\t}\n\n\tfor i := range t.vpnNetworks {\n\t\terr = t.addIp(t.vpnNetworks[i])\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_netbsd.go#L289-L325","documentation":"Activate() puts the tun device into IFF_BROADCAST mode via the TUNSIFMODE ioctl. If that ioctl fails, this error wraps the errno, meaning the kernel refused to set the device mode (device in wrong state, bad descriptor, or permission issue).","triggerScenarios":"ioctl(fd, TUNSIFMODE, IFF_BROADCAST) fails because t.fd is invalid/closed, the device was already configured to an incompatible mode, or the caller lacks privileges.","commonSituations":"Calling Activate after the device was destroyed; double activation racing with Close; unprivileged execution.","solutions":["Ensure Activate() is called once, right after newTun() and before Close()","Verify the tun device still exists and the fd is valid (recreate with ifconfig tunN create if destroyed)","Run with root privileges as TUNSIFMODE requires device access"],"exampleFix":"// before\ntun.Close()\ntun.Activate() // fd already closed\n// after\ntun.Activate()\n// ... use tun ...\ntun.Close()","handlingStrategy":"try-catch","validationCode":"// call Activate exactly once, immediately after newTun\nvar activateOnce sync.Once\nfunc safeActivate(t *tun) error {\n    var err error\n    activateOnce.Do(func() { err = t.Activate() })\n    return err\n}","typeGuard":null,"tryCatchPattern":"if err := tun.Activate(); err != nil {\n    log.Printf(\"tun activate failed: %v — device may need recreation (ifconfig tunN create)\", err)\n}","preventionTips":["Activate immediately after opening, before any I/O","Do not call Activate concurrently or after Close","Ensure the device exists and the process is privileged"],"tags":["netbsd","tun","ioctl","activate"],"backgroundTag":"tun-device-mode-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}