{"record":{"id":"4095dc2816605ca7","repo":"cilium/cilium","slug":"unable-to-generate-rnd-mac-addr-w","errorCode":null,"errorMessage":"unable to generate rnd mac addr: %w","messagePattern":"unable to generate rnd mac addr: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/connector/veth.go","lineNumber":33,"sourceCode":"\t\"github.com/cilium/cilium/pkg/mac\"\n)\n\n// setupVethPair sets up the host-facing interface, the peer interface and fills\n// up some endpoint fields such as mac, NodeMac, ifIndex and ifName. Returns a pointer\n// for the created veth, a pointer for the peer link and error if something fails.\nfunc setupVethPair(defaultLogger *slog.Logger, cfg LinkConfig, sysctl sysctl.Sysctl) (*netlink.Veth, netlink.Link, error) {\n\tlogger := defaultLogger.With(logfields.LogSubsys, \"endpoint-connector\")\n\t// systemd 242+ tries to set a \"persistent\" MAC addr for any virtual device\n\t// by default (controlled by MACAddressPolicy). As setting happens\n\t// asynchronously after a device has been created, ep.Mac and ep.HostMac\n\t// can become stale which has a serious consequence - the kernel will drop\n\t// any packet sent to/from the endpoint. However, we can trick systemd by\n\t// explicitly setting MAC addrs for both veth ends. This sets\n\t// addr_assign_type for NET_ADDR_SET which prevents systemd from changing\n\t// the addrs.\n\tepHostMAC, err := mac.GenerateRandMAC()\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to generate rnd mac addr: %w\", err)\n\t}\n\tepLXCMAC, err := mac.GenerateRandMAC()\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to generate rnd mac addr: %w\", err)\n\t}\n\n\tveth := &netlink.Veth{\n\t\tLinkAttrs: netlink.LinkAttrs{\n\t\t\tName:         cfg.HostIfName,\n\t\t\tHardwareAddr: epHostMAC.HardwareAddr(),\n\t\t\tTxQLen:       1000,\n\t\t},\n\t\tPeerName:         cfg.PeerIfName,\n\t\tPeerHardwareAddr: epLXCMAC.HardwareAddr(),\n\t}\n\n\tif err := netlink.LinkAdd(veth); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to create veth pair: %w\", err)","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/connector/veth.go#L15-L51","documentation":"setupVethPair generates a random MAC address for the host-side veth end using mac.GenerateRandMAC, which can fail. The error wraps that failure. Random MACs are set explicitly so systemd does not rewrite the addresses of the veth pair.","triggerScenarios":"Calling NewLinkPair (or the anonymous setup path) when mac.GenerateRandMAC fails — e.g. crypto/rand cannot supply entropy or the generated bytes fail the library's unicast/multicast bit validation.","commonSituations":"Hosts with a depleted or blocked /dev/urandom (rare, e.g. very early boot or seccomp restrictions); a bug or misconfiguration in the mac package's constraints causing repeated generation failures.","solutions":["Retry link pair setup; entropy failures are usually transient","Verify /dev/urandom is readable inside the container/host","Check the cilium/pkg/mac package version for known generation bugs and upgrade","If persistent, replace the entropy source or pin MACs explicitly in configuration"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"f, err := os.Open(\"/dev/urandom\"); if err != nil { return fmt.Errorf(\"no entropy source: %w\", err) }; f.Close()","typeGuard":null,"tryCatchPattern":"peer, err := NewLinkPair(cfg)\nif err != nil {\n    if strings.Contains(err.Error(), \"unable to generate rnd mac addr\") {\n        // transient entropy failure: retry with backoff\n    }\n    return err\n}","preventionTips":["Ensure /dev/urandom is available in the container","Avoid running during extremely early boot when entropy is restricted","Keep the mac package updated","Check seccomp profiles don't block getrandom(2)"],"tags":["network","veth","mac-address","entropy"],"backgroundTag":"mac-generation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}