{"record":{"id":"656a3160298bab13","repo":"slackhq/nebula","slug":"unable-to-create-af-route-socket-v-656a31","errorCode":null,"errorMessage":"unable to create AF_ROUTE socket: %v","messagePattern":"unable to create AF_ROUTE socket: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_freebsd.go","lineNumber":617,"sourceCode":"\t\t\tt.l.Error(\"Failed to remove route\", \"error\", err, \"route\", r)\n\t\t} else {\n\t\t\tt.l.Info(\"Removed route\", \"route\", r)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (t *tun) deviceBytes() (o [16]byte) {\n\tfor i, c := range t.Device {\n\t\to[i] = byte(c)\n\t}\n\treturn\n}\n\nfunc addRoute(prefix netip.Prefix, gateway netroute.Addr) error {\n\tsock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create AF_ROUTE socket: %v\", err)\n\t}\n\tdefer unix.Close(sock)\n\n\troute := &netroute.RouteMessage{\n\t\tVersion: unix.RTM_VERSION,\n\t\tType:    unix.RTM_ADD,\n\t\tFlags:   unix.RTF_UP,\n\t\tSeq:     1,\n\t}\n\n\tif prefix.Addr().Is4() {\n\t\troute.Addrs = []netroute.Addr{\n\t\t\tunix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},\n\t\t\tunix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},\n\t\t\tunix.RTAX_GATEWAY: gateway,\n\t\t}\n\t} else {\n\t\troute.Addrs = []netroute.Addr{","sourceCodeStart":599,"sourceCodeEnd":635,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_freebsd.go#L599-L635","documentation":"addRoute adds a kernel route by sending a routing socket message over a raw AF_ROUTE socket. If unix.Socket(AF_ROUTE, SOCK_RAW, AF_UNSPEC) fails, this error wraps the errno. Without a routing socket the library cannot program routes, so the route add aborts.","triggerScenarios":"unix.Socket for the routing socket returns an error during addRoute (invoked from addRoutes after Activate) — most commonly EPERM/EACCES for an unprivileged process, or resource exhaustion.","commonSituations":"Running the tunnel daemon as a non-root user without route-management privileges; FreeBSD jails/security.mac restricting raw socket creation; fd exhaustion; hardened seclevel settings disallowing raw sockets.","solutions":["Run the process as root or with equivalent privileges to manage the routing table","Check the wrapped errno: EACCES/EPERM → privileges; EMFILE/ENFILE → fd limits","If running in a jail, verify the jail permits raw socket creation (allow.raw_sockets / vnet)","Pre-create routes manually with `route add` if you cannot grant privileges, and skip route programming"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-check privilege on unix via a probe socket\nif probe, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC); err != nil {\n    return fmt.Errorf(\"routing sockets unavailable (need root/jail raw-socket allowance): %w\", err)\n} else {\n    unix.Close(probe)\n}","typeGuard":null,"tryCatchPattern":"if err := addRoute(prefix, gw); err != nil {\n    if strings.Contains(err.Error(), \"unable to create AF_ROUTE socket\") {\n        log.Error(\"cannot create routing socket; run privileged or pre-add routes manually\", \"err\", err)\n        return err\n    }\n}","preventionTips":["Run route-managing daemons as root or with explicit capability grants","Verify jail settings permit raw sockets (allow.raw_sockets / vnet)","Monitor fd usage; EMFILE can also block socket creation","Fall back to pre-provisioned routes when privileges can't be granted"],"tags":["freebsd","routing","socket","privileges","network"],"backgroundTag":"routing-socket-creation-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}