{"record":{"id":"87a390677e8b4d8a","repo":"slackhq/nebula","slug":"unknown-address-type-v-87a390","errorCode":null,"errorMessage":"unknown address type %v","messagePattern":"unknown address type (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_openbsd.go","lineNumber":291,"sourceCode":"\t\t\tAddr:   prefixToMask(cidr).As16(),\n\t\t}\n\t\treq.Lifetime[0] = 0xffffffff\n\t\treq.Lifetime[1] = 0xffffffff\n\n\t\ts, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, unix.IPPROTO_IP)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer syscall.Close(s)\n\n\t\tif err := ioctl(uintptr(s), SIOCAIFADDR_IN6, uintptr(unsafe.Pointer(&req))); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set tun address %s: %s\", cidr.Addr().String(), err)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"unknown address type %v\", cidr)\n}\n\nfunc (t *tun) Activate() error {\n\terr := t.doIoctlByName(unix.SIOCSIFMTU, uint32(t.MTU))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to set tun mtu: %w\", err)\n\t}\n\n\tfor i := range t.vpnNetworks {\n\t\terr = t.addIp(t.vpnNetworks[i])\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn t.addRoutes(false)\n}\n","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_openbsd.go#L273-L309","documentation":"addIp only handles prefixes whose address is IPv4 or IPv6. If cidr.Addr() is neither (which for netip.Prefix should be impossible with valid input, but guards netip.PrefixFrom zero values / invalid prefixes), it returns this error with the prefix printed. It is a defensive programming error indicating malformed prefix input.","triggerScenarios":"Passing an invalid/zero-value netip.Prefix into the vpnNetworks slice, e.g. from bad config parsing that produced PrefixFrom(0,0) entries.","commonSituations":"Programmatic construction of tun with hand-built prefixes; deserialization bugs producing zero prefixes rather than failing.","solutions":["Validate all netip.Prefix values are IsValid() before constructing the tun","Fix config parsing so invalid networks are rejected early","Check the printed %v value to identify which prefix was invalid"],"exampleFix":"// before\np := netip.PrefixFrom(netip.Addr{}, 0) // invalid\nt.addIp(p)\n// after\nif p.IsValid() { t.addIp(p) } else { return fmt.Errorf(\"invalid prefix\") }","handlingStrategy":"validation","validationCode":"for _, p := range vpnNetworks {\n    if !p.IsValid() {\n        return fmt.Errorf(\"invalid vpn network prefix: %v\", p)\n    }\n}","typeGuard":"func validPrefixes(ps []netip.Prefix) bool {\n    for _, p := range ps {\n        if !p.IsValid() || p.Addr().Is4() == p.Addr().Is6() && p.Addr().IsValid() {\n            return false\n        }\n    }\n    return true\n}","tryCatchPattern":null,"preventionTips":["Always validate netip.Prefix with IsValid() before use","Reject invalid networks at config parse time","Avoid netip.PrefixFrom with zero Addr"],"tags":["openbsd","tun","address","invalid-input"],"backgroundTag":"invalid-network-prefix","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}