{"record":{"id":"89012014564f8074","repo":"slackhq/nebula","slug":"error-creating-ip-s","errorCode":null,"errorMessage":"error creating IP: %s","messagePattern":"error creating IP: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"service/service.go","lineNumber":103,"sourceCode":"\t}\n\tipv4Subnet, _ := tcpip.NewSubnet(tcpip.AddrFrom4([4]byte{0x00, 0x00, 0x00, 0x00}), tcpip.MaskFrom(strings.Repeat(\"\\x00\", 4)))\n\ts.ipstack.SetRouteTable([]tcpip.Route{\n\t\t{\n\t\t\tDestination: ipv4Subnet,\n\t\t\tNIC:         nicID,\n\t\t},\n\t})\n\n\tipNet := device.Networks()\n\tpa := tcpip.ProtocolAddress{\n\t\tAddressWithPrefix: tcpip.AddrFromSlice(ipNet[0].Addr().AsSlice()).WithPrefix(),\n\t\tProtocol:          ipv4.ProtocolNumber,\n\t}\n\tif err := s.ipstack.AddProtocolAddress(nicID, pa, stack.AddressProperties{\n\t\tPEB:        stack.CanBePrimaryEndpoint, // zero value default\n\t\tConfigType: stack.AddressConfigStatic,  // zero value default\n\t}); err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating IP: %s\", err)\n\t}\n\n\tconst tcpReceiveBufferSize = 0\n\tconst maxInFlightConnectionAttempts = 1024\n\ttcpFwd := tcp.NewForwarder(s.ipstack, tcpReceiveBufferSize, maxInFlightConnectionAttempts, s.tcpHandler)\n\ts.ipstack.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpFwd.HandlePacket)\n\n\treader, writer := device.Pipe()\n\n\tgo func() {\n\t\t<-ctx.Done()\n\t\treader.Close()\n\t\twriter.Close()\n\t}()\n\n\t// create Goroutines to forward packets between Nebula and Gvisor\n\teg.Go(func() error {\n\t\tbuf := make([]byte, header.IPv4MaximumHeaderSize+header.IPv4MaximumPayloadSize)","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/service/service.go#L85-L121","documentation":"service.New assigns the netstack's static IPv4 address with AddProtocolAddress(nicID, pa, ...); failure is fatal and wrapped as 'error creating IP'. The address (provided via the Nebula cert/tun config) could not be installed on the NIC.","triggerScenarios":"service.New is called with a protocol address whose NIC ID does not exist, the address format is invalid, the address is malformed (not a valid IPv4 with prefix), or a gVisor version rejects the AddressProperties configuration.","commonSituations":"Nebula cert encodes an invalid or overridden tun IP; address parsing upstream produced a tcpip.ProtocolAddress that gVisor rejects; running two service instances conflicting on addressing; gVisor API changes to AddProtocolAddress/AddressProperties.","solutions":["Verify the IP parsed from the certificate/tun config is a valid IPv4 with correct prefix length","Ensure CreateNIC succeeded for nicID before AddProtocolAddress (ordering in New)","Check the wrapped error text for the specific tcpip code and fix the address source accordingly","Upgrade/pin gVisor to match the stack.AddressProperties API used here"],"exampleFix":"// before\n Addr: tcpip.AddrFrom4([4]byte{10, 0, 0}) // truncated/invalid 3-byte address\n// after\n Addr: tcpip.AddrFrom4([4]byte{10, 0, 0, 5}) // full valid IPv4 from cert networks","handlingStrategy":"try-catch","validationCode":"ip, _, err := net.ParseCIDR(hostIP)\nif err != nil || ip.To4() == nil {\n    return fmt.Errorf(\"invalid IPv4 for netstack: %s\", hostIP)\n}","typeGuard":"func isIPv4WithPrefix(s string) bool {\n    ip, _, err := net.ParseCIDR(s)\n    return err == nil && ip.To4() != nil\n}","tryCatchPattern":"svc, err := service.New(...)\nif err != nil {\n    if strings.Contains(err.Error(), \"error creating IP\") {\n        log.Fatalf(\"failed to assign netstack address; check cert networks/tun IP: %v\", err)\n    }\n    return err\n}","preventionTips":["Verify certificate networks encode a valid IPv4/prefix","Ensure cert IP and tun config agree","Keep gVisor version matching the AddProtocolAddress/AddressProperties API","Reissue certs if the encoded IP is malformed"],"tags":["netstack","gvisor","ip-address"],"backgroundTag":"invalid-ip-address","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}