{"record":{"id":"99bd91fa0610e10e","repo":"netbirdio/netbird","slug":"creating-default-subnet-w","errorCode":null,"errorMessage":"creating default subnet: %w","messagePattern":"creating default subnet: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"client/firewall/uspfilter/forwarder/forwarder.go","lineNumber":117,"sourceCode":"\tif v6 := iface.Address().IPv6; v6.IsValid() {\n\t\tv6Addr := tcpip.ProtocolAddress{\n\t\t\tProtocol: ipv6.ProtocolNumber,\n\t\t\tAddressWithPrefix: tcpip.AddressWithPrefix{\n\t\t\t\tAddress:   tcpip.AddrFrom16(v6.As16()),\n\t\t\t\tPrefixLen: iface.Address().IPv6Net.Bits(),\n\t\t\t},\n\t\t}\n\t\tif err := s.AddProtocolAddress(nicID, v6Addr, stack.AddressProperties{}); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"add IPv6 protocol address: %s\", err)\n\t\t}\n\t}\n\n\tdefaultSubnet, err := tcpip.NewSubnet(\n\t\ttcpip.AddrFrom4([4]byte{0, 0, 0, 0}),\n\t\ttcpip.MaskFromBytes([]byte{0, 0, 0, 0}),\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating default subnet: %w\", err)\n\t}\n\n\tdefaultSubnetV6, err := tcpip.NewSubnet(\n\t\ttcpip.AddrFrom16([16]byte{}),\n\t\ttcpip.MaskFromBytes(make([]byte, 16)),\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating default v6 subnet: %w\", err)\n\t}\n\n\tif err := s.SetPromiscuousMode(nicID, true); err != nil {\n\t\treturn nil, fmt.Errorf(\"set promiscuous mode: %s\", err)\n\t}\n\tif err := s.SetSpoofing(nicID, true); err != nil {\n\t\treturn nil, fmt.Errorf(\"set spoofing: %s\", err)\n\t}\n\n\ts.SetRouteTable([]tcpip.Route{","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/uspfilter/forwarder/forwarder.go#L99-L135","documentation":"Returned when tcpip.NewSubnet rejects the default IPv4 catch-all 0.0.0.0/0. NewSubnet only fails when the mask is non-contiguous (not a valid prefix mask), which cannot happen with the literal 0,0,0,0 mask hardcoded here. This is a defensive check around a practically unreachable error in gVisor's subnet API.","triggerScenarios":"Only fires if the hardcoded zero mask bytes are somehow non-contiguous (memory corruption, a fork of gVisor with different NewSubnet semantics, or a refactor that replaces the literals with computed masks).","commonSituations":"Virtually never seen in the field; appears in error catalogs because the constructor propagates it. Developers copying this code and substituting a computed mask (e.g. from user input) can hit it when the mask has non-contiguous bits.","solutions":["No action needed for the literal-constant form; treat as an invariant assertion","If you refactored the mask to be computed, validate the prefix with tcpip.NewSubnet-adjacent logic or derive the mask via tcpip.MaskFromBits only from a valid prefix length","Report upstream if genuinely hit with unmodified constants, since it would indicate state corruption"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Go: this is an error return from a constructor\nf, err := forwarder.New(iface, logger, flowLogger, netstack, mtu)\nif err != nil {\n    log.Errorf(\"forwarder init failed: %v\", err)\n    return err\n}","preventionTips":["Do not replace the literal zero masks with computed values","If you fork the constructor, keep masks derived only from validated prefix lengths"],"tags":["go","netbird","gvisor","netstack","defensive"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}