{"record":{"id":"a55dd0f11b2b65d7","repo":"slackhq/nebula","slug":"unable-to-create-af-route-socket-v-a55dd0","errorCode":null,"errorMessage":"unable to create AF_ROUTE socket: %v","messagePattern":"unable to create AF_ROUTE socket: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"overlay/tun_netbsd.go","lineNumber":448,"sourceCode":"\t\t\tt.l.Error(\"Failed to remove route\", \"error\", err, \"route\", r)\n\t\t} else {\n\t\t\tt.l.Info(\"Removed route\", \"route\", r)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (t *tun) deviceBytes() (o [16]byte) {\n\tfor i, c := range t.Device {\n\t\to[i] = byte(c)\n\t}\n\treturn\n}\n\nfunc addRoute(prefix netip.Prefix, gateways []netip.Prefix) error {\n\tsock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create AF_ROUTE socket: %v\", err)\n\t}\n\tdefer unix.Close(sock)\n\n\troute := &netroute.RouteMessage{\n\t\tVersion: unix.RTM_VERSION,\n\t\tType:    unix.RTM_ADD,\n\t\tFlags:   unix.RTF_UP | unix.RTF_GATEWAY,\n\t\tSeq:     1,\n\t}\n\n\tif prefix.Addr().Is4() {\n\t\tgw, err := selectGateway(prefix, gateways)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\troute.Addrs = []netroute.Addr{\n\t\t\tunix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},\n\t\t\tunix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},","sourceCodeStart":430,"sourceCodeEnd":466,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_netbsd.go#L430-L466","documentation":"addRoute on NetBSD needs a raw routing socket (AF_ROUTE) to inject RTM_ADD messages into the kernel routing table. This error is returned when socket(AF_ROUTE, SOCK_RAW, AF_UNSPEC) fails. It indicates the process cannot create a routing socket, so the route cannot be installed.","triggerScenarios":"addRoute (via addRoutes) calling unix.Socket(unix.AF_ROUTE, ...) which fails, typically EACCES/EPERM because the process is not root, or resource exhaustion (EMFILE/ENFILE).","commonSituations":"Running the VPN client without root/CAP_NET_ADMIN on a NetBSD host; hitting the process file-descriptor limit; hardened security settings (securelevel) restricting routing sockets.","solutions":["Run the process as root or grant the equivalent network-administration privileges.","Check and raise the file-descriptor limit (ulimit -n) if errno is EMFILE/ENFILE.","Inspect the wrapped errno (%v) to determine the exact kernel rejection reason.","Verify no MAC/securelevel policy on the host blocks AF_ROUTE sockets for the user."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Before addRoutes: check we can create a routing socket\nprobe, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)\nif err != nil {\n    return fmt.Errorf(\"process lacks permission to create routing sockets; run as root: %w\", err)\n}\nunix.Close(probe)\n\n// and check fd headroom\nvar lim unix.Rlimit\nunix.Getrlimit(unix.RLIMIT_NOFILE, &lim)\nif lim.Cur < 64 {\n    return fmt.Errorf(\"file descriptor limit too low: %d\", lim.Cur)\n}","typeGuard":null,"tryCatchPattern":"if err := addRoute(prefix, gateways); err != nil {\n    var errno syscall.Errno\n    if errors.As(err, &errno) {\n        switch errno {\n        case unix.EPERM, unix.EACCES:\n            return fmt.Errorf(\"need root privileges to manage routes\")\n        case unix.EMFILE, unix.ENFILE:\n            return fmt.Errorf(\"fd limit reached; raise ulimit -n\")\n        }\n    }\n    return err\n}","preventionTips":["Run route-managing code as root or with equivalent privileges.","Raise RLIMIT_NOFILE if your service opens many sockets.","Probe AF_ROUTE socket creation early at startup to fail fast with a clear message.","Check host securelevel/MAC policies on hardened NetBSD systems."],"tags":["netbsd","routing","socket","permissions"],"backgroundTag":"route-socket-permission-denied","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}