{"record":{"id":"aaf3486744c1ce15","repo":"netbirdio/netbird","slug":"could-not-generate-random-state-v","errorCode":null,"errorMessage":"could not generate random state: %v","messagePattern":"could not generate random state: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/internal/auth/pkce_flow.go","lineNumber":139,"sourceCode":"\t\tScopes:      strings.Split(config.Scope, \" \"),\n\t}\n\n\treturn &PKCEAuthorizationFlow{\n\t\tproviderConfig: config,\n\t\toAuthConfig:    cfg,\n\t}, nil\n}\n\n// GetClientID returns the provider client id\nfunc (p *PKCEAuthorizationFlow) GetClientID(_ context.Context) string {\n\treturn p.providerConfig.ClientID\n}\n\n// RequestAuthInfo requests a authorization code login flow information.\nfunc (p *PKCEAuthorizationFlow) RequestAuthInfo(ctx context.Context) (AuthFlowInfo, error) {\n\tstate, err := randomBytesInHex(24)\n\tif err != nil {\n\t\treturn AuthFlowInfo{}, fmt.Errorf(\"could not generate random state: %v\", err)\n\t}\n\tp.state = state\n\n\tcodeVerifier, err := randomBytesInHex(64)\n\tif err != nil {\n\t\treturn AuthFlowInfo{}, fmt.Errorf(\"could not create a code verifier: %v\", err)\n\t}\n\tp.codeVerifier = codeVerifier\n\n\tcodeChallenge := createCodeChallenge(codeVerifier)\n\n\tparams := []oauth2.AuthCodeOption{\n\t\toauth2.SetAuthURLParam(\"code_challenge_method\", \"S256\"),\n\t\toauth2.SetAuthURLParam(\"code_challenge\", codeChallenge),\n\t\toauth2.SetAuthURLParam(\"audience\", p.providerConfig.Audience),\n\t}\n\tif !p.providerConfig.DisablePromptLogin {\n\t\tswitch p.providerConfig.LoginFlag {","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/pkce_flow.go#L121-L157","documentation":"Returned by PKCEAuthorizationFlow.RequestAuthInfo when randomBytesInHex(24) fails while generating the OAuth state parameter (client/internal/auth/pkce_flow.go:137-140). randomBytesInHex (client/internal/auth/util.go:13) does io.ReadFull from crypto/rand.Reader; failure means the OS entropy source is unavailable or returned an error. On Linux, getrandom(2) blocks or fails only in genuinely broken environments, so this is a rare host-level condition rather than a configuration issue.","triggerScenarios":"crypto/rand.Reader read fails: container/VM booted without an entropy source, a hardened or sandboxed runtime denying getrandom, kernel entropy starvation on embedded systems, or (Linux <3.17 / getrandom-emulating setups) blocking early in boot.","commonSituations":"Minimal VMs or containers started before the CRNG is initialized; seccomp/AppArmor profiles blocking getrandom; extremely early-boot agents. Practically never seen on normal desktops and servers.","solutions":["Retry the login once the host has been up and gathered entropy (check: cat /proc/sys/kernel/random/entropy_avail)","In containers/VMs, use a modern kernel and consider virtio-rng to feed guest entropy","Audit seccomp/sandbox profiles to confirm the getrandom syscall is allowed for the netbird process"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Probe entropy availability before launching the flow (Linux)\nfunc entropyAvailable() bool {\n\tb, err := os.ReadFile(\"/proc/sys/kernel/random/entropy_avail\")\n\tif err != nil {\n\t\treturn true // non-Linux: assume ok\n\t}\n\tn, err := strconv.Atoi(strings.TrimSpace(string(b)))\n\treturn err == nil && n > 128\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"could not generate random state\") {\n\t// host entropy problem: wait/retry, fix the environment (virtio-rng, sandbox rules)\n}","preventionTips":["Give VMs/containers an entropy source (virtio-rng) in deployment templates","Permit getrandom in seccomp/sandbox profiles for the agent","Retry after boot - most entropy failures vanish once the CRNG initializes"],"tags":["crypto","entropy","pkce","sandbox","vm"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}