{"record":{"id":"ddc4ac36763d4a19","repo":"slackhq/nebula","slug":"failed-to-create-route-routemessage-for-change-w","errorCode":null,"errorMessage":"failed to create route.RouteMessage for change: %w","messagePattern":"failed to create route\\.RouteMessage for change: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_freebsd.go","lineNumber":654,"sourceCode":"\t\t\tunix.RTAX_DST:     &netroute.Inet6Addr{IP: prefix.Masked().Addr().As16()},\n\t\t\tunix.RTAX_NETMASK: &netroute.Inet6Addr{IP: prefixToMask(prefix).As16()},\n\t\t\tunix.RTAX_GATEWAY: gateway,\n\t\t}\n\t}\n\n\tdata, err := route.Marshal()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create route.RouteMessage: %w\", err)\n\t}\n\n\t_, err = unix.Write(sock, data[:])\n\tif err != nil {\n\t\tif errors.Is(err, unix.EEXIST) {\n\t\t\t// Try to do a change\n\t\t\troute.Type = unix.RTM_CHANGE\n\t\t\tdata, err = route.Marshal()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create route.RouteMessage for change: %w\", err)\n\t\t\t}\n\t\t\t_, err = unix.Write(sock, data[:])\n\t\t\treturn err\n\t\t}\n\t\treturn fmt.Errorf(\"failed to write route.RouteMessage to socket: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc delRoute(prefix netip.Prefix, gateway netroute.Addr) error {\n\tsock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create AF_ROUTE socket: %v\", err)\n\t}\n\tdefer unix.Close(sock)\n\n\troute := netroute.RouteMessage{","sourceCodeStart":636,"sourceCodeEnd":672,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_freebsd.go#L636-L672","documentation":"In addRoute (overlay/tun_freebsd.go:654), when adding a route via an AF_ROUTE socket fails with unix.EEXIST, the code retries with an RTM_CHANGE route.RouteMessage. This error is thrown if route.Marshal() fails while building that change message, meaning the route message could not be serialized for the kernel routing socket.","triggerScenarios":"Calling addRoute with a prefix/gateway combination whose marshaled RouteMessage exceeds the buffer capacity (RS_MAX size limits), or an invalid address family (e.g. a gateway netip.Addr that doesn't match the prefix's family) causing netroute.RouteMessage.Marshal to fail.","commonSituations":"Configured routes where the gateway address family mismatches the destination prefix (IPv4 route with IPv6 gateway or vice versa); corrupted runtime route state after a reload; extremely unusual route options making the message exceed kernel buffer size.","solutions":["Verify the gateway and prefix use the same address family (both IPv4 or both IPv6) in the tunneled_routes / route configuration.","Check the wrapped err (%w) for the specific Marshal failure (e.g. address family mismatch, message too large) and correct the offending route entry.","Update Go/x/sys and netroute dependencies, since Marshal behavior changed across versions.","Simplify unusual route entries (very long flag combinations) that could exceed the RTM message size limit."],"exampleFix":"// before\nroutes:\n  - prefix: 10.0.0.0/8\n    gateway: fd00::1   # IPv6 gateway for IPv4 route\n// after\nroutes:\n  - prefix: 10.0.0.0/8\n    gateway: 10.0.0.1  # matching IPv4 gateway","handlingStrategy":"validation","validationCode":"func validRoutePair(prefix netip.Prefix, gw netroute.Addr) bool {\n\treturn (prefix.Addr().Is4() && gw.Is4()) || (prefix.Addr().Is6() && gw.Is6())\n}","typeGuard":"func isSameFamily(prefix netip.Prefix, gw netroute.Addr) bool {\n\treturn prefix.Addr().BitLen() == gw.BitLen()\n}","tryCatchPattern":"if err := addRoute(prefix, gw); err != nil {\n\tvar merr *fmt.WrapError // inspect wrapped Marshal cause\n\tlog.Printf(\"route change marshal failed for %v via %v: %v\", prefix, gw, err)\n}","preventionTips":["Keep gateway and prefix in the same address family in route config.","Test route configurations on the target FreeBSD version before deployment.","Keep golang.org/x/sys/netroute dependencies current."],"tags":["freebsd","routing","network"],"backgroundTag":"route-message-marshal-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}