{"record":{"id":"de5f1d534ff2e861","repo":"netbirdio/netbird","slug":"create-ipset-s-w","errorCode":null,"errorMessage":"create ipset %s: %w","messagePattern":"create ipset (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/iptables/acl_linux.go","lineNumber":553,"sourceCode":"\tdefer func() {\n\t\tif err := ipset.Destroy(probeName); err != nil {\n\t\t\tlog.Debugf(\"destroy ipset probe set %q: %v\", probeName, err)\n\t\t}\n\t}()\n\n\treturn true\n}\n\nfunc (m *aclManager) createIPSet(name string) error {\n\topts := ipset.CreateOptions{\n\t\tReplace: true,\n\t}\n\tif m.v6 {\n\t\topts.Family = ipset.FamilyIPV6\n\t}\n\n\tif err := ipset.Create(name, ipset.TypeHashNet, opts); err != nil {\n\t\treturn fmt.Errorf(\"create ipset %s: %w\", name, err)\n\t}\n\n\tlog.Debugf(\"created ipset %s with type hash:net\", name)\n\treturn nil\n}\n\nfunc (m *aclManager) addToIPSet(name string, ip net.IP) error {\n\tcidr := uint8(32)\n\tif ip.To4() == nil {\n\t\tcidr = 128\n\t}\n\n\tentry := &ipset.Entry{\n\t\tIP:      ip,\n\t\tCIDR:    cidr,\n\t\tReplace: true,\n\t}\n","sourceCodeStart":535,"sourceCodeEnd":571,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/iptables/acl_linux.go#L535-L571","documentation":"This is the createIPSet helper: a netlink CREATE of a hash:net set (Replace:true, FamilyIPV6 when m.v6) failed. It fails without CAP_NET_ADMIN, when ip_set/ip_set_hash_net modules are absent, or on an invalid name (ipset caps names at 31 characters). Callers wrap it again (error 481), so logs can show 'create ipset: create ipset <name>: ...' with the inner message carrying the netlink errno.","triggerScenarios":"First use of a new ruleset ipset on a host lacking the ipset kernel modules; unprivileged agent; generated set name over 31 chars; kernel namespace where netlink CREATE is filtered by seccomp/AppArmor.","commonSituations":"Minimal VM images and containers without module auto-load; long peer-group-derived set names; security-hardened deployments restricting netlink.","solutions":["Run as root / grant CAP_NET_ADMIN and CAP_NET_MODULE.","Pre-load ip_set and ip_set_hash_net at boot or image build.","Keep set names <=31 characters.","If modules genuinely cannot load, disable the ipset path so the manager falls back to per-IP rules."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"func ensureIPSetCreatePossible(name string) error {\n    if len(name) > 31 {\n        return fmt.Errorf(\"ipset name %q exceeds 31-char limit\", name)\n    }\n    if os.Geteuid() != 0 {\n        return errors.New(\"ipset CREATE requires CAP_NET_ADMIN\")\n    }\n    if _, err := os.Stat(\"/proc/net/ipset\"); err != nil {\n        return errors.New(\"ipset subsystem unavailable (modprobe ip_set)\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := mgr.AddPeerFiltering(...); err != nil {\n    if strings.Contains(err.Error(), \"create ipset\") {\n        // EPERM -> privileges; missing module -> load ip_set_hash_net; long name -> shorten\n        log.Errorf(\"ipset create failed: %v\", err)\n    }\n}","preventionTips":["Cap generated ipset names at 31 characters at the naming layer.","Bake `modprobe ip_set ip_set_hash_net` into image entrypoints or use built-in kernels.","Grant CAP_NET_ADMIN and CAP_NET_MODULE to the daemon.","When ipset truly is unavailable, configure the manager to use its non-ipset rule path."],"tags":["go","linux","ipset","netlink","permissions","kernel-modules","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}