{"record":{"id":"f2aecfed1ab6f50c","repo":"netbirdio/netbird","slug":"parse-ipc-config-w","errorCode":null,"errorMessage":"parse IPC config: %w","messagePattern":"parse IPC config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/iface/configurer/usp.go","lineNumber":146,"sourceCode":"\t}\n\treturn nil\n}\n\nfunc (c *WGUSPConfigurer) RemoveEndpointAddress(peerKey string) error {\n\tpeerKeyParsed, err := wgtypes.ParseKey(peerKey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parse peer key: %w\", err)\n\t}\n\n\tipcStr, err := c.device.IpcGet()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get IPC config: %w\", err)\n\t}\n\n\t// Parse current status to get allowed IPs for the peer\n\tstats, err := parseStatus(c.deviceName, ipcStr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parse IPC config: %w\", err)\n\t}\n\n\tvar allowedIPs []net.IPNet\n\tfound := false\n\tfor _, peer := range stats.Peers {\n\t\tif peer.PublicKey == peerKey {\n\t\t\tallowedIPs = peer.AllowedIPs\n\t\t\tfound = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !found {\n\t\treturn fmt.Errorf(\"peer %s not found\", peerKey)\n\t}\n\n\t// remove the peer from the WireGuard configuration\n\tpeer := wgtypes.PeerConfig{\n\t\tPublicKey: peerKeyParsed,","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/iface/configurer/usp.go#L128-L164","documentation":"RemoveEndpointAddress wrapped a parseStatus failure over the raw IpcGet dump. parseStatus is deliberately lenient: it logs and skips malformed lines (bad keys, bad CIDRs) and in the current code always returns a nil error, so this branch is defensive and effectively unreachable with a well-formed wireguard-go dump. If it ever fires, the IPC string came from an incompatible producer or was corrupted in memory.","triggerScenarios":"A wireguard-go version whose UAPI output diverges from the expected key=value lines; an IPC string produced by something other than the paired device; memory corruption or a data race on the dumped string.","commonSituations":"Vendored wireguard-go fork with altered UAPI serialization; test harness injecting hand-written IPC strings; version skew after a dependency bump.","solutions":["Pin or verify the wireguard-go version paired with this configurer","Capture the raw IPC dump when this triggers and diff it against expected UAPI lines","Keep parseStatus tolerant: skip unknown lines rather than failing the whole operation","Add a regression test feeding a known-good dump through RemoveEndpointAddress"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := uspCfg.RemoveEndpointAddress(peerKey); err != nil {\n\tif strings.Contains(err.Error(), \"parse IPC config\") {\n\t\t// capture the dump for diagnosis; parseStatus is lenient so this is near-unreachable\n\t\tlog.Debugf(\"parse IPC config failed for peer %s\", peerKey)\n\t}\n\treturn err\n}","preventionTips":["Pin the wireguard-go version so UAPI output shape cannot drift","Keep parsers tolerant of unknown lines so new UAPI fields do not break callers","Add fixture tests that push real IpcGet output through the parse path","Log dump length and first line on failure to identify foreign producers"],"tags":["wireguard-go","uapi","parsing","defense-in-depth","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}