{"record":{"id":"f91b0dee21998f87","repo":"slackhq/nebula","slug":"unable-to-create-af-route-socket-v-f91b0d","errorCode":null,"errorMessage":"unable to create AF_ROUTE socket: %v","messagePattern":"unable to create AF_ROUTE socket: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tun_openbsd.go","lineNumber":427,"sourceCode":"\t\t\tt.l.Error(\"Failed to remove route\", \"error\", err, \"route\", r)\n\t\t} else {\n\t\t\tt.l.Info(\"Removed route\", \"route\", r)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (t *tun) deviceBytes() (o [16]byte) {\n\tfor i, c := range t.Device {\n\t\to[i] = byte(c)\n\t}\n\treturn\n}\n\nfunc addRoute(prefix netip.Prefix, gateways []netip.Prefix) error {\n\tsock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create AF_ROUTE socket: %v\", err)\n\t}\n\tdefer unix.Close(sock)\n\n\troute := &netroute.RouteMessage{\n\t\tVersion: unix.RTM_VERSION,\n\t\tType:    unix.RTM_ADD,\n\t\tFlags:   unix.RTF_UP | unix.RTF_GATEWAY,\n\t\tSeq:     1,\n\t}\n\n\tif prefix.Addr().Is4() {\n\t\tgw, err := selectGateway(prefix, gateways)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\troute.Addrs = []netroute.Addr{\n\t\t\tunix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},\n\t\t\tunix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tun_openbsd.go#L409-L445","documentation":"addRoute opens a raw AF_ROUTE socket to send routing socket messages (RTM_ADD) to the kernel. If unix.Socket fails, the error is wrapped with this message. On OpenBSD this typically means the process lacks the privilege to open routing sockets.","triggerScenarios":"addIp or addRoutes invoking addRoute when socket(AF_ROUTE, SOCK_RAW, AF_UNSPEC) fails — unprivileged user, resource limits, or seccomp/pledge restrictions blocking socket creation.","commonSituations":"OpenBSD 'pledge' sandboxes without 'route' promise; running nebula as a non-root service; fd limits exhausted.","solutions":["Run the process as root or grant routing privileges","If using OpenBSD pledge, include the 'route' promise","Check ulimit -n / fd exhaustion if EMFILE is the cause","Ensure the service unit/config grants the needed capability"],"exampleFix":"# before\n$ ./nebula -config config.yaml  # unprivileged, AF_ROUTE denied\n# after\n$ doas ./nebula -config config.yaml","handlingStrategy":"fallback","validationCode":"probe, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)\nif err != nil {\n    return fmt.Errorf(\"cannot open routing socket (need root/pledge route): %w\", err)\n}\nunix.Close(probe)","typeGuard":null,"tryCatchPattern":"if err := t.Activate(); err != nil {\n    var errno syscall.Errno\n    if errors.As(err, &errno) && (errno == syscall.EPERM || errno == syscall.EACCES) {\n        log.Error(\"routing socket denied; run as root or add 'route' pledge\")\n    }\n    return err\n}","preventionTips":["Run with routing privileges (root or appropriate group/pledge)","Include 'route' in OpenBSD pledge promises","Monitor fd limits to avoid EMFILE on socket creation"],"tags":["openbsd","route","socket","privileges","af-route"],"backgroundTag":"route-add-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}