{"record":{"id":"fce814125e1f6632","repo":"netbirdio/netbird","slug":"set-network-layer-for-checksum-w","errorCode":null,"errorMessage":"set network layer for checksum: %w","messagePattern":"set network layer for checksum: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/iface/wgproxy/udp/rawsocket.go","lineNumber":137,"sourceCode":"\t\tipv6 := &layers.IPv6{\n\t\t\tDstIP:      localHostNetIPAddrV6.IP,\n\t\t\tSrcIP:      srcAddr.IP,\n\t\t\tVersion:    6,\n\t\t\tHopLimit:   64,\n\t\t\tNextHeader: layers.IPProtocolUDP,\n\t\t}\n\t\tipH = ipv6\n\t\tnetworkLayer = ipv6\n\t}\n\n\tudpH := &layers.UDP{\n\t\tSrcPort: layers.UDPPort(srcAddr.Port),\n\t\tDstPort: layers.UDPPort(dstPort), // dst is the localhost WireGuard port\n\t}\n\n\terr := udpH.SetNetworkLayerForChecksum(networkLayer)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"set network layer for checksum: %w\", err)\n\t}\n\n\treturn ipH, udpH, nil\n}\n","sourceCodeStart":119,"sourceCodeEnd":142,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/iface/wgproxy/udp/rawsocket.go#L119-L142","documentation":"Returned by prepareHeaders when UDP.SetNetworkLayerForChecksum rejects the network layer passed to it. gopacket's implementation only accepts *layers.IPv4 or *layers.IPv6; anything else (nil, a different layer type) errors. In this function the two branches always assign either the IPv4 or the IPv6 layer, so the error is a defensive guard that current code cannot reach.","triggerScenarios":"Only reachable if both the `srcAddr.IP.To4() != nil` branch and its else somehow leave networkLayer unset - i.e., a refactor bug or memory corruption. The address-family check mirrors NewSrcFaker's socket choice, so they stay consistent by construction.","commonSituations":"Effectively never seen; would only appear in forks that add a third family branch or reorder the checks between NewSrcFaker and prepareHeaders.","solutions":["Report as an internal invariant if it ever fires, with the srcAddr value","Audit forks for changes to the To4() family selection that diverge between raw socket creation and header preparation"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func isSupportedNetworkLayer(l gopacket.NetworkLayer) bool {\n    switch l.(type) {\n    case *layers.IPv4, *layers.IPv6:\n        return true\n    default:\n        return false\n    }\n}","tryCatchPattern":"if err := udpH.SetNetworkLayerForChecksum(networkLayer); err != nil {\n    // unreachable with current branches; fail loudly to catch refactors\n    return nil, nil, fmt.Errorf(\"set network layer for checksum: %w\", err)\n}","preventionTips":["Keep the address-family decision (To4()) in one place shared by socket creation and header preparation","Add the type guard above in tests asserting prepareHeaders always returns IPv4/IPv6 layers","Any third family added later must update both NewSrcFaker and prepareHeaders together"],"tags":["go","netbird","gopacket","unreachable-invariant","checksum"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}