netbirdio/netbird · error

could not generate random state: %v

Error message

could not generate random state: %v

What it means

Returned by PKCEAuthorizationFlow.RequestAuthInfo when randomBytesInHex(24) fails while generating the OAuth state parameter (client/internal/auth/pkce_flow.go:137-140). randomBytesInHex (client/internal/auth/util.go:13) does io.ReadFull from crypto/rand.Reader; failure means the OS entropy source is unavailable or returned an error. On Linux, getrandom(2) blocks or fails only in genuinely broken environments, so this is a rare host-level condition rather than a configuration issue.

Source

Thrown at client/internal/auth/pkce_flow.go:139

		Scopes:      strings.Split(config.Scope, " "),
	}

	return &PKCEAuthorizationFlow{
		providerConfig: config,
		oAuthConfig:    cfg,
	}, nil
}

// GetClientID returns the provider client id
func (p *PKCEAuthorizationFlow) GetClientID(_ context.Context) string {
	return p.providerConfig.ClientID
}

// RequestAuthInfo requests a authorization code login flow information.
func (p *PKCEAuthorizationFlow) RequestAuthInfo(ctx context.Context) (AuthFlowInfo, error) {
	state, err := randomBytesInHex(24)
	if err != nil {
		return AuthFlowInfo{}, fmt.Errorf("could not generate random state: %v", err)
	}
	p.state = state

	codeVerifier, err := randomBytesInHex(64)
	if err != nil {
		return AuthFlowInfo{}, fmt.Errorf("could not create a code verifier: %v", err)
	}
	p.codeVerifier = codeVerifier

	codeChallenge := createCodeChallenge(codeVerifier)

	params := []oauth2.AuthCodeOption{
		oauth2.SetAuthURLParam("code_challenge_method", "S256"),
		oauth2.SetAuthURLParam("code_challenge", codeChallenge),
		oauth2.SetAuthURLParam("audience", p.providerConfig.Audience),
	}
	if !p.providerConfig.DisablePromptLogin {
		switch p.providerConfig.LoginFlag {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Retry the login once the host has been up and gathered entropy (check: cat /proc/sys/kernel/random/entropy_avail)
2. In containers/VMs, use a modern kernel and consider virtio-rng to feed guest entropy
3. Audit seccomp/sandbox profiles to confirm the getrandom syscall is allowed for the netbird process

// Probe entropy availability before launching the flow (Linux)
func entropyAvailable() bool {
	b, err := os.ReadFile("/proc/sys/kernel/random/entropy_avail")
	if err != nil {
		return true // non-Linux: assume ok
	}
	n, err := strconv.Atoi(strings.TrimSpace(string(b)))
	return err == nil && n > 128
}

if err != nil && strings.Contains(err.Error(), "could not generate random state") {
	// host entropy problem: wait/retry, fix the environment (virtio-rng, sandbox rules)
}

When it happens

Trigger: crypto/rand.Reader read fails: container/VM booted without an entropy source, a hardened or sandboxed runtime denying getrandom, kernel entropy starvation on embedded systems, or (Linux <3.17 / getrandom-emulating setups) blocking early in boot.

Common situations: Minimal VMs or containers started before the CRNG is initialized; seccomp/AppArmor profiles blocking getrandom; extremely early-boot agents. Practically never seen on normal desktops and servers.

Related errors

• could not create a code verifier: %v
• could not generate %d random bytes: %v
• generate root key: %w
• %s %s
• failed to create artifact key: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/aaf3486744c1ce15. Report an issue: GitHub.