netbirdio/netbird · warning

set network layer for checksum: %w

Error message

set network layer for checksum: %w

What it means

Returned by prepareHeaders when UDP.SetNetworkLayerForChecksum rejects the network layer passed to it. gopacket's implementation only accepts *layers.IPv4 or *layers.IPv6; anything else (nil, a different layer type) errors. In this function the two branches always assign either the IPv4 or the IPv6 layer, so the error is a defensive guard that current code cannot reach.

Source

Thrown at client/iface/wgproxy/udp/rawsocket.go:137

		ipv6 := &layers.IPv6{
			DstIP:      localHostNetIPAddrV6.IP,
			SrcIP:      srcAddr.IP,
			Version:    6,
			HopLimit:   64,
			NextHeader: layers.IPProtocolUDP,
		}
		ipH = ipv6
		networkLayer = ipv6
	}

	udpH := &layers.UDP{
		SrcPort: layers.UDPPort(srcAddr.Port),
		DstPort: layers.UDPPort(dstPort), // dst is the localhost WireGuard port
	}

	err := udpH.SetNetworkLayerForChecksum(networkLayer)
	if err != nil {
		return nil, nil, fmt.Errorf("set network layer for checksum: %w", err)
	}

	return ipH, udpH, nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Report as an internal invariant if it ever fires, with the srcAddr value
2. Audit forks for changes to the To4() family selection that diverge between raw socket creation and header preparation

func isSupportedNetworkLayer(l gopacket.NetworkLayer) bool {
    switch l.(type) {
    case *layers.IPv4, *layers.IPv6:
        return true
    default:
        return false
    }
}

if err := udpH.SetNetworkLayerForChecksum(networkLayer); err != nil {
    // unreachable with current branches; fail loudly to catch refactors
    return nil, nil, fmt.Errorf("set network layer for checksum: %w", err)
}

When it happens

Trigger: Only reachable if both the `srcAddr.IP.To4() != nil` branch and its else somehow leave networkLayer unset - i.e., a refactor bug or memory corruption. The address-family check mirrors NewSrcFaker's socket choice, so they stay consistent by construction.

Common situations: Effectively never seen; would only appear in forks that add a third family branch or reorder the checks between NewSrcFaker and prepareHeaders.

Related errors

• set network layer for TCP checksum: %w
• set network layer for UDP checksum: %w
• mixed address families: src=%s dst=%s
• serialize packet: %w
• build packet: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/fce814125e1f6632. Report an issue: GitHub.