What causes "src faker raw conn: %s" in netbirdio/netbird?

Treat as benign teardown noise; the closed flag prevents repeated closes from close() itself

src faker raw conn: %s

Error message

src faker raw conn: %s

What it means

Appended to the close() multierror when SrcFaker.Close() (which just closes the underlying raw socket) fails. The SrcFaker exists only while the proxy was redirected to fake packet source addresses (RedirectAs, used for direct peerings to keep the WG socket bound to one port); it may already be nil if no redirect ever happened or Work() closed it during un-redirect.

Source

Thrown at client/iface/wgproxy/udp/proxy.go:200

	p.cancel()

	p.pausedCond.L.Lock()
	p.paused = false
	p.pausedCond.Signal()
	p.pausedCond.L.Unlock()

	if err := p.remoteConn.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
		result = multierror.Append(result, fmt.Errorf("remote conn: %s", err))
	}

	if err := p.localConn.Close(); err != nil {
		result = multierror.Append(result, fmt.Errorf("local conn: %s", err))
	}

	if p.srcFakerConn != nil {
		if err := p.srcFakerConn.Close(); err != nil {
			result = multierror.Append(result, fmt.Errorf("src faker raw conn: %s", err))
		}
	}

	return cerrors.FormatErrorOrNil(result)
}

// proxyToRemote proxies from Wireguard to the RemoteKey
func (p *WGUDPProxy) proxyToRemote(ctx context.Context) {
	defer func() {
		if err := p.close(); err != nil {
			log.Warnf("error in proxy to remote loop: %s", err)
		}
	}()

	buf := make([]byte, p.mtu+bufsize.WGBufferOverhead)
	for ctx.Err() == nil {
		n, err := p.localConn.Read(buf)
		if err != nil {

View on GitHub (pinned to 93e97f4bf1)

Solutions

Treat as benign teardown noise; the closed flag prevents repeated closes from close() itself
If raw-socket fd leaks are suspected, track `ls /proc/$(pgrep -x netbird)/fd` across redirects
Upgrade the agent - redirect/close interleaving has been a churn area

Defensive patterns

Strategy: try-catch

Try / catch

if err := p.srcFakerConn.Close(); err != nil {
    if errors.Is(err, syscall.EBADF) || errors.Is(err, net.ErrClosed) {
        log.Debugf("src faker already closed during redirect swap: %v", err)
    } else {
        result = multierror.Append(result, fmt.Errorf("src faker raw conn: %w", err))
    }
}

Prevention

Serialize RedirectAs/Work/close against each other - they coordinate via different locks (pausedCond vs closeMu) and can race on srcFakerConn
Nil out srcFakerConn immediately after closing so a second close path sees nil instead of a dead socket
Monitor raw-socket fd counts during rapid direct/relay transitions

When it happens

Trigger: Close racing with Work()/RedirectAs() swapping srcFakerConn (they close the old one under pausedCond, close() runs under closeMu, and the two locks do not serialize each other); raw socket fd already invalid.

Common situations: Peer transitions relay->direct->relay; shutdown right after a redirect switch. Because Work() and RedirectAs nil out srcFakerConn after closing it, the residual error usually means a double close slipped through the race window.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/215d82a123b918fb. Report an issue: GitHub.