slackhq/nebula · error

unknown address type %v

Error message

unknown address type %v

What it means

addIp only handles prefixes whose address is IPv4 or IPv6. If cidr.Addr() is neither (which for netip.Prefix should be impossible with valid input, but guards netip.PrefixFrom zero values / invalid prefixes), it returns this error with the prefix printed. It is a defensive programming error indicating malformed prefix input.

Source

Thrown at overlay/tun_openbsd.go:291

			Addr:   prefixToMask(cidr).As16(),
		}
		req.Lifetime[0] = 0xffffffff
		req.Lifetime[1] = 0xffffffff

		s, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, unix.IPPROTO_IP)
		if err != nil {
			return err
		}
		defer syscall.Close(s)

		if err := ioctl(uintptr(s), SIOCAIFADDR_IN6, uintptr(unsafe.Pointer(&req))); err != nil {
			return fmt.Errorf("failed to set tun address %s: %s", cidr.Addr().String(), err)
		}

		return nil
	}

	return fmt.Errorf("unknown address type %v", cidr)
}

func (t *tun) Activate() error {
	err := t.doIoctlByName(unix.SIOCSIFMTU, uint32(t.MTU))
	if err != nil {
		return fmt.Errorf("failed to set tun mtu: %w", err)
	}

	for i := range t.vpnNetworks {
		err = t.addIp(t.vpnNetworks[i])
		if err != nil {
			return err
		}
	}

	return t.addRoutes(false)
}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Validate all netip.Prefix values are IsValid() before constructing the tun
2. Fix config parsing so invalid networks are rejected early
3. Check the printed %v value to identify which prefix was invalid

Example fix

// before
p := netip.PrefixFrom(netip.Addr{}, 0) // invalid
t.addIp(p)
// after
if p.IsValid() { t.addIp(p) } else { return fmt.Errorf("invalid prefix") }

for _, p := range vpnNetworks {
    if !p.IsValid() {
        return fmt.Errorf("invalid vpn network prefix: %v", p)
    }
}

func validPrefixes(ps []netip.Prefix) bool {
    for _, p := range ps {
        if !p.IsValid() || p.Addr().Is4() == p.Addr().Is6() && p.Addr().IsValid() {
            return false
        }
    }
    return true
}

When it happens

Trigger: Passing an invalid/zero-value netip.Prefix into the vpnNetworks slice, e.g. from bad config parsing that produced PrefixFrom(0,0) entries.

Common situations: Programmatic construction of tun with hand-built prefixes; deserialization bugs producing zero prefixes rather than failing.

Related errors

• newTunFromFd not supported in openbsd
• a device name in the format of /dev/tunN must be specified
• error closing tun file: %w
• unable to determine IP version from packet
• failed to set tun address %s: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/87a390677e8b4d8a. Report an issue: GitHub.