SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Android app crashes when Rosenpass is enabled #2183

New Issue
Open
opened 2025-11-20 07:05:26 -05:00 by saavagebueno · 8 comments
saavagebueno commented 2025-11-20 07:05:26 -05:00
Owner
Copy Link

Originally created by @guedressel on GitHub (Aug 14, 2025).

Describe the problem

In the Android app I enable Rosenpass in the advance settings, then I hit "connect". After connecting and showing the number of peers the app crashes.
When I disable Rosenpass again, the connection gets established without crashing.

Are you using NetBird Cloud?

Yes - NetBird Cloud.

NetBird version

Android app version 0.1.7

Is any other VPN software installed?

Yes. Tailscale and Proton VPN, but they are disabled.

Debug output

08-14 13:44:58.548 16782 16814 I GoLog   : time=2025-08-14T11:44:58.548Z level=DEBUG msg="Sending message" pid="YlGGu+cD21f3rjjIbZetFv48emNOVz1AmoTGnjagqpg=" type=InitHello
08-14 13:44:58.550 16782 16814 I GoLog   : time=2025-08-14T11:44:58.550Z level=DEBUG msg="Started new handshake" pid="YlGGu+cD21f3rjjIbZetFv48emNOVz1AmoTGnjagqpg=" sidi=6aa98752
08-14 13:44:58.551 16782 16814 I GoLog   : time=2025-08-14T11:44:58.551Z level=DEBUG msg="Added peer" pid="YlGGu+cD21f3rjjIbZetFv48emNOVz1AmoTGnjagqpg="
08-14 13:44:58.554 16782     0 E Go      : panic: runtime error: invalid memory address or nil pointer dereference
08-14 13:44:58.554 16782     0 E Go      : [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x6c606e327c]
08-14 13:44:58.554 16782     0 E Go      : 
08-14 13:44:58.554 16782     0 E Go      : goroutine 494 [running]:
08-14 13:44:58.554 16782     0 E Go      : github.com/netbirdio/netbird/client/internal/rosenpass.(*NetbirdHandler).AddPeer(...)
08-14 13:44:58.554 16782     0 E Go      : 	/Users/pzoli/netbird/android-client/netbird/client/internal/rosenpass/netbird_handler.go:44
08-14 13:44:58.554 16782     0 E Go      : github.com/netbirdio/netbird/client/internal/rosenpass.(*Manager).addPeer(0x4000907080, {0x40030fa000?, 0x6c5fa5c07d?, 0x2b?}, {0x4000010230, 0x6}, {0x40035c2820, 0xe}, {0x4000a5a390, 0x2c})
08-14 13:44:58.554 16782     0 E Go      : 	/Users/pzoli/netbird/android-client/netbird/client/internal/rosenpass/manager.go:86 +0x2ac
08-14 13:44:58.554 16782     0 E Go      : github.com/netbirdio/netbird/client/internal/rosenpass.(*Manager).OnConnected(0x4000907080, {0x4000a5a390, 0x2c}, {0x40030fa000, 0x7ff80, 0x80000}, {0x40035c2820, 0xe}, {0x4000010230, 0x6})
08-14 13:44:58.554 16782     0 E Go      : 	/Users/pzoli/netbird/android-client/netbird/client/internal/rosenpass/manager.go:188 +0x1a8
08-14 13:44:58.554 16782     0 E Go      : github.com/netbirdio/netbird/client/internal/peer.(*Conn).doOnConnected(0x40000caa08, {0x40030fa000, 0x7ff80, 0x80000}, {0x4000010230, 0x6})
08-14 13:44:58.554 16782     0 E Go      : 	/Users/pzoli/netbird/android-client/netbird/client/internal/peer/conn.go:652 +0xa4
08-14 13:44:58.554 16782     0 E Go      : github.com/netbirdio/netbird/client/internal/peer.(*Conn).onRelayConnectionIsReady(0x40000caa08, {{0x6c60c08218, 0x40035c0780}, {0x40030fa000, 0x7ff80, 0x80000}, {0x4000010230, 0x6}})
08-14 13:44:58.554 16782     0 E Go      : 	/Users/pzoli/netbird/android-client/netbird/client/internal/peer/conn.go:530 +0x530
08-14 13:44:58.554 16782     0 E Go      : created by github.com/netbirdio/netbird/client/internal/peer.(*WorkerRelay).OnNewOffer in goroutine 246
08-14 13:44:58.554 16782     0 E Go      : 	/Users/pzoli/netbird/android-client/netbird/client/internal/peer/worker_relay.go:87 +0x3c4
08-14 13:44:58.554 16782 16815 F libc    : Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 16815 (Thread-4), pid 16782 (.netbird.client)
08-14 13:44:58.708 17867 17867 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
08-14 13:44:58.711 17867 17867 I crash_dump64: performing dump of process 16782 (target tid = 16815)
08-14 13:44:58.994 17867 17867 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
08-14 13:44:58.994 17867 17867 F DEBUG   : Build fingerprint: 'google/tokay/tokay:16/BP2A.250705.008/13578956:user/release-keys'
08-14 13:44:58.994 17867 17867 F DEBUG   : Revision: 'MP1.0'
08-14 13:44:58.994 17867 17867 F DEBUG   : ABI: 'arm64'
08-14 13:44:58.994 17867 17867 F DEBUG   : Timestamp: 2025-08-14 13:44:58.723194595+0200
08-14 13:44:58.994 17867 17867 F DEBUG   : Process uptime: 278s
08-14 13:44:58.994 17867 17867 F DEBUG   : Cmdline: io.netbird.client
08-14 13:44:58.994 17867 17867 F DEBUG   : pid: 16782, tid: 16815, name: Thread-4  >>> io.netbird.client <<<
08-14 13:44:58.994 17867 17867 F DEBUG   : uid: 1010420
08-14 13:44:58.994 17867 17867 F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
08-14 13:44:58.994 17867 17867 F DEBUG   : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
08-14 13:44:58.994 17867 17867 F DEBUG   : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
08-14 13:44:58.994 17867 17867 F DEBUG   :     x0  0000000000000000  x1  00000000000041af  x2  0000000000000006  x3  0000000000000008
08-14 13:44:58.994 17867 17867 F DEBUG   :     x4  0000000000000001  x5  0000000000000001  x6  0000000000000000  x7  000000000000000a
08-14 13:44:58.994 17867 17867 F DEBUG   :     x8  0000000000000083  x9  000000000000005c  x10 0000000000000006  x11 0000006c60f020ba
08-14 13:44:58.994 17867 17867 F DEBUG   :     x12 0000000000000005  x13 0000000000000010  x14 0000000000000004  x15 000000000000001c
08-14 13:44:58.994 17867 17867 F DEBUG   :     x16 0000006c54901b90  x17 0000006c549f9040  x18 0000006c547ac000  x19 000000000000418e
08-14 13:44:58.994 17867 17867 F DEBUG   :     x20 0000006c549f8ee0  x21 0000004000071808  x22 000000000000001c  x23 6a371f67747cf4b9
08-14 13:44:58.994 17867 17867 F DEBUG   :     x24 de1334d706e8ff4b  x25 1c2d2cc2815a36cc  x26 0000000000000000  x27 0000000000000010
08-14 13:44:58.994 17867 17867 F DEBUG   :     x28 0000004000a2f6c0  x29 000000400098f9a8
08-14 13:44:58.994 17867 17867 F DEBUG   :     lr  0000006c5fc92f50  sp  000000400098f9b0  pc  0000006c5fcb8dd8  pst 0000000080001000
08-14 13:44:58.994 17867 17867 F DEBUG   : 1 total frames
08-14 13:44:58.994 17867 17867 F DEBUG   : backtrace:
08-14 13:44:58.994 17867 17867 F DEBUG   :       #00 pc 00000000006afdd8  /data/app/~~fPCYJ-q2cHydcguYT7v_yg==/io.netbird.client-XjPbHrLHqC6Rf01q9iWfyQ==/split_config.arm64_v8a.apk (offset 0x4000) (runtime.raise.abi0+40) (BuildId: 269325c02f9e0a958cf5f866975f0fb6676642de)
Originally created by @guedressel on GitHub (Aug 14, 2025). **Describe the problem** In the Android app I enable Rosenpass in the advance settings, then I hit "connect". After connecting and showing the number of peers the app crashes. When I disable Rosenpass again, the connection gets established without crashing. **Are you using NetBird Cloud?** Yes - NetBird Cloud. **NetBird version** Android app version 0.1.7 **Is any other VPN software installed?** Yes. Tailscale and Proton VPN, but they are disabled. **Debug output** ``` 08-14 13:44:58.548 16782 16814 I GoLog : time=2025-08-14T11:44:58.548Z level=DEBUG msg="Sending message" pid="YlGGu+cD21f3rjjIbZetFv48emNOVz1AmoTGnjagqpg=" type=InitHello 08-14 13:44:58.550 16782 16814 I GoLog : time=2025-08-14T11:44:58.550Z level=DEBUG msg="Started new handshake" pid="YlGGu+cD21f3rjjIbZetFv48emNOVz1AmoTGnjagqpg=" sidi=6aa98752 08-14 13:44:58.551 16782 16814 I GoLog : time=2025-08-14T11:44:58.551Z level=DEBUG msg="Added peer" pid="YlGGu+cD21f3rjjIbZetFv48emNOVz1AmoTGnjagqpg=" 08-14 13:44:58.554 16782 0 E Go : panic: runtime error: invalid memory address or nil pointer dereference 08-14 13:44:58.554 16782 0 E Go : [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x6c606e327c] 08-14 13:44:58.554 16782 0 E Go : 08-14 13:44:58.554 16782 0 E Go : goroutine 494 [running]: 08-14 13:44:58.554 16782 0 E Go : github.com/netbirdio/netbird/client/internal/rosenpass.(*NetbirdHandler).AddPeer(...) 08-14 13:44:58.554 16782 0 E Go : /Users/pzoli/netbird/android-client/netbird/client/internal/rosenpass/netbird_handler.go:44 08-14 13:44:58.554 16782 0 E Go : github.com/netbirdio/netbird/client/internal/rosenpass.(*Manager).addPeer(0x4000907080, {0x40030fa000?, 0x6c5fa5c07d?, 0x2b?}, {0x4000010230, 0x6}, {0x40035c2820, 0xe}, {0x4000a5a390, 0x2c}) 08-14 13:44:58.554 16782 0 E Go : /Users/pzoli/netbird/android-client/netbird/client/internal/rosenpass/manager.go:86 +0x2ac 08-14 13:44:58.554 16782 0 E Go : github.com/netbirdio/netbird/client/internal/rosenpass.(*Manager).OnConnected(0x4000907080, {0x4000a5a390, 0x2c}, {0x40030fa000, 0x7ff80, 0x80000}, {0x40035c2820, 0xe}, {0x4000010230, 0x6}) 08-14 13:44:58.554 16782 0 E Go : /Users/pzoli/netbird/android-client/netbird/client/internal/rosenpass/manager.go:188 +0x1a8 08-14 13:44:58.554 16782 0 E Go : github.com/netbirdio/netbird/client/internal/peer.(*Conn).doOnConnected(0x40000caa08, {0x40030fa000, 0x7ff80, 0x80000}, {0x4000010230, 0x6}) 08-14 13:44:58.554 16782 0 E Go : /Users/pzoli/netbird/android-client/netbird/client/internal/peer/conn.go:652 +0xa4 08-14 13:44:58.554 16782 0 E Go : github.com/netbirdio/netbird/client/internal/peer.(*Conn).onRelayConnectionIsReady(0x40000caa08, {{0x6c60c08218, 0x40035c0780}, {0x40030fa000, 0x7ff80, 0x80000}, {0x4000010230, 0x6}}) 08-14 13:44:58.554 16782 0 E Go : /Users/pzoli/netbird/android-client/netbird/client/internal/peer/conn.go:530 +0x530 08-14 13:44:58.554 16782 0 E Go : created by github.com/netbirdio/netbird/client/internal/peer.(*WorkerRelay).OnNewOffer in goroutine 246 08-14 13:44:58.554 16782 0 E Go : /Users/pzoli/netbird/android-client/netbird/client/internal/peer/worker_relay.go:87 +0x3c4 08-14 13:44:58.554 16782 16815 F libc : Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 16815 (Thread-4), pid 16782 (.netbird.client) 08-14 13:44:58.708 17867 17867 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto 08-14 13:44:58.711 17867 17867 I crash_dump64: performing dump of process 16782 (target tid = 16815) 08-14 13:44:58.994 17867 17867 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 08-14 13:44:58.994 17867 17867 F DEBUG : Build fingerprint: 'google/tokay/tokay:16/BP2A.250705.008/13578956:user/release-keys' 08-14 13:44:58.994 17867 17867 F DEBUG : Revision: 'MP1.0' 08-14 13:44:58.994 17867 17867 F DEBUG : ABI: 'arm64' 08-14 13:44:58.994 17867 17867 F DEBUG : Timestamp: 2025-08-14 13:44:58.723194595+0200 08-14 13:44:58.994 17867 17867 F DEBUG : Process uptime: 278s 08-14 13:44:58.994 17867 17867 F DEBUG : Cmdline: io.netbird.client 08-14 13:44:58.994 17867 17867 F DEBUG : pid: 16782, tid: 16815, name: Thread-4 >>> io.netbird.client <<< 08-14 13:44:58.994 17867 17867 F DEBUG : uid: 1010420 08-14 13:44:58.994 17867 17867 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE) 08-14 13:44:58.994 17867 17867 F DEBUG : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY) 08-14 13:44:58.994 17867 17867 F DEBUG : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr -------- 08-14 13:44:58.994 17867 17867 F DEBUG : x0 0000000000000000 x1 00000000000041af x2 0000000000000006 x3 0000000000000008 08-14 13:44:58.994 17867 17867 F DEBUG : x4 0000000000000001 x5 0000000000000001 x6 0000000000000000 x7 000000000000000a 08-14 13:44:58.994 17867 17867 F DEBUG : x8 0000000000000083 x9 000000000000005c x10 0000000000000006 x11 0000006c60f020ba 08-14 13:44:58.994 17867 17867 F DEBUG : x12 0000000000000005 x13 0000000000000010 x14 0000000000000004 x15 000000000000001c 08-14 13:44:58.994 17867 17867 F DEBUG : x16 0000006c54901b90 x17 0000006c549f9040 x18 0000006c547ac000 x19 000000000000418e 08-14 13:44:58.994 17867 17867 F DEBUG : x20 0000006c549f8ee0 x21 0000004000071808 x22 000000000000001c x23 6a371f67747cf4b9 08-14 13:44:58.994 17867 17867 F DEBUG : x24 de1334d706e8ff4b x25 1c2d2cc2815a36cc x26 0000000000000000 x27 0000000000000010 08-14 13:44:58.994 17867 17867 F DEBUG : x28 0000004000a2f6c0 x29 000000400098f9a8 08-14 13:44:58.994 17867 17867 F DEBUG : lr 0000006c5fc92f50 sp 000000400098f9b0 pc 0000006c5fcb8dd8 pst 0000000080001000 08-14 13:44:58.994 17867 17867 F DEBUG : 1 total frames 08-14 13:44:58.994 17867 17867 F DEBUG : backtrace: 08-14 13:44:58.994 17867 17867 F DEBUG : #00 pc 00000000006afdd8 /data/app/~~fPCYJ-q2cHydcguYT7v_yg==/io.netbird.client-XjPbHrLHqC6Rf01q9iWfyQ==/split_config.arm64_v8a.apk (offset 0x4000) (runtime.raise.abi0+40) (BuildId: 269325c02f9e0a958cf5f866975f0fb6676642de) ```
saavagebueno added the triage-needed label 2025-11-20 07:05:26 -05:00
saavagebueno commented 2025-11-20 07:05:28 -05:00
Author
Owner
Copy Link

@Ghx0sty commented on GitHub (Aug 21, 2025):

Having the exact same issue. I've noticed the crash specifically occurs the second you connect to at least 1 other peer with Rosenpass enabled.

@guedressel out of interest, what type of Android device are you using, and does it run a custom ROM/forked version of Android?

@Ghx0sty commented on GitHub (Aug 21, 2025): Having the exact same issue. I've noticed the crash specifically occurs the second you connect to at least 1 other peer with Rosenpass enabled. @guedressel out of interest, what type of Android device are you using, and does it run a custom ROM/forked version of Android?
saavagebueno commented 2025-11-20 07:05:28 -05:00
Author
Owner
Copy Link

@xcslabs commented on GitHub (Sep 15, 2025):

Xiaomi-14 on android 15 (security patch 2005 - 08) / Netbird self-hosted. Same issue:

When rosenpass is deactivated from app it works, but obviously cannot connect to peers.
When enabling rosenpass:

...
...
...
09-15 11:26:33.096 26856 15365 I GoLog   : time=2025-09-15T09:26:33.096Z level=DEBUG msg="Started new handshake" pid="0kRst31dM2kVXr0B0M6Pd/8Q+B7VmZ/V+jVn/nu953w=" sidi=6e0a69bf
09-15 11:26:33.098 26856 15366 I GoLog   : time=2025-09-15T09:26:33.098Z level=DEBUG msg="Added peer" pid="0kRst31dM2kVXr0B0M6Pd/8Q+B7VmZ/V+jVn/nu953w="
09-15 11:26:33.100 26856     0 E Go      : panic: runtime error: invalid memory address or nil pointer dereference
09-15 11:26:33.100 26856     0 E Go      : [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x6ebbf36f50]
09-15 11:26:33.100 26856     0 E Go      : 
09-15 11:26:33.100 26856     0 E Go      : goroutine 1856 [running]:
09-15 11:26:33.100 26856     0 E Go      : github.com/netbirdio/netbird/client/internal/rosenpass.(*NetbirdHandler).AddPeer(...)
09-15 11:26:33.100 26856     0 E Go      : 	/home/runner/work/android-client/android-client/netbird/client/internal/rosenpass/netbird_handler.go:44
09-15 11:26:33.100 26856     0 E Go      : github.com/netbirdio/netbird/client/internal/rosenpass.(*Manager).addPeer(0x4004012a00, {0x4004406000?, 0x6ebb24a09b?, 0x2b?}, {0x400621b876, 0x6}, {0x400406a2b0, 0xe}, {0x4000859f50, 0x2c})
09-15 11:26:33.100 26856     0 E Go      : 	/home/runner/work/android-client/android-client/netbird/client/internal/rosenpass/manager.go:86 +0x2b0
09-15 11:26:33.100 26856     0 E Go      : github.com/netbirdio/netbird/client/internal/rosenpass.(*Manager).OnConnected(0x4004012a00, {0x4000859f50, 0x2c}, {0x4004406000, 0x7ff80, 0x80000}, {0x400406a2b0, 0xe}, {0x400621b876, 0x6})
09-15 11:26:33.100 26856     0 E Go      : 	/home/runner/work/android-client/android-client/netbird/client/internal/rosenpass/manager.go:188 +0x1b0
09-15 11:26:33.100 26856     0 E Go      : github.com/netbirdio/netbird/client/internal/peer.(*Conn).doOnConnected(0x4002b58248, {0x4004406000, 0x7ff80, 0x80000}, {0x400621b876, 0x6})
09-15 11:26:33.100 26856     0 E Go      : 	/home/runner/work/android-client/android-client/netbird/client/internal/peer/conn.go:623 +0xa8
09-15 11:26:33.100 26856     0 E Go      : github.com/netbirdio/netbird/client/internal/peer.(*Conn).onRelayConnectionIsReady(0x4002b58248, {{0x6ebc3cd510, 0x4003c2c740}, {0x4004406000, 0x7ff80, 0x80000}, {0x400621b876, 0x6}})
09-15 11:26:33.100 26856     0 E Go      : 	/home/runner/work/android-client/android-client/netbird/client/internal/peer/conn.go:502 +0x524
09-15 11:26:33.100 26856     0 E Go      : created by github.com/netbirdio/netbird/client/internal/peer.(*WorkerRelay).OnNewOffer in goroutine 1573
09-15 11:26:33.100 26856     0 E Go      : 	/home/runner/work/android-client/android-client/netbird/client/internal/peer/worker_relay.go:89 +0x3fc
09-15 11:26:33.101 26856 21406 I libc    : handling signal: 6
--------- beginning of crash
09-15 11:26:33.101 26856 21406 F libc    : Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 21406 (.netbird.client), pid 26856 (.netbird.client)
09-15 11:26:33.101 26856 21406 I libc    : debuggerd_dispatch_pseudothread start. crashing tid: 21406
09-15 11:26:33.123 26856 21406 I libc    : crash_dump pid: 21433
...
...
...
@xcslabs commented on GitHub (Sep 15, 2025): Xiaomi-14 on android 15 (security patch 2005 - 08) / Netbird self-hosted. Same issue: When rosenpass is deactivated from app it works, but obviously cannot connect to peers. When enabling rosenpass: ``` ... ... ... 09-15 11:26:33.096 26856 15365 I GoLog : time=2025-09-15T09:26:33.096Z level=DEBUG msg="Started new handshake" pid="0kRst31dM2kVXr0B0M6Pd/8Q+B7VmZ/V+jVn/nu953w=" sidi=6e0a69bf 09-15 11:26:33.098 26856 15366 I GoLog : time=2025-09-15T09:26:33.098Z level=DEBUG msg="Added peer" pid="0kRst31dM2kVXr0B0M6Pd/8Q+B7VmZ/V+jVn/nu953w=" 09-15 11:26:33.100 26856 0 E Go : panic: runtime error: invalid memory address or nil pointer dereference 09-15 11:26:33.100 26856 0 E Go : [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x6ebbf36f50] 09-15 11:26:33.100 26856 0 E Go : 09-15 11:26:33.100 26856 0 E Go : goroutine 1856 [running]: 09-15 11:26:33.100 26856 0 E Go : github.com/netbirdio/netbird/client/internal/rosenpass.(*NetbirdHandler).AddPeer(...) 09-15 11:26:33.100 26856 0 E Go : /home/runner/work/android-client/android-client/netbird/client/internal/rosenpass/netbird_handler.go:44 09-15 11:26:33.100 26856 0 E Go : github.com/netbirdio/netbird/client/internal/rosenpass.(*Manager).addPeer(0x4004012a00, {0x4004406000?, 0x6ebb24a09b?, 0x2b?}, {0x400621b876, 0x6}, {0x400406a2b0, 0xe}, {0x4000859f50, 0x2c}) 09-15 11:26:33.100 26856 0 E Go : /home/runner/work/android-client/android-client/netbird/client/internal/rosenpass/manager.go:86 +0x2b0 09-15 11:26:33.100 26856 0 E Go : github.com/netbirdio/netbird/client/internal/rosenpass.(*Manager).OnConnected(0x4004012a00, {0x4000859f50, 0x2c}, {0x4004406000, 0x7ff80, 0x80000}, {0x400406a2b0, 0xe}, {0x400621b876, 0x6}) 09-15 11:26:33.100 26856 0 E Go : /home/runner/work/android-client/android-client/netbird/client/internal/rosenpass/manager.go:188 +0x1b0 09-15 11:26:33.100 26856 0 E Go : github.com/netbirdio/netbird/client/internal/peer.(*Conn).doOnConnected(0x4002b58248, {0x4004406000, 0x7ff80, 0x80000}, {0x400621b876, 0x6}) 09-15 11:26:33.100 26856 0 E Go : /home/runner/work/android-client/android-client/netbird/client/internal/peer/conn.go:623 +0xa8 09-15 11:26:33.100 26856 0 E Go : github.com/netbirdio/netbird/client/internal/peer.(*Conn).onRelayConnectionIsReady(0x4002b58248, {{0x6ebc3cd510, 0x4003c2c740}, {0x4004406000, 0x7ff80, 0x80000}, {0x400621b876, 0x6}}) 09-15 11:26:33.100 26856 0 E Go : /home/runner/work/android-client/android-client/netbird/client/internal/peer/conn.go:502 +0x524 09-15 11:26:33.100 26856 0 E Go : created by github.com/netbirdio/netbird/client/internal/peer.(*WorkerRelay).OnNewOffer in goroutine 1573 09-15 11:26:33.100 26856 0 E Go : /home/runner/work/android-client/android-client/netbird/client/internal/peer/worker_relay.go:89 +0x3fc 09-15 11:26:33.101 26856 21406 I libc : handling signal: 6 --------- beginning of crash 09-15 11:26:33.101 26856 21406 F libc : Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 21406 (.netbird.client), pid 26856 (.netbird.client) 09-15 11:26:33.101 26856 21406 I libc : debuggerd_dispatch_pseudothread start. crashing tid: 21406 09-15 11:26:33.123 26856 21406 I libc : crash_dump pid: 21433 ... ... ... ```
saavagebueno commented 2025-11-20 07:05:28 -05:00
Author
Owner
Copy Link

@kreisklasse commented on GitHub (Sep 17, 2025):

Have the same issue as @guedressel and the others on a Samsung Pad Android 13 and a Google Pixel 8 Android 16 (September 2025 update state). Both with the latest netbird app v0.57.0 and UI version v0.1.9

@kreisklasse commented on GitHub (Sep 17, 2025): Have the same issue as @guedressel and the others on a Samsung Pad Android 13 and a Google Pixel 8 Android 16 (September 2025 update state). Both with the latest netbird app v0.57.0 and UI version v0.1.9
saavagebueno commented 2025-11-20 07:05:28 -05:00
Author
Owner
Copy Link

@Blacks-Army commented on GitHub (Oct 11, 2025):

I am also having this issue

@Blacks-Army commented on GitHub (Oct 11, 2025): I am also having this issue
saavagebueno commented 2025-11-20 07:05:28 -05:00
Author
Owner
Copy Link

@jhf2442 commented on GitHub (Oct 12, 2025):

Same for me - ref https://github.com/netbirdio/android-client/issues/87

@jhf2442 commented on GitHub (Oct 12, 2025): Same for me - ref https://github.com/netbirdio/android-client/issues/87
saavagebueno commented 2025-11-20 07:05:28 -05:00
Author
Owner
Copy Link

@davidsmith91 commented on GitHub (Oct 19, 2025):

Same issue.

@davidsmith91 commented on GitHub (Oct 19, 2025): Same issue.
saavagebueno commented 2025-11-20 07:05:29 -05:00
Author
Owner
Copy Link

@davidsmith91 commented on GitHub (Oct 19, 2025):

I gave both the logs and the files related to the logs of @xcslabs to ChatGPT 5.0 Extended Thinking.

This is the answer ChatGPT gave, and possibly the solution or at least a start
@Ghx0sty @guedressel

I don't know who I should tag (who are the main developers)
Please help me tag them so it can get fixed

CHATGPT Answer:
Here’s a concise comment you can paste into the GitHub issue—what’s happening, why it crashes on Android (GrapheneOS/Xiaomi, etc.), and what the proper fix is so Rosenpass actually works (not just hiding the panic).

Summary (user perspective)
The app panics when a peer connects. This is not just a crash: it also means Rosenpass isn’t actually applying preshared keys to WireGuard on Android, so you don’t get the promised “quantum-resistance.” The code currently masks an initialization error and then dereferences a nil handler.

What’s happening

  • The crash is a nil-pointer panic in rosenpass.NetbirdHandler.AddPeer called from rosenpass.Manager.addPeer during OnConnected.

  • In netbird/client/internal/rosenpass/manager.go, generateConfig() calls:

    // file: netbird/client/internal/rosenpass/manager.go
m.rpWgHandler, _ = NewNetbirdHandler(m.preSharedKey, m.ifaceName) // error ignored

    If NewNetbirdHandler fails, it returns (nil, err). Because the error is ignored, m.rpWgHandler stays nil.
    Later, addPeer(...) calls m.rpWgHandler.AddPeer(...) → nil receiver → panic.

  • Why does NewNetbirdHandler fail? In netbird/client/internal/rosenpass/netbird_handler.go it does:

    // file: netbird/client/internal/rosenpass/netbird_handler.go
hdlr.client, err = wgctrl.New()

    On Android (GrapheneOS, Xiaomi, etc.), wgctrl.New() commonly fails because the process can’t access the kernel WG API or a userspace WG UAPI socket at the expected path. SELinux/permissions and non-standard UAPI locations are typical causes. So the handler never initializes.

Bottom line: ignoring that constructor error both causes the panic and can make the app look like Rosenpass is active when it can’t actually apply keys.

Why this matters

Without a working handler, Rosenpass never updates the WireGuard peer’s preshared key after the handshake. That means you don’t get the intended post-quantum protection on Android—even if logs/UI hint that Rosenpass is “enabled.”

Best fix (not just hiding the crash)

A. Fail fast instead of continuing with a nil handler
Propagate the error and abort Rosenpass startup if the handler can’t be built:

// file: netbird/client/internal/rosenpass/manager.go
- m.rpWgHandler, _ = NewNetbirdHandler(m.preSharedKey, m.ifaceName)
+ var err error
+ m.rpWgHandler, err = NewNetbirdHandler(m.preSharedKey, m.ifaceName /* see B */)
+ if err != nil {
+     return rp.Config{}, fmt.Errorf("creating rosenpass wg handler: %w", err)
+ }

(Also add a nil check before using m.rpWgHandler in addPeer / removePeer to prevent any future regressions.)

B. Make Rosenpass work on Android by removing the hard dependency on wgctrl
On Android, don’t rely on wgctrl. NetBird already configures WG locally via its own interfaces (WGIface / EndpointUpdater). Use those to apply the PSK that comes from Rosenpass:

  1. Introduce a small interface the handler can use to set a peer’s PSK and read current peers:
// file: netbird/client/internal/rosenpass/wg_configurator.go
type WGConfigurator interface {
    UpdatePeerPSK(pub wgtypes.Key, psk *wgtypes.Key, endpoint *net.UDPAddr, allowedIPs []wgtypes.IPNet) error
    PeerSnapshot() ([]wgtypes.Peer, error)
    RemovePeer(pub wgtypes.Key) error
}
  1. Provide an Android implementation of WGConfigurator that calls the existing NetBird Android WG code (no wgctrl):
// file: netbird/client/internal/rosenpass/wg_configurator_android.go
//go:build android
type wgConfiguratorAndroid struct { /* holds your WGIface */ }
  1. Change NetbirdHandler to depend on WGConfigurator instead of wgctrl.Client:
// file: netbird/client/internal/rosenpass/netbird_handler.go
- client *wgctrl.Client
+ cfg    WGConfigurator

…and replace client.Device(...) / ConfigureDevice(...) with cfg.PeerSnapshot(...) / cfg.UpdatePeerPSK(...) / cfg.RemovePeer(...).

  1. In manager.go, construct the right configurator per platform and pass it to NewNetbirdHandler(...). On Android, use the Android adapter; on desktop/server builds you can keep a default wgctrl-based adapter.

C. Don’t advertise “Rosenpass enabled” until it actually applied a key
Gate any “Rosenpass enabled” / status bit behind a successful call to UpdatePeerPSK(...) (e.g., set a simple “healthy” flag in the handler after the first successful apply). That prevents false positives when the handler couldn’t initialize.

Why this is the right approach

  • It surfaces the real error (instead of crashing later on a nil) and avoids misleading users.
  • It makes Rosenpass actually functional on Android (GrapheneOS, Xiaomi, etc.) by using the configuration path that already works there.
  • It preserves the existing wgctrl path on platforms where it does work.
  • It gives a clear health signal so the UI/logs only claim “Rosenpass enabled” when keys are actually being rotated.

Minimal acceptance criteria / testing

  1. On Android, connect two peers and observe that after handshake the handler logs a successful PSK apply (e.g., “applied rosenpass PSK to ”).
  2. Verify via your WG state that the peer’s preshared key changes post-handshake.
  3. Ensure the app does not mark Rosenpass enabled (or silently continue) if the handler cannot initialize.

If maintainers prefer to keep wgctrl everywhere, they’ll need to ensure a working UAPI path and permissions on Android—which is brittle across devices/ROMs. The adapter approach above is more robust and keeps the promise of Rosenpass on Android without special privileges.

@davidsmith91 commented on GitHub (Oct 19, 2025): I gave both the logs and the files related to the logs of @xcslabs to ChatGPT 5.0 Extended Thinking. This is the answer ChatGPT gave, and possibly the solution or at least a start @Ghx0sty @guedressel I don't know who I should tag (who are the main developers) Please help me tag them so it can get fixed --- CHATGPT Answer: Here’s a concise comment you can paste into the GitHub issue—what’s happening, why it crashes on Android (GrapheneOS/Xiaomi, etc.), and what the **proper** fix is so Rosenpass actually works (not just hiding the panic). --- **Summary (user perspective)** The app panics when a peer connects. This is not just a crash: it also means Rosenpass isn’t actually applying preshared keys to WireGuard on Android, so you don’t get the promised “quantum-resistance.” The code currently masks an initialization error and then dereferences a nil handler. --- ## What’s happening * The crash is a nil-pointer panic in `rosenpass.NetbirdHandler.AddPeer` called from `rosenpass.Manager.addPeer` during `OnConnected`. * In `netbird/client/internal/rosenpass/manager.go`, `generateConfig()` calls: ```go // file: netbird/client/internal/rosenpass/manager.go m.rpWgHandler, _ = NewNetbirdHandler(m.preSharedKey, m.ifaceName) // error ignored ``` If `NewNetbirdHandler` fails, it returns `(nil, err)`. Because the error is ignored, `m.rpWgHandler` stays **nil**. Later, `addPeer(...)` calls `m.rpWgHandler.AddPeer(...)` → nil receiver → panic. * Why does `NewNetbirdHandler` fail? In `netbird/client/internal/rosenpass/netbird_handler.go` it does: ```go // file: netbird/client/internal/rosenpass/netbird_handler.go hdlr.client, err = wgctrl.New() ``` On Android (GrapheneOS, Xiaomi, etc.), `wgctrl.New()` commonly fails because the process can’t access the kernel WG API or a userspace WG UAPI socket at the expected path. SELinux/permissions and non-standard UAPI locations are typical causes. So the handler never initializes. **Bottom line:** ignoring that constructor error both causes the panic and can make the app *look* like Rosenpass is active when it can’t actually apply keys. --- ## Why this matters Without a working handler, Rosenpass never updates the WireGuard peer’s preshared key after the handshake. That means you don’t get the intended post-quantum protection on Android—even if logs/UI hint that Rosenpass is “enabled.” --- ## Best fix (not just hiding the crash) **A. Fail fast instead of continuing with a nil handler** Propagate the error and abort Rosenpass startup if the handler can’t be built: ```diff // file: netbird/client/internal/rosenpass/manager.go - m.rpWgHandler, _ = NewNetbirdHandler(m.preSharedKey, m.ifaceName) + var err error + m.rpWgHandler, err = NewNetbirdHandler(m.preSharedKey, m.ifaceName /* see B */) + if err != nil { + return rp.Config{}, fmt.Errorf("creating rosenpass wg handler: %w", err) + } ``` (Also add a nil check before using `m.rpWgHandler` in `addPeer` / `removePeer` to prevent any future regressions.) **B. Make Rosenpass work on Android by removing the hard dependency on `wgctrl`** On Android, don’t rely on `wgctrl`. NetBird already configures WG locally via its own interfaces (`WGIface` / `EndpointUpdater`). Use those to apply the PSK that comes from Rosenpass: 1. Introduce a small interface the handler can use to set a peer’s PSK and read current peers: ```go // file: netbird/client/internal/rosenpass/wg_configurator.go type WGConfigurator interface { UpdatePeerPSK(pub wgtypes.Key, psk *wgtypes.Key, endpoint *net.UDPAddr, allowedIPs []wgtypes.IPNet) error PeerSnapshot() ([]wgtypes.Peer, error) RemovePeer(pub wgtypes.Key) error } ``` 2. Provide an **Android implementation** of `WGConfigurator` that calls the existing NetBird Android WG code (no `wgctrl`): ```go // file: netbird/client/internal/rosenpass/wg_configurator_android.go //go:build android type wgConfiguratorAndroid struct { /* holds your WGIface */ } ``` 3. Change `NetbirdHandler` to depend on `WGConfigurator` instead of `wgctrl.Client`: ```diff // file: netbird/client/internal/rosenpass/netbird_handler.go - client *wgctrl.Client + cfg WGConfigurator ``` …and replace `client.Device(...) / ConfigureDevice(...)` with `cfg.PeerSnapshot(...) / cfg.UpdatePeerPSK(...) / cfg.RemovePeer(...)`. 4. In `manager.go`, construct the right configurator per platform and pass it to `NewNetbirdHandler(...)`. On Android, use the Android adapter; on desktop/server builds you can keep a default `wgctrl`-based adapter. **C. Don’t advertise “Rosenpass enabled” until it actually applied a key** Gate any “Rosenpass enabled” / status bit behind a **successful call** to `UpdatePeerPSK(...)` (e.g., set a simple “healthy” flag in the handler after the first successful apply). That prevents false positives when the handler couldn’t initialize. --- ## Why this is the right approach * It surfaces the **real** error (instead of crashing later on a nil) and avoids misleading users. * It makes Rosenpass **actually functional on Android** (GrapheneOS, Xiaomi, etc.) by using the configuration path that already works there. * It preserves the existing `wgctrl` path on platforms where it *does* work. * It gives a clear health signal so the UI/logs only claim “Rosenpass enabled” when keys are actually being rotated. --- ## Minimal acceptance criteria / testing 1. On Android, connect two peers and observe that after handshake the handler logs a successful **PSK apply** (e.g., “applied rosenpass PSK to <pubkey>”). 2. Verify via your WG state that the peer’s **preshared key changes** post-handshake. 3. Ensure the app does **not** mark Rosenpass enabled (or silently continue) if the handler cannot initialize. --- If maintainers prefer to keep `wgctrl` everywhere, they’ll need to ensure a working UAPI path and permissions on Android—which is brittle across devices/ROMs. The adapter approach above is more robust and keeps the promise of Rosenpass on Android without special privileges.
saavagebueno commented 2025-11-20 07:05:29 -05:00
Author
Owner
Copy Link

@Exitium-DEV commented on GitHub (Oct 19, 2025):

+1, crash with Rosenpass

@Exitium-DEV commented on GitHub (Oct 19, 2025): +1, crash with Rosenpass
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2183
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?