{"record":{"id":"06a312f3563335ae","repo":"slackhq/nebula","slug":"groups-specified-as-s-but-host-any-will-match-an","errorCode":null,"errorMessage":"groups specified as %s, but host=any will match any host, regardless of groups","messagePattern":"groups specified as (.+?), but host=any will match any host, regardless of groups","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":1032,"sourceCode":"func (r *rule) sanity() error {\n\t//port, proto, local_cidr are AND, no need to check here\n\t//ca_sha and ca_name don't have a wildcard value, no need to check here\n\tgroupsEmpty := len(r.Groups) == 0\n\thostEmpty := r.Host == \"\"\n\tcidrEmpty := r.Cidr == \"\"\n\n\tif (groupsEmpty && hostEmpty && cidrEmpty) == true {\n\t\treturn nil //no content!\n\t}\n\n\tgroupsHasAny := slices.Contains(r.Groups, \"any\")\n\tif groupsHasAny && len(r.Groups) > 1 {\n\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the other groups specified\", r.Groups)\n\t}\n\n\tif r.Host == \"any\" {\n\t\tif !groupsEmpty {\n\t\t\treturn fmt.Errorf(\"groups specified as %s, but host=any will match any host, regardless of groups\", r.Groups)\n\t\t}\n\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"cidr specified as %s, but host=any will match any host, regardless of cidr\", r.Cidr)\n\t\t}\n\t}\n\n\tif groupsHasAny {\n\t\tif !hostEmpty && r.Host != \"any\" {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified host %s\", r.Groups, r.Host)\n\t\t}\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified cidr %s\", r.Groups, r.Cidr)\n\t\t}\n\t}\n\n\tif r.Code != \"\" {\n\t\treturn fmt.Errorf(\"code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional\", r.Code)","sourceCodeStart":1014,"sourceCodeEnd":1050,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L1014-L1050","documentation":"host: any matches every host regardless of groups, so specifying groups together with host 'any' is contradictory — the groups can never restrict anything. The rule translator rejects the rule to prevent a false sense of scoping.","triggerScenarios":"A rule with host: any and a non-empty groups list during rule translation (e.g. host: any, groups: [prod]).","commonSituations":"Author thinking host=any means 'any host in these groups'; converting a host-specific rule to any and forgetting to drop groups.","solutions":["Remove the groups field if you really want to match any host","Or replace host: any with the intended host name if you want groups to apply"],"exampleFix":"// before\nhost: any\ngroups: [prod]\n// after\nhost: any","handlingStrategy":"validation","validationCode":"func checkHostAnyRule(r FirewallRuleConfig) error {\n    if r.Host == \"any\" && len(r.Groups) > 0 {\n        return fmt.Errorf(\"host=any cannot be combined with groups\")\n    }\n    return nil\n}","typeGuard":"func isHostAnyConsistent(host string, groups []string) bool {\n    return host != \"any\" || len(groups) == 0\n}","tryCatchPattern":"if err := loadFirewallConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"host=any will match any host\") {\n        return fmt.Errorf(\"redundant selectors with host=any: %w\", err)\n    }\n    return err\n}","preventionTips":["Remember host=any means the groups field must be empty","If you need group scoping, name the host explicitly instead of 'any'","Lint rules combining host: any with groups or cidr"],"tags":["go","firewall","config","host"],"backgroundTag":"firewall-rule-invalid","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}