{"record":{"id":"0a3370bb06641922","repo":"juanfont/headscale","slug":"w-q-only-is-allowed","errorCode":null,"errorMessage":"%w: %q, only \"*\" is allowed","messagePattern":"%w: %q, only \"\\*\" is allowed","errorType":"validation","errorClass":"ErrProtocolNoSpecificPorts","httpStatus":null,"severity":"error","filePath":"hscontrol/policy/v2/types.go","lineNumber":3184,"sourceCode":"\treturn &policy, nil\n}\n\n// validateProtocolPortCompatibility checks that only TCP, UDP, and SCTP [Protocol]s\n// can have specific ports. All other [Protocol]s should only use wildcard ports.\nfunc validateProtocolPortCompatibility(protocol Protocol, destinations []AliasWithPorts) error {\n\t// Only TCP, UDP, and SCTP support specific ports\n\tsupportsSpecificPorts := protocol == ProtocolNameTCP || protocol == ProtocolNameUDP || protocol == ProtocolNameSCTP || protocol == \"\"\n\n\tif supportsSpecificPorts {\n\t\treturn nil // No validation needed for these protocols\n\t}\n\n\t// For all other protocols, check that all destinations use wildcard ports\n\tfor _, dst := range destinations {\n\t\tfor _, portRange := range dst.Ports {\n\t\t\t// Check if it's not a wildcard port (0-65535)\n\t\t\tif portRange.First != 0 || portRange.Last != 65535 {\n\t\t\t\treturn fmt.Errorf(\"%w: %q, only \\\"*\\\" is allowed\", ErrProtocolNoSpecificPorts, protocol)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateTests enforces the four shape rules a tests-block entry must\n// follow: a tests entry describes one connection attempt to one specific\n// destination port over a connection-oriented protocol and asserts\n// whether that attempt is allowed or denied. The same shapes remain\n// valid inside [ACL] or [Grant] destinations where the rule does not apply.\nfunc validateTests(pol *Policy, tests []PolicyTest) error {\n\tvar errs []error\n\n\tfor i, t := range tests {\n\t\tif len(t.Accept) == 0 && len(t.Deny) == 0 {\n\t\t\terrs = append(errs, fmt.Errorf(\"test %d: %w\", i, ErrTestEmptyAssertions))","sourceCodeStart":3166,"sourceCodeEnd":3202,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/policy/v2/types.go#L3166-L3202","documentation":"Error \"%w: %q, only \"*\" is allowed\" thrown in juanfont/headscale.","triggerScenarios":"Thrown at hscontrol/policy/v2/types.go:3184 when the library encounters an invalid state.","commonSituations":"Only '*' is permitted in this position of the entry. Replace the offending value with a wildcard or restructure the rule.","solutions":["Inspect the wrapped error for the underlying cause and correct the failing condition (); retry the operation after fixing the input, configuration, or environment."],"exampleFix":"Inspect the wrapped error for the underlying cause and correct the failing condition (); retry the operation after fixing the input, configuration, or environment.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}