{"record":{"id":"158346a3f242e20c","repo":"slackhq/nebula","slug":"groups-spec-s-contains-the-group-any-this-r-158346","errorCode":null,"errorMessage":"groups spec [%s] contains the group '\"any\". This rule will ignore the specified cidr %s","messagePattern":"groups spec \\[(.+?)\\] contains the group '\"any\"\\. This rule will ignore the specified cidr (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":1045,"sourceCode":"\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the other groups specified\", r.Groups)\n\t}\n\n\tif r.Host == \"any\" {\n\t\tif !groupsEmpty {\n\t\t\treturn fmt.Errorf(\"groups specified as %s, but host=any will match any host, regardless of groups\", r.Groups)\n\t\t}\n\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"cidr specified as %s, but host=any will match any host, regardless of cidr\", r.Cidr)\n\t\t}\n\t}\n\n\tif groupsHasAny {\n\t\tif !hostEmpty && r.Host != \"any\" {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified host %s\", r.Groups, r.Host)\n\t\t}\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified cidr %s\", r.Groups, r.Cidr)\n\t\t}\n\t}\n\n\tif r.Code != \"\" {\n\t\treturn fmt.Errorf(\"code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional\", r.Code)\n\t}\n\n\t//todo alert on cidr-any\n\n\treturn nil\n}\n\nfunc parsePort(s string) (int32, int32, error) {\n\tconst notAPort int32 = -2\n\tif s == \"any\" {\n\t\treturn firewall.PortAny, firewall.PortAny, nil\n\t}\n\tif s == \"fragment\" {","sourceCodeStart":1027,"sourceCodeEnd":1063,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L1027-L1063","documentation":"If groups contain 'any' and a cidr is also specified, the cidr can never take effect because 'any' matches every group (and thus every peer), so the rule is rejected rather than silently ignoring the cidr.","triggerScenarios":"A rule with groups containing 'any' and a non-empty cidr during rule translation, e.g. groups: [any], cidr: 192.168.0.0/16.","commonSituations":"Widening a cidr-scoped rule by adding 'any' to groups; template-generated rules that always emit a groups list including any.","solutions":["Remove 'any' from groups if cidr scoping is intended","Or remove the cidr if the rule should match everything"],"exampleFix":"// before\ngroups: [any]\ncidr: 192.168.0.0/16\n// after\ncidr: 192.168.0.0/16","handlingStrategy":"validation","validationCode":"func checkAnyGroupsCidr(groups []string, cidr string) error {\n    if slices.Contains(groups, \"any\") && cidr != \"\" && cidr != \"any\" {\n        return fmt.Errorf(\"groups containing 'any' cannot restrict to cidr %s\", cidr)\n    }\n    return nil\n}","typeGuard":"func isAnyGroupsCidrConsistent(groups []string, cidr string) bool {\n    return !slices.Contains(groups, \"any\") || cidr == \"\" || cidr == \"any\"\n}","tryCatchPattern":"if err := loadFirewallConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"ignore the specified cidr\") {\n        return fmt.Errorf(\"groups=any makes cidr moot: %w\", err)\n    }\n    return err\n}","preventionTips":["Never combine groups containing 'any' with a cidr","For cidr rules, omit groups entirely","Lint for 'any' group alongside cidr fields"],"tags":["go","firewall","config","cidr"],"backgroundTag":"firewall-rule-invalid","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}