{"record":{"id":"447419e63d5ad0e6","repo":"slackhq/nebula","slug":"errunknownnetworktype","errorCode":"ErrUnknownNetworkType","errorMessage":"unknown network type","messagePattern":"unknown network type","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":418,"sourceCode":"\n\t\tif warning := r.sanity(); warning != nil {\n\t\t\tl.Warn(\"firewall rule sanity check\",\n\t\t\t\t\"table\", table,\n\t\t\t\t\"rule\", i,\n\t\t\t\t\"warning\", warning,\n\t\t\t)\n\t\t}\n\n\t\terr = fw.AddRule(inbound, proto, startPort, endPort, r.Groups, r.Host, r.Cidr, r.LocalCidr, r.CAName, r.CASha)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"%s rule #%v; `%s`\", table, i, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nvar ErrUnknownNetworkType = errors.New(\"unknown network type\")\nvar ErrPeerRejected = errors.New(\"remote address is not within a network that we handle\")\nvar ErrInvalidRemoteIP = errors.New(\"remote address is not in remote certificate networks\")\nvar ErrInvalidLocalIP = errors.New(\"local address is not in list of handled local addresses\")\nvar ErrNoMatchingRule = errors.New(\"no matching rule in firewall table\")\n\n// Drop returns an error if the packet should be dropped, explaining why. It\n// returns nil if the packet should not be dropped.\nfunc (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {\n\t// Make sure remote address matches nebula certificate, and determine how to treat it\n\tif h.networks == nil {\n\t\t// Simple case: Certificate has one address and no unsafe networks\n\t\tif h.vpnAddrs[0] != fp.RemoteAddr {\n\t\t\tf.metrics(incoming).droppedRemoteAddr.Inc(1)\n\t\t\treturn ErrInvalidRemoteIP\n\t\t}\n\t} else {\n\t\tnwType, ok := h.networks.Lookup(fp.RemoteAddr)\n\t\tif !ok {","sourceCodeStart":400,"sourceCodeEnd":436,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L400-L436","documentation":"ErrUnknownNetworkType in firewall.go is returned by Firewall.Drop when the packet's network type (the switch over conn/network classification) matches none of the handled cases. The code labels it 'should never happen', so it indicates an internal classification bug or an unexpected packet category reaching the firewall rather than a policy decision.","triggerScenarios":"Drop() called with a packet whose network type falls into the default branch at firewall.go:450 — i.e. a classification outside IPv4/IPv6 (or the handled host/network cases) reaches the switch.","commonSituations":"Bugs in tunnel/routing code feeding unclassified packets to the firewall; custom patches adding new network types without updating Drop's switch; corrupted packet metadata from unsafe memory handling.","solutions":["Log the offending packet's network type at the Drop site to identify the unhandled classification.","Update the switch in Drop to handle the new network type explicitly.","Fix the upstream classifier so only known network types reach the firewall.","Check for recent custom modifications to firewall or packet-parsing code that introduced the type."],"exampleFix":"// before\ndefault:\n    f.metrics(incoming).droppedRemoteAddr.Inc(1)\n    return ErrUnknownNetworkType\n\n// after\ncase cert.Curve_WhateverNewType: // handle the missing case explicitly\n    return f.checkRule(...)\ndefault:\n    f.metrics(incoming).droppedRemoteAddr.Inc(1)\n    return fmt.Errorf(\"unknown network type %v: %w\", networkType, ErrUnknownNetworkType)","handlingStrategy":"try-catch","validationCode":"// before feeding packets to the firewall, ensure the classification is known\nswitch pkt.NetworkType() {\ncase ipv4Type, ipv6Type:\n    // ok\ndefault:\n    return fmt.Errorf(\"unclassifiable packet, refusing to pass to firewall\")\n}","typeGuard":"func isKnownNetworkType(t NetworkType) bool {\n    return t == IPv4 || t == IPv6\n}","tryCatchPattern":"if err := f.Drop(pkt, incoming); err != nil {\n    if errors.Is(err, ErrUnknownNetworkType) {\n        log.Printf(\"BUG: unhandled network type %v; dropping and reporting\", pkt.NetworkType())\n        reportBug(pkt)\n        return // drop is safe; do not retry\n    }\n    // other firewall errors (no matching rule, invalid IP) handled separately\n}","preventionTips":["Treat this error as a bug signal: alert/log it rather than silently dropping.","Extend Drop's switch whenever new network types are introduced.","Keep packet classification and firewall checks in lockstep via shared constants.","Fuzz/soak test the tunnel parser so malformed packets are rejected before classification."],"tags":["firewall","packet-processing","go"],"backgroundTag":"unknown-network-type","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}