{"record":{"id":"5f7336fc0b2087ca","repo":"slackhq/nebula","slug":"code-specified-as-s-support-for-code-will-be","errorCode":null,"errorMessage":"code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional","messagePattern":"code specified as \\[(.+?)\\]\\. Support for 'code' will be dropped in a future release, as it has never been functional","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":1050,"sourceCode":"\t\t\treturn fmt.Errorf(\"groups specified as %s, but host=any will match any host, regardless of groups\", r.Groups)\n\t\t}\n\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"cidr specified as %s, but host=any will match any host, regardless of cidr\", r.Cidr)\n\t\t}\n\t}\n\n\tif groupsHasAny {\n\t\tif !hostEmpty && r.Host != \"any\" {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified host %s\", r.Groups, r.Host)\n\t\t}\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified cidr %s\", r.Groups, r.Cidr)\n\t\t}\n\t}\n\n\tif r.Code != \"\" {\n\t\treturn fmt.Errorf(\"code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional\", r.Code)\n\t}\n\n\t//todo alert on cidr-any\n\n\treturn nil\n}\n\nfunc parsePort(s string) (int32, int32, error) {\n\tconst notAPort int32 = -2\n\tif s == \"any\" {\n\t\treturn firewall.PortAny, firewall.PortAny, nil\n\t}\n\tif s == \"fragment\" {\n\t\treturn firewall.PortFragment, firewall.PortFragment, nil\n\t}\n\tif !strings.Contains(s, `-`) {\n\t\trPort, err := parsePortValue(\"\", s)\n\t\tif err != nil {","sourceCodeStart":1032,"sourceCodeEnd":1068,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L1032-L1068","documentation":"The 'code' field on firewall rules (intended for ICMP codes) has never been functional in this library. Any rule that sets a non-empty code is rejected outright with this deprecation message, instead of being ignored, so configs relying on it fail visibly.","triggerScenarios":"A firewall rule in config with a non-empty code field, e.g. code: 0 on an icmp rule, during rule translation.","commonSituations":"Copying iptables/nftables ICMP code semantics into nebula rules; old example configs that still carry code.","solutions":["Delete the code field from the rule","Express any needed filtering without 'code' (e.g. restrict proto icmp rules another way)","Audit configs migrated from other firewall systems for code fields"],"exampleFix":"// before\n- port: any\n  proto: icmp\n  code: 0\n  host: any\n// after\n- port: any\n  proto: icmp\n  host: any","handlingStrategy":"validation","validationCode":"func checkNoCodeField(rules []FirewallRuleConfig) error {\n    for i, r := range rules {\n        if r.Code != \"\" {\n            return fmt.Errorf(\"rule #%d sets 'code', which is unsupported: %s\", i, r.Code)\n        }\n    }\n    return nil\n}","typeGuard":"func isCodeFree(code string) bool { return code == \"\" }","tryCatchPattern":"if err := loadFirewallConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"Support for 'code' will be dropped\") {\n        return fmt.Errorf(\"remove unsupported 'code' fields: %w\", err)\n    }\n    return err\n}","preventionTips":["Never set the code field in firewall rules","Strip code fields when migrating configs from iptables/nftables","Keep library updated and read deprecation warnings in release notes"],"tags":["go","firewall","config","deprecation"],"backgroundTag":"unsupported-config-field","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}