{"record":{"id":"62de39306cfb1d2b","repo":"slackhq/nebula","slug":"cidr-specified-as-s-but-host-any-will-match-any","errorCode":null,"errorMessage":"cidr specified as %s, but host=any will match any host, regardless of cidr","messagePattern":"cidr specified as (.+?), but host=any will match any host, regardless of cidr","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":1036,"sourceCode":"\thostEmpty := r.Host == \"\"\n\tcidrEmpty := r.Cidr == \"\"\n\n\tif (groupsEmpty && hostEmpty && cidrEmpty) == true {\n\t\treturn nil //no content!\n\t}\n\n\tgroupsHasAny := slices.Contains(r.Groups, \"any\")\n\tif groupsHasAny && len(r.Groups) > 1 {\n\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the other groups specified\", r.Groups)\n\t}\n\n\tif r.Host == \"any\" {\n\t\tif !groupsEmpty {\n\t\t\treturn fmt.Errorf(\"groups specified as %s, but host=any will match any host, regardless of groups\", r.Groups)\n\t\t}\n\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"cidr specified as %s, but host=any will match any host, regardless of cidr\", r.Cidr)\n\t\t}\n\t}\n\n\tif groupsHasAny {\n\t\tif !hostEmpty && r.Host != \"any\" {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified host %s\", r.Groups, r.Host)\n\t\t}\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified cidr %s\", r.Groups, r.Cidr)\n\t\t}\n\t}\n\n\tif r.Code != \"\" {\n\t\treturn fmt.Errorf(\"code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional\", r.Code)\n\t}\n\n\t//todo alert on cidr-any\n","sourceCodeStart":1018,"sourceCodeEnd":1054,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L1018-L1054","documentation":"host: any matches any host regardless of cidr, so pairing a cidr with host 'any' is contradictory: the cidr would never take effect. The rule translator rejects this combination rather than silently ignoring the cidr.","triggerScenarios":"A rule with host: any and a non-empty cidr field during rule translation (e.g. host: any, cidr: 10.0.0.0/8).","commonSituations":"Author intending 'any host in this cidr' — which requires cidr alone, not host: any; merged rule templates retaining host: any.","solutions":["Drop host: any and keep only the cidr if you want cidr-scoped matching","Or drop the cidr if you truly want any host"],"exampleFix":"// before\nhost: any\ncidr: 10.0.0.0/8\n// after\ncidr: 10.0.0.0/8","handlingStrategy":"validation","validationCode":"func checkHostAnyCidr(r FirewallRuleConfig) error {\n    if r.Host == \"any\" && r.Cidr != \"\" && r.Cidr != \"any\" {\n        return fmt.Errorf(\"host=any cannot be combined with cidr %s\", r.Cidr)\n    }\n    return nil\n}","typeGuard":"func isHostAnyCidrConsistent(host, cidr string) bool {\n    return host != \"any\" || cidr == \"\" || cidr == \"any\"\n}","tryCatchPattern":"if err := loadFirewallConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"host=any will match any host, regardless of cidr\") {\n        return fmt.Errorf(\"drop host=any or the cidr: %w\", err)\n    }\n    return err\n}","preventionTips":["For cidr-scoped rules, set cidr only and omit host","Use host=any only when the rule should truly match all hosts","Lint configs for host: any paired with cidr"],"tags":["go","firewall","config","cidr"],"backgroundTag":"firewall-rule-invalid","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}