{"record":{"id":"84acd434f88e5ab0","repo":"slackhq/nebula","slug":"unable-to-marshal-network-w","errorCode":null,"errorMessage":"unable to marshal network: %w","messagePattern":"unable to marshal network: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cert/cert_v2.go","lineNumber":503,"sourceCode":"\tvar b cryptobyte.Builder\n\tvar err error\n\n\t// Details are a structure\n\tb.AddASN1(TagCertDetails, func(b *cryptobyte.Builder) {\n\n\t\t// Add the name\n\t\tb.AddASN1(TagDetailsName, func(b *cryptobyte.Builder) {\n\t\t\tb.AddBytes([]byte(d.name))\n\t\t})\n\n\t\t// Add the networks if any exist\n\t\tif len(d.networks) > 0 {\n\t\t\tb.AddASN1(TagDetailsNetworks, func(b *cryptobyte.Builder) {\n\t\t\t\tfor _, n := range d.networks {\n\t\t\t\t\tsb, innerErr := n.MarshalBinary()\n\t\t\t\t\tif innerErr != nil {\n\t\t\t\t\t\t// MarshalBinary never returns an error\n\t\t\t\t\t\terr = fmt.Errorf(\"unable to marshal network: %w\", innerErr)\n\t\t\t\t\t\treturn\n\t\t\t\t\t}\n\t\t\t\t\tb.AddASN1OctetString(sb)\n\t\t\t\t}\n\t\t\t})\n\t\t}\n\n\t\t// Add the unsafe networks if any exist\n\t\tif len(d.unsafeNetworks) > 0 {\n\t\t\tb.AddASN1(TagDetailsUnsafeNetworks, func(b *cryptobyte.Builder) {\n\t\t\t\tfor _, n := range d.unsafeNetworks {\n\t\t\t\t\tsb, innerErr := n.MarshalBinary()\n\t\t\t\t\tif innerErr != nil {\n\t\t\t\t\t\t// MarshalBinary never returns an error\n\t\t\t\t\t\terr = fmt.Errorf(\"unable to marshal unsafe network: %w\", innerErr)\n\t\t\t\t\t\treturn\n\t\t\t\t\t}\n\t\t\t\t\tb.AddASN1OctetString(sb)","sourceCodeStart":485,"sourceCodeEnd":521,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/cert_v2.go#L485-L521","documentation":"During details.Marshal, each network entry is serialized with MarshalBinary and embedded as an octet string. If any network fails to marshal, this wrapped error is set. The inline comment notes MarshalBinary never returns an error today, so this is a defensive guard against future/buggy implementations.","triggerScenarios":"Signing or marshalling a certificate whose details.networks contains a network whose MarshalBinary returns a non-nil error (theoretically unreachable with the current NL a MarshalBinary implementation).","commonSituations":"Custom or future network implementations, corrupted certificate structs, or tests exercising defensive paths.","solutions":["Check the wrapped innerErr to identify the offending network.","Verify networks on the certificate are standard *cert.NebulaCertificate-compatible entries with valid host/mask values.","Rebuild the certificate with valid network data."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"for _, n := range certDetails.Networks {\n    if n == nil || !validIPMask(n) {\n        return fmt.Errorf(\"invalid network entry in certificate details\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"unable to marshal network\") {\n    return fmt.Errorf(\"bad network on certificate: %w\", err)\n}","preventionTips":["Populate networks with fully valid host/mask values before signing.","Rebuild certificates instead of mutating unmarshalled details structs.","Treat this as a bug report if seen on stock library code."],"tags":["certificate","marshalling","network"],"backgroundTag":"certificate-marshalling-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}