{"record":{"id":"95e51238090fbbe3","repo":"slackhq/nebula","slug":"sout-of-range-0-65535-s","errorCode":null,"errorMessage":"%sout of range [0,65535]; `%s`","messagePattern":"(.+?)out of range \\[0,65535\\]; `(.+?)`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":1115,"sourceCode":"}\n\n// parsePortValue accepts a base-10 decimal in [0, 65535] and returns it\n// widened to int32. Using strconv.ParseUint with bitSize 16 rejects\n// negative input, out-of-range input (>65535), and any non-decimal byte\n// by construction, so the int32 widening that follows is provably safe\n// and cannot collide with firewall.PortAny (0) or firewall.PortFragment\n// (-1) via integer truncation.\n//\n// prefix is prepended to both error messages so callers can disambiguate\n// the single-port path (prefix=\"\") from the range bounds (prefix=\"beginning\n// range \" / \"ending range \"), preserving the historical error strings.\nfunc parsePortValue(prefix, s string) (int32, error) {\n\tn, err := strconv.ParseUint(s, 10, 16)\n\tif err == nil {\n\t\treturn int32(n), nil\n\t}\n\tif errors.Is(err, strconv.ErrRange) {\n\t\treturn 0, fmt.Errorf(\"%sout of range [0,65535]; `%s`\", prefix, s)\n\t}\n\treturn 0, fmt.Errorf(\"%swas not a number; `%s`\", prefix, s)\n}\n","sourceCodeStart":1097,"sourceCodeEnd":1119,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L1097-L1119","documentation":"Nebula's firewall rule parser calls parsePortValue to convert a port string from the config into an int32. When strconv.ParseUint(s,10,16) fails with strconv.ErrRange (the text is numeric but outside the uint16 port range), it returns this error wrapping the prefix and the offending string. Valid ports must be 0-65535.","triggerScenarios":"A firewall rule in the Nebula config (e.g. firewall.outbound / inbound port fields) contains a numeric string outside [0,65535], such as '70000' or a value with trailing whitespace making it overflow the 16-bit parse, passed via parsePort (firewall.go:1067) or addFireWallRulesFromConfig.","commonSituations":"Typos in firewall rules (port 65536+), copy-paste of 0-based or decimal-expanded port values, generated rules from scripts using wrong ranges, YAML values parsed as strings like '99999'.","solutions":["Fix the port value in the Nebula config YAML so it is an integer in [0,65535]","If a port range is intended, use the 'port: start-end' range syntax with both endpoints in range","Re-run `nebula -config ...` / `-test` to validate the config before deploying"],"exampleFix":"// before\nfirewall:\n  inbound:\n    - port: 70000\n      proto: tcp\n// after\nfirewall:\n  inbound:\n    - port: 443\n      proto: tcp","handlingStrategy":"validation","validationCode":"func validPort(s string) bool {\n\tn, err := strconv.ParseUint(strings.TrimSpace(s), 10, 16)\n\treturn err == nil && n >= 0 && n <= 65535\n}\n// call before writing the port into the nebula config","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always emit ports as integers within 0-65535 when generating nebula configs","Use `nebula -test -config` in CI to catch bad firewall rules before deploy","Prefer range syntax 'start-end' over manual arithmetic that can overflow","Lint YAML configs for port fields with a JSON/YAML schema limiting port to 0-65535"],"tags":["config","firewall","port-range"],"backgroundTag":"port-out-of-range","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}