{"record":{"id":"9728cb30525ecf4b","repo":"slackhq/nebula","slug":"config-s-contains-both-true-and-false-rules-bu","errorCode":null,"errorMessage":"config `%s` contains both true and false rules, but no default set for 0.0.0.0/0","messagePattern":"config `(.+?)` contains both true and false rules, but no default set for 0\\.0\\.0\\.0/0","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"allow_list.go","lineNumber":156,"sourceCode":"\t\t\trules.allValues = value\n\t\t\trules.firstValue = false\n\t\t} else {\n\t\t\tif value != rules.allValues {\n\t\t\t\trules.allValuesMatch = false\n\t\t\t}\n\t\t}\n\n\t\t// Check if this is 0.0.0.0/0 or ::/0\n\t\tif maskBits == 0 {\n\t\t\trules.defaultSet = true\n\t\t}\n\t}\n\n\tif !rules4.defaultSet {\n\t\tif rules4.allValuesMatch {\n\t\t\ttree.Insert(netip.PrefixFrom(netip.IPv4Unspecified(), 0), !rules4.allValues)\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` contains both true and false rules, but no default set for 0.0.0.0/0\", k)\n\t\t}\n\t}\n\n\tif !rules6.defaultSet {\n\t\tif rules6.allValuesMatch {\n\t\t\ttree.Insert(netip.PrefixFrom(netip.IPv6Unspecified(), 0), !rules6.allValues)\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` contains both true and false rules, but no default set for ::/0\", k)\n\t\t}\n\t}\n\n\treturn &AllowList{cidrTree: tree}, nil\n}\n\nfunc getAllowListInterfaces(k string, v any) ([]AllowListNameRule, error) {\n\tvar nameRules []AllowListNameRule\n\n\trawRules, ok := v.(map[string]any)","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/allow_list.go#L138-L174","documentation":"An IPv4 allow list that mixes allow (true) and deny (false) rules is ambiguous without a default rule for 0.0.0.0/0, because the library cannot infer the fallback decision for unmatched IPs. If no explicit default IPv4 rule is present and the rules contain both true and false values, newAllowList rejects the config.","triggerScenarios":"newAllowListFromConfig / getRemoteAllowRanges where a 0.0.0.0/0 entry is absent and at least one rule is true and at least one is false among the IPv4 CIDRs.","commonSituations":"Users adding a deny rule for one range and an allow rule for another but forgetting to state the default policy with 0.0.0.0/0.","solutions":["Add an explicit 0.0.0.0/0: true or 0.0.0.0/0: false entry as the default policy","Or make all IPv4 rules the same value so the default can be inferred"],"exampleFix":"// before\nremote_allow_ranges:\n  10.0.0.0/8: true\n  192.168.0.0/16: false\n// after\nremote_allow_ranges:\n  0.0.0.0/0: false\n  10.0.0.0/8: true\n  192.168.0.0/16: false","handlingStrategy":"validation","validationCode":"func hasV4Default(m map[string]any) bool {\n\t_, ok := m[\"0.0.0.0/0\"]\n\treturn ok\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include an explicit 0.0.0.0/0 default when mixing allow/deny rules","Document the default policy at the top of the config"],"tags":["config","firewall","allowlist","ipv4"],"backgroundTag":"missing-default-rule","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}