{"record":{"id":"9c5077d44a781442","repo":"netbirdio/netbird","slug":"invalid-dns-labels-w","errorCode":null,"errorMessage":"invalid dns labels: %w","messagePattern":"invalid dns labels: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/embed/embed.go","lineNumber":192,"sourceCode":"\t\tif err := os.Setenv(netstack.EnvUseNetstackMode, \"true\"); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"setenv: %w\", err)\n\t\t}\n\t\tif err := os.Setenv(netstack.EnvSkipProxy, \"true\"); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"setenv: %w\", err)\n\t\t}\n\t}\n\n\tif opts.StatePath != \"\" {\n\t\t// TODO: Disable state if path not provided\n\t\tif err := os.Setenv(\"NB_DNS_STATE_FILE\", opts.StatePath); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"setenv: %w\", err)\n\t\t}\n\t}\n\n\tvar err error\n\tvar parsedLabels domain.List\n\tif parsedLabels, err = domain.FromStringList(opts.DNSLabels); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid dns labels: %w\", err)\n\t}\n\n\tt := true\n\tvar config *profilemanager.Config\n\tinput := profilemanager.ConfigInput{\n\t\tConfigPath:          opts.ConfigPath,\n\t\tManagementURL:       opts.ManagementURL,\n\t\tPreSharedKey:        &opts.PreSharedKey,\n\t\tDisableServerRoutes: &t,\n\t\tDisableClientRoutes: &opts.DisableClientRoutes,\n\t\tDisableIPv6:         &opts.DisableIPv6,\n\t\tBlockInbound:        &opts.BlockInbound,\n\t\tBlockLANAccess:      &opts.BlockLANAccess,\n\t\tWireguardPort:       opts.WireguardPort,\n\t\tMTU:                 opts.MTU,\n\t\tDNSLabels:           parsedLabels,\n\t}\n\tif opts.ConfigPath != \"\" {","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/embed/embed.go#L174-L210","documentation":"Returned by embed.New when domain.FromStringList rejects one of the Options.DNSLabels entries. Each label must parse as a valid DNS domain (per shared/management/domain parsing rules: valid label characters, length limits, no scheme or port). The wrapped error identifies the offending label.","triggerScenarios":"Calling embed.New with DNSLabels containing entries like \"my label\" (space), \"label;other\", \"http://svc\", \"svc:8080\", an empty string, or a label longer than 63 characters.","commonSituations":"Reusing service names, URLs, or host:port strings as DNS labels; splitting a comma-separated label config on the wrong delimiter leaving empty strings; copy-pasting FQDNs with trailing dots or underscores where the parser does not accept them.","solutions":["Pass only bare DNS-valid labels (alphanumeric plus hyphen, each label 1-63 chars) in DNSLabels.","Validate with domain.FromStringList before embed.New when labels come from user input.","Check the wrapped error message for the exact label that failed and fix or drop that entry."],"exampleFix":"// before\nclient, err := embed.New(embed.Options{DNSLabels: []string{\"my service\", \"svc.internal:8080\"}})\n\n// after\nclient, err := embed.New(embed.Options{DNSLabels: []string{\"my-service\", \"svc-internal\"}})","handlingStrategy":"validation","validationCode":"import \"github.com/netbirdio/netbird/shared/management/domain\"\n\nif _, err := domain.FromStringList(opts.DNSLabels); err != nil {\n    return fmt.Errorf(\"reject labels before embed.New: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sanitize labels to [a-z0-9-] before passing them in.","Reject empty strings from split operations before they reach DNSLabels."],"tags":["dns","validation","config","embed"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}