{"record":{"id":"a0874c2c415fb775","repo":"netbirdio/netbird","slug":"port-d-out-of-range-1-65535","errorCode":null,"errorMessage":"port %d out of range (1-65535)","messagePattern":"port (.+?) out of range \\(1-65535\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/ssh.go","lineNumber":697,"sourceCode":"\t\treturn nil\n\t}\n\n\t_, portStr, err := net.SplitHostPort(addr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parse address %s: %w\", addr, err)\n\t}\n\n\tport, err := strconv.Atoi(portStr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid port %s: %w\", portStr, err)\n\t}\n\n\tif port == 0 {\n\t\treturn fmt.Errorf(\"port 0 is not valid for destination address\")\n\t}\n\n\tif port < 0 || port > 65535 {\n\t\treturn fmt.Errorf(\"port %d out of range (1-65535)\", port)\n\t}\n\n\treturn nil\n}\n\n// parsePortForwardSpec parses port forward specifications like \"8080:localhost:80\" or \"[::1]:8080:localhost:80\".\n// Also supports Unix sockets like \"8080:/tmp/socket\" or \"127.0.0.1:8080:/tmp/socket\".\nfunc parsePortForwardSpec(spec string) (string, string, error) {\n\t// Support formats:\n\t// port:host:hostport  -> localhost:port -> host:hostport\n\t// host:port:host:hostport  -> host:port -> host:hostport\n\t// [host]:port:host:hostport -> [host]:port -> host:hostport\n\t// port:unix_socket_path -> localhost:port -> unix_socket_path\n\t// host:port:unix_socket_path -> host:port -> unix_socket_path\n\n\tif strings.HasPrefix(spec, \"[\") && strings.Contains(spec, \"]:\") {\n\t\treturn parseIPv6ForwardSpec(spec)\n\t}","sourceCodeStart":679,"sourceCodeEnd":715,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/ssh.go#L679-L715","documentation":"Returned by validateDestinationPort when the destination port integer falls outside 1-65535. Because Atoi accepts a sign, a `-1` port reaches this check as negative; anything above 65535 (70000, 808080) is the more typical hit. The check is a plain less/greater comparison after the equality-to-zero case was handled separately.","triggerScenarios":"`-L 8080:host:70000`, `-R 9000:localhost:65536`, or `-L 8080:host:-1` — surfaced via `invalid remote address: port 70000 out of range (1-65535)` or `invalid local address: ...` depending on -L/-R.","commonSituations":"Typos adding a digit; copied ports from another protocol's space (e.g., an IP octet or an ID pasted as a port); hex or octal-looking values like 0x1f90 (Atoi parses 0x1f90 as 0 then fails? — no, it parses to 0/invalid and is caught earlier, but trailing-digit typos dominate).","solutions":["Correct the port to the 1-65535 range of the actual service (80, 443, 5432, 8080...).","Double-check the source of the number — ports over 65535 usually mean a paste error.","When generating specs in scripts, clamp/validate the numeric field before composing the string."],"exampleFix":"# before\nnetbird ssh -L 8080:cache:63800 peer1\n# -> invalid remote address: port 63800 out of range (1-65535)\n\n# after\nnetbird ssh -L 8080:cache:6379 peer1","handlingStrategy":"validation","validationCode":"if port < 1 || port > 65535 {\n\treturn fmt.Errorf(\"port %d out of range (1-65535)\", port)\n}\n_ = spec // only compose the -L/-R string after the range check passes","typeGuard":"func inPortRange(n int) bool { return n >= 1 && n <= 65535 }","tryCatchPattern":"if port > 65535 || port < 0 {\n\t// range violation: values like 65536/70000 are usually typos or pasted\n\t// non-port numbers; reject rather than truncate\n}","preventionTips":["Type ports as uint16/int in config schemas so impossible values cannot be expressed.","Watch for paste artifacts: IP octets, IDs, and 5-digit+ numbers ending up in port fields.","Apply the same 1-65535 bounds check on both -L and -R endpoints in your wrappers."],"tags":["go","ssh","validation","port","cli"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}