{"record":{"id":"b2a132847b340e5e","repo":"juanfont/headscale","slug":"test-d-deny-q-w","errorCode":null,"errorMessage":"test %d, deny %q: %w","messagePattern":"test (.+?), deny %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hscontrol/policy/v2/types.go","lineNumber":3222,"sourceCode":"\n\t\tif t.Proto != \"\" &&\n\t\t\tt.Proto != ProtocolNameTCP &&\n\t\t\tt.Proto != ProtocolNameUDP &&\n\t\t\tt.Proto != ProtocolNameSCTP {\n\t\t\terrs = append(errs, fmt.Errorf(\"test %d: %w: %q\", i, ErrTestProtocolNotAllowed, t.Proto))\n\t\t}\n\n\t\tfor _, dst := range t.Accept {\n\t\t\terr := validateTestDestination(pol, dst)\n\t\t\tif err != nil {\n\t\t\t\terrs = append(errs, fmt.Errorf(\"test %d, accept %q: %w\", i, dst, err))\n\t\t\t}\n\t\t}\n\n\t\tfor _, dst := range t.Deny {\n\t\t\terr := validateTestDestination(pol, dst)\n\t\t\tif err != nil {\n\t\t\t\terrs = append(errs, fmt.Errorf(\"test %d, deny %q: %w\", i, dst, err))\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(errs) > 0 {\n\t\treturn fmt.Errorf(\"%w:\\n%w\", errPolicyTestsFailed, multierr.New(errs...))\n\t}\n\n\treturn nil\n}\n\n// validateTestDestination enforces that a tests-block dst describes one\n// connection attempt to one specific host on one specific port. SaaS\n// rejects three shapes that violate the rule: autogroup:internet (routed\n// by exit-node [tailcfg.Node.AllowedIPs], not the packet filter); multi-port\n// (range/list/wildcard, no single allow/deny answer); and CIDR ranges\n// — both raw `/N` syntax and `hosts:`-table aliases whose RHS is a\n// multi-host prefix. Bare IP literals reach this function as *[Prefix]","sourceCodeStart":3204,"sourceCodeEnd":3240,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/policy/v2/types.go#L3204-L3240","documentation":"Error \"test %d, deny %q: %w\" thrown in juanfont/headscale.","triggerScenarios":"Thrown at hscontrol/policy/v2/types.go:3222 when the library encounters an invalid state.","commonSituations":"A deny entry in a policy test failed to resolve. Ensure the deny destination is a single valid host.","solutions":["Inspect the wrapped error for the underlying cause and correct the failing condition (test , deny); retry the operation after fixing the input, configuration, or environment."],"exampleFix":"Inspect the wrapped error for the underlying cause and correct the failing condition (test , deny); retry the operation after fixing the input, configuration, or environment.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}