{"record":{"id":"bc0b95aa0665af2c","repo":"slackhq/nebula","slug":"unsupported-version","errorCode":null,"errorMessage":"unsupported version","messagePattern":"unsupported version","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lighthouse.go","lineNumber":1229,"sourceCode":"\t\t\t} else {\n\t\t\t\tif lhh.l.Enabled(context.Background(), slog.LevelDebug) {\n\t\t\t\t\tlhh.l.Debug(\"unable to punch to host, no addresses in common\",\n\t\t\t\t\t\t\"to\", crt.Networks(),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif useVersion == cert.Version1 {\n\t\t\tif !whereToPunch.Is4() {\n\t\t\t\treturn 0, fmt.Errorf(\"invalid vpn addr for v1 handleHostQuery\")\n\t\t\t}\n\t\t\tb := whereToPunch.As4()\n\t\t\tn.Details.OldVpnAddr = binary.BigEndian.Uint32(b[:])\n\t\t} else if useVersion == cert.Version2 {\n\t\t\tn.Details.VpnAddr = netAddrToProtoAddr(whereToPunch)\n\t\t} else {\n\t\t\treturn 0, errors.New(\"unsupported version\")\n\t\t}\n\t\tlhh.coalesceAnswers(useVersion, c, n)\n\n\t\treturn n.MarshalTo(lhh.pb)\n\t})\n\n\tif !found {\n\t\treturn\n\t}\n\n\tif err != nil {\n\t\tlhh.l.Error(\"Failed to marshal lighthouse host was queried for\",\n\t\t\t\"error\", err,\n\t\t\t\"vpnAddrs\", fromVpnAddrs,\n\t\t)\n\t\treturn\n\t}\n","sourceCodeStart":1211,"sourceCodeEnd":1247,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/lighthouse.go#L1211-L1247","documentation":"This error comes from the lighthouse handshake-answer marshaling path. When a lighthouse relays vpn-addr answers back to a querying host, it checks the certificate version of the target (`useVersion`). Only Version1 (old 32-bit VPN addresses) and Version2 (ProtoAddr) are supported; any other value makes the answer un-marshalable, so the lighthouse aborts instead of emitting a corrupted answer.","triggerScenarios":"A lighthouse (LightHouseHandler.GetNearestOrAll) processes an answer for a peer whose certificate `useVersion` is neither cert.Version1 nor cert.Version2 — e.g. a hand-crafted certificate, a version enum from a newer/older protocol build, or a zero-value version struct.","commonSituations":"Mixed-version nebula clusters after a protocol upgrade, a certificate signed with an unknown/future version field, or custom tooling that mints certificates with a nonstandard Version value.","solutions":["Re-issue the peer's certificate with a supported Version (cert.Version1 or cert.Version2).","Upgrade the lighthouse binary so it recognizes the peer's certificate version.","Ensure all nodes are on a mutually compatible nebula release before rolling new certificate versions."],"exampleFix":"// before: certificate with unknown version\nCertificate{ Version: 3, ... }\n// after\nCertificate{ Version: cert.Version2, ... }","handlingStrategy":"validation","validationCode":"if cert.Version != cert.Version1 && cert.Version != cert.Version2 {\n    return fmt.Errorf(\"certificate version %d not supported by lighthouse\", cert.Version)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set an explicit, supported Version when minting certificates.","Align nebula versions across the whole fleet before introducing new certificate versions.","Validate certificates with nebula-cert at issuance time."],"tags":["lighthouse","certificate-version","protocol-compatibility"],"backgroundTag":"unsupported-certificate-version","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}