{"record":{"id":"bc5889ad4ae93e80","repo":"slackhq/nebula","slug":"unable-to-marshal-unsafe-network-w","errorCode":null,"errorMessage":"unable to marshal unsafe network: %w","messagePattern":"unable to marshal unsafe network: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cert/cert_v2.go","lineNumber":518,"sourceCode":"\t\t\t\t\tsb, innerErr := n.MarshalBinary()\n\t\t\t\t\tif innerErr != nil {\n\t\t\t\t\t\t// MarshalBinary never returns an error\n\t\t\t\t\t\terr = fmt.Errorf(\"unable to marshal network: %w\", innerErr)\n\t\t\t\t\t\treturn\n\t\t\t\t\t}\n\t\t\t\t\tb.AddASN1OctetString(sb)\n\t\t\t\t}\n\t\t\t})\n\t\t}\n\n\t\t// Add the unsafe networks if any exist\n\t\tif len(d.unsafeNetworks) > 0 {\n\t\t\tb.AddASN1(TagDetailsUnsafeNetworks, func(b *cryptobyte.Builder) {\n\t\t\t\tfor _, n := range d.unsafeNetworks {\n\t\t\t\t\tsb, innerErr := n.MarshalBinary()\n\t\t\t\t\tif innerErr != nil {\n\t\t\t\t\t\t// MarshalBinary never returns an error\n\t\t\t\t\t\terr = fmt.Errorf(\"unable to marshal unsafe network: %w\", innerErr)\n\t\t\t\t\t\treturn\n\t\t\t\t\t}\n\t\t\t\t\tb.AddASN1OctetString(sb)\n\t\t\t\t}\n\t\t\t})\n\t\t}\n\n\t\t// Add groups if any exist\n\t\tif len(d.groups) > 0 {\n\t\t\tb.AddASN1(TagDetailsGroups, func(b *cryptobyte.Builder) {\n\t\t\t\tfor _, group := range d.groups {\n\t\t\t\t\tb.AddASN1(asn1.UTF8String, func(b *cryptobyte.Builder) {\n\t\t\t\t\t\tb.AddBytes([]byte(group))\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t})\n\t\t}\n","sourceCodeStart":500,"sourceCodeEnd":536,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/cert_v2.go#L500-L536","documentation":"Identical guard to the networks case but for details.unsafeNetworks: each entry is marshalled with MarshalBinary inside the TagDetailsUnsafeNetworks ASN.1 block, and any inner error is wrapped with this message. Defensive; current implementations never error.","triggerScenarios":"Marshalling/signing a certificate with an unsafeNetworks entry whose MarshalBinary returns an error (defensive path).","commonSituations":"Hand-built certificate details with corrupt/zero-value unsafe networks; future code changes to network marshalling.","solutions":["Inspect the wrapped innerErr for the failing unsafe network.","Validate unsafe networks (host/mask) before building the certificate.","Re-create the certificate with valid unsafe network entries."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"for _, n := range certDetails.UnsafeNetworks {\n    if n == nil || !validIPMask(n) {\n        return fmt.Errorf(\"invalid unsafe network entry in certificate details\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"unable to marshal unsafe network\") {\n    return fmt.Errorf(\"bad unsafe network on certificate: %w\", err)\n}","preventionTips":["Validate unsafe networks (host/mask) before certificate creation.","Avoid hand-editing certificate detail structs.","Keep unsafe networks within expected CIDR bounds."],"tags":["certificate","marshalling","unsafe-networks"],"backgroundTag":"certificate-marshalling-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}