{"record":{"id":"c8dcb4c1fb8ac887","repo":"cloudflare/cloudflared","slug":"invalid-port-d-needs-to-be-between-1-and-65535","errorCode":null,"errorMessage":"invalid port %d, needs to be between 1 and 65535","messagePattern":"invalid port (.+?), needs to be between 1 and 65535","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ipaccess/access.go","lineNumber":66,"sourceCode":"func NewRule(ipnet *net.IPNet, ports []int, allow bool) (Rule, error) {\n\trule := Rule{\n\t\tipNet: ipnet,\n\t\tports: ports,\n\t\tallow: allow,\n\t}\n\treturn rule, rule.Validate()\n}\n\nfunc (r *Rule) Validate() error {\n\tif r.ipNet == nil {\n\t\treturn fmt.Errorf(\"no ipnet set on the rule\")\n\t}\n\n\tif len(r.ports) > 0 {\n\t\tsort.Ints(r.ports)\n\t\tfor _, port := range r.ports {\n\t\t\tif port < 1 || port > 65535 {\n\t\t\t\treturn fmt.Errorf(\"invalid port %d, needs to be between 1 and 65535\", port)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (h *Policy) Allowed(ip net.IP, port int) (bool, *Rule) {\n\tif len(h.rules) == 0 {\n\t\treturn h.defaultAllow, nil\n\t}\n\n\tfor _, rule := range h.rules {\n\t\tif rule.ipNet.Contains(ip) {\n\t\t\tif len(rule.ports) == 0 {\n\t\t\t\treturn rule.allow, &rule\n\t\t\t} else if pos := sort.SearchInts(rule.ports, port); pos < len(rule.ports) && rule.ports[pos] == port {\n\t\t\t\treturn rule.allow, &rule","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ipaccess/access.go#L48-L84","documentation":"Range validation in ipaccess Rule.Validate: a rule was constructed (via NewRule) with a port number outside the valid TCP/UDP range 1-65535. The rule set is rejected at construction time so an unusable access policy never reaches enforcement.","triggerScenarios":"Thrown at ipaccess/access.go:66 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the ports list passed to NewRule; every entry must be an integer between 1 and 65535.","Remove 0 or negative placeholders and out-of-range values; ports are sorted and validated one by one.","If ports are user-supplied, validate them before calling NewRule."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}