{"record":{"id":"d375c1808bf3314c","repo":"slackhq/nebula","slug":"config-s-contains-both-true-and-false-rules-bu-d375c1","errorCode":null,"errorMessage":"config `%s` contains both true and false rules, but no default set for ::/0","messagePattern":"config `(.+?)` contains both true and false rules, but no default set for ::/0","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"allow_list.go","lineNumber":164,"sourceCode":"\t\t// Check if this is 0.0.0.0/0 or ::/0\n\t\tif maskBits == 0 {\n\t\t\trules.defaultSet = true\n\t\t}\n\t}\n\n\tif !rules4.defaultSet {\n\t\tif rules4.allValuesMatch {\n\t\t\ttree.Insert(netip.PrefixFrom(netip.IPv4Unspecified(), 0), !rules4.allValues)\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` contains both true and false rules, but no default set for 0.0.0.0/0\", k)\n\t\t}\n\t}\n\n\tif !rules6.defaultSet {\n\t\tif rules6.allValuesMatch {\n\t\t\ttree.Insert(netip.PrefixFrom(netip.IPv6Unspecified(), 0), !rules6.allValues)\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` contains both true and false rules, but no default set for ::/0\", k)\n\t\t}\n\t}\n\n\treturn &AllowList{cidrTree: tree}, nil\n}\n\nfunc getAllowListInterfaces(k string, v any) ([]AllowListNameRule, error) {\n\tvar nameRules []AllowListNameRule\n\n\trawRules, ok := v.(map[string]any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"config `%s.interfaces` is invalid (type %T): %v\", k, v, v)\n\t}\n\n\tfirstEntry := true\n\tvar allValues bool\n\tfor name, rawAllow := range rawRules {\n\t\tallow, ok := config.AsBool(rawAllow)","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/allow_list.go#L146-L182","documentation":"Same ambiguity check as the IPv4 case but for IPv6: an allow list mixing true and false rules needs an explicit default ::/0 entry, otherwise the decision for unmatched IPv6 addresses is undefined and newAllowList fails.","triggerScenarios":"newAllowListFromConfig / getRemoteAllowRanges where no ::/0 key exists and the IPv6 CIDR rules include both true and false values.","commonSituations":"Dual-stack configs where the admin added an IPv4 default (0.0.0.0/0) but forgot the IPv6 default (::/0).","solutions":["Add an explicit ::/0: true or ::/0: false entry","Or make all IPv6 rules a single value so the default is unambiguous"],"exampleFix":"// before\nremote_allow_ranges:\n  0.0.0.0/0: false\n  fd00::/8: true\n  2001:db8::/32: false\n// after\nremote_allow_ranges:\n  0.0.0.0/0: false\n  ::/0: false\n  fd00::/8: true\n  2001:db8::/32: false","handlingStrategy":"validation","validationCode":"func hasV6Default(m map[string]any) bool {\n\t_, ok := m[\"::/0\"]\n\treturn ok\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["In dual-stack configs, always add both 0.0.0.0/0 and ::/0 defaults","Review IPv6 rules whenever IPv4 rules change"],"tags":["config","firewall","allowlist","ipv6"],"backgroundTag":"missing-default-rule","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}