{"record":{"id":"d6c292588c43b8be","repo":"slackhq/nebula","slug":"swas-not-a-number-s","errorCode":null,"errorMessage":"%swas not a number; `%s`","messagePattern":"(.+?)was not a number; `(.+?)`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":1117,"sourceCode":"// parsePortValue accepts a base-10 decimal in [0, 65535] and returns it\n// widened to int32. Using strconv.ParseUint with bitSize 16 rejects\n// negative input, out-of-range input (>65535), and any non-decimal byte\n// by construction, so the int32 widening that follows is provably safe\n// and cannot collide with firewall.PortAny (0) or firewall.PortFragment\n// (-1) via integer truncation.\n//\n// prefix is prepended to both error messages so callers can disambiguate\n// the single-port path (prefix=\"\") from the range bounds (prefix=\"beginning\n// range \" / \"ending range \"), preserving the historical error strings.\nfunc parsePortValue(prefix, s string) (int32, error) {\n\tn, err := strconv.ParseUint(s, 10, 16)\n\tif err == nil {\n\t\treturn int32(n), nil\n\t}\n\tif errors.Is(err, strconv.ErrRange) {\n\t\treturn 0, fmt.Errorf(\"%sout of range [0,65535]; `%s`\", prefix, s)\n\t}\n\treturn 0, fmt.Errorf(\"%swas not a number; `%s`\", prefix, s)\n}\n","sourceCodeStart":1099,"sourceCodeEnd":1119,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L1099-L1119","documentation":"parsePortValue returns this error when strconv.ParseUint fails with any error other than ErrRange, i.e. the string is not a syntactically valid base-10 number (or is empty). It means the port field in the firewall config does not parse as an integer.","triggerScenarios":"A firewall rule port value in the Nebula config is a non-numeric string such as 'any', '443,8080', 'https', or contains stray characters/whitespace, when the config is parsed at startup via parsePort/addFireWallRulesFromConfig.","commonSituations":"Writing 'port: any' instead of omitting the field, comma-separated lists instead of a range, YAML type quirks making the value a map/list, service-name style ports ('ssh').","solutions":["Replace the value in the config with a numeric port or a numeric range like '22-23'","Omit the port key entirely to match any port instead of writing 'any'","Validate the config with `nebula -test -config ...` before restarting"],"exampleFix":"// before\nfirewall:\n  inbound:\n    - port: any\n      proto: tcp\n// after\nfirewall:\n  inbound:\n    - proto: tcp","handlingStrategy":"validation","validationCode":"func isNumericPort(v interface{}) bool {\n\ts, ok := v.(string)\n\tif !ok {\n\t\treturn false\n\t}\n\t_, err := strconv.Atoi(strings.TrimSpace(s))\n\treturn err == nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never write 'any', service names, or comma lists in port fields — omit the key or use a range","Validate configs with `nebula -test -config` as a pre-start step","Quote string values in YAML carefully to avoid accidental non-string coercion","Add schema validation for firewall rule fields in config management tooling"],"tags":["config","firewall","parse-error"],"backgroundTag":"invalid-number-format","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}