{"record":{"id":"dede1da7c09d4b19","repo":"slackhq/nebula","slug":"config-s-has-invalid-value-type-t-v","errorCode":null,"errorMessage":"config `%s` has invalid value (type %T): %v","messagePattern":"config `(.+?)` has invalid value \\(type %T\\): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"allow_list.go","lineNumber":116,"sourceCode":"\t}\n\n\trules4 := allowListRules{firstValue: true, allValuesMatch: true, defaultSet: false}\n\trules6 := allowListRules{firstValue: true, allValuesMatch: true, defaultSet: false}\n\n\tfor rawCIDR, rawValue := range rawMap {\n\t\tif handleKey != nil {\n\t\t\thandled, err := handleKey(rawCIDR, rawValue)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif handled {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\n\t\tvalue, ok := config.AsBool(rawValue)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` has invalid value (type %T): %v\", k, rawValue, rawValue)\n\t\t}\n\n\t\tipNet, err := netip.ParsePrefix(rawCIDR)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` has invalid CIDR: %s. %w\", k, rawCIDR, err)\n\t\t}\n\n\t\tipNet = netip.PrefixFrom(ipNet.Addr().Unmap(), ipNet.Bits())\n\n\t\ttree.Insert(ipNet, value)\n\n\t\tmaskBits := ipNet.Bits()\n\n\t\tvar rules *allowListRules\n\t\tif ipNet.Addr().Is4() {\n\t\t\trules = &rules4\n\t\t} else {\n\t\t\trules = &rules6","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/allow_list.go#L98-L134","documentation":"newAllowList parses one firewall allow-list entry from config. Each CIDR key must map to a boolean allow/deny value; if config.AsBool cannot convert the raw YAML/JSON value to a bool, construction fails with this error. The type %T and value %v of the offending value are included to pinpoint the config mistake.","triggerScenarios":"Calling NewRemoteAllowListFromConfig or newAllowListFromConfig where a CIDR key's value is a non-boolean such as a string (\"yes\", \"allow\"), an integer, a list, or a nested map instead of true/false.","commonSituations":"YAML configs using unquoted yes/no (older YAML 1.1 habit), values wrapped in quotes becoming strings, or users pasting rules where the value is meant for a different firewall syntax (e.g. iptables accept/drop).","solutions":["Change the CIDR's value in the config to a literal true or false","If using YAML strings like \"true\", unquote them so they parse as booleans","Check the reported type %T in the message to see what the value actually parsed as"],"exampleFix":"// before\nremote_allow_ranges:\n  10.0.0.0/8: \"true\"\n// after\nremote_allow_ranges:\n  10.0.0.0/8: true","handlingStrategy":"validation","validationCode":"func validBoolRules(m map[string]any) bool {\n\tfor _, v := range m {\n\t\tif _, ok := v.(bool); !ok {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true\n}","typeGuard":"func asBool(v any) (bool, bool) {\n\tb, ok := v.(bool)\n\treturn b, ok\n}","tryCatchPattern":null,"preventionTips":["Use literal true/false in YAML/JSON, never quoted strings or yes/no","Lint configs against the library's schema before deploy"],"tags":["config","validation","firewall","allowlist"],"backgroundTag":"invalid-config-value","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}