{"record":{"id":"dfa305077b6c0480","repo":"slackhq/nebula","slug":"invalid-port-d-dfa305","errorCode":null,"errorMessage":"invalid port %d","messagePattern":"invalid port (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"service/service.go","lineNumber":225,"sourceCode":"\n// Listen listens on the provided address. Currently only TCP with wildcard\n// addresses are supported.\nfunc (s *Service) Listen(network, address string) (net.Listener, error) {\n\tif network != \"tcp\" && network != \"tcp4\" {\n\t\treturn nil, errors.New(\"only tcp is supported\")\n\t}\n\taddr, err := net.ResolveTCPAddr(network, address)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif addr.IP != nil && !bytes.Equal(addr.IP, []byte{0, 0, 0, 0}) {\n\t\treturn nil, fmt.Errorf(\"only wildcard address supported, got %q %v\", address, addr.IP)\n\t}\n\tif addr.Port == 0 {\n\t\treturn nil, errors.New(\"specific port required, got 0\")\n\t}\n\tif addr.Port < 0 || addr.Port >= math.MaxUint16 {\n\t\treturn nil, fmt.Errorf(\"invalid port %d\", addr.Port)\n\t}\n\tport := uint16(addr.Port)\n\n\tl := &tcpListener{\n\t\tport:   port,\n\t\ts:      s,\n\t\taddr:   addr,\n\t\taccept: make(chan net.Conn),\n\t}\n\n\ts.mu.Lock()\n\tdefer s.mu.Unlock()\n\n\tif _, ok := s.mu.listeners[port]; ok {\n\t\treturn nil, fmt.Errorf(\"already listening on port %d\", port)\n\t}\n\ts.mu.listeners[port] = l\n","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/service/service.go#L207-L243","documentation":"After requiring a wildcard address, Listen validates that the requested port fits in a uint16 and is representable. Ports below 0 or at/above math.MaxUint16 (65535) cannot be used as TCP ports in the netstack and produce this error. Note the earlier separate branch rejects port 0 with its own message.","triggerScenarios":"Calling Service.Listen(\"tcp\", \":65535\") or \":99999\" or \":-1\" — any resolved port with port < 0 || port >= math.MaxUint16 at service/service.go:225. ResolveTCPAddr accepts these numerically, so the failure surfaces here.","commonSituations":"Interpolating an unvalidated integer into the address string (fmt.Sprintf(\":%d\", cfg.Port)); admin config with 65535 or a sentinel like 0 for \"any port\"; copying a port from a spec that allows 65535.","solutions":["Use a port in the range 1–65534.","Validate the port integer before formatting it into the listen address.","If you need an OS-assigned port, this library does not support port 0 — pick a free port yourself."],"exampleFix":"// before\nl, err := svc.Listen(\"tcp\", \":65535\")\n// after\nconst port = 8080\nif port > 0 && port < math.MaxUint16 {\n    l, err = svc.Listen(\"tcp\", fmt.Sprintf(\":%d\", port))\n}","handlingStrategy":"validation","validationCode":"if port <= 0 || port >= math.MaxUint16 {\n    return fmt.Errorf(\"port must be in [1, 65534], got %d\", port)\n}\nl, err := svc.Listen(\"tcp\", fmt.Sprintf(\":%d\", port))","typeGuard":"func isValidPort(p int) bool { return p > 0 && p < math.MaxUint16 }","tryCatchPattern":"l, err := svc.Listen(\"tcp\", addr)\nif err != nil {\n    var perr *net.AddrError\n    if strings.HasPrefix(err.Error(), \"invalid port\") {\n        return fmt.Errorf(\"configured listen port out of range: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate configured port integers before string formatting them into addresses.","Treat 65535 as invalid here (comparison is >= math.MaxUint16).","Pick ephemeral-range ports (e.g. 49152–65400) for tests and scan for a free one."],"tags":["network","gvisor","netstack","listen","invalid-port"],"backgroundTag":"invalid-port-number","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}