{"record":{"id":"e02169e7bedd2620","repo":"tailscale/tailscale","slug":"decode-mask-v","errorCode":null,"errorMessage":"decode mask: %v","messagePattern":"decode mask: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/linuxfw/nftables_runner.go","lineNumber":1407,"sourceCode":"\t_ = c.AddRule(rule)\n\n\tif err := c.Flush(); err != nil {\n\t\treturn fmt.Errorf(\"add rule: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// createDropOutgoingPacketFromCGNATRangeRuleWithTunname creates a rule to drop\n// outgoing packets from the CGNAT range.\nfunc createDropOutgoingPacketFromCGNATRangeRuleWithTunname(table *nftables.Table, chain *nftables.Chain, tunname string) (*nftables.Rule, error) {\n\t_, ipNet, err := net.ParseCIDR(tsaddr.CGNATRange().String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parse cidr: %v\", err)\n\t}\n\tmask, err := hex.DecodeString(ipNet.Mask.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decode mask: %v\", err)\n\t}\n\tnetip := ipNet.IP.Mask(ipNet.Mask).To4()\n\tsaddrExpr, err := newLoadSaddrExpr(nftables.TableFamilyIPv4, 1)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"newLoadSaddrExpr: %v\", err)\n\t}\n\trule := &nftables.Rule{\n\t\tTable: table,\n\t\tChain: chain,\n\t\tExprs: []expr.Any{\n\t\t\t&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},\n\t\t\t&expr.Cmp{\n\t\t\t\tOp:       expr.CmpOpEq,\n\t\t\t\tRegister: 1,\n\t\t\t\tData:     []byte(tunname),\n\t\t\t},\n\t\t\tsaddrExpr,\n\t\t\t&expr.Bitwise{","sourceCodeStart":1389,"sourceCodeEnd":1425,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/util/linuxfw/nftables_runner.go#L1389-L1425","documentation":"createDropOutgoingPacketFromCGNATRangeRuleWithTunname failed to hex-decode the parsed network mask into raw bytes for the nftables payload expression. This indicates the parsed mask string was not valid hex — an internal encoding problem, not a user-input error.","triggerScenarios":"Thrown at util/linuxfw/nftables_runner.go:1407 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the mask produced by net.ParseCIDR for the given range.","Verify the range uses a standard IPv4 mask; non-standard masks may not decode.","Fix the range definition if it was customized."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}