{"record":{"id":"e3cecc09dc2d76e3","repo":"slackhq/nebula","slug":"groups-spec-s-contains-the-group-any-this-r-e3cecc","errorCode":null,"errorMessage":"groups spec [%s] contains the group '\"any\". This rule will ignore the specified host %s","messagePattern":"groups spec \\[(.+?)\\] contains the group '\"any\"\\. This rule will ignore the specified host (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":1042,"sourceCode":"\n\tgroupsHasAny := slices.Contains(r.Groups, \"any\")\n\tif groupsHasAny && len(r.Groups) > 1 {\n\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the other groups specified\", r.Groups)\n\t}\n\n\tif r.Host == \"any\" {\n\t\tif !groupsEmpty {\n\t\t\treturn fmt.Errorf(\"groups specified as %s, but host=any will match any host, regardless of groups\", r.Groups)\n\t\t}\n\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"cidr specified as %s, but host=any will match any host, regardless of cidr\", r.Cidr)\n\t\t}\n\t}\n\n\tif groupsHasAny {\n\t\tif !hostEmpty && r.Host != \"any\" {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified host %s\", r.Groups, r.Host)\n\t\t}\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified cidr %s\", r.Groups, r.Cidr)\n\t\t}\n\t}\n\n\tif r.Code != \"\" {\n\t\treturn fmt.Errorf(\"code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional\", r.Code)\n\t}\n\n\t//todo alert on cidr-any\n\n\treturn nil\n}\n\nfunc parsePort(s string) (int32, int32, error) {\n\tconst notAPort int32 = -2\n\tif s == \"any\" {","sourceCodeStart":1024,"sourceCodeEnd":1060,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L1024-L1060","documentation":"When a rule's groups include 'any' (which matches every group) and a specific host is also given (other than the literal 'any'), the host constraint is meaningless because the rule already matches all groups — and via groups, any peer. The translator rejects the rule to surface the contradiction.","triggerScenarios":"A rule with groups containing 'any' and a non-empty host other than 'any' during rule translation, e.g. groups: [any], host: laptop-1.","commonSituations":"Adding 'any' to a host-specific rule to widen it, not realizing groups=any makes the host selector moot.","solutions":["Remove 'any' from the groups list if the host restriction is intended","Or remove the host field if any-host matching is what you want"],"exampleFix":"// before\ngroups: [any]\nhost: laptop-1\n// after\nhost: laptop-1","handlingStrategy":"validation","validationCode":"func checkAnyGroupsHost(groups []string, host string) error {\n    if slices.Contains(groups, \"any\") && host != \"\" && host != \"any\" {\n        return fmt.Errorf(\"groups containing 'any' cannot restrict to host %s\", host)\n    }\n    return nil\n}","typeGuard":"func isAnyGroupsHostConsistent(groups []string, host string) bool {\n    return !slices.Contains(groups, \"any\") || host == \"\" || host == \"any\"\n}","tryCatchPattern":"if err := loadFirewallConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"ignore the specified host\") {\n        return fmt.Errorf(\"groups=any makes host selector moot: %w\", err)\n    }\n    return err\n}","preventionTips":["Never combine groups containing 'any' with a specific host","Decide whether the rule is group-based or host-based and use one selector","Lint for the 'any' group alongside host fields"],"tags":["go","firewall","config","groups"],"backgroundTag":"firewall-rule-invalid","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}