ginuerzh/gost · error

invalid port: %s

Error message

invalid port: %s

What it means

ParsePortRange parses a port spec; the single-value branch parses with strconv.Atoi and then range-checks 0–65535. A syntactically valid integer outside that range (or causing Atoi failure, which surfaces strconv's own error) yields "invalid port: %s" for out-of-range values.

Source

Thrown at permissions.go:40

	Min, Max int
}

// ParsePortRange parses the s to a PortRange.
// The s may be a '*' means 0-65535.
func ParsePortRange(s string) (*PortRange, error) {
	if s == "*" {
		return &PortRange{Min: 0, Max: 65535}, nil
	}

	minmax := strings.Split(s, "-")
	switch len(minmax) {
	case 1:
		port, err := strconv.Atoi(s)
		if err != nil {
			return nil, err
		}
		if port < 0 || port > 65535 {
			return nil, fmt.Errorf("invalid port: %s", s)
		}
		return &PortRange{Min: port, Max: port}, nil
	case 2:
		min, err := strconv.Atoi(minmax[0])
		if err != nil {
			return nil, err
		}
		max, err := strconv.Atoi(minmax[1])
		if err != nil {
			return nil, err
		}

		realmin := maxint(0, minint(min, max))
		realmax := minint(65535, maxint(min, max))

		return &PortRange{Min: realmin, Max: realmax}, nil
	default:
		return nil, fmt.Errorf("invalid range: %s", s)

View on GitHub (pinned to a33fdbf4c9)

Solutions

1. Correct the port value to be within 0–65535 in the config/permission string.
2. Validate ports with a quick pre-check (parse and range-check) before passing to ParsePortSet/ParsePermissions.
3. If the input came from user input, clamp or reject it at your application's validation layer.

Example fix

// before
perms = "connect * * 65536"
// after
perms = "connect * * 65535"

func validPort(s string) bool {
    p, err := strconv.Atoi(s)
    return err == nil && p >= 0 && p <= 65535
}
if !validPort(portSpec) { return errors.New("port out of range") }

pr, err := ParsePortRange(spec)
if err != nil {
    return fmt.Errorf("bad port spec %q: %w", spec, err)
}

When it happens

Trigger: Calling ParsePortRange("70000"), ParsePortRange("-5"), or any single token whose numeric value is <0 or >65535; also reached via ParsePortSet for such elements.

Common situations: Config typos in port-based permissions (e.g. port "65536", "99999"); generated configs with unvalidated user input; mixing port ranges with negative numbers.

Related errors

• invalid range: %s
• must specify at least one port
• action list must look like connect,bind given: %s
• ErrInvalidNode
• cannot be empty

AI-assisted analysis of ginuerzh/gost@a33fdbf4c9 (2026-09-02). Data as JSON: /api/errors/246bb7c36f031d10. Report an issue: GitHub.