juanfont/headscale · error

test %d, deny %q: %w

Error message

test %d, deny %q: %w

What it means

Error "test %d, deny %q: %w" thrown in juanfont/headscale.

Source

Thrown at hscontrol/policy/v2/types.go:3222

		if t.Proto != "" &&
			t.Proto != ProtocolNameTCP &&
			t.Proto != ProtocolNameUDP &&
			t.Proto != ProtocolNameSCTP {
			errs = append(errs, fmt.Errorf("test %d: %w: %q", i, ErrTestProtocolNotAllowed, t.Proto))
		}

		for _, dst := range t.Accept {
			err := validateTestDestination(pol, dst)
			if err != nil {
				errs = append(errs, fmt.Errorf("test %d, accept %q: %w", i, dst, err))
			}
		}

		for _, dst := range t.Deny {
			err := validateTestDestination(pol, dst)
			if err != nil {
				errs = append(errs, fmt.Errorf("test %d, deny %q: %w", i, dst, err))
			}
		}
	}

	if len(errs) > 0 {
		return fmt.Errorf("%w:\n%w", errPolicyTestsFailed, multierr.New(errs...))
	}

	return nil
}

// validateTestDestination enforces that a tests-block dst describes one
// connection attempt to one specific host on one specific port. SaaS
// rejects three shapes that violate the rule: autogroup:internet (routed
// by exit-node [tailcfg.Node.AllowedIPs], not the packet filter); multi-port
// (range/list/wildcard, no single allow/deny answer); and CIDR ranges
// — both raw `/N` syntax and `hosts:`-table aliases whose RHS is a
// multi-host prefix. Bare IP literals reach this function as *[Prefix]

View on GitHub (pinned to 565fd254d0)

Solutions

1. Inspect the wrapped error for the underlying cause and correct the failing condition (test , deny); retry the operation after fixing the input, configuration, or environment.

Example fix

Inspect the wrapped error for the underlying cause and correct the failing condition (test , deny); retry the operation after fixing the input, configuration, or environment.

When it happens

Trigger: Thrown at hscontrol/policy/v2/types.go:3222 when the library encounters an invalid state.

Common situations: A deny entry in a policy test failed to resolve. Ensure the deny destination is a single valid host.

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/b2a132847b340e5e. Report an issue: GitHub.