juanfont/headscale · error · ErrProtocolNoSpecificPorts

%w: %q, only "*" is allowed

Error message

%w: %q, only "*" is allowed

What it means

Error "%w: %q, only "*" is allowed" thrown in juanfont/headscale.

Source

Thrown at hscontrol/policy/v2/types.go:3184

	return &policy, nil
}

// validateProtocolPortCompatibility checks that only TCP, UDP, and SCTP [Protocol]s
// can have specific ports. All other [Protocol]s should only use wildcard ports.
func validateProtocolPortCompatibility(protocol Protocol, destinations []AliasWithPorts) error {
	// Only TCP, UDP, and SCTP support specific ports
	supportsSpecificPorts := protocol == ProtocolNameTCP || protocol == ProtocolNameUDP || protocol == ProtocolNameSCTP || protocol == ""

	if supportsSpecificPorts {
		return nil // No validation needed for these protocols
	}

	// For all other protocols, check that all destinations use wildcard ports
	for _, dst := range destinations {
		for _, portRange := range dst.Ports {
			// Check if it's not a wildcard port (0-65535)
			if portRange.First != 0 || portRange.Last != 65535 {
				return fmt.Errorf("%w: %q, only \"*\" is allowed", ErrProtocolNoSpecificPorts, protocol)
			}
		}
	}

	return nil
}

// validateTests enforces the four shape rules a tests-block entry must
// follow: a tests entry describes one connection attempt to one specific
// destination port over a connection-oriented protocol and asserts
// whether that attempt is allowed or denied. The same shapes remain
// valid inside [ACL] or [Grant] destinations where the rule does not apply.
func validateTests(pol *Policy, tests []PolicyTest) error {
	var errs []error

	for i, t := range tests {
		if len(t.Accept) == 0 && len(t.Deny) == 0 {
			errs = append(errs, fmt.Errorf("test %d: %w", i, ErrTestEmptyAssertions))

View on GitHub (pinned to 565fd254d0)

Solutions

1. Inspect the wrapped error for the underlying cause and correct the failing condition (); retry the operation after fixing the input, configuration, or environment.

Example fix

Inspect the wrapped error for the underlying cause and correct the failing condition (); retry the operation after fixing the input, configuration, or environment.

When it happens

Trigger: Thrown at hscontrol/policy/v2/types.go:3184 when the library encounters an invalid state.

Common situations: Only '*' is permitted in this position of the entry. Replace the offending value with a wildcard or restructure the rule.

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/0a3370bb06641922. Report an issue: GitHub.