juanfont/headscale · error · errPolicyTestsFailed

%w: %w

Error message

%w:
%w

What it means

Error "%w: %w" thrown in juanfont/headscale.

Source

Thrown at hscontrol/policy/v2/types.go:3228

		}

		for _, dst := range t.Accept {
			err := validateTestDestination(pol, dst)
			if err != nil {
				errs = append(errs, fmt.Errorf("test %d, accept %q: %w", i, dst, err))
			}
		}

		for _, dst := range t.Deny {
			err := validateTestDestination(pol, dst)
			if err != nil {
				errs = append(errs, fmt.Errorf("test %d, deny %q: %w", i, dst, err))
			}
		}
	}

	if len(errs) > 0 {
		return fmt.Errorf("%w:\n%w", errPolicyTestsFailed, multierr.New(errs...))
	}

	return nil
}

// validateTestDestination enforces that a tests-block dst describes one
// connection attempt to one specific host on one specific port. SaaS
// rejects three shapes that violate the rule: autogroup:internet (routed
// by exit-node [tailcfg.Node.AllowedIPs], not the packet filter); multi-port
// (range/list/wildcard, no single allow/deny answer); and CIDR ranges
// — both raw `/N` syntax and `hosts:`-table aliases whose RHS is a
// multi-host prefix. Bare IP literals reach this function as *[Prefix]
// /32 or /128 just like explicit `/32` / `/128` does, so the CIDR
// check inspects the raw input string for `/` rather than the parsed
// alias type.
func validateTestDestination(pol *Policy, dst string) error {
	awp, err := parseDestinationAlias(dst)
	if err != nil {

View on GitHub (pinned to 565fd254d0)

Solutions

1. Inspect the wrapped error for the underlying cause and correct the failing condition (); retry the operation after fixing the input, configuration, or environment.

Example fix

Inspect the wrapped error for the underlying cause and correct the failing condition (); retry the operation after fixing the input, configuration, or environment.

When it happens

Trigger: Thrown at hscontrol/policy/v2/types.go:3228 when the library encounters an invalid state.

Common situations: A compound policy error combining two failures. Read both wrapped messages; fix the primary error first and re-run validation.

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/8b0b5b8da5f866ca. Report an issue: GitHub.