netbirdio/netbird · error

decode source prefix: %w

Error message

decode source prefix: %w

What it means

Error "decode source prefix: %w" thrown in netbirdio/netbird.

Source

Thrown at client/internal/acl/manager.go:418

	}

	return id.RuleID(hex.EncodeToString(md5.New().Sum([]byte(idStr))))
}

// getRuleGroupingSelector takes all rule properties except IP address to build selector
func (d *DefaultManager) getRuleGroupingSelector(rule *mgmProto.FirewallRule) string {
	return fmt.Sprintf("%v:%v:%v:%s:%v", strconv.Itoa(int(rule.Direction)), rule.Action, rule.Protocol, rule.Port, rule.PortInfo)
}


// extractRuleIP extracts the peer IP from a firewall rule.
// If sourcePrefixes is populated (new management), decode the first entry and use its address.
// Otherwise fall back to the deprecated PeerIP string field (old management).
func extractRuleIP(r *mgmProto.FirewallRule) (netip.Addr, error) {
	if len(r.SourcePrefixes) > 0 {
		addr, err := netiputil.DecodeAddr(r.SourcePrefixes[0])
		if err != nil {
			return netip.Addr{}, fmt.Errorf("decode source prefix: %w", err)
		}
		return addr.Unmap(), nil
	}

	//nolint:staticcheck // PeerIP used for backward compatibility with old management
	addr, err := netip.ParseAddr(r.PeerIP)
	if err != nil {
		return netip.Addr{}, fmt.Errorf("invalid IP address, skipping firewall rule")
	}
	return addr.Unmap(), nil
}

func convertToFirewallProtocol(protocol mgmProto.RuleProtocol) (firewall.Protocol, error) {
	switch protocol {
	case mgmProto.RuleProtocol_TCP:
		return firewall.ProtocolTCP, nil
	case mgmProto.RuleProtocol_UDP:
		return firewall.ProtocolUDP, nil

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at client/internal/acl/manager.go:418 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/d61b2f4ac7fe3591. Report an issue: GitHub.