ErrLookup › slackhq/nebula

slackhq/nebula

A scalable overlay networking tool with a focus on performance, simplicity and security · Go · 176 source files

Analyzed at dd8f660c0a on 2026-09-03. 528 documented errors.

Code / Message	Type	Severity	Tags
`ErrBadFormat` bad wire format	error_code	error	parsing, asn1, certificate
`ErrRootExpired` root certificate is expired	error_code	critical	certificate, expiry, pkix
`ErrExpired` certificate is expired	error_code	error	certificate, expiry, pkix
`ErrNotCA` certificate is not a CA	error_code	error	certificate, ca-pool, validation
`ErrNotSelfSigned` certificate is not self-signed	error_code	error	certificate, signature, ca-pool
`ErrBlockListed` certificate is in the block list	error_code	critical	certificate, revocation, blocklist
`ErrFingerprintMismatch` certificate fingerprint did not match	error_code	error	certificate, fingerprint, pinning
`ErrSignatureMismatch` certificate signature did not match	error_code	critical	certificate, signature, trust-chain
`ErrInvalidPublicKey` invalid public key	error_code	error	certificate, public-key, validation
`ErrInvalidPrivateKey` invalid private key	error_code	error	private-key, keypair, validation
`ErrPublicPrivateCurveMismatch` public key does not match private key curve	error_code	error
`ErrPublicPrivateKeyMismatch` public key and private key are not a pair	error_code	error
`ErrPrivateKeyEncrypted` private key must be decrypted	error_code	error
`ErrCaNotFound` could not find ca for the certificate	error_code	error
`ErrUnknownVersion` certificate version unrecognized	error_code	error
`ErrCertPubkeyPresent` certificate has unexpected pubkey present	error_code	error
`ErrCurveMismatch` certificate curve does not match CA	error_code	error
`ErrInvalidPEMBlock` input did not contain a valid PEM encoded block	error_code	error
`ErrInvalidPEMCertificateBanner` bytes did not contain a proper certificate banner	error_code	error
`ErrInvalidPEMX25519PublicKeyBanner` bytes did not contain a proper X25519 public key banner	error_code	error
`ErrInvalidPEMX25519PrivateKeyBanner` bytes did not contain a proper X25519 private key banner	error_code	error	pem, x25519, key-parsing, config
`ErrInvalidPEMEd25519PublicKeyBanner` bytes did not contain a proper Ed25519 public key banner	error_code	error	pem, ed25519, key-parsing, config
`ErrInvalidPEMEd25519PrivateKeyBanner` bytes did not contain a proper Ed25519 private key banner	error_code	error	pem, ed25519, key-parsing, config
`ErrNoPeerStaticKey` no peer static key was present	error_code	error	handshake, peer-key, nil-argument
`ErrNoPayload` provided payload was empty	error_code	error	handshake, payload, nil-argument
`ErrMissingDetails` certificate did not contain details	error_code	error	certificate, fingerprint, uninitialized
`ErrEmptySignature` empty signature	error_code	error	signature, certificate, signing
`ErrEmptyRawDetails` empty rawDetails not allowed	error_code	error	certificate, marshal, uninitialized
invalid ASN.1	validation	error	asn1, p256, signature, encoding
invalid integer	validation	error	asn1, p256, signature, encoding
`ErrTruncatedPEMBlock` truncated PEM block	error_code	error	pem, certificate, parsing, go
use of Curve25519 is not allowed in FIPS 140-only mode	validation	error	fips, crypto, curve25519, pki
use of Curve25519 is not allowed in FIPS 140-only mode	validation	error	fips, crypto, curve25519, keygen
`ErrNoTerminal` cannot read password from nonexistent terminal	error_code	error	terminal, password, stdin, automation
use of Curve25519 is not allowed in FIPS 140-only mode	validation	error	fips, crypto, curve25519, signing
Empty configuration	validation	error	config, validation, go
`ErrAlreadyStarted` nebula is already started	error_code	warning	lifecycle, state-machine, go
`ErrAlreadyStopped` nebula cannot be restarted	error_code	warning	lifecycle, state-machine, go
`ErrUnknownState` nebula state is invalid	error_code	error	lifecycle, state-machine, concurrency, go
`ErrUnknownNetworkType` unknown network type	error_code	error	firewall, packet-processing, go
`ErrPeerRejected` remote address is not within a network that we handle	error_code	warning	firewall, packet-drop, vpn-peer, nebula
`ErrInvalidRemoteIP` remote address is not in remote certificate networks	error_code	error	firewall, ip-spoofing, certificate, packet-drop
`ErrInvalidLocalIP` local address is not in list of handled local addresses	error_code	error	firewall, routing, configuration, packet-drop
`ErrNoMatchingRule` no matching rule in firewall table	error_code	warning	firewall, access-control, default-deny, rule-mismatch
could not parse rule	validation	error	configuration, yaml, firewall-rules, parse-error
group should contain a single value, an array with more than	validation	error	config, firewall, validation
`ErrInitiateOnResponder` initiate called on responder	error_code	error	handshake, state-machine, misuse
`ErrInitiateAlreadyCalled` initiate already called	error_code	error	handshake, state-machine, retry
`ErrInitiateNotCalled` initiate must be called before ProcessPacket for initiators	error_code	error	handshake, state-machine, ordering
`ErrPacketTooShort` packet too short	error_code	warning	network, handshake, malformed-packet
`ErrPublicKeyMismatch` public key mismatch between certificate and handshake	error_code	critical	handshake, certificate, public-key, security
`ErrIncompleteHandshake` handshake completed without receiving required content	error_code	error	handshake, protocol, noise
`ErrMachineFailed` handshake machine has failed	error_code	error	handshake, state-machine, noise
`ErrUnknownSubtype` unknown handshake subtype	error_code	error	handshake, protocol, versioning
`ErrMissingContent` expected handshake content but message was empty	error_code	error	handshake, protocol, noise
`ErrUnexpectedContent` received unexpected handshake content	error_code	error	handshake, protocol, noise
`ErrInvalidRemoteIndex` peer sent an invalid index in handshake payload	error_code	error	handshake, protocol, index
`ErrIndexAllocation` failed to allocate local index	error_code	error	handshake, resources, index-allocation
`ErrNoCredential` no handshake credential available for cert version	error_code	error	handshake, credentials, configuration
`ErrAsymmetricCipherKeys` noise produced only one cipher key	error_code	critical	handshake, noise, cryptography
`ErrMultiMessageUnsupported` multi-message handshake patterns are not yet supported by the manager	error_code	error	handshake, unsupported-feature, noise-protocol
`ErrSubtypeMismatch` packet subtype does not match handshake machine subtype	error_code	warning	handshake, subtype, packet-parsing
invalid handshake message	error_code	error	handshake, protobuf, wire-format
invalid handshake details	error_code	error	handshake, protobuf, wire-format
`ErrExistingHostInfo` existing hostinfo	error_code	info	handshake, hostmap, race-condition
`ErrAlreadySeen` already seen	error_code	warning	replay-attack, crypto, packet-processing
`ErrLocalIndexCollision` local index collision	error_code	error	handshake, hostmap, index-collision
failed to generate unique localIndexId	error_code	critical	handshake, resource-exhaustion, index-allocation
`ErrHeaderTooShort` header is too short	error_code	warning	packet-parsing, header, udp
nil header	error_code	error	header, nil-pointer, packet-encoding
unable to find host	error_code	error	network, relay, hostmap, nebula
unable to find host with relay	error_code	error	network, relay, hostmap, nebula
no outside connection	validation	critical	network, config, udp, nebula, startup
no inside interface (tun)	validation	critical	network, config, tun, nebula, startup
no certificate state	validation	critical	config, pki, certificates, nebula, startup
no firewall rules	validation	critical	config, firewall, nebula, startup
no connection manager	validation	critical	config, nebula, startup, wiring
`ErrIPv6CouldNotFindPayload` could not find payload in ipv6 packet	error_code	warning	network, ipv6, packet-parsing, nebula
`ErrHostNotKnown` host not known	error_code	error	network, lighthouse, discovery, nebula
`ErrBadDetailsVpnAddr` invalid packet, malformed detailsVpnAddr	error_code	warning	network, lighthouse, packet-parsing, nebula
unsupported version	exception	error	lighthouse, certificate-version, protocol-compatibility
no cipher state available to encrypt	exception	error	noise, aesgcm, nil-state, encryption
no cipher state available to encrypt	exception	error	noise, chachapoly, nil-state, encryption
`ErrMessageCounterExhausted` message counter exhausted	error_code	error	noise, nonce, rekey, replay-protection
no cipher state available to encrypt	exception	error	noise, fips140, aesgcm, nil-state
`ErrOutOfWindow` out of window packet	error_code	warning	replay-window, packet-processing, network
`ErrPacketTooShort` packet is too short	error_code	warning	packet-parsing, malformed-packet, network
`ErrUnknownIPVersion` packet is an unknown ip version	error_code	warning	packet-parsing, ip-version, network
`ErrIPv4InvalidHeaderLength` invalid ipv4 header length	error_code	warning	ipv4, packet-parsing, malformed-packet
`ErrIPv4PacketTooShort` ipv4 packet is too short	error_code	warning	ipv4, packet-parsing, short-packet
`ErrIPv6PacketTooShort` ipv6 packet is too short	error_code	warning	network, ipv6, packet-parsing, firewall
`errAdapterNotFound` adapter not present in network connections enumeration	exception	warning	windows, network, com, network-category
queue set already closed	exception	error	linux, network, gso, lifecycle, concurrency
queue set already closed	exception	error	linux, network, epoll, lifecycle, concurrency
`errPacketTooShort` packet too short	error_code	warning	linux, virtio, tso, packet-parsing, network
packet is too short	exception	warning	linux, virtio, tcp, packet-parsing, network
unable to determine IP version from packet	exception	warning	ios, tun, ipv4, ipv6, packet-parsing
`notImplemented` not implemented	error_code	error	hsm, pkcs11, build-tags, stub, cgo
pki: use of Curve25519 is not allowed in FIPS 140-only mode	validation	error	fips, crypto, curve25519, noise, pki
pki: use of ChaChaPoly is not allowed in FIPS 140-only mode	validation	error	fips, crypto, chacha20-poly1305, noise, pki
no pki.key path or PEM data provided	validation	critical	pki, config, nebula, missing-key
no pki.cert path or PEM data provided	validation	critical	pki, config, nebula, missing-cert
no certificates found in pki.cert	validation	critical	pki, certificate, nebula, invalid-pem
no pki.ca path or PEM data provided	validation	critical	pki, ca, nebula, config
no valid CA certificates present	validation	critical	pki, ca, expired-certificate, nebula
relay hostinfo is no longer in the hostmap	exception	error	relay, hostmap, race-condition, nebula
failed to generate unique localIndexId	exception	error	relay, hostmap, index-exhaustion, nebula
must be using user device	validation	error	service, device, nebula, tun
only tcp is supported	validation	error	service, network, tcp, nebula
specific port required, got 0	validation	error	service, tcp, port, nebula, validation
could not find hostinfo	exception	warning	nebula, hostmap, relay, vpn, diagnostics
failed to cast command	exception	error	nebula, sshd, type-assertion, go
stats.host can not be empty	validation	error	nebula, config, graphite, stats, validation
stats.listen should not be empty	validation	error	nebula, config, prometheus, stats, validation
stats.path should not be empty	validation	error	nebula, config, prometheus, stats, validation
`ErrInvalidIPv6RemoteForSocket` listener is IPv4, but writing to IPv6 remote	error_code	error	nebula, udp, ipv6, socket, network
could not initialize winrio	exception	error	nebula, windows, winrio, udp, platform
${ce.Context}	exception	error	nebula, error-wrapping, contextual-error, go
Send ring corrupt	exception	critical	nebula, wintun, windows, tun, ring-buffer
config `%s` has invalid type: %T	validation	error	nebula, config, allow-list, yaml, validation
config `%s` has invalid value (type %T): %v	validation	error	config, validation, firewall, allowlist
config `%s` has invalid CIDR: %s. %w	validation	error	config, network, cidr, validation
config `%s` contains both true and false rules, but no defau	validation	error	config, firewall, allowlist, ipv4
config `%s` contains both true and false rules, but no defau	validation	error	config, firewall, allowlist, ipv6
config `%s.interfaces` is invalid (type %T): %v	validation	error	config, validation, interfaces, allowlist
config `%s.interfaces` has invalid value (type %T): %v	validation	error	config, validation, interfaces, allowlist
config `%s.interfaces` has invalid key: %s: %v	validation	error	config, regex, interfaces, allowlist
config `%s.interfaces` values must all be the same true/fals	validation	error	config, validation, interfaces, allowlist
invalid mask: %s for cidr: %s	validation	error	nebula, config, ipv4, ipv6, calculated-remotes
invalid port: %d	validation	error	nebula, config, port, validation, calculated-remotes
config `%s` has invalid type: %T	validation	error	nebula, config, type-error, yaml, calculated-remotes
config `%s` has invalid CIDR: %s	validation	error	nebula, config, cidr, validation, calculated-remotes
config '%s.%s': %w	validation	error	nebula, config, error-wrapping, calculated-remotes
calculated_remotes entry has invalid type: %T	validation	error	nebula, config, type-error, yaml, calculated-remotes
calculated_remotes entry: %w	validation	error	nebula, config, error-wrapping, calculated-remotes
invalid type: %T	validation	error	nebula, config, type-error, yaml, calculated-remotes
missing mask: %v	validation	error	nebula, config, missing-field, calculated-remotes
invalid mask (type %T): %v	validation	error	nebula, config, type-error, yaml, calculated-remotes
invalid mask: %s	validation	error	config, yaml, cidr, network
missing port: %v	validation	error	config, yaml, port, network
invalid port: %s: %w	validation	error	config, yaml, port, parsing
invalid port (type %T): %v	validation	error	config, yaml, type-error, port
%s: %w	validation	error	certificate, pki, ca-pool
could not calculate fingerprint for provided CA; error: %w;	exception	error	certificate, fingerprint, ca-pool
no certificate	validation	error	certificate, nil-check, ca-pool
could not calculate fingerprint to verify: %w	validation	error	certificate, fingerprint, verification, ca-pool
could not calculate alternate fingerprint to verify: %w	validation	error	certificate, fingerprint, p256, signature
no issuer in certificate	validation	error	certificate, issuer, ca-lookup
certificate expires after signing certificate	validation	error	certificate, validity, ca-constraints
certificate is valid before the signing certificate	validation	error	certificate, validity, ca-constraints
certificate contained a group not present on the signing ca:	validation	error	certificate, groups, ca-constraints
certificate contained a network assignment outside the limit	validation	error	certificate, network, ca-constraints, netip
certificate contained an unsafe network assignment outside t	validation	error	certificate, unsafe-networks, routing, ca-constraints
certificate curve %s does not match expected %s	validation	error	certificate, curve, mismatch, ecdsa
curve in cert and private key supplied don't match	validation	error	certificate, private-key, curve, mismatch
key was not 64 bytes, is invalid ed25519 private key	validation	error	certificate, private-key, ed25519, key-length
public key in cert and private key supplied don't match	exception	error	certificate, ed25519, key-mismatch, crypto
cannot parse private key as P256: %w	exception	error	certificate, p256, ecdh, key-format
invalid curve: %s	exception	error	certificate, curve, argument-validation
nil byte array	exception	error	certificate, unmarshal, empty-input
encoded Details was nil	exception	error	certificate, protobuf, unmarshal, missing-field
encoded IPs should be in pairs, an odd number was found	exception	error	certificate, protobuf, ips, validation
encoded Subnets should be in pairs, an odd number was found	exception	error	certificate, protobuf, subnets, validation
invalid curve: %s	exception	error	certificate, curve, validation
marshalling certificate details failed: %w	exception	error	certificate, marshalling, signing
unable to marshal network: %w	exception	warning	certificate, marshalling, network
unable to marshal unsafe network: %w	exception	warning	certificate, marshalling, unsafe-networks
failed to decode issuer: %w	exception	error	certificate, hex, issuer, marshalling
invalid AES-256 key length (%d) - cowardly refusing to encry	exception	error	encryption, aes, internal
invalid passphrase or corrupt private key	exception	critical	encryption, passphrase, aes-gcm, decryption
incompatible Argon2 version: %d	exception	error	encryption, argon2, kdf
salt must be set in argon2Parameters	exception	error	encryption, argon2, kdf, salt
salt must be at least 128 bits	exception	error	crypto, argon2, salt, validation
invalid ciphertext blob - blob shorter than nonce length	exception	error	crypto, aes-gcm, ciphertext, malformed-input
invalid curve: %v	exception	error	crypto, curve, enum, unsupported
nil byte array	exception	error	crypto, protobuf, empty-input, validation
encoded EncryptionMetadata was nil	exception	error	crypto, protobuf, missing-field, metadata
encoded Argon2Parameters was nil	exception	error	crypto, protobuf, argon2, missing-field
Argon2Parameters Version must be at least %d and no more tha	exception	error	crypto, argon2, bounds-check, protobuf
Argon2Parameters Memory must be be greater than 0 and no mor	exception	error	crypto, argon2, memory, bounds-check
Argon2Parameters Parallelism must be be greater than 0 and n	exception	error	crypto, argon2, parallelism, bounds-check
-argon-iterations must be be greater than 0 and no more than	exception	error	crypto, argon2, iterations, bounds-check
input did not contain a valid PEM encoded block	exception	error	pem, parsing, key-management, go
bytes did not contain a proper nebula encrypted Ed25519/ECDS	exception	error	pem, banner-mismatch, key-management, go
unsupported encryption algorithm: %s	exception	error	encryption, algorithm-support, key-management, go
key was not %d bytes, is invalid ed25519 private key	exception	error	ed25519, key-length, key-management, go
key was not 32 bytes, is invalid ECDSA P256 private key	exception	error	ecdsa, p256, key-length, key-management, go
input did not contain a valid PEM encoded block	exception	error	pem, parsing, public-key, go
bytes did not contain a proper public key banner	exception	error	pem, banner-mismatch, public-key, key-agreement, go
key was not %d bytes, is invalid %s public key	exception	error	pem, key-length, public-key, go
bytes did not contain a proper Ed25519/ECDSA public key bann	exception	error	pem, banner-mismatch, public-key, signing, go
bytes did not contain a proper private key banner	error_code	error	pem, private-key, key-banner, wrong-key-type
key was not %d bytes, is invalid %s private key	error_code	error	pem, private-key, key-length, corruption
key was not %d bytes, is invalid Ed25519 private key	error_code	error	pem, ed25519, signing-key, key-length
key was not 32 bytes, is invalid ECDSA P256 private key	error_code	error	pem, ecdsa, p256, signing-key, key-length
bytes did not contain a proper Ed25519/ECDSA private key ban	error_code	error	pem, signing-key, key-banner, wrong-key-type
invalid curve: %s	error_code	error	certificate, curve, signing, misconfiguration
curve in cert and private key supplied don't match	error_code	error	certificate, curve-mismatch, signing, key-type
can not sign a CA certificate with another	error_code	error	pki, certificate, ca
error computing issuer: %v	error_code	error	pki, certificate, fingerprint
self signed certificates must have IsCA set to true	error_code	error	pki, certificate, self-signed
unknown cert version %d	error_code	error	pki, certificate, versioning
invalid certificate	error_code	error	pki, certificate, type-assertion
out-key must be encrypted interactively	error_code	error	cli, tty, passphrase
error reading passphrase: %s	error_code	error	cli, tty, passphrase
no passphrase specified, remove -encrypt flag to write out-k	error_code	error	cli, passphrase, input-validation
invalid curve for PKCS#11: %s	error_code	error	cli, pkcs11, curve
error while creating PKCS#11 client: %w	error_code	error	cli, pkcs11, hsm
error while getting public key with PKCS#11: %w	error_code	error	pkcs11, hsm, crypto, cli
error while generating ed25519 keys: %s	error_code	error	crypto, ed25519, entropy, cli
error while generating ecdsa keys: %s	error_code	error	crypto, ecdsa, p256, entropy, cli
error while converting ecdsa key: %s	error_code	error	crypto, ecdsa, ecdh, p256
invalid curve: %s	error_code	error	validation, cli, crypto, curve
refusing to overwrite existing CA key: %s	error_code	error	filesystem, safety, cli, overwrite-guard
refusing to overwrite existing CA cert: %s	error_code	error	filesystem, safety, cli, overwrite-guard
error while signing with PKCS#11: %w	error_code	error	pkcs11, hsm, signing, crypto
error while signing: %s	error_code	error	signing, crypto, cli
error while encrypting out-key: %s	error_code	error	encryption, crypto, passphrase, cli
error while writing out-key: %s	error_code	error	filesystem, cli, ca
error while marshalling certificate: %s	error_code	error	pem, certificate, cli, serialization
error while writing out-crt: %s	error_code	error	filesystem, cli, ca
error while generating qr code: %s	error_code	error	qrcode, cli, ca
error while writing out-qr: %s	error_code	error	filesystem, qrcode, cli
invalid curve for PKCS#11: %s	error_code	error	pkcs11, curve, cli, validation
invalid curve: %s	error_code	error	curve, cli, validation
error while creating PKCS#11 client: %w	error_code	error	pkcs11, hsm, cli, initialization
error while getting public key: %w	error_code	error	pkcs11, hsm, cli, keypair
error while writing out-key: %s	error_code	error	filesystem, cli, keygen
error while writing out-pub: %s	console	error	filesystem, file-write, nebula-cert
unknown mode: %s	console	error	cli, usage, nebula-cert
unable to read cert; %s	console	error	filesystem, file-read, nebula-cert
error while unmarshaling cert: %s	console	error	parsing, pem, certificate, nebula-cert
error while marshalling cert to PEM: %s	console	error	encoding, pem, qrcode, nebula-cert
error while generating qr code: %s	console	error	qrcode, encoding, payload-size, nebula-cert
error while writing out-qr: %s	console	error	filesystem, file-write, qrcode, nebula-cert
error while reading ca-key: %s	console	error	filesystem, file-read, ca-key, nebula-cert
ca-key is encrypted and must be decrypted interactively	console	error	encryption, tty, passphrase, ca-key, nebula-cert
error reading password: %s	console	error	password, stdin, encryption, ca-key, nebula-cert
cannot open encrypted ca-key without passphrase	console	error
error while parsing encrypted ca-key: %s	console	error
error while parsing ca-key: %s	console	error
error while reading ca-crt: %s	console	error
error while parsing ca-crt: %s	console	error
refusing to sign, root certificate does not match private ke	console	error
ca certificate is expired	console	error
error while creating PKCS#11 client: %w	console	error
error while reading in-pub: %s	console	error
error while parsing in-pub: %s	console	error
curve of in-pub does not match ca	console	error	pki, certificate-signing, curve-mismatch, nebula
error while getting public key with PKCS#11: %w	console	error	pkcs11, hsm, pki, nebula
refusing to overwrite existing cert: %s	console	error	filesystem, overwrite-protection, pki, nebula
error while signing: %w	console	error	pki, certificate-signing, signing-failure, nebula
error while signing with PKCS#11: %w	console	error	pkcs11, hsm, signing-failure, pki, nebula
invalid version: %d	console	error	pki, certificate-version, unreachable, nebula
refusing to overwrite existing key: %s	console	error	filesystem, private-key, overwrite-protection, nebula
error while writing out-key: %s	console	error	filesystem, private-key, io-error, nebula
error while marshalling certificate: %s	console	error	go, cli, certificate, pem
error while writing out-crt: %s	console	error	go, cli, filesystem, file-write
error while generating qr code: %s	console	error	go, cli, qrcode, certificate
error while writing out-qr: %s	console	error	go, cli, filesystem, file-write
-%s and -%s both set to %q, only one input may read from std	console	error	go, cli, stdin, flag-conflict
-%s and -%s both set to %q, only one output may write to std	console	error	go, cli, stdout, flag-conflict
error while reading ca: %w	console	error	go, cli, file-read, ca
error while adding ca cert to pool: %w	console	error	go, cli, pem, ca, certificate-parsing
unable to read crt: %w	console	error	go, cli, file-read, certificate
error while parsing crt: %w	console	error	go, cli, pem, certificate-parsing
error while verifying certificate v%d %s with issuer %s: %w	exception	error
error while verifying certificate %+v: %w	exception	error
failed to load config: %s	exception	error
failed to apply logging config: %s	exception	error
no config files found at %s	validation	error
problem while reading directory %s: %s	exception	error
no default config found at %s or %s	validation	error
handshake message index %d exceeds replay window	exception	error
bad cpulist entry %q: %w	validation	error
bad cpulist range %q	validation	error	cpu, configuration, parsing
unknown protocol %v	validation	error	firewall, configuration, validation
%s failed to parse, should be an array of rules	validation	error	firewall, yaml, configuration, validation
%s rule #%v; %s	validation	error	firewall, yaml, configuration
%s rule #%v; only one of port or code should be provided	validation	error	firewall, configuration, validation
%s rule #%v; at least one of host, group, cidr, local_cidr,	validation	error	firewall, configuration, validation
%s rule #%v; proto was not understood; `%s`	validation	error	firewall, configuration, validation
%s rule #%v; %s %s	validation	error	firewall, configuration, ports
%s rule #%v; cidr did not parse; %s	validation	error	firewall, configuration, cidr, networking
%s rule #%v; local_cidr did not parse; %s	validation	error	firewall, configuration, cidr, networking
%s rule #%v; `%s`	validation	error	go, firewall, config, port-range
start port was lower than end port	validation	error	go, firewall, port-range, validation
only one of group or groups should be defined, both provided	validation	error	go, firewall, config, validation
groups spec [%s] contains the group '"any". This rule will i	validation	error	go, firewall, config, groups
groups specified as %s, but host=any will match any host, re	validation	error	go, firewall, config, host
cidr specified as %s, but host=any will match any host, rega	validation	error	go, firewall, config, cidr
groups spec [%s] contains the group '"any". This rule will i	validation	error	go, firewall, config, groups
groups spec [%s] contains the group '"any". This rule will i	validation	error	go, firewall, config, cidr
code specified as [%s]. Support for 'code' will be dropped i	validation	error	go, firewall, config, deprecation
appears to be a range but could not be parsed; `%s`	validation	error	go, firewall, port-range, parsing
%sout of range [0,65535]; `%s`	validation	error	config, firewall, port-range
%swas not a number; `%s`	validation	error	config, firewall, parse-error
%w: %v	exception	error	handshake, certificate, version-mismatch
build noise state: %w	exception	error	handshake, noise, key-material
noise ReadMessage: %w	exception	warning	handshake, noise, decryption, udp
unmarshal handshake: %w	exception	error	handshake, payload, deserialization
recombine cert: %w	exception	error	handshake, certificate, curve-mismatch
verify cert: %w	exception	error	handshake, certificate, verification, expired-cert
%w: %w	exception	error	handshake, index-allocation, resource-exhaustion
`ErrNoCredential` %w: %v	exception	critical	handshake, certificate, configuration
noise WriteMessage: %w	exception	error	noise, handshake, crypto
`ErrUnknownSubtype` %w: %d	exception	error	handshake, protocol, version-skew
tunnel message counter is exhausted	exception	error	relay, tunnel, counter-exhaustion
lighthouse %s does not have a static_host_map entry	validation	error	configuration, lighthouse, yaml
static_map.network must be one of ip, ip4, or ip6	validation	error	configuration, static-map, validation
invalid vpn addr for v1 handleHostQuery	exception	error	lighthouse, ipv6, cert-version
unknown log format `%s`. possible formats: %s	validation	error	logging, configuration, validation
not a valid logging level: %q	validation	error	logging, configuration, validation
failed to initialize interface: %s	exception	critical	startup, tun-device, interface
unable to unmarshal pubkey: %w	exception	error	go, noise-protocol, ecdh, key-parsing
unable to unmarshal private key: %w	exception	error	go, noise-protocol, ecdh, key-parsing
unable to unmarshal pubkey: %w	exception	error	go, noise-protocol, pkcs11, hsm, ecdh
unknown tun.network_category %q (expected public, private, d	validation	error	windows, configuration, tun, network-category
INetworkListManager.GetNetworkConnections: %s	exception	error	windows, com, network-list-manager, winapi
IEnumNetworkConnections.Next: %s	exception	error	windows, com, winapi, enumeration
INetworkConnection.GetAdapterId: %s	exception	error	windows, com, winapi, adapter
INetworkConnection.GetNetwork: %s	exception	error	windows, com, winapi, network-list-manager
INetwork.GetCategory: %s	exception	error	windows, com, winapi, network-category
INetwork.SetCategory: %s	exception	error	windows, com, winapi, privileges, network-category
CoInitializeEx: %w	exception	error	windows, com, network
CoCreateInstance(NetworkListManager): %s	exception	error	windows, com, network
tun.routes is not an array	validation	error	config, validation
entry %v in tun.routes is invalid	validation	error	config, validation
entry %v.mtu in tun.routes is not present	validation	error	config, validation
entry %v.mtu in tun.routes is not an integer: %v	validation	error	config, validation
entry %v.mtu in tun.routes is below 500: %v	validation	error	config, validation
entry %v.route in tun.routes is not present	validation	error	config, validation
entry %v.route in tun.routes failed to parse: %v	validation	error	config, validation, cidr
entry %v.route in tun.routes is not contained within the con	validation	error	config, validation, routing
tun.unsafe_routes is not an array	validation	error
entry %v in tun.unsafe_routes is invalid	validation	error
entry %v.mtu in tun.unsafe_routes is not an integer: %v	validation	error
entry %v.mtu in tun.unsafe_routes is below 500: %v	validation	error
entry %v.metric in tun.unsafe_routes is not an integer: %v	validation	error
entry %v.metric in tun.unsafe_routes is not in range (0-%d)	validation	error
entry %v.via in tun.unsafe_routes is not present	validation	error
entry %v.via in tun.unsafe_routes failed to parse address: %	validation	error
entry %v in tun.unsafe_routes[%v].via is invalid	validation	error
entry .gateway in tun.unsafe_routes[%v].via[%v] is not prese	validation	error
entry .gateway in tun.unsafe_routes[%v].via[%v] is not a str	validation	error
entry .gateway in tun.unsafe_routes[%v].via[%v] failed to pa	validation	error
entry .weight in tun.unsafe_routes[%v].via[%v] is not an int	validation	error
entry .weight in tun.unsafe_routes[%v].via[%v] is not in ran	validation	error
entry %v.via in tun.unsafe_routes is not a string or list of	validation	error
entry %v.route in tun.unsafe_routes is not present	validation	error
entry %v.install in tun.unsafe_routes is not a boolean: %v	validation	error
entry %v.route in tun.unsafe_routes failed to parse: %v	validation	error
entry %v.route in tun.unsafe_routes is contained within the	validation	error
end of checksum offset (%d) exceeds packet length (%d)	exception	error
bad IPv4 IHL: %d	exception	error	network, ipv4, checksum, packet-parsing
gso_size is zero	exception	error	network, tso, gso, tcp, segmentation
csum_start is zero	exception	error	network, tcp, offload, segmentation, packet-parsing
header len %d exceeds max %d	exception	error	network, tcp, segmentation, header-length, packet-parsing
udp header len mismatch: %d	exception	error
csum offsets out of range: start=%d offset=%d len=%d	exception	error
no gateway found for %v in the list of vpn networks	exception	error
newTun not supported in Android	exception	error	android, tun-device, unsupported-platform
system socket: %v	exception	error	macos, darwin, utun, socket, syscall
CTLIOCGINFO: %v	exception	error	macos, darwin, utun, ioctl, kernel
SYS_CONNECT: %v	exception	error	macos, darwin, utun, connect, interface-in-use
failed to retrieve tun name: %w	exception	error	macos, darwin, utun, getsockopt, race-condition
SetNonblock: %v	exception	error	macos, darwin, utun, file-descriptor, nonblocking
newTunFromFd not supported in Darwin	exception	error	macos, darwin, tun-device, unsupported-platform, file-descriptor
failed to set tun mtu: %v	exception	error	macos, darwin, mtu, ioctl, permissions
failed to get tun flags: %s	exception	error	macos, darwin, ioctl, interface-flags, permissions
unable to discover link_addr for tun interface	exception	error	macos, darwin, utun, link-address, interface
failed to run tun device: %s	exception	error	network, darwin, ioctl, tun-device
failed to set tun v4 address: %s	exception	error	network, darwin, ipv4, ioctl, address-assignment
failed to set tun address: %s	exception	error	network, darwin, ipv6, ioctl, address-assignment
unable to create AF_ROUTE socket: %v	exception	error	network, darwin, routing, socket, permissions
failed to create route.RouteMessage: %w	exception	error	network, darwin, routing, route-message
failed to write route.RouteMessage to socket: %w	exception	error	network, darwin, routing, socket-write
unable to determine IP version from packet	exception	warning	network, darwin, packet, tun-device, malformed-packet
unable to determine IP version from packet	exception	error	freebsd, tun, packet-format, ipv6, network
newTunFromFd not supported in FreeBSD	exception	error	freebsd, tun, unsupported-platform, file-descriptor
failed to set tun device as nonblocking: %w	exception	error	freebsd, tun, nonblocking, syscall, file-descriptor
failed to create shutdown pipe: %w	exception	error	freebsd, tun, pipe, file-descriptor, shutdown
failed to set tun address %s: %s	exception	error	freebsd, tun, ioctl, network-config, ipv4
unknown address type %v	exception	error	freebsd, tun, address-family, config-validation, netip
unable to discover link_addr for tun interface	exception	error	freebsd, tun, interface-lookup, network-config
unable to create AF_ROUTE socket: %v	exception	error	freebsd, routing, socket, privileges, network
failed to create route.RouteMessage: %w	exception	error	freebsd, routing, route-message, serialization, network
failed to create route.RouteMessage for change: %w	exception	error	freebsd, routing, network
failed to write route.RouteMessage to socket: %w	exception	error	freebsd, routing, network, permissions
newTun not supported in iOS	exception	error	ios, tun, unsupported-platform, network-extension
failed to set the tun fd to non-blocking mode: %w	exception	error	ios, tun, file-descriptor
/dev/net/tun doesn't exist, failed to mkdir -p /dev/net: %w	exception	error	linux, tun, devfs, container, permissions
failed to create /dev/net/tun: %w	exception	error	linux, tun, mknod, container, permissions
created /dev/net/tun, but still failed: %w	exception	error	linux, tun, kernel, permissions
failed to enable offload on multiqueue tun fd: %w	exception	error	network, tun, linux, ioctl
failed to get tun address list: %s	exception	error	network, tun, linux, netlink
failed to set tun device name: %s	exception	error	network, tun, linux, ioctl
failed to get tun device link: %s	exception	error	network, tun, linux, netlink
failed to bring the tun device up: %s	exception	error	network, tun, linux, permissions
failed to set default route MTU: %w	exception	error	network, routing, tun, mtu
failed to run tun device: %s	exception	error	network, tun, linux, ioctl
failed to set mtu %v on the default route %v; %v	exception	error	network, routing, mtu, netlink
newTunFromFd not supported in NetBSD	exception	error	netbsd, tun, unsupported, platform
a device name in the format of /dev/tunN must be specified	exception	error	netbsd, tun, config, validation
error closing tun file: %w	exception	error	netbsd, tun, close, file-descriptor
failed to get syscall conn for tun: %w	exception	error	netbsd, tun, read, file-descriptor
failed to make read call for tun: %w	exception	error	netbsd, tun, read, syscall
failed to make inner read call for tun: %w	exception	error	netbsd, tun, read, errno, syscall
unable to determine IP version from packet	exception	error	netbsd, tun, write, packet-format
failed to set tun address %s: %s	exception	error	netbsd, tun, ioctl, ip-address, permissions
unknown address type %v	exception	error	netbsd, tun, ip-address, validation
failed to set tun device mode: %w	exception	error	netbsd, tun, ioctl, activate
failed to set tun device head: %w	exception	critical	netbsd, tun, ioctl, network
failed to set tun mtu: %w	exception	critical	netbsd, tun, mtu, ioctl
unable to create AF_ROUTE socket: %v	exception	critical	netbsd, routing, socket, permissions
failed to create route.RouteMessage: %w	exception	error	netbsd, routing, marshal, route-message
failed to create route.RouteMessage for change: %w	exception	error	netbsd, routing, marshal, eexist
failed to write route.RouteMessage to socket: %w	exception	error	netbsd, routing, socket-write, route-message
newTunFromFd not supported in openbsd	exception	error	openbsd, tun, unsupported, platform
a device name in the format of /dev/tunN must be specified	validation	error	openbsd, tun, config, missing-config
error closing tun file: %w	exception	warning	openbsd, tun, close, file-descriptor
unable to determine IP version from packet	exception	error	openbsd, tun, packet, ip-version
failed to set tun address %s: %s	exception	error	openbsd, tun, ioctl, ipv4, address-assignment
failed to set route for vpn network %v: %w	exception	error	openbsd, tun, route, ipv4, routing
unknown address type %v	validation	error	openbsd, tun, address, invalid-input
failed to set tun mtu: %w	exception	error	openbsd, tun, mtu, ioctl, activate
unable to create AF_ROUTE socket: %v	exception	error	openbsd, route, socket, privileges, af-route
failed to create route.RouteMessage: %w	exception	error	openbsd, routing, route-socket, serialization
failed to create route.RouteMessage for change: %w	exception	error	openbsd, routing, route-socket, serialization
failed to write route.RouteMessage to socket: %w	exception	error	openbsd, routing, route-socket, permissions
newTunFromFd not supported	exception	error	testing, tun, unsupported-feature
newTunFromFd not supported in Windows	exception	error	windows, tun, wintun, unsupported-feature
can not load the wintun driver: %w	exception	critical	windows, tun, wintun, missing-dll
generate GUID failed: %w	exception	error	windows, tun, wintun, configuration
create TUN device failed: %w	exception	critical	windows, tun, wintun, network-interface
failed to set address: %w	exception	error	windows, network, ip-address, winipcfg
failed to get ip interface: %w	exception	error	windows, routing, winipcfg, network-interface
failed to set ip interface: %w	exception	error	windows, routing, mtu, winipcfg
unknown public key type: %T	exception	error	pkcs11, hsm, ecdsa, key-type
failed to get public key: %w	exception	error	pkcs11, hsm, public-key, self-test
got a key of %d bytes, expected %d	exception	error	pkcs11, hsm, ecdh, noise-protocol
failed to load module library: %s	exception	error	pkcs11, hsm, shared-library, load-failure
failed to open session on slot %d	exception	error	pkcs11, hsm, session, slot
unable to login. error: %w	exception	error	pkcs11, hsm, authentication, pin
failed to find private key for deriving: %w	exception	error	pkcs11, hsm, key-not-found
got an empty secret key	exception	error	pkcs11, hsm, ecdh, derive
pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and looking	exception	error	pkcs11, hsm, public-key, attribute-missing
pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading	exception	error	pkcs11, hsm, attribute-access-denied
pkcs11 module gave us a nil or empty CKA_EC_POINT	exception	error	pkcs11, hsm, empty-attribute
unknown public key length: %d	exception	error	pkcs11, ec-point, encoding, curve
unsupported curve: %s	validation	error	config, curve, noise, validation
unable to read pki.cert file %s: %s	exception	error	filesystem, certificate, config, file-not-found
pki: use of %s is not allowed in FIPS 140-only mode	validation	error	fips, certificate, curve, compliance
v1 certificate already found in pki.cert	validation	error	certificate, config, duplicate, pki
v2 certificate already found in pki.cert	validation	error	pki, certificate, config
unknown certificate version %v	validation	error	pki, certificate, version
can not use pki.initiating_version 1 without a v1 certificat	validation	error	pki, config, handshake
unknown pki.initiating_version: %v	validation	error	pki, config, validation
private key is not a pair with public key in nebula cert: %w	validation	critical	pki, keypair, certificate
error marshalling v1 certificate for handshake: %w	error_code	error	pki, certificate, serialization
error marshalling v2 certificate for handshake: %w	error_code	error	pki, certificate, serialization
error while unmarshaling pki.key %s: %s	validation	error	pki, filesystem, config
unable to read pki.key file %s: %s	validation	error
error while unmarshaling pki.cert: %w	validation	error	pki, certificate, config
nebula certificate for this host is expired	validation	critical	pki, certificate, expired
no networks encoded in certificate	validation	error	pki, certificate, config
host certificate is a CA certificate	validation	error	pki, certificate, config
unable to read pki.ca file %s: %s	validation	error	pki, ca, file-io, config
error while adding CA certificate to CA trust store: %s	error_code	error	pki, ca, certificate, config
could not enable TCP SACK: %v	error_code	error	netstack, tcp, gvisor
could not create netstack NIC: %v	error_code	error	netstack, gvisor, nic
error creating IP: %s	error_code	error	netstack, gvisor, ip-address
unknown network type: %s	validation	error	network, gvisor, netstack, invalid-argument
only wildcard address supported, got %q %v	validation	error	network, gvisor, netstack, listen, bind-address
invalid port %d	validation	error	network, gvisor, netstack, listen, invalid-port
already listening on port %d	validation	error	network, gvisor, netstack, listen, port-in-use
sshd.listen must be provided	validation	error	ssh, configuration, startup, missing-config
invalid sshd.listen address: %s	validation	error	ssh, configuration, address-parsing
sshd.listen can not use port 22	validation	error	ssh, configuration, port-conflict
sshd.host_key must be provided	validation	error	ssh, configuration, host-key, missing-config
error while loading sshd.host_key file: %s	validation	error	ssh, configuration, host-key, file-io
error while adding sshd.host_key: %s	error_code	error	ssh, configuration, host-key, key-format
path %q resolves to the sandbox directory itself %q	validation	error	path-validation, ssh-debug, security, nebula
path %q is outside the sandbox directory %q	validation	error	path-validation, ssh-debug, security, nebula
hostmap LocalIndex '%v' does not match RelayState LocalIndex	error_code	warning	relay, hostmap, state-inconsistency, nebula
unknown user %s	error_code	error	ssh, authentication, config, nebula
unknown public key for %s (%s)	error_code	error	ssh, authentication, public-key, nebula
failed to parse private key: %s	validation	critical	ssh, config, private-key, parse-error, nebula
stats.interval was an invalid duration: %s	validation	error	config, stats, duration, validation, nebula
error while setting up graphite sink: %s	exception	error	config, stats, graphite, dns, network, nebula
stats.type was not understood: %s	exception	error	config, stats, validation, nebula
SO_REUSEPORT failed: %v	exception	error	android, udp, socket-options, kernel, nebula
SO_REUSEPORT failed: %v	exception	error
failed to open udp socket: %w	exception	error
failed to get udp fd: %w	exception	error
unexpected PacketConn: %T %#v	exception	error
SO_REUSEPORT failed: %v	exception	error
LocalAddr returned invalid IP address: %s	exception	error
LocalAddr returned: %#v	exception	error
Unexpected PacketConn: %T %#v	exception	error
LocalAddr returned invalid IP address: %s	exception	error
LocalAddr returned: %#v	exception	error
unable to open socket: %w	exception	critical	udp, linux, syscall, socket-creation, file-descriptors
unable to set SO_REUSEPORT: %w	exception	error	udp, linux, so-reuseport, setsockopt
unable to bind to socket: %w	exception	critical	udp, linux, bind, address-in-use, privileged-port
unsupported sock type: %T	exception	warning	udp, linux, localaddr, sockaddr, unreachable
WriteBatch: len(bufs)=%d != len(addrs)=%d	exception	error	udp, linux, writebatch, programming-error, argument-validation
sendmmsg made no progress	exception	error	udp, linux, sendmmsg, gso, stall
SO_REUSEPORT failed: %v	exception	error	udp, netbsd, so-reuseport, setsockopt, bsd
bind: %w	exception	critical	udp, windows, bind, rio, address-in-use
init rx ring: %w	exception	error	udp, windows, rio, receive-ring, winrio
winrio.Socket error: %w	exception	error	udp, windows, winrio, socket-creation, rio
error rx.Open(): %w	exception	error	windows, udp, rio, network
error tx.Open(): %w	exception	error	windows, udp, rio, network
error CreateRequestQueue: %w	exception	error	windows, udp, rio, network
error windows.Bind(): %w	exception	error	windows, udp, bind, network
multiple udp listeners not supported on windows	exception	error	windows, udp, unsupported-feature, configuration
%s (%v): %w	exception	info	error-handling, wrapping, logging
add v4 filter: %w	exception	error	windows, wfp, firewall, network
add v6 filter: %w	exception	error	windows, wfp, firewall, ipv6, network
FwpmEngineOpen0: 0x%x	exception	error	wfp, windows, bfe, firewall, privileges
GenerateGUID for sublayer: %w	exception	error	wfp, windows, guid, com
FwpmSubLayerAdd0: 0x%x	exception	error	wfp, windows, sublayer, bfe, firewall
FwpmFilterAdd0: 0x%x	exception	error	wfp, windows, firewall, filter, network-interface
Error creating interface: %w	exception	error
Error starting session: %w	error_code	error
Read failed: %w	error_code	error
Write failed: %w	error_code	error