What causes "appears to be a range but could not be parsed; `%s`" in slackhq/nebula?

Correct the port string to 'start-end' with both endpoints present, e.g. '100-200'

appears to be a range but could not be parsed; `%s`

Error message

appears to be a range but could not be parsed; `%s`

What it means

parsePort detected a '-' in the port string, so it treats it as a range, but after splitting and trimming, one or both sides are empty (or the split failed), making the range unparseable. Typical culprits are leading/trailing dashes or double dashes, e.g. '-80', '80-', or '80--90'.

Source

Thrown at firewall.go:1079

		return firewall.PortAny, firewall.PortAny, nil
	}
	if s == "fragment" {
		return firewall.PortFragment, firewall.PortFragment, nil
	}
	if !strings.Contains(s, `-`) {
		rPort, err := parsePortValue("", s)
		if err != nil {
			return notAPort, notAPort, err
		}
		return rPort, rPort, nil
	}

	sPorts := strings.SplitN(s, `-`, 2)
	for i := range sPorts {
		sPorts[i] = strings.Trim(sPorts[i], " ")
	}
	if len(sPorts) != 2 || sPorts[0] == "" || sPorts[1] == "" {
		return notAPort, notAPort, fmt.Errorf("appears to be a range but could not be parsed; `%s`", s)
	}

	startPort, err := parsePortValue("beginning range ", sPorts[0])
	if err != nil {
		return notAPort, notAPort, err
	}

	endPort, err := parsePortValue("ending range ", sPorts[1])
	if err != nil {
		return notAPort, notAPort, err
	}

	if startPort == firewall.PortAny {
		endPort = firewall.PortAny
	}

	return startPort, endPort, nil
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Correct the port string to 'start-end' with both endpoints present, e.g. '100-200'
Remove stray or doubled dashes from the value
If a single port is meant, remove the dash entirely

Example fix

// before
port: "-100"
// after
port: "1-100"

Defensive patterns

Strategy: validation

Validate before calling

func checkPortString(s string) error {
    if strings.Contains(s, "-") {
        parts := strings.SplitN(s, "-", 2)
        if strings.TrimSpace(parts[0]) == "" || strings.TrimSpace(parts[1]) == "" {
            return fmt.Errorf("malformed port range: %q", s)
        }
    }
    return nil
}

Type guard

func isWellFormedPortRange(s string) bool {
    if s == "any" || s == "fragment" || !strings.Contains(s, "-") { return true }
    p := strings.SplitN(s, "-", 2)
    return strings.TrimSpace(p[0]) != "" && strings.TrimSpace(p[1]) != ""
}

Try / catch

if _, _, err := firewall.ParsePort(s); err != nil {
    if strings.Contains(err.Error(), "could not be parsed") {
        return fmt.Errorf("fix port range syntax in %q: %w", s, err)
    }
    return err
}

Prevention

Quote port range values in YAML so dashes are not misread as list syntax
Always write ranges as 'start-end' with both endpoints present
Validate port strings with a regex like ^\d+(-\d+)?$ before loading configs

When it happens

Trigger: Config port value containing '-' that doesn't split into two non-empty tokens, e.g. port: '-100', port: '100-', or port: '10--20', passed through parsePort.

Common situations: YAML typos with stray dashes (especially since '-' is also a YAML list indicator); negative port numbers; templates emitting empty endpoints in ranges.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/6f530fb16e25897f. Report an issue: GitHub.