What causes "calculated_remotes entry: %w" in slackhq/nebula?

Read the wrapped inner error after `calculated_remotes entry:` for the real cause

calculated_remotes entry: %w

Error message

calculated_remotes entry: %w

What it means

This is a wrapping error emitted by newCalculatedRemotesListFromConfig when one entry in a CIDR's list fails in newCalculatedRemotesEntryFromConfig. It prefixes the inner error with `calculated_remotes entry:` so operators know the failure came from a specific entry; the actionable detail is in the wrapped message.

Source

Thrown at calculated_remote.go:118

		}

		calculatedRemotes.Insert(cidr, entry)
	}

	return calculatedRemotes, nil
}

func newCalculatedRemotesListFromConfig(cidr netip.Prefix, raw any) ([]*calculatedRemote, error) {
	rawList, ok := raw.([]any)
	if !ok {
		return nil, fmt.Errorf("calculated_remotes entry has invalid type: %T", raw)
	}

	var l []*calculatedRemote
	for _, e := range rawList {
		c, err := newCalculatedRemotesEntryFromConfig(cidr, e)
		if err != nil {
			return nil, fmt.Errorf("calculated_remotes entry: %w", err)
		}
		l = append(l, c)
	}

	return l, nil
}

func newCalculatedRemotesEntryFromConfig(cidr netip.Prefix, raw any) (*calculatedRemote, error) {
	rawMap, ok := raw.(map[string]any)
	if !ok {
		return nil, fmt.Errorf("invalid type: %T", raw)
	}

	rawValue := rawMap["mask"]
	if rawValue == nil {
		return nil, fmt.Errorf("missing mask: %v", rawMap)
	}
	rawMask, ok := rawValue.(string)

View on GitHub (pinned to dd8f660c0a)

Solutions

Read the wrapped inner error after `calculated_remotes entry:` for the real cause
Fix the offending entry map (mask/port) inside the list under the failing CIDR
Test each entry independently with netip.ParsePrefix and port range checks

Defensive patterns

Strategy: try-catch

Validate before calling

for _, e := range entryList {
	m, ok := e.(map[string]any)
	if !ok { continue }
	if _, ok := m["mask"].(string); !ok { continue }
	if _, err := netip.ParsePrefix(m["mask"].(string)); err != nil { continue }
	// entry looks structurally valid
}

Try / catch

if err != nil {
	if strings.Contains(err.Error(), "calculated_remotes entry:") {
		// unwrap with errors.Unwrap / %v of chain to find the per-entry cause
		log.Printf("bad entry: %v", err)
	}
}

Prevention

Validate each entry map (mask string CIDR, port 0-65535) before reload
Check every element of every list — one bad entry fails the whole section
Use errors.Unwrap in a loop to print the full cause chain from logs

When it happens

Trigger: Any single entry in a calculated_remotes list is malformed (not a map, missing mask, bad mask type, unparseable mask, missing/invalid port) — the per-entry error gets wrapped by this line.

Common situations: Nebula reload failures where the log shows `calculated_remotes entry: <inner>`; scan the rest of the chained message to find which field was wrong.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/c08681eb53e261aa. Report an issue: GitHub.