code specified as [%s]. Support for 'code' will be dropped i

Error message

code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional

What it means

The 'code' field on firewall rules (intended for ICMP codes) has never been functional in this library. Any rule that sets a non-empty code is rejected outright with this deprecation message, instead of being ignored, so configs relying on it fail visibly.

Source

Thrown at firewall.go:1050

			return fmt.Errorf("groups specified as %s, but host=any will match any host, regardless of groups", r.Groups)
		}

		if !cidrEmpty {
			return fmt.Errorf("cidr specified as %s, but host=any will match any host, regardless of cidr", r.Cidr)
		}
	}

	if groupsHasAny {
		if !hostEmpty && r.Host != "any" {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified host %s", r.Groups, r.Host)
		}
		if !cidrEmpty {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified cidr %s", r.Groups, r.Cidr)
		}
	}

	if r.Code != "" {
		return fmt.Errorf("code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional", r.Code)
	}

	//todo alert on cidr-any

	return nil
}

func parsePort(s string) (int32, int32, error) {
	const notAPort int32 = -2
	if s == "any" {
		return firewall.PortAny, firewall.PortAny, nil
	}
	if s == "fragment" {
		return firewall.PortFragment, firewall.PortFragment, nil
	}
	if !strings.Contains(s, `-`) {
		rPort, err := parsePortValue("", s)
		if err != nil {

View on GitHub (pinned to dd8f660c0a)

Solutions

Delete the code field from the rule
Express any needed filtering without 'code' (e.g. restrict proto icmp rules another way)
Audit configs migrated from other firewall systems for code fields

Example fix

// before
- port: any
  proto: icmp
  code: 0
  host: any
// after
- port: any
  proto: icmp
  host: any

Defensive patterns

Strategy: validation

Validate before calling

func checkNoCodeField(rules []FirewallRuleConfig) error {
    for i, r := range rules {
        if r.Code != "" {
            return fmt.Errorf("rule #%d sets 'code', which is unsupported: %s", i, r.Code)
        }
    }
    return nil
}

Type guard

func isCodeFree(code string) bool { return code == "" }

Try / catch

if err := loadFirewallConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "Support for 'code' will be dropped") {
        return fmt.Errorf("remove unsupported 'code' fields: %w", err)
    }
    return err
}

Prevention

Never set the code field in firewall rules
Strip code fields when migrating configs from iptables/nftables
Keep library updated and read deprecation warnings in release notes

When it happens

Trigger: A firewall rule in config with a non-empty code field, e.g. code: 0 on an icmp rule, during rule translation.

Common situations: Copying iptables/nftables ICMP code semantics into nebula rules; old example configs that still carry code.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/5f7336fc0b2087ca. Report an issue: GitHub.