slackhq/nebula · error

invalid port %d

Error message

invalid port %d

What it means

After requiring a wildcard address, Listen validates that the requested port fits in a uint16 and is representable. Ports below 0 or at/above math.MaxUint16 (65535) cannot be used as TCP ports in the netstack and produce this error. Note the earlier separate branch rejects port 0 with its own message.

Source

Thrown at service/service.go:225

// Listen listens on the provided address. Currently only TCP with wildcard
// addresses are supported.
func (s *Service) Listen(network, address string) (net.Listener, error) {
	if network != "tcp" && network != "tcp4" {
		return nil, errors.New("only tcp is supported")
	}
	addr, err := net.ResolveTCPAddr(network, address)
	if err != nil {
		return nil, err
	}
	if addr.IP != nil && !bytes.Equal(addr.IP, []byte{0, 0, 0, 0}) {
		return nil, fmt.Errorf("only wildcard address supported, got %q %v", address, addr.IP)
	}
	if addr.Port == 0 {
		return nil, errors.New("specific port required, got 0")
	}
	if addr.Port < 0 || addr.Port >= math.MaxUint16 {
		return nil, fmt.Errorf("invalid port %d", addr.Port)
	}
	port := uint16(addr.Port)

	l := &tcpListener{
		port:   port,
		s:      s,
		addr:   addr,
		accept: make(chan net.Conn),
	}

	s.mu.Lock()
	defer s.mu.Unlock()

	if _, ok := s.mu.listeners[port]; ok {
		return nil, fmt.Errorf("already listening on port %d", port)
	}
	s.mu.listeners[port] = l

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Use a port in the range 1–65534.
2. Validate the port integer before formatting it into the listen address.
3. If you need an OS-assigned port, this library does not support port 0 — pick a free port yourself.

Example fix

// before
l, err := svc.Listen("tcp", ":65535")
// after
const port = 8080
if port > 0 && port < math.MaxUint16 {
    l, err = svc.Listen("tcp", fmt.Sprintf(":%d", port))
}

if port <= 0 || port >= math.MaxUint16 {
    return fmt.Errorf("port must be in [1, 65534], got %d", port)
}
l, err := svc.Listen("tcp", fmt.Sprintf(":%d", port))

func isValidPort(p int) bool { return p > 0 && p < math.MaxUint16 }

l, err := svc.Listen("tcp", addr)
if err != nil {
    var perr *net.AddrError
    if strings.HasPrefix(err.Error(), "invalid port") {
        return fmt.Errorf("configured listen port out of range: %w", err)
    }
    return err
}

When it happens

Trigger: Calling Service.Listen("tcp", ":65535") or ":99999" or ":-1" — any resolved port with port < 0 || port >= math.MaxUint16 at service/service.go:225. ResolveTCPAddr accepts these numerically, so the failure surfaces here.

Common situations: Interpolating an unvalidated integer into the address string (fmt.Sprintf(":%d", cfg.Port)); admin config with 65535 or a sentinel like 0 for "any port"; copying a port from a spec that allows 65535.

Related errors

• only wildcard address supported, got %q %v
• already listening on port %d
• unknown network type: %s
• could not enable TCP SACK: %v
• could not create netstack NIC: %v

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/dfa305077b6c0480. Report an issue: GitHub.