slackhq/nebula · warning

unable to marshal network: %w

Error message

unable to marshal network: %w

What it means

During details.Marshal, each network entry is serialized with MarshalBinary and embedded as an octet string. If any network fails to marshal, this wrapped error is set. The inline comment notes MarshalBinary never returns an error today, so this is a defensive guard against future/buggy implementations.

Source

Thrown at cert/cert_v2.go:503

	var b cryptobyte.Builder
	var err error

	// Details are a structure
	b.AddASN1(TagCertDetails, func(b *cryptobyte.Builder) {

		// Add the name
		b.AddASN1(TagDetailsName, func(b *cryptobyte.Builder) {
			b.AddBytes([]byte(d.name))
		})

		// Add the networks if any exist
		if len(d.networks) > 0 {
			b.AddASN1(TagDetailsNetworks, func(b *cryptobyte.Builder) {
				for _, n := range d.networks {
					sb, innerErr := n.MarshalBinary()
					if innerErr != nil {
						// MarshalBinary never returns an error
						err = fmt.Errorf("unable to marshal network: %w", innerErr)
						return
					}
					b.AddASN1OctetString(sb)
				}
			})
		}

		// Add the unsafe networks if any exist
		if len(d.unsafeNetworks) > 0 {
			b.AddASN1(TagDetailsUnsafeNetworks, func(b *cryptobyte.Builder) {
				for _, n := range d.unsafeNetworks {
					sb, innerErr := n.MarshalBinary()
					if innerErr != nil {
						// MarshalBinary never returns an error
						err = fmt.Errorf("unable to marshal unsafe network: %w", innerErr)
						return
					}
					b.AddASN1OctetString(sb)

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the wrapped innerErr to identify the offending network.
2. Verify networks on the certificate are standard *cert.NebulaCertificate-compatible entries with valid host/mask values.
3. Rebuild the certificate with valid network data.

for _, n := range certDetails.Networks {
    if n == nil || !validIPMask(n) {
        return fmt.Errorf("invalid network entry in certificate details")
    }
}

if err != nil && strings.Contains(err.Error(), "unable to marshal network") {
    return fmt.Errorf("bad network on certificate: %w", err)
}

When it happens

Trigger: Signing or marshalling a certificate whose details.networks contains a network whose MarshalBinary returns a non-nil error (theoretically unreachable with the current NL a MarshalBinary implementation).

Common situations: Custom or future network implementations, corrupted certificate structs, or tests exercising defensive paths.

Related errors

• certificate contained a network assignment outside the limit
• marshalling certificate details failed: %w
• unable to marshal unsafe network: %w
• failed to decode issuer: %w
• ErrBadFormat

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/84acd434f88e5ab0. Report an issue: GitHub.