slackhq/nebula · warning

unable to marshal unsafe network: %w

Error message

unable to marshal unsafe network: %w

What it means

Identical guard to the networks case but for details.unsafeNetworks: each entry is marshalled with MarshalBinary inside the TagDetailsUnsafeNetworks ASN.1 block, and any inner error is wrapped with this message. Defensive; current implementations never error.

Source

Thrown at cert/cert_v2.go:518

					sb, innerErr := n.MarshalBinary()
					if innerErr != nil {
						// MarshalBinary never returns an error
						err = fmt.Errorf("unable to marshal network: %w", innerErr)
						return
					}
					b.AddASN1OctetString(sb)
				}
			})
		}

		// Add the unsafe networks if any exist
		if len(d.unsafeNetworks) > 0 {
			b.AddASN1(TagDetailsUnsafeNetworks, func(b *cryptobyte.Builder) {
				for _, n := range d.unsafeNetworks {
					sb, innerErr := n.MarshalBinary()
					if innerErr != nil {
						// MarshalBinary never returns an error
						err = fmt.Errorf("unable to marshal unsafe network: %w", innerErr)
						return
					}
					b.AddASN1OctetString(sb)
				}
			})
		}

		// Add groups if any exist
		if len(d.groups) > 0 {
			b.AddASN1(TagDetailsGroups, func(b *cryptobyte.Builder) {
				for _, group := range d.groups {
					b.AddASN1(asn1.UTF8String, func(b *cryptobyte.Builder) {
						b.AddBytes([]byte(group))
					})
				}
			})
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Inspect the wrapped innerErr for the failing unsafe network.
2. Validate unsafe networks (host/mask) before building the certificate.
3. Re-create the certificate with valid unsafe network entries.

for _, n := range certDetails.UnsafeNetworks {
    if n == nil || !validIPMask(n) {
        return fmt.Errorf("invalid unsafe network entry in certificate details")
    }
}

if err != nil && strings.Contains(err.Error(), "unable to marshal unsafe network") {
    return fmt.Errorf("bad unsafe network on certificate: %w", err)
}

When it happens

Trigger: Marshalling/signing a certificate with an unsafeNetworks entry whose MarshalBinary returns an error (defensive path).

Common situations: Hand-built certificate details with corrupt/zero-value unsafe networks; future code changes to network marshalling.

Related errors

• certificate contained an unsafe network assignment outside t
• marshalling certificate details failed: %w
• unable to marshal network: %w
• failed to decode issuer: %w
• ErrBadFormat

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/bc5889ad4ae93e80. Report an issue: GitHub.