slackhq/nebula · error

unsupported version

Error message

unsupported version

What it means

This error comes from the lighthouse handshake-answer marshaling path. When a lighthouse relays vpn-addr answers back to a querying host, it checks the certificate version of the target (`useVersion`). Only Version1 (old 32-bit VPN addresses) and Version2 (ProtoAddr) are supported; any other value makes the answer un-marshalable, so the lighthouse aborts instead of emitting a corrupted answer.

Source

Thrown at lighthouse.go:1229

			} else {
				if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
					lhh.l.Debug("unable to punch to host, no addresses in common",
						"to", crt.Networks(),
					)
				}
			}
		}

		if useVersion == cert.Version1 {
			if !whereToPunch.Is4() {
				return 0, fmt.Errorf("invalid vpn addr for v1 handleHostQuery")
			}
			b := whereToPunch.As4()
			n.Details.OldVpnAddr = binary.BigEndian.Uint32(b[:])
		} else if useVersion == cert.Version2 {
			n.Details.VpnAddr = netAddrToProtoAddr(whereToPunch)
		} else {
			return 0, errors.New("unsupported version")
		}
		lhh.coalesceAnswers(useVersion, c, n)

		return n.MarshalTo(lhh.pb)
	})

	if !found {
		return
	}

	if err != nil {
		lhh.l.Error("Failed to marshal lighthouse host was queried for",
			"error", err,
			"vpnAddrs", fromVpnAddrs,
		)
		return
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Re-issue the peer's certificate with a supported Version (cert.Version1 or cert.Version2).
2. Upgrade the lighthouse binary so it recognizes the peer's certificate version.
3. Ensure all nodes are on a mutually compatible nebula release before rolling new certificate versions.

Example fix

// before: certificate with unknown version
Certificate{ Version: 3, ... }
// after
Certificate{ Version: cert.Version2, ... }

if cert.Version != cert.Version1 && cert.Version != cert.Version2 {
    return fmt.Errorf("certificate version %d not supported by lighthouse", cert.Version)
}

When it happens

Trigger: A lighthouse (LightHouseHandler.GetNearestOrAll) processes an answer for a peer whose certificate `useVersion` is neither cert.Version1 nor cert.Version2 — e.g. a hand-crafted certificate, a version enum from a newer/older protocol build, or a zero-value version struct.

Common situations: Mixed-version nebula clusters after a protocol upgrade, a certificate signed with an unknown/future version field, or custom tooling that mints certificates with a nonstandard Version value.

Related errors

• ErrHostNotKnown
• ErrBadDetailsVpnAddr
• invalid version: %d
• lighthouse %s does not have a static_host_map entry
• invalid vpn addr for v1 handleHostQuery

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/bc0b95aa0665af2c. Report an issue: GitHub.