tailscale/tailscale · error

decode mask: %v

Error message

decode mask: %v

What it means

createDropOutgoingPacketFromCGNATRangeRuleWithTunname failed to hex-decode the parsed network mask into raw bytes for the nftables payload expression. This indicates the parsed mask string was not valid hex — an internal encoding problem, not a user-input error.

Source

Thrown at util/linuxfw/nftables_runner.go:1407

	_ = c.AddRule(rule)

	if err := c.Flush(); err != nil {
		return fmt.Errorf("add rule: %w", err)
	}

	return nil
}

// createDropOutgoingPacketFromCGNATRangeRuleWithTunname creates a rule to drop
// outgoing packets from the CGNAT range.
func createDropOutgoingPacketFromCGNATRangeRuleWithTunname(table *nftables.Table, chain *nftables.Chain, tunname string) (*nftables.Rule, error) {
	_, ipNet, err := net.ParseCIDR(tsaddr.CGNATRange().String())
	if err != nil {
		return nil, fmt.Errorf("parse cidr: %v", err)
	}
	mask, err := hex.DecodeString(ipNet.Mask.String())
	if err != nil {
		return nil, fmt.Errorf("decode mask: %v", err)
	}
	netip := ipNet.IP.Mask(ipNet.Mask).To4()
	saddrExpr, err := newLoadSaddrExpr(nftables.TableFamilyIPv4, 1)
	if err != nil {
		return nil, fmt.Errorf("newLoadSaddrExpr: %v", err)
	}
	rule := &nftables.Rule{
		Table: table,
		Chain: chain,
		Exprs: []expr.Any{
			&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
			&expr.Cmp{
				Op:       expr.CmpOpEq,
				Register: 1,
				Data:     []byte(tunname),
			},
			saddrExpr,
			&expr.Bitwise{

View on GitHub (pinned to 6e0912f979)

Solutions

1. Inspect the mask produced by net.ParseCIDR for the given range.
2. Verify the range uses a standard IPv4 mask; non-standard masks may not decode.
3. Fix the range definition if it was customized.

When it happens

Trigger: Thrown at util/linuxfw/nftables_runner.go:1407 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/e02169e7bedd2620. Report an issue: GitHub.