zeroclaw-labs/zeroclaw · error

Invalid {label} entry(s): [{}]. Each entry must be an RFC 60

Error message

Invalid {label} entry(s): [{}]. Each entry must be an RFC 6052 NAT64 prefix written as <ipv6>/<length> with a length of 32, 40, 48, 56, 64, or 96 and no bits set beyond it, for example \"2001:db8:122:344::/96\".

What it means

Error "Invalid {label} entry(s): [{}]. Each entry must be an RFC 6052 NAT64 prefix written as <ipv6>/<length> with a length of 32, 40, 48, 56, 64, or 96 and no bits set beyond it, for example \"2001:db8:122:344::/96\"." thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-infra/src/net_guard.rs:728

/// A malformed list is never silently reduced to its well-formed subset. One
/// bad entry rejects the whole list so that a typo fails the caller closed
/// instead of quietly narrowing the validation boundary — a list that parsed
/// to "no prefixes" would look exactly like a deployment that runs no NAT64
/// translator, and would disable network-specific classification without any
/// signal.
pub fn parse_nat64_prefixes(prefixes: &[String], label: &str) -> anyhow::Result<Vec<Nat64Prefix>> {
    let mut parsed = Vec::with_capacity(prefixes.len());
    let mut rejected = Vec::new();

    for entry in prefixes {
        match Nat64Prefix::parse(entry) {
            Ok(prefix) => parsed.push(prefix),
            Err(err) => rejected.push(format!("'{entry}' ({err})")),
        }
    }

    if !rejected.is_empty() {
        anyhow::bail!(
            "Invalid {label} entry(s): [{}]. Each entry must be an RFC 6052 NAT64 prefix written \
             as <ipv6>/<length> with a length of 32, 40, 48, 56, 64, or 96 and no bits set beyond \
             it, for example \"2001:db8:122:344::/96\".",
            rejected.join(", ")
        );
    }

    parsed.sort_unstable();
    parsed.dedup();
    Ok(parsed)
}

/// Decode `v6` under **every** configured prefix that contains it, yielding
/// each such prefix alongside the IPv4 address it embeds.
///
/// Configured prefixes may overlap: a prefix is a CIDR range, so a declared
/// `/96` can nest inside a declared `/32`, and one IPv6 address then sits in
/// both. The two prefixes decode different octets, so they translate that one

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Rewrite each entry as <ipv6>/<length> per RFC 6052, e.g. "2001:db8:122:344::/96".

When it happens

Trigger: Thrown at crates/zeroclaw-infra/src/net_guard.rs:728 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/8585cf37518fe277. Report an issue: GitHub.