What causes "Unable to parse CIDR for Fake DNS IP assignment" in XTLS/Xray-core?

Fix the per-chunk delay range: min >= 0 and max >= min

Unable to parse CIDR for Fake DNS IP assignment

Error message

Unable to parse CIDR for Fake DNS IP assignment

What it means

Before writing each chunk, writePaddingTurnWithBuffer draws an inter-chunk delay via randomPaddingDelay(delays[i]); this error wraps that draw for chunk i. Sub-causes: an invalid delay range (min < 0 or max < min) in a variant's per-chunk delays, or crypto/rand.Int failing. Schedule-level validation checks turn.chunkDelay and variant delays up front, so the rand failure or a direct unvalidated write is the realistic path.

Source

Thrown at app/dns/fakedns/fake.go:83

		return nil, err
	}
	return fkdns, nil
}

func NewFakeDNSHolderConfigOnly(conf *FakeDnsPool) (*Holder, error) {
	return &Holder{config: conf}, nil
}

func (fkdns *Holder) initializeFromConfig() error {
	return fkdns.initialize(fkdns.config.IpPool, int(fkdns.config.LruSize))
}

func (fkdns *Holder) initialize(ipPoolCidr string, lruSize int) error {
	var ipRange *net.IPNet
	var err error

	if _, ipRange, err = net.ParseCIDR(ipPoolCidr); err != nil {
		return errors.New("Unable to parse CIDR for Fake DNS IP assignment").Base(err).AtError()
	}

	ones, bits := ipRange.Mask.Size()
	rooms := bits - ones
	if math.Log2(float64(lruSize)) >= float64(rooms) {
		return errors.New("LRU size is bigger than subnet size").AtError()
	}
	fkdns.domainToIP = cache.NewLru(lruSize)
	fkdns.ipRange = ipRange
	return nil
}

// GetFakeIPForDomain checks and generates a fake IP for a domain name
func (fkdns *Holder) GetFakeIPForDomain(domain string) []net.Address {
	fkdns.mu.Lock()
	defer fkdns.mu.Unlock()
	if v, ok := fkdns.domainToIP.Get(domain); ok {
		return []net.Address{v.(net.Address)}

View on GitHub (pinned to 7d214f8b09)

Solutions

Fix the per-chunk delay range: min >= 0 and max >= min
Run through runPaddingSchedule so variant delays are validated with a precise index
Address OS entropy availability if rand failures recur (same host-level fix as other rand errors)

Example fix

// before
variant.delays = []paddingDelayRange{{min: 20 * time.Millisecond, max: 5 * time.Millisecond}}
// after
variant.delays = []paddingDelayRange{{min: 5 * time.Millisecond, max: 20 * time.Millisecond}}

Defensive patterns

Strategy: validation

Validate before calling

for j, d := range variant.delays {
    if d.min < 0 || d.max < d.min {
        return fmt.Errorf("variant chunk %d delay invalid", j)
    }
}

Prevention

Validate per-chunk delays with the schedule, not just turn-level delays
Order delay bounds during config parsing

When it happens

Trigger: Direct writePaddingTurn calls with a variant whose delays[j] has min > max; OS-level rand.Reader failure while shaping multi-chunk traffic.

Common situations: Hand-built variants in tests with misordered delay bounds; entropy-starved containers during bursts of many randomized turns; config parsing that maps durations without ordering checks.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/3fd6754bf421e4da. Report an issue: GitHub.