{"record":{"id":"114bf36f26bb01c7","repo":"crowdsecurity/crowdsec","slug":"parsing-whitelist-w","errorCode":null,"errorMessage":"parsing whitelist: %w","messagePattern":"parsing whitelist: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/whitelist.go","lineNumber":116,"sourceCode":"\t\t\tif out {\n\t\t\t\tn.Logger.Debugf(\"Event is whitelisted by expr, reason [%s]\", n.Whitelist.Reason)\n\t\t\t\tisWhitelisted = true\n\t\t\t}\n\t\tdefault:\n\t\t\tn.Logger.Errorf(\"unexpected type %t (%v) while running '%s'\", output, output, n.Whitelist.Exprs[eidx])\n\t\t}\n\t}\n\tif isWhitelisted {\n\t\tn.bumpWhitelistMetric(metrics.NodesWlHitsOk, p)\n\t}\n\treturn isWhitelisted, nil\n}\n\nfunc (n *Node) CompileWLs() (bool, error) {\n\tfor _, v := range n.Whitelist.Ips {\n\t\taddr, err := netip.ParseAddr(v)\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"parsing whitelist: %w\", err)\n\t\t}\n\n\t\tn.Whitelist.B_Ips = append(n.Whitelist.B_Ips, addr)\n\t\tn.Logger.Debugf(\"adding ip %s to whitelists\", addr)\n\t}\n\n\tfor _, v := range n.Whitelist.Cidrs {\n\t\ttnet, err := netip.ParsePrefix(v)\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"parsing whitelist: %w\", err)\n\t\t}\n\t\tn.Whitelist.B_Cidrs = append(n.Whitelist.B_Cidrs, tnet)\n\t\tn.Logger.Debugf(\"adding cidr %s to whitelists\", tnet)\n\t}\n\n\tfor _, filter := range n.Whitelist.Exprs {\n\t\tvar err error\n\t\texpression := &ExprWhitelist{}","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/whitelist.go#L98-L134","documentation":"CompileWLs compiles the static IP whitelist entries declared in a parser/postoverflow node. Each entry under `whitelist: ip:` is parsed with netip.ParseAddr; if the string is not a valid IP address, the error is wrapped as \"parsing whitelist\". This surfaces at config load time so a malformed whitelist never silently disables itself.","triggerScenarios":"A node's Whitelist.Ips entry (YAML key `ip:`) is not a parseable IP (e.g. a hostname, '1.2.3.4/32' with a mask, empty string) when CompileWLs runs during parser compilation.","commonSituations":"Putting a CIDR in the `ip:` field instead of `cidr:`; pasting a hostname or FQDN; whitespace or a trailing character copied from a document; IPv6 abbreviated incorrectly.","solutions":["Move CIDR entries from `ip:` to `cidr:` in the whitelist section","Use only bare IPs in `ip:` (e.g. 1.2.3.4, ::1); validate with `python3 -c \"import ipaddress;ipaddress.ip_address('X')\"`","If you need hostnames or conditions, use an `expression:` whitelist instead","Read the wrapped netip error to see the exact offending value"],"exampleFix":"// before\nwhitelist:\n  reason: office\n  ip: 192.168.0.0/16   # wrong field\n// after\nwhitelist:\n  reason: office\n  cidr:\n    - 192.168.0.0/16","handlingStrategy":"validation","validationCode":"import \"net/netip\"\nfunc validWLIPs(ips []string) error {\n  for _, v := range ips {\n    if _, err := netip.ParseAddr(v); err != nil {\n      return fmt.Errorf(\"whitelist ip %q invalid: %w\", v, err)\n    }\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":"ok, err := node.CompileWLs()\nif err != nil {\n  if strings.Contains(err.Error(), \"parsing whitelist\") {\n    log.Fatalf(\"bad whitelist entry in %s: %v\", node.Name, err)\n  }\n  return err\n}","preventionTips":["Never put CIDRs in the `ip:` field — use `cidr:`","Use `expression:` whitelists for hostnames or conditions","Validate edited whitelist files with `cscli explain` or a quick netip.ParseAddr check before restart"],"tags":["crowdsec","whitelist","ip","config"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}