{"record":{"id":"115fc559d27f4638","repo":"XTLS/Xray-core","slug":"cidr-prefix-length","errorCode":null,"errorMessage":"CIDR prefix length ","messagePattern":"CIDR prefix length ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/geodata/rule_parser.go","lineNumber":126,"sourceCode":"\tswitch ipAddr.Family() {\n\tcase net.AddressFamilyIPv4:\n\t\tmaxPrefix = 32\n\tcase net.AddressFamilyIPv6:\n\t\tmaxPrefix = 128\n\tdefault:\n\t\treturn nil, errors.New(\"unsupported address family\")\n\t}\n\n\tprefixBits := maxPrefix\n\tif prefixStr != \"\" {\n\t\tparsedPrefix, err := strconv.ParseUint(prefixStr, 10, 32)\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"invalid CIDR prefix length: \", prefixStr).Base(err)\n\t\t}\n\t\tprefixBits = uint32(parsedPrefix)\n\t}\n\tif prefixBits > maxPrefix {\n\t\treturn nil, errors.New(\"CIDR prefix length \", prefixBits, \" exceeds max \", maxPrefix)\n\t}\n\n\treturn &CIDR{\n\t\tIp:     []byte(ipAddr.IP()),\n\t\tPrefix: prefixBits,\n\t}, nil\n}\n\nfunc ParseDomainRule(r string, defaultType Domain_Type) (*DomainRule, error) {\n\tif strings.HasPrefix(r, \"geosite:\") {\n\t\tr = \"ext:\" + DefaultGeoSiteDat + \":\" + r[len(\"geosite:\"):]\n\t}\n\n\tprefix := 0\n\tfor _, ext := range [...]string{\"ext:\", \"ext-domain:\", \"ext-site:\"} {\n\t\tif strings.HasPrefix(r, ext) {\n\t\t\tprefix = len(ext)\n\t\t\tbreak","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/geodata/rule_parser.go#L108-L144","documentation":"The prefix length parsed successfully as a number but exceeds the address-family maximum (32 for IPv4, 128 for IPv6). The message includes both the offending value and the max, e.g. 'CIDR prefix length 33 exceeds max 32'.","triggerScenarios":"Rules like \"192.168.1.0/33\", \"10.0.0.0/64\", or \"2001:db8::/129\".","commonSituations":"Using IPv6-sized prefixes on IPv4 addresses by copy-paste; off-by-one typos.","solutions":["Clamp the prefix: IPv4 ≤ 32, IPv6 ≤ 128 (e.g. \"10.0.0.0/24\").","Omit the prefix entirely to match the single address (it defaults to full length)."],"exampleFix":"// before\n\"ip\": [\"192.168.1.0/33\"]\n\n// after\n\"ip\": [\"192.168.1.0/32\"]","handlingStrategy":"validation","validationCode":"p, err := netip.ParsePrefix(r)\nif err != nil { return err }\nmax := 32\nif p.Addr().Is6() { max = 128 }\nif p.Bits() > max { return fmt.Errorf(\"%q: prefix %d exceeds %d\", r, p.Bits(), max) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate every CIDR with netip.ParsePrefix in your config pipeline; it enforces family-correct bounds."],"tags":["geodata","cidr","validation","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}