{"record":{"id":"14d43b4193da397c","repo":"crowdsecurity/crowdsec","slug":"fail-to-apply-startipendipfilter-w-14d43b","errorCode":null,"errorMessage":"fail to apply StartIpEndIpFilter: %w","messagePattern":"fail to apply StartIpEndIpFilter: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/decisions.go","lineNumber":393,"sourceCode":"\t}\n\n\tcount, err := c.ExpireDecisions(ctx, toUpdate)\n\n\treturn count, toUpdate, err\n}\n\nfunc (c *Client) CountDecisionsByValue(ctx context.Context, value string, since *time.Time, onlyActive bool) (int, error) {\n\trng, err := csnet.NewRange(value)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"unable to convert '%s' to int: %w\", value, err)\n\t}\n\n\tcontains := true\n\tdecisions := c.Ent.Decision.Query()\n\n\tdecisions, err = decisionIPFilter(decisions, contains, rng)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"fail to apply StartIpEndIpFilter: %w\", err)\n\t}\n\n\tif since != nil {\n\t\tdecisions = decisions.Where(decision.CreatedAtGT(*since))\n\t}\n\n\tif onlyActive {\n\t\tdecisions = decisions.Where(decision.UntilGT(time.Now().UTC()))\n\t}\n\n\tcount, err := decisions.Count(ctx)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"fail to count decisions: %w\", err)\n\t}\n\n\treturn count, nil\n}\n","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/decisions.go#L375-L411","documentation":"After parsing the range, CountDecisionsByValue applies decisionIPFilter, which converts the range into StartIp/EndIp ent predicates. If that conversion fails (e.g. mixed/inconsistent address families or internal filter construction error), the error is wrapped with this message, meaning the IP range could not be translated into a DB filter.","triggerScenarios":"decisionIPFilter returning an error while processing the parsed range for the count query — typically an internal predicate-construction failure rather than user input error.","commonSituations":"Upgrading crowdsec with schema/predicate mismatches; pathological ranges spanning IPv4/IPv6 boundaries; custom forks modifying decisionIPFilter.","solutions":["Check the wrapped inner error to identify the predicate-construction failure","Ensure the crowdsec version's database schema matches (run migrations after upgrades)","Pass a plain single-IP or single-family CIDR; avoid exotic mixed-family inputs","If reproducible on standard input, report it — this path is expected to succeed for valid ranges"],"exampleFix":"// before\nrng, _ := csnet.ParseRange(\"::ffff:1.2.3.4/120\") // mixed-family edge\n// after\nrng, err := csnet.ParseRange(\"1.2.3.0/24\")\nif err != nil { return err }","handlingStrategy":"validation","validationCode":"rng, err := csnet.NewRange(value)\nif err != nil { return err } // catches bad input before decisionIPFilter\nif rng.Contains(net.ParseIP(\"127.0.0.1\")) == false && strings.Contains(value, \":\") && strings.Contains(value, \".\") {\n    return errors.New(\"mixed-family range\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := client.CountDecisionsByValue(ctx, value, since, onlyActive); err != nil {\n    if strings.Contains(err.Error(), \"StartIpEndIpFilter\") {\n        // predicate construction failed; log value + unwrapped error\n    }\n    return err\n}","preventionTips":["Use single-family (IPv4 or IPv6) ranges","Keep crowdsec and its DB schema versions in sync","If reproducible with a standard CIDR, file a bug with the input value"],"tags":["go","database","filter","network"],"backgroundTag":"database-query-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}