{"record":{"id":"1dbe50d6099e5fb8","repo":"hashicorp/nomad","slug":"could-not-parse-transparent-proxy-excluded-outboun","errorCode":null,"errorMessage":"could not parse transparent proxy excluded outbound CIDR as network prefix: %w","messagePattern":"could not parse transparent proxy excluded outbound CIDR as network prefix: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/connect.go","lineNumber":125,"sourceCode":"\t*ntp = *tp\n\n\tntp.ExcludeInboundPorts = slices.Clone(tp.ExcludeInboundPorts)\n\tntp.ExcludeOutboundPorts = slices.Clone(tp.ExcludeOutboundPorts)\n\tntp.ExcludeOutboundCIDRs = slices.Clone(tp.ExcludeOutboundCIDRs)\n\tntp.ExcludeUIDs = slices.Clone(tp.ExcludeUIDs)\n\n\treturn ntp\n}\n\nfunc (tp *ConsulTransparentProxy) Validate() error {\n\tvar mErr multierror.Error\n\n\tfor _, rawCidr := range tp.ExcludeOutboundCIDRs {\n\t\t_, err := netip.ParsePrefix(rawCidr)\n\t\tif err != nil {\n\t\t\t// note: error returned always include parsed string\n\t\t\tmErr.Errors = append(mErr.Errors,\n\t\t\t\tfmt.Errorf(\"could not parse transparent proxy excluded outbound CIDR as network prefix: %w\", err))\n\t\t}\n\t}\n\n\trequireUIDisUint := func(uidRaw string) error {\n\t\t_, err := strconv.ParseUint(uidRaw, 10, 16)\n\t\tif err != nil {\n\t\t\te, ok := err.(*strconv.NumError)\n\t\t\tif !ok {\n\t\t\t\treturn fmt.Errorf(\"invalid user ID %q: %w\", uidRaw, err)\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"invalid user ID %q: %w\", uidRaw, e.Err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tif tp.UID != \"\" {\n\t\tif err := requireUIDisUint(tp.UID); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors,","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/connect.go#L107-L143","documentation":"During ConnectTransparentProxy validation, each ExcludeOutboundCIDRs entry is parsed with netip.ParsePrefix. Any string that is not a valid CIDR prefix is appended as this error to a multi-error. The message intentionally includes the parse error, which always embeds the offending string.","triggerScenarios":"A transparent_proxy block lists an exclude_outbound_cidrs entry like '10.0.0.0/33', '10.0.0.1' (missing prefix), or '::1/300' and Validate() runs.","commonSituations":"Using bare IPs without /32; typos in prefix length; IPv6/IPv4 confusion; copying iptables-style ranges that netip rejects.","solutions":["Rewrite the entry as a valid CIDR, e.g. 10.0.0.1/32 for a single host","Check the prefix length is valid for the address family (0-32 IPv4, 0-128 IPv6)","Remove entries that aren't needed from exclude_outbound_cidrs"],"exampleFix":"// before\ntransparent_proxy {\n  exclude_outbound_cidrs = [\"10.0.0.1\"]\n}\n// after\ntransparent_proxy {\n  exclude_outbound_cidrs = [\"10.0.0.1/32\"]\n}","handlingStrategy":"validation","validationCode":"for _, cidr := range tp.ExcludeOutboundCIDRs {\n    if _, err := netip.ParsePrefix(cidr); err != nil {\n        return fmt.Errorf(\"exclude_outbound_cidrs entry %q invalid: %w\", cidr, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := tp.Validate(); err != nil {\n    var mErr multierror\n    if errors.As(err, &mErr) { for _, e := range mErr.Errors { log.Print(e) } }\n}","preventionTips":["Always include a prefix length (/32 for single hosts)","Validate CIDRs with `ipcalc` or netip.ParsePrefix in CI before submitting jobs","Keep IPv4 and IPv6 entries in separate, correctly-formatted lists"],"tags":["validation","connect","cidr","networking"],"backgroundTag":"invalid-cidr-notation","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}