{"record":{"id":"3eebbb23c4b91ca7","repo":"cilium/cilium","slug":"invalid-cidr-s-3eebbb","errorCode":null,"errorMessage":"invalid CIDR '%s'","messagePattern":"invalid CIDR '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/cilium-cni/cmd/interface.go","lineNumber":32,"sourceCode":"\t\"github.com/cilium/cilium/api/v1/models\"\n\tlinuxrouting \"github.com/cilium/cilium/pkg/datapath/linux/routing\"\n\t\"github.com/cilium/cilium/pkg/ip\"\n)\n\nfunc interfaceAdd(logger *slog.Logger, ipConfig *current.IPConfig, ipam *models.IPAMAddressResponse, conf *models.DaemonConfigurationStatus) error {\n\tif ipam == nil {\n\t\treturn fmt.Errorf(\"missing IPAM configuration\")\n\t}\n\t// If the gateway IP is not available, it is already set up\n\tif !ipam.Gateway.IsValid() {\n\t\treturn nil\n\t}\n\n\tvar allCIDRs []*net.IPNet\n\n\tfor _, cidr := range ipam.Cidrs {\n\t\tif !cidr.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid CIDR '%s'\", cidr)\n\t\t}\n\t\t// Mask explicitly: net.ParseCIDR, which this loop replaces, returned\n\t\t// the masked network, and ip.CoalesceCIDRs below expects that shape.\n\t\tallCIDRs = append(allCIDRs, netipx.PrefixIPNet(cidr.Masked()))\n\t}\n\n\t// Coalesce CIDRs into minimum set needed for route rules\n\t// The routes set up here will be cleaned up by linuxrouting.Delete.\n\t// Therefor the code here should be kept in sync with the deletion code.\n\tipv4CIDRs, ipv6CIDRs := ip.CoalesceCIDRs(allCIDRs)\n\tcoalescedCIDRs := make([]string, 0, len(allCIDRs))\n\tvar masq bool\n\n\tif ipConfig.Address.IP.To4() != nil {\n\t\tfor _, cidr := range ipv4CIDRs {\n\t\t\tcoalescedCIDRs = append(coalescedCIDRs, cidr.String())\n\t\t}\n","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/plugins/cilium-cni/cmd/interface.go#L14-L50","documentation":"One of the CIDR prefixes in ipam.Cidrs failed the netip.Prefix validity check. The agent supplied an IPAM CIDR string that cannot be parsed/validated as a network prefix, so route coalescing for the new interface cannot proceed.","triggerScenarios":"CNI ADD where the IPAM response's Cidrs array contains a malformed or zero-value prefix — corrupt agent state, hand-edited IPAM config, or a plugin populating Cidrs with raw unparsed strings.","commonSituations":"Custom IPAM plugins or CRDs emitting CIDRs with host bits/typos ('10.0.0.0/33', '10.0.0.5/24' variants a strict parser rejects); upgrading agents that changed CIDR serialization; ENI/Azure metadata returning unexpected values.","solutions":["Inspect the IPAM response (cilium-dbg or agent logs) and find the offending CIDR string","Fix the IPAM pool/config producing the malformed CIDR","Restart cilium-agent to refresh IPAM state if the value came from stale caches","Report/upgrade if a cloud IPAM integration (ENI/Azure) is emitting invalid prefixes"],"exampleFix":"// before (IPAM config)\n\"cidrs\": [\"10.0.0.0/33\"]\n// after\n\"cidrs\": [\"10.0.0.0/24\"]","handlingStrategy":"validation","validationCode":"// Validate CIDRs as netip.Prefix before handing them to the CNI path\nfor _, c := range cidrStrings {\n    p, err := netip.ParsePrefix(c)\n    if err != nil {\n        return fmt.Errorf(\"IPAM config CIDR %q invalid: %v\", c, err)\n    }\n    _ = p.Masked()\n}","typeGuard":null,"tryCatchPattern":"if err := cniAdd(args); err != nil {\n    if strings.Contains(err.Error(), \"invalid CIDR\") {\n        // dump the IPAM response to logs and fail fast with the offending value\n        return fmt.Errorf(\"fix IPAM pool; response cidrs: %v\", ipamResp.Cidrs)\n    }\n    return err\n}","preventionTips":["Validate custom IPAM plugin outputs with netip.ParsePrefix in CI","Avoid hand-editing CIDR fields in IPAM CRDs/configmaps","After cilium upgrades, verify cloud IPAM integrations still serialize CIDRs compatibly"],"tags":["cni","ipam","cidr","cilium"],"backgroundTag":"invalid-cidr","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}