{"record":{"id":"3fd6754bf421e4da","repo":"XTLS/Xray-core","slug":"unable-to-parse-cidr-for-fake-dns-ip-assignment","errorCode":null,"errorMessage":"Unable to parse CIDR for Fake DNS IP assignment","messagePattern":"Unable to parse CIDR for Fake DNS IP assignment","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/dns/fakedns/fake.go","lineNumber":83,"sourceCode":"\t\treturn nil, err\n\t}\n\treturn fkdns, nil\n}\n\nfunc NewFakeDNSHolderConfigOnly(conf *FakeDnsPool) (*Holder, error) {\n\treturn &Holder{config: conf}, nil\n}\n\nfunc (fkdns *Holder) initializeFromConfig() error {\n\treturn fkdns.initialize(fkdns.config.IpPool, int(fkdns.config.LruSize))\n}\n\nfunc (fkdns *Holder) initialize(ipPoolCidr string, lruSize int) error {\n\tvar ipRange *net.IPNet\n\tvar err error\n\n\tif _, ipRange, err = net.ParseCIDR(ipPoolCidr); err != nil {\n\t\treturn errors.New(\"Unable to parse CIDR for Fake DNS IP assignment\").Base(err).AtError()\n\t}\n\n\tones, bits := ipRange.Mask.Size()\n\trooms := bits - ones\n\tif math.Log2(float64(lruSize)) >= float64(rooms) {\n\t\treturn errors.New(\"LRU size is bigger than subnet size\").AtError()\n\t}\n\tfkdns.domainToIP = cache.NewLru(lruSize)\n\tfkdns.ipRange = ipRange\n\treturn nil\n}\n\n// GetFakeIPForDomain checks and generates a fake IP for a domain name\nfunc (fkdns *Holder) GetFakeIPForDomain(domain string) []net.Address {\n\tfkdns.mu.Lock()\n\tdefer fkdns.mu.Unlock()\n\tif v, ok := fkdns.domainToIP.Get(domain); ok {\n\t\treturn []net.Address{v.(net.Address)}","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/app/dns/fakedns/fake.go#L65-L101","documentation":"Before writing each chunk, writePaddingTurnWithBuffer draws an inter-chunk delay via randomPaddingDelay(delays[i]); this error wraps that draw for chunk i. Sub-causes: an invalid delay range (min < 0 or max < min) in a variant's per-chunk delays, or crypto/rand.Int failing. Schedule-level validation checks turn.chunkDelay and variant delays up front, so the rand failure or a direct unvalidated write is the realistic path.","triggerScenarios":"Direct writePaddingTurn calls with a variant whose delays[j] has min > max; OS-level rand.Reader failure while shaping multi-chunk traffic.","commonSituations":"Hand-built variants in tests with misordered delay bounds; entropy-starved containers during bursts of many randomized turns; config parsing that maps durations without ordering checks.","solutions":["Fix the per-chunk delay range: min >= 0 and max >= min","Run through runPaddingSchedule so variant delays are validated with a precise index","Address OS entropy availability if rand failures recur (same host-level fix as other rand errors)"],"exampleFix":"// before\nvariant.delays = []paddingDelayRange{{min: 20 * time.Millisecond, max: 5 * time.Millisecond}}\n// after\nvariant.delays = []paddingDelayRange{{min: 5 * time.Millisecond, max: 20 * time.Millisecond}}","handlingStrategy":"validation","validationCode":"for j, d := range variant.delays {\n    if d.min < 0 || d.max < d.min {\n        return fmt.Errorf(\"variant chunk %d delay invalid\", j)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate per-chunk delays with the schedule, not just turn-level delays","Order delay bounds during config parsing"],"tags":["padding","delay","crypto-rand","xmc"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}