{"record":{"id":"4d01f2ddf7d4eb50","repo":"crowdsecurity/crowdsec","slug":"scope-is-s-but-s-isn-t-a-valid-ip","errorCode":null,"errorMessage":"scope is %s but '%s' isn't a valid ip","messagePattern":"scope is (.+?) but '(.+?)' isn't a valid ip","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/overflows.go","lineNumber":114,"sourceCode":"\t}\n\n\treturn srcs, nil\n}\n\nfunc eventSources(evt pipeline.Event, leaky *Leaky) (map[string]models.Source, error) {\n\tsrcs := make(map[string]models.Source)\n\n\tsrc := models.Source{}\n\n\tswitch leaky.Factory.Spec.ScopeType.Scope {\n\tcase types.Range, types.Ip:\n\t\tv, ok := evt.Meta[\"source_ip\"]\n\t\tif !ok {\n\t\t\treturn srcs, fmt.Errorf(\"scope is %s but Meta[source_ip] doesn't exist\", leaky.Factory.Spec.ScopeType.Scope)\n\t\t}\n\n\t\tif net.ParseIP(v) == nil {\n\t\t\treturn srcs, fmt.Errorf(\"scope is %s but '%s' isn't a valid ip\", leaky.Factory.Spec.ScopeType.Scope, v)\n\t\t}\n\n\t\tsrc.IP = v\n\t\t// not &leaky.Factory.Spec.ScopeType.Scope: the factory is shared by every\n\t\t// bucket of the scenario, and postoverflow statics write through this pointer\n\t\tsrc.Scope = new(string)\n\t\t*src.Scope = leaky.Factory.Spec.ScopeType.Scope\n\n\t\tif v, ok := evt.Enriched[\"ASNumber\"]; ok {\n\t\t\tsrc.AsNumber = v\n\t\t} else if v, ok := evt.Enriched[\"ASNNumber\"]; ok {\n\t\t\tsrc.AsNumber = v\n\t\t}\n\n\t\tif v, ok := evt.Enriched[\"IsoCode\"]; ok {\n\t\t\tsrc.Cn = v\n\t\t}\n","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/overflows.go#L96-L132","documentation":"When building the event source in eventSources, if the bucket's scope type is an IP-based scope (e.g. 'ip' or 'ip_in_range'), the value of evt.Meta[\"source_ip\"] must parse as an IP address via net.ParseIP. If it's present but malformed (e.g. a hostname or garbage), this error is returned. It means the parser produced a Meta[source_ip] value that isn't a valid IP while the scenario's scope demands one.","triggerScenarios":"A scenario whose scope.type is 'ip'/'ip_in_range' is evaluated against an event whose parsed Meta[\"source_ip\"] fails net.ParseIP (empty-ish garbage, 'unknown', 'host.example.com').","commonSituations":"A parser enrichment wrote a hostname instead of an IP into source_ip; logs where the source field is optional and parsed to a non-IP placeholder; misconfigured custom parser; IPv6 zone identifiers like 'fe80::1%eth0' which net.ParseIP rejects.","solutions":["Fix the parser so Meta[\"source_ip\"] is set only with a syntactically valid IP (validate with net.ParseIP in the parser/expression).","Check the log line feeding the event — a malformed source field is being parsed as source_ip.","Change the scenario scope type if IP scoping doesn't fit this event source (e.g. use a non-IP scope).","Strip IPv6 zone identifiers before assigning source_ip."],"exampleFix":"// before (parser)\nMeta: source_ip: evt.Parsed.source_host  # may be 'unknown'\n// after\nMeta: source_ip: evt.Parsed.source_ip | filter(net.ParseIP(evt.Parsed.source_ip) != nil) ? evt.Parsed.source_ip : \"\"","handlingStrategy":"validation","validationCode":"ip := evt.Meta[\"source_ip\"]\nif net.ParseIP(ip) == nil {\n\t// don't feed this event to an ip-scoped scenario / fix the parser\n}","typeGuard":null,"tryCatchPattern":"srcs, err := leaky.SourceFromEvent(evt, leaky)\nif err != nil && strings.Contains(err.Error(), \"isn't a valid ip\") {\n\tleaky.logger.Warnf(\"dropping event with bad source_ip: %v\", err)\n\treturn nil\n}","preventionTips":["Validate source_ip with net.ParseIP inside parsers/enrichment.","Strip IPv6 zone identifiers (%eth0) before setting source_ip.","Only set source_ip when the log field actually contains an address."],"tags":["crowdsec","leakybucket","scenario","ip"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}