{"record":{"id":"735f029ec4989ca4","repo":"OpenNHP/opennhp","slug":"invalid-ip-address-s","errorCode":null,"errorMessage":"invalid IP address: %s","messagePattern":"invalid IP address: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/utils/ebpf/ebpf.go","lineNumber":470,"sourceCode":"\t\terr = AddEbpfRuleForProtocolPort(protocol, dstPort, TtlSec64)\n\t\tif err != nil {\n\t\t\tlog.Error(\"failed add ebpf protocol: %s dst port: %d\", params.Protocol, params.DstPort)\n\t\t\treturn err\n\t\t}\n\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported map type: %d\", mapType)\n\t}\n\n\treturn nil\n}\n\n// Parse the IP address\nfunc parseIP(ipStr string) (uint32, error) {\n\tip := net.ParseIP(ipStr)\n\tif ip == nil {\n\t\tlog.Error(\"invalid IP address: %s\", ipStr)\n\t\treturn 0, fmt.Errorf(\"invalid IP address: %s\", ipStr)\n\t}\n\tip = ip.To4()\n\tif ip == nil {\n\t\tlog.Error(\"only IPv4 addresses are supported: %s\", ipStr)\n\t\treturn 0, fmt.Errorf(\"only IPv4 addresses are supported: %s\", ipStr)\n\t}\n\treturn binary.LittleEndian.Uint32(ip), nil\n}\n\n// Parse the port\nfunc parsePort(portStr string) (uint16, error) {\n\tport, err := strconv.ParseUint(portStr, 10, 16)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\treturn binary.LittleEndian.Uint16([]byte{byte(port >> 8), byte(port & 0xFF)}), nil\n}\n","sourceCodeStart":452,"sourceCodeEnd":488,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/utils/ebpf/ebpf.go#L452-L488","documentation":"parseIP in nhp/utils/ebpf/ebpf.go validates an IP string with net.ParseIP before converting it to a uint32 for eBPF map rules. When the string is not a parseable IP address (nil result), the function logs and returns this error. Callers building firewall-style eBPF rules from user-supplied address strings will abort rule creation.","triggerScenarios":"Calling AddEbpfRuleForSrcDstPortProto, AddEbpfRuleForSrcDst, AddEbpfRuleForSrcDestPort, AddEbpfIcmpRuleForSrcDst, or AddEbpfRuleForSrcDestPortList with a src or dst string that net.ParseIP cannot parse (e.g. '999.1.1.1', '10.0.0.256', 'host.local', or an empty string).","commonSituations":"Config file (resource.toml / rule definitions) contains a hostname instead of a literal IP; a template variable was left unexpanded; trailing whitespace or CIDR suffix ('10.0.0.1/24') passed where a bare IP is expected; IPv6 address supplied but later rejected by the IPv4 check.","solutions":["Print the offending string and validate it with net.ParseIP before calling the eBPF rule API","Correct the config value to a valid literal IPv4 address","Trim whitespace and strip any /prefix CIDR suffix before passing","Resolve hostnames to IPs with net.LookupHost first if a DNS name is intended"],"exampleFix":"// before\nAddEbpfRuleForSrcDst(\"10.0.0.256\", \"192.168.1.10\", ...)\n// after\nif net.ParseIP(strings.TrimSpace(src)) == nil { return fmt.Errorf(\"bad src ip %q\", src) }\nAddEbpfRuleForSrcDst(\"10.0.0.1\", \"192.168.1.10\", ...)","handlingStrategy":"validation","validationCode":"func validIPv4(s string) bool { ip := net.ParseIP(strings.TrimSpace(s)); return ip != nil && ip.To4() != nil }\nif !validIPv4(src) { return fmt.Errorf(\"invalid src ip: %q\", src) }","typeGuard":null,"tryCatchPattern":"if err != nil { return fmt.Errorf(\"ebpf rule rejected: %w\", err) }","preventionTips":["Validate all IPs at config-load time with net.ParseIP + To4","Reject CIDR suffixes and hostnames explicitly with a clear message","Trim whitespace from rule fields"],"tags":["ebpf","networking","ip-parsing","validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}