{"record":{"id":"8356e702b0ec172b","repo":"apache/cassandra","slug":"invalid-netmask-netmask-for-ip-hostaddress","errorCode":null,"errorMessage":"Invalid netmask <netMask> for IP <hostAddress>","messagePattern":"Invalid netmask <netMask> for IP <hostAddress>","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/CIDR.java","lineNumber":46,"sourceCode":"/**\n * Contains a CIDR, and operations on it\n */\npublic final class CIDR\n{\n    private final InetAddress startIpAddress;\n    private final InetAddress endIpAddress;\n    // max mask value with IPv6 is 128, not easy to handle value 128 using Byte, hence using short\n    private final short netMask;\n\n    /**\n     * Generates a CIDR from given IP and netmask\n     * @param ipAddress IP address of CIDR\n     * @param netMask   netmask of CIDR\n     */\n    public CIDR(InetAddress ipAddress, short netMask)\n    {\n        if (netMask > maxNetMaskAllowed(ipAddress))\n            throw new IllegalArgumentException(\"Invalid netmask \" + netMask + \" for IP \" + ipAddress.getHostAddress());\n\n        Pair<InetAddress, InetAddress> ipRange = calcIpRangeOfCidr(ipAddress, netMask);\n        this.startIpAddress = ipRange.left();\n        this.endIpAddress = ipRange.right();\n        this.netMask = netMask;\n    }\n\n    /**\n     * Generates a CIDR from given string\n     * @param cidrStr CIDR as string\n     */\n    public static CIDR getInstance(String cidrStr)\n    {\n        if (cidrStr == null || cidrStr.isEmpty())\n        {\n            throw new IllegalArgumentException(String.format(\"%s is not a valid CIDR String\", cidrStr));\n        }\n","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/CIDR.java#L28-L64","documentation":"CIDR's constructor validates that the netmask length is legal for the address family: at most 32 bits for IPv4 and 128 for IPv4-mapped/IPv6 (see maxNetMaskAllowed). A CIDR(inetAddress, netMask) call with a mask longer than the family allows throws IllegalArgumentException 'Invalid netmask <mask> for IP <ip>'.","triggerScenarios":"Calling new CIDR(InetAddress, short) with e.g. netMask 33 for an IPv4 address or 129 for IPv6; parsing user-supplied CIDR strings like '10.0.0.0/33' before constructing; config-driven endpoint filtering rules with out-of-range masks.","commonSituations":"Typo in cidr_allow/cidr_filter configuration entries; scripts generating masks from wrong-width counts; mixing IPv4/IPv6 assumptions when computing default masks.","solutions":["Validate the mask before construction: 0 <= mask <= 32 for IPv4, 0 <= mask <= 128 for IPv6","Fix the offending entry in the CIDR configuration (cassandra.yaml cidr_allowlist / role CIDR filters)","Normalize IPv4-mapped IPv6 addresses and their masks consistently before constructing","Wrap CIDR parsing in a helper that throws a clear config error naming the bad rule"],"exampleFix":"// before\nCIDR cidr = new CIDR(InetAddress.getByName(\"10.0.0.1\"), (short) 33); // throws\n// after\nshort mask = 24;\nassert mask >= 0 && mask <= 32; // IPv4 limit\nCIDR cidr = new CIDR(InetAddress.getByName(\"10.0.0.1\"), mask);","handlingStrategy":"validation","validationCode":"void validateCidr(java.net.InetAddress ip, short mask) {\n    int max = ip.getAddress().length == 4 ? 32 : 128;\n    if (mask < 0 || mask > max)\n        throw new IllegalArgumentException(\"netmask /\" + mask + \" invalid for \" + ip.getHostAddress() + \" (max \" + max + \")\");\n}","typeGuard":"boolean isValidNetmask(java.net.InetAddress ip, short mask) {\n    return mask >= 0 && mask <= (ip.getAddress().length == 4 ? 32 : 128);\n}","tryCatchPattern":"try {\n    CIDR cidr = new CIDR(ip, netMask);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Invalid netmask\"))\n        log.error(\"Fix CIDR rule: \" + e.getMessage());\n    throw e;\n}","preventionTips":["Validate CIDR strings with a regex/parser before constructing","Check mask limits per family: /0-/32 IPv4, /0-/128 IPv6","Load and validate cidr_allowlist rules at startup, not per-request","Handle IPv4-mapped addresses and their masks consistently"],"tags":["network","cidr","invalid-argument"],"backgroundTag":"invalid-argument-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}