{"record":{"id":"882d6eda60758f0c","repo":"coredns/coredns","slug":"s-w","errorCode":null,"errorMessage":"%s: %w","messagePattern":"%s: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugin/proxyproto/setup.go","lineNumber":43,"sourceCode":"\tvar (\n\t\tallowedIPNets              []*net.IPNet\n\t\tpolicy                     = proxyproto.IGNORE\n\t\tdefaultSet                 bool\n\t\tsessionTrackingTTL         time.Duration\n\t\tsessionTrackingMaxSessions int\n\t)\n\tfor c.Next() {\n\t\targs := c.RemainingArgs()\n\t\tif len(args) != 0 {\n\t\t\treturn plugin.Error(\"proxyproto\", c.ArgErr())\n\t\t}\n\t\tfor c.NextBlock() {\n\t\t\tswitch c.Val() {\n\t\t\tcase \"allow\":\n\t\t\t\tfor _, v := range c.RemainingArgs() {\n\t\t\t\t\t_, ipnet, err := net.ParseCIDR(v)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn plugin.Error(\"proxyproto\", fmt.Errorf(\"%s: %w\", v, err))\n\t\t\t\t\t}\n\t\t\t\t\tallowedIPNets = append(allowedIPNets, ipnet)\n\t\t\t\t}\n\t\t\tcase \"default\":\n\t\t\t\tdefaultSet = true\n\t\t\t\tv := c.RemainingArgs()\n\t\t\t\tif len(v) != 1 {\n\t\t\t\t\treturn plugin.Error(\"proxyproto\", c.ArgErr())\n\t\t\t\t}\n\t\t\t\tswitch strings.ToLower(v[0]) {\n\t\t\t\tcase \"use\":\n\t\t\t\t\tpolicy = proxyproto.USE\n\t\t\t\tcase \"ignore\":\n\t\t\t\t\tpolicy = proxyproto.IGNORE\n\t\t\t\tcase \"reject\":\n\t\t\t\t\tpolicy = proxyproto.REJECT\n\t\t\t\tcase \"skip\":\n\t\t\t\t\tpolicy = proxyproto.SKIP","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/coredns/coredns/blob/558c9757a92b361e550bdba82d0b4ddf3d12d595/plugin/proxyproto/setup.go#L25-L61","documentation":"CoreDNS's proxyproto plugin failed to parse one of the CIDR arguments after the 'allow' directive in the Corefile. net.ParseCIDR rejected the value, and the plugin wraps it with the offending value via plugin.Error. The Corefile cannot be loaded until the CIDR is corrected.","triggerScenarios":"A Corefile contains a 'proxyproto { allow <value> }' block where <value> is not a valid CIDR (e.g. '10.0.0.1' without a prefix length, '10.0.0.0/33', or a typo).","commonSituations":"Users listing individual IPs without the /32 or /128 prefix, copy-pasting addresses from other tools that don't use CIDR notation, or mistyping a prefix length.","solutions":["Convert bare IPs to CIDR form: 10.0.0.1 becomes 10.0.0.1/32 (IPv4) or fd00::1/128 (IPv6).","Fix the prefix length if it is out of range for the address family (0-32 for IPv4, 0-128 for IPv6).","Validate the value locally with `net.ParseCIDR` or `cidr` tooling before adding it to the Corefile."],"exampleFix":"// before\nproxyproto {\n    allow 10.0.0.1\n}\n// after\nproxyproto {\n    allow 10.0.0.1/32\n}","handlingStrategy":"validation","validationCode":"_, ipnet, err := net.ParseCIDR(v)\nif err != nil {\n    return fmt.Errorf(\"proxyproto allow: %q is not a valid CIDR: %w\", v, err)\n}\n_ = ipnet","typeGuard":"func isCIDR(s string) bool { _, _, err := net.ParseCIDR(s); return err == nil }","tryCatchPattern":null,"preventionTips":["Always write IPs in CIDR form (/32 or /128 for single hosts).","Lint the Corefile with `coredns -conf Corefile -dns.port 0` before deploy.","Keep an allowlist of pre-validated CIDRs in config management."],"tags":["coredns","cidr","corefile","config-validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"558c9757a92b361e550bdba82d0b4ddf3d12d595","analyzedAt":"2026-09-06T22:47:02.106Z","contentChangedAt":"2026-09-06T22:47:02.106Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}