{"record":{"id":"8f5cd703a0d42db0","repo":"cloudflare/cloudflared","slug":"invalid-cidr-supplied-for-s","errorCode":null,"errorMessage":"Invalid CIDR supplied for %s","messagePattern":"Invalid CIDR supplied for (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cfapi/ip_route_filter.go","lineNumber":119,"sourceCode":"\n\tif maxFetch := c.Int(\"max-fetch-size\"); maxFetch > 0 {\n\t\tf.MaxFetchSize(uint(maxFetch))\n\t}\n\n\treturn f, nil\n}\n\n// Parses a CIDR from the flag. If the flag was unset, returns (nil, nil).\nfunc cidrFromFlag(c *cli.Context, flag cli.StringFlag) (*net.IPNet, error) {\n\tif !c.IsSet(flag.Name) {\n\t\treturn nil, nil\n\t}\n\n\t_, subset, err := net.ParseCIDR(c.String(flag.Name))\n\tif err != nil {\n\t\treturn nil, err\n\t} else if subset == nil {\n\t\treturn nil, fmt.Errorf(\"Invalid CIDR supplied for %s\", flag.Name)\n\t}\n\n\treturn subset, nil\n}\n\nfunc NewIPRouteFilter() *IpRouteFilter {\n\tvalues := &IpRouteFilter{queryParams: url.Values{}}\n\n\t// always list cfd_tunnel routes only\n\tvalues.queryParams.Set(\"tun_types\", \"cfd_tunnel\")\n\n\treturn values\n}\n\nfunc (f *IpRouteFilter) CommentIs(comment string) {\n\tf.queryParams.Set(\"comment\", comment)\n}\n","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cfapi/ip_route_filter.go#L101-L137","documentation":"cidrFromFlag builds an IpRouteFilter from a CLI flag value by parsing it with net.ParseCIDR. When the parsed subset is nil (or parsing fails earlier), it reports that the CIDR supplied for the given flag name is invalid. This guards route filtering so only well-formed networks are used to query the API.","triggerScenarios":"Running cloudflared tunnel ip filter (route filter) commands with a flag value that is not a valid CIDR, e.g. `--ip 10.0.0.1` (missing prefix), `10.0.0.0/33`, or a hostname.","commonSituations":"Typing an IP without a prefix length; confusing IPv4/IPv6 notation; copy-pasting ranges like `10.0.0.0-10.0.0.255` (dash ranges are not CIDR); shell mangling of slashes.","solutions":["Supply a valid CIDR with an explicit prefix, e.g. 10.0.0.0/24 or 2001:db8::/32; for a single IP use x.x.x.x/32.","Check the flag's expected name/value via the command's --help output.","Use a calculator or `ipcalc`/`cidrify` to convert IP ranges into CIDR notation before passing them.","If passing via script, quote the value so shells do not split on '/': --ip \"10.0.0.0/24\"."],"exampleFix":"// before\n$ cloudflared tunnel route ip filter --ip 10.0.0.1\n// after\n$ cloudflared tunnel route ip filter --ip 10.0.0.1/32","handlingStrategy":"validation","validationCode":"_, _, err := net.ParseCIDR(flagValue)\nif err != nil || flagValue == \"\" {\n\treturn fmt.Errorf(\"flag %s requires a valid CIDR like 10.0.0.0/24\", flagName)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include an explicit prefix length (/32 for single IPs)","Quote CIDR values in shell scripts","Validate CIDR inputs with a preflight check in automation","Convert IP ranges to CIDR blocks before passing to the CLI"],"tags":["go","cli","cidr","validation"],"backgroundTag":"invalid-flag-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}