{"record":{"id":"a2c424e38b5abe65","repo":"nsqio/nsq","slug":"failed-to-parse-allow-config-from-cidr-s-s","errorCode":null,"errorMessage":"failed to parse --allow-config-from-cidr (%s) - %s","messagePattern":"failed to parse --allow-config-from-cidr \\((.+?)\\) - (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nsqadmin/nsqadmin.go","lineNumber":109,"sourceCode":"\tfor _, address := range opts.NSQDHTTPAddresses {\n\t\t_, err := net.ResolveTCPAddr(\"tcp\", address)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to resolve --nsqd-http-address (%s) - %s\", address, err)\n\t\t}\n\t}\n\n\tif opts.ProxyGraphite {\n\t\turl, err := url.Parse(opts.GraphiteURL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse --graphite-url (%s) - %s\", opts.GraphiteURL, err)\n\t\t}\n\t\tn.graphiteURL = url\n\t}\n\n\tif opts.AllowConfigFromCIDR != \"\" {\n\t\t_, _, err := net.ParseCIDR(opts.AllowConfigFromCIDR)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse --allow-config-from-cidr (%s) - %s\", opts.AllowConfigFromCIDR, err)\n\t\t}\n\t}\n\n\topts.BasePath = normalizeBasePath(opts.BasePath)\n\n\tn.logf(LOG_INFO, version.String(\"nsqadmin\"))\n\n\tvar err error\n\tn.httpListener, err = net.Listen(\"tcp\", n.getOpts().HTTPAddress)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"listen (%s) failed - %s\", n.getOpts().HTTPAddress, err)\n\t}\n\n\treturn n, nil\n}\n\nfunc normalizeBasePath(p string) string {\n\tif len(p) == 0 {","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/nsqio/nsq/blob/85cf10c09c6c3c86160d6f0eb156f62d0efc1648/nsqadmin/nsqadmin.go#L91-L127","documentation":"When --allow-config-from-cidr is a non-empty string, nsqadmin.New validates it with net.ParseCIDR before serving. The value must be true CIDR notation (an IP plus a /prefix length, e.g. 10.0.0.0/8), because nsqadmin uses the parsed network to authorize which clients may change config at runtime. A malformed value aborts startup.","triggerScenarios":"Passing --allow-config-from-cidr=192.168.1.10 (bare IP, missing /32), a prefix out of range such as 10.0.0.0/33 or ::1/129, or plain garbage like 'office-network'. Any of these makes net.ParseCIDR return an error from nsqadmin.New.","commonSituations":"Operators naturally write a single IP where a CIDR is required; IPv6 prefixes with wrong bit counts; upgrading from configs that previously ignored this flag; leftover placeholder values in templated config files.","solutions":["Convert a single host IP to CIDR: append /32 for IPv4 (192.168.1.10/32) or /128 for IPv6","Use a proper network range such as 10.0.0.0/8 or 192.168.0.0/16","Verify with a quick Go one-liner or an online CIDR calculator that the prefix length matches the address family (0-32 IPv4, 0-128 IPv6)","Leave the flag empty if you want no CIDR-based config access restriction"],"exampleFix":"# before\n--allow-config-from-cidr=192.168.1.10\n\n# after\n--allow-config-from-cidr=192.168.1.10/32","handlingStrategy":"validation","validationCode":"if opts.AllowConfigFromCIDR != \"\" {\n\tif _, _, err := net.ParseCIDR(opts.AllowConfigFromCIDR); err != nil {\n\t\tlog.Fatalf(\"bad --allow-config-from-cidr %q: %v\", opts.AllowConfigFromCIDR, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"n, err := nsqadmin.New(opts)\nif err != nil && strings.Contains(err.Error(), \"failed to parse --allow-config-from-cidr\") {\n\t// config error: correct to CIDR notation (ip/prefix) and restart\n}\nif err != nil {\n\tlog.Fatal(err)\n}","preventionTips":["Encode the allowed network as a real subnet in config management, never a bare host IP","Use /32 (IPv4) or /128 (IPv6) for single hosts","Lint nsqadmin flags in a pre-deploy check"],"tags":["nsqadmin","config","cidr","networking","startup"],"backgroundTag":null,"analyzedSha":"85cf10c09c6c3c86160d6f0eb156f62d0efc1648","analyzedAt":"2026-08-16T00:53:05.009Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}