{"record":{"id":"addb02a85995da11","repo":"crowdsecurity/crowdsec","slug":"invalid-cidr-range-s-for-bot-entry-s-in-s","errorCode":null,"errorMessage":"invalid CIDR range '%s' for bot entry '%s' in %s: %w","messagePattern":"invalid CIDR range '(.+?)' for bot entry '(.+?)' in (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exprhelpers/botfile.go","lineNumber":97,"sourceCode":"\n\t\tentry.pathRegexes = append(entry.pathRegexes, re)\n\t}\n\n\tentry.ipSet = make(map[netip.Addr]struct{}, len(entry.IPs))\n\n\tfor _, ip := range entry.IPs {\n\t\taddr, err := netip.ParseAddr(ip)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid IP '%s' for bot entry '%s' in %s: %w\", ip, entry.Name, filename, err)\n\t\t}\n\n\t\tentry.ipSet[addr.Unmap()] = struct{}{}\n\t}\n\n\tfor _, r := range entry.Ranges {\n\t\tprefix, err := netip.ParsePrefix(r)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid CIDR range '%s' for bot entry '%s' in %s: %w\", r, entry.Name, filename, err)\n\t\t}\n\n\t\tentry.prefixes = append(entry.prefixes, prefix.Masked())\n\t}\n\n\tfor _, p := range entry.RDNS {\n\t\t// an empty pattern matches every PTR-confirmed host: almost\n\t\t// certainly a mistake, reject it\n\t\tif p == \"\" {\n\t\t\treturn fmt.Errorf(\"empty rdns pattern for bot entry '%s' in %s\", entry.Name, filename)\n\t\t}\n\n\t\tre, err := compileBotRegex(p)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid rdns regex '%s' for bot entry '%s' in %s: %w\", p, entry.Name, filename, err)\n\t\t}\n\n\t\tentry.rdnsRegexes = append(entry.rdnsRegexes, re)","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/exprhelpers/botfile.go#L79-L115","documentation":"botFileInit parses each element of the entry's \"ranges\" array with netip.ParsePrefix and stores the masked prefix. This error is thrown when a listed range is not valid CIDR notation. Note that a bare IP like \"1.2.3.4\" is also rejected by ParsePrefix — ranges require the /prefix-length form.","triggerScenarios":"A bots JSONL entry contains \"ranges\":[...] with an element missing the prefix length (\"10.0.0.0\"), an invalid length (\"10.0.0.0/33\"), a hostname, or any other non-CIDR string. netip.ParsePrefix fails and the error wraps its message.","commonSituations":"Copy-pasting single IPs into ranges instead of ips; omitting \"/32\" or \"/128\" when listing individual hosts as ranges; typo in prefix length; using IPv6 notation incorrectly (e.g. \"/129\"); comma-separated multiple networks in one element.","solutions":["Write the value in CIDR form: \"203.0.113.0/24\", \"198.51.100.7/32\", \"2001:db8::/32\".","If you meant a single address, move the value to the \"ips\" array (bare IPs are rejected by ParsePrefix).","Fix the prefix length: IPv4 allows /0–/32, IPv6 /0–/128; remove lengths like /33.","Validate locally before editing: `python3 -c \"import ipaddress; ipaddress.ip_network('VALUE')\"`.","Split comma-separated networks into separate array elements."],"exampleFix":"// before\n{\"name\":\"cloud\",\"ranges\":[\"10.0.0.0\",\"2001:db8::/129\"]}\n// after\n{\"name\":\"cloud\",\"ranges\":[\"10.0.0.0/8\",\"2001:db8::/32\"]}","handlingStrategy":"validation","validationCode":"for _, r := range entry.Ranges {\n\tif _, err := netip.ParsePrefix(strings.TrimSpace(r)); err != nil {\n\t\t// reject before FileInit\n\t}\n}\nvalid := err == nil","typeGuard":null,"tryCatchPattern":"if err := exprhelpers.FileInit(botFile, \"bots\"); err != nil {\n\tif strings.Contains(err.Error(), \"invalid CIDR range\") {\n\t\tlog.Errorf(\"bad ranges element: %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Always write ranges as address/length CIDR, including /32 and /128 for single hosts.","Validate prefixes with netip.ParsePrefix (or ipaddress.ip_network) in CI.","Put bare single IPs in the ips array instead of ranges.","Split comma-joined networks into separate JSON array elements."],"tags":["go","cidr","network","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}