{"record":{"id":"ae3dc503634ae813","repo":"slackhq/nebula","slug":"config-s-has-invalid-cidr-s","errorCode":null,"errorMessage":"config `%s` has invalid CIDR: %s","messagePattern":"config `(.+?)` has invalid CIDR: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"calculated_remote.go","lineNumber":94,"sourceCode":"\treturn &ap\n}\n\nfunc NewCalculatedRemotesFromConfig(c *config.C, k string) (*bart.Table[[]*calculatedRemote], error) {\n\tvalue := c.Get(k)\n\tif value == nil {\n\t\treturn nil, nil\n\t}\n\n\tcalculatedRemotes := new(bart.Table[[]*calculatedRemote])\n\n\trawMap, ok := value.(map[string]any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"config `%s` has invalid type: %T\", k, value)\n\t}\n\tfor rawCIDR, rawValue := range rawMap {\n\t\tcidr, err := netip.ParsePrefix(rawCIDR)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` has invalid CIDR: %s\", k, rawCIDR)\n\t\t}\n\n\t\tentry, err := newCalculatedRemotesListFromConfig(cidr, rawValue)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"config '%s.%s': %w\", k, rawCIDR, err)\n\t\t}\n\n\t\tcalculatedRemotes.Insert(cidr, entry)\n\t}\n\n\treturn calculatedRemotes, nil\n}\n\nfunc newCalculatedRemotesListFromConfig(cidr netip.Prefix, raw any) ([]*calculatedRemote, error) {\n\trawList, ok := raw.([]any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"calculated_remotes entry has invalid type: %T\", raw)\n\t}","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/calculated_remote.go#L76-L112","documentation":"Each key in the calculated_remotes map must be a valid CIDR prefix parseable by netip.ParsePrefix (e.g. 10.0.42.0/24). The library throws this when a key fails to parse, naming the config key and the bad CIDR string.","triggerScenarios":"NewCalculatedRemotesFromConfig iterating the rawMap encounters a key like `10.0.42.0` (missing prefix length), `10.0.42.0/33` (bits out of range), `not-a-cidr`, or a bare host IP with no /mask.","commonSituations":"Omitting the /prefix-length in a YAML key, quoting mistakes that leave stray characters in the key, or using a hostname instead of a CIDR in lighthouse.calculated_remotes.","solutions":["Fix the map key to be a full CIDR including prefix length (e.g. 10.0.42.0/24)","Test the key with Go's netip.ParsePrefix to confirm it parses","Quote the key in YAML if it contains characters that break parsing"],"exampleFix":"// before\nlighthouse:\n  calculated_remotes:\n    10.0.42.0:\n      - mask: 10.0.0.0/8\n        port: 4242\n// after\nlighthouse:\n  calculated_remotes:\n    10.0.42.0/24:\n      - mask: 10.0.0.0/8\n        port: 4242","handlingStrategy":"validation","validationCode":"for key := range rawMap {\n\tif _, err := netip.ParsePrefix(key); err != nil {\n\t\treturn fmt.Errorf(\"key %q is not a valid CIDR: %v\", key, err)\n\t}\n}","typeGuard":"func isParseableCIDR(s string) bool {\n\t_, err := netip.ParsePrefix(s)\n\treturn err == nil\n}","tryCatchPattern":"tbl, err := NewCalculatedRemotesFromConfig(c, k)\nif err != nil {\n\tif strings.Contains(err.Error(), \"has invalid CIDR\") {\n\t\t// extract and report the bad key from the message\n\t\treturn fmt.Errorf(\"fix CIDR key in %s config: %w\", k, err)\n\t}\n\treturn err\n}","preventionTips":["Always include a prefix length in CIDR keys (10.0.42.0/24, not 10.0.42.0)","Pre-validate keys with netip.ParsePrefix before writing the config","Quote YAML keys containing unusual characters"],"tags":["nebula","config","cidr","validation","calculated-remotes"],"backgroundTag":"invalid-cidr-notation","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}