{"record":{"id":"b55e1ee5e3274194","repo":"slackhq/nebula","slug":"config-s-has-invalid-cidr-s-w","errorCode":null,"errorMessage":"config `%s` has invalid CIDR: %s. %w","messagePattern":"config `(.+?)` has invalid CIDR: (.+?)\\. %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"allow_list.go","lineNumber":121,"sourceCode":"\tfor rawCIDR, rawValue := range rawMap {\n\t\tif handleKey != nil {\n\t\t\thandled, err := handleKey(rawCIDR, rawValue)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif handled {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\n\t\tvalue, ok := config.AsBool(rawValue)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` has invalid value (type %T): %v\", k, rawValue, rawValue)\n\t\t}\n\n\t\tipNet, err := netip.ParsePrefix(rawCIDR)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"config `%s` has invalid CIDR: %s. %w\", k, rawCIDR, err)\n\t\t}\n\n\t\tipNet = netip.PrefixFrom(ipNet.Addr().Unmap(), ipNet.Bits())\n\n\t\ttree.Insert(ipNet, value)\n\n\t\tmaskBits := ipNet.Bits()\n\n\t\tvar rules *allowListRules\n\t\tif ipNet.Addr().Is4() {\n\t\t\trules = &rules4\n\t\t} else {\n\t\t\trules = &rules6\n\t\t}\n\n\t\tif rules.firstValue {\n\t\t\trules.allValues = value\n\t\t\trules.firstValue = false","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/allow_list.go#L103-L139","documentation":"newAllowList validates that each key in an allow-list config block is a valid CIDR prefix using netip.ParsePrefix. If the key is not parseable as an IP prefix (missing mask, bad IP, hostnames), construction fails with this error, wrapping the underlying parse error.","triggerScenarios":"Calling newAllowListFromConfig or NewRemoteAllowListFromConfig with a key like \"10.0.0.0/33\", \"192.168.1.1\" (no prefix length), or a hostname instead of a CIDR.","commonSituations":"Typos in CIDR notation, forgotten /mask suffix, IPv6 written with wrong syntax, or using interface names/hostnames where only CIDRs are accepted.","solutions":["Correct the CIDR key to valid prefix notation, e.g. 10.0.0.0/8","Ensure a prefix length is present (/24, /32, /64, etc.)","Use the wrapped net.ParsePrefix error in the message to see the exact parse failure"],"exampleFix":"// before\nremote_allow_ranges:\n  192.168.1.1: true\n// after\nremote_allow_ranges:\n  192.168.1.0/24: true","handlingStrategy":"validation","validationCode":"func validCIDRs(keys []string) error {\n\tfor _, k := range keys {\n\t\tif _, err := netip.ParsePrefix(k); err != nil {\n\t\t\treturn fmt.Errorf(\"bad CIDR %q: %w\", k, err)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"allowList, err := NewRemoteAllowListFromConfig(k, v, itf)\nif err != nil {\n\treturn fmt.Errorf(\"invalid allow list config: %w\", err)\n}","preventionTips":["Always include a prefix length in CIDR keys","Validate CIDRs with netip.ParsePrefix in CI before rollout"],"tags":["config","network","cidr","validation"],"backgroundTag":"invalid-cidr","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}