{"record":{"id":"ca2eae6ccbd32d42","repo":"cockroachdb/cockroach","slug":"invalid-trusted-proxy-cidrs","errorCode":null,"errorMessage":"invalid trusted proxy CIDRs","messagePattern":"invalid trusted proxy CIDRs","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/cmd/roachprod-centralized/app/api.go","lineNumber":77,"sourceCode":"func (a *Api) Init(l *logger.Logger) {\n\n\t// Init gin engine and set up server-wide middlewares\n\tgin.DefaultWriter = l\n\tif l.LogLevel >= slog.LevelInfo {\n\t\tgin.SetMode(gin.ReleaseMode)\n\t} else {\n\t\tgin.SetMode(gin.DebugMode)\n\t}\n\n\t// Full API mode: create gin engine with all middlewares\n\tginEngine := gin.New()\n\n\t// Configure trusted proxies for correct ClientIP() resolution.\n\t// Without this, Gin trusts all proxies by default, allowing X-Forwarded-For\n\t// spoofing which bypasses service account IP origin checks.\n\tif err := ginEngine.SetTrustedProxies(a.trustedProxies); err != nil {\n\t\tl.Error(\"invalid trusted proxy configuration\", slog.Any(\"error\", err))\n\t\tpanic(errors.Wrap(err, \"invalid trusted proxy CIDRs\"))\n\t}\n\tif len(a.trustedProxies) == 0 {\n\t\tl.Warn(\"no trusted proxies configured; ClientIP() will use RemoteAddr directly\")\n\t} else {\n\t\tl.Info(\"trusted proxies configured\", slog.Any(\"cidrs\", a.trustedProxies))\n\t}\n\tginEngine.Use(gin.Recovery())\n\tginEngine.Use(a.securityHeaders())\n\tginEngine.Use(a.requestSizeLimit())\n\tginEngine.Use(a.requestID())\n\tginEngine.Use(a.traceContext())\n\tginEngine.Use(a.slogFormatter(l))\n\n\t// Add Prometheus metrics endpoint\n\tif a.metrics {\n\t\tm := ginmetrics.GetMonitor()\n\t\tm.SetMetricPrefix(fmt.Sprintf(\"%s_\", configtypes.MetricsNamespace))\n\t\tm.SetMetricPath(\"/metrics\")","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/cockroachdb/cockroach/blob/8812064a015d2faf99d3fc7e15880f94042954b0/pkg/cmd/roachprod-centralized/app/api.go#L59-L95","documentation":"The roachprod-centralized API server configures gin at startup and calls SetTrustedProxies with the configured CIDR list; invalid CIDRs make gin return an error, which is wrapped with 'invalid trusted proxy CIDRs' and panicked. Failing fast is intentional: silently ignoring the config would let X-Forwarded-For spoofing bypass service-account IP origin checks.","triggerScenarios":"Passing malformed proxy entries in the config/flag: 'not-a-cidr', '10.0.0.1/8/9', a bare hostname where a CIDR is required, stray spaces, or an empty element produced by a trailing comma.","commonSituations":"First deployment behind a load balancer: operators copy the LB hostname instead of its CIDR, paste a comma list without quoting so the shell mangles it, or leave an empty final element after editing.","solutions":["Validate every entry with net.ParseCIDR before starting the server","Pass a properly quoted comma list of CIDRs: --trusted-proxies='10.0.0.0/8,127.0.0.1/32'","Use 0.0.0.0/0 only if every hop is trusted; omit the flag to trust none (ClientIP falls back to RemoteAddr, which the server logs a warning about)"],"exampleFix":"# before\n--trusted-proxies=10.0.0.1,my-lb.example.com\n\n# after\n--trusted-proxies='10.0.0.0/8,127.0.0.1/32'","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate CIDRs with net.ParseCIDR in deploy scripts before starting the server","Quote comma-separated CIDR lists on the command line","Treat startup panic here as correct behavior: never work around it by disabling trusted-proxy checking in trusted deployments"],"tags":["roachprod","api","gin","proxy","security","go"],"backgroundTag":null,"analyzedSha":"8812064a015d2faf99d3fc7e15880f94042954b0","analyzedAt":"2026-08-15T16:34:17.351Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}