{"record":{"id":"e08a0c069c78e7bb","repo":"cloudflare/cloudflared","slug":"backend-returned-invalid-network-s","errorCode":null,"errorMessage":"backend returned invalid network %s","messagePattern":"backend returned invalid network (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cfapi/ip_route.go","lineNumber":60,"sourceCode":"\tjson, err := json.Marshal(str)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"error serializing CIDR into JSON\")\n\t}\n\treturn json, nil\n}\n\n// UnmarshalJSON parses a JSON string into net.IPNet\nfunc (c *CIDR) UnmarshalJSON(data []byte) error {\n\tvar s string\n\tif err := json.Unmarshal(data, &s); err != nil {\n\t\treturn errors.Wrap(err, \"error parsing cidr string\")\n\t}\n\t_, network, err := net.ParseCIDR(s)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"error parsing invalid network from backend\")\n\t}\n\tif network == nil {\n\t\treturn fmt.Errorf(\"backend returned invalid network %s\", s)\n\t}\n\t*c = CIDR(*network)\n\treturn nil\n}\n\n// NewRoute has all the parameters necessary to add a new route to the table.\ntype NewRoute struct {\n\tNetwork  net.IPNet\n\tTunnelID uuid.UUID\n\tComment  string\n\t// Optional field. If unset, backend will assume the default vnet for the account.\n\tVNetID *uuid.UUID\n}\n\n// MarshalJSON handles fields with non-JSON types (e.g. net.IPNet).\nfunc (r NewRoute) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(&struct {\n\t\tNetwork  string     `json:\"network\"`","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cfapi/ip_route.go#L42-L78","documentation":"This error is thrown by CIDR.UnmarshalJSON when the Cloudflare API backend returns a JSON string that net.ParseCIDR parses successfully but yields a nil network — meaning the backend produced a network value that cannot be represented as a CIDR. It indicates the backend response does not conform to the expected IP route schema. The error is a defensive invariant check after successful parsing.","triggerScenarios":"Unmarshalling a JSON payload (e.g. from the /ip_routes API) into cfapi.CIDR where the string parses via net.ParseCIDR without error yet returns a nil *net.IPNet, which in practice means an empty or malformed value slipped past the parser.","commonSituations":"Cloudflare API schema changes or bugs returning unexpected route fields; stale SDK types used against a newer/older API; mocked or replayed test fixtures with empty network strings.","solutions":["Verify the exact JSON value the backend returned for the network field (log the raw response body before unmarshalling).","Update cloudflared/cfapi types to match the current Cloudflare API schema for IP routes.","If the backend can return an empty value, pre-filter route entries or add a custom UnmarshalJSON path that skips blank strings.","Report the malformed backend response to Cloudflare support with the request ID if the API genuinely returned a bad network."],"exampleFix":"// before\ntype Route struct {\n\tNetwork cfapi.CIDR `json:\"network\"`\n}\n// after\ntype Route struct {\n\tNetwork cfapi.CIDR `json:\"network\"`\n}\n// guard before decode:\nvar raw struct{ Network string `json:\"network\"` }\n_ = json.Unmarshal(body, &raw)\nif _, _, err := net.ParseCIDR(raw.Network); err != nil || raw.Network == \"\" { /* skip or handle */ }","handlingStrategy":"validation","validationCode":"func validCIDR(s string) bool {\n\tif s == \"\" { return false }\n\t_, n, err := net.ParseCIDR(s)\n\treturn err == nil && n != nil\n}\nif !validCIDR(raw.Network) { /* skip entry or handle before json.Unmarshal into cfapi.CIDR */ }","typeGuard":"func isParsedCIDR(n *net.IPNet) bool { return n != nil }","tryCatchPattern":null,"preventionTips":["Log raw API responses when unmarshalling backend types","Pin and test cfapi types against current API fixtures","Skip entries with empty network strings before decoding"],"tags":["go","cidr","api-response","unmarshal"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}