{"record":{"id":"e36f9180d09ed921","repo":"crowdsecurity/crowdsec","slug":"declared-range-s-of-s-can-t-be-parsed","errorCode":null,"errorMessage":"declared range %s of %s can't be parsed","messagePattern":"declared range (.+?) of (.+?) can't be parsed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/overflows.go","lineNumber":158,"sourceCode":"\t\t\t\tlog.Warningf(\"bad latitude %s : %s\", v, err)\n\t\t\t}\n\n\t\t\tsrc.Latitude = float32(l)\n\t\t}\n\n\t\tif v, ok := evt.Enriched[\"Longitude\"]; ok {\n\t\t\tl, err := strconv.ParseFloat(v, 32)\n\t\t\tif err != nil {\n\t\t\t\tlog.Warningf(\"bad longitude %s : %s\", v, err)\n\t\t\t}\n\n\t\t\tsrc.Longitude = float32(l)\n\t\t}\n\n\t\tif v, ok := evt.Meta[\"SourceRange\"]; ok && v != \"\" {\n\t\t\t_, ipNet, err := net.ParseCIDR(v)\n\t\t\tif err != nil {\n\t\t\t\treturn srcs, fmt.Errorf(\"declared range %s of %s can't be parsed\", v, src.IP)\n\t\t\t}\n\n\t\t\tif ipNet != nil {\n\t\t\t\tsrc.Range = ipNet.String()\n\t\t\t\tleaky.logger.Tracef(\"Valid range from %s : %s\", src.IP, src.Range)\n\t\t\t}\n\t\t}\n\n\t\tif leaky.Factory.Spec.ScopeType.Scope == types.Ip {\n\t\t\tsrc.Value = &src.IP\n\t\t} else if leaky.Factory.Spec.ScopeType.Scope == types.Range {\n\t\t\tsrc.Value = &src.Range\n\n\t\t\tif leaky.Factory.Spec.ScopeType.RunTimeFilter != nil {\n\t\t\t\tretValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{\"evt\": &evt}, leaky.logger, leaky.Factory.Spec.Debug)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn srcs, fmt.Errorf(\"while running scope filter: %w\", err)\n\t\t\t\t}","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/overflows.go#L140-L176","documentation":"eventSources optionally reads evt.Meta[\"SourceRange\"] and parses it as a CIDR with net.ParseCIDR. If the value is present and non-empty but not a valid CIDR, this error is returned naming the range and the associated source IP. It means the parsed SourceRange metadata doesn't follow 'a.b.c.d/nn' notation.","triggerScenarios":"An event carrying Meta[\"SourceRange\"] with a value like '192.168.1.0/33', '10.0.0.5' (missing prefix), or 'fe80::/invalid' reaches a bucket whose source is being built; net.ParseCIDR fails.","commonSituations":"Custom parser sets SourceRange from a log field that holds a plain IP or a netmask (255.255.255.0) rather than CIDR; hand-edited enrichment; upstream log changed format after a product update.","solutions":["Fix the parser/enrichment to emit CIDR notation (e.g. append '/24' or use geoip enrichment that produces a proper CIDR).","Validate SourceRange with net.ParseCIDR in the parser before setting Meta.","Leave Meta[\"SourceRange\"] unset if the log provides no range — empty/missing is tolerated.","Check the wrapped log source for format changes after an upgrade."],"exampleFix":"// before\nMeta: SourceRange: evt.Parsed.netmask  # '255.255.255.0'\n// after\nMeta: SourceRange: evt.Parsed.source_ip + \"/24\"","handlingStrategy":"validation","validationCode":"if r, ok := evt.Meta[\"SourceRange\"]; ok && r != \"\" {\n\tif _, _, err := net.ParseCIDR(r); err != nil {\n\t\t// fix parser: SourceRange must be CIDR like 10.0.0.0/24\n\t}\n}","typeGuard":null,"tryCatchPattern":"srcs, err := leaky.SourceFromEvent(evt, leaky)\nif err != nil && strings.Contains(err.Error(), \"can't be parsed\") {\n\tleaky.logger.Warnf(\"bad SourceRange metadata: %v\", err)\n\treturn nil\n}","preventionTips":["Emit SourceRange strictly in CIDR notation from parsers.","Leave SourceRange unset rather than setting a non-CIDR value.","Re-validate parser output against log format after upstream changes."],"tags":["crowdsec","leakybucket","cidr","parser"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}