{"record":{"id":"e84ae92e5c12aef0","repo":"cloudflare/cloudflared","slug":"unable-to-parse-cidr-s","errorCode":null,"errorMessage":"unable to parse cidr: %s","messagePattern":"unable to parse cidr: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ipaccess/access.go","lineNumber":42,"sourceCode":"\t\t}\n\t}\n\n\tpolicy := Policy{\n\t\tdefaultAllow: defaultAllow,\n\t\trules:        rules,\n\t}\n\n\treturn &policy, nil\n}\n\nfunc NewRuleByCIDR(prefix *string, ports []int, allow bool) (Rule, error) {\n\tif prefix == nil || len(*prefix) == 0 {\n\t\treturn Rule{}, fmt.Errorf(\"no prefix provided\")\n\t}\n\n\t_, ipnet, err := net.ParseCIDR(*prefix)\n\tif err != nil {\n\t\treturn Rule{}, fmt.Errorf(\"unable to parse cidr: %s\", *prefix)\n\t}\n\n\treturn NewRule(ipnet, ports, allow)\n}\n\nfunc NewRule(ipnet *net.IPNet, ports []int, allow bool) (Rule, error) {\n\trule := Rule{\n\t\tipNet: ipnet,\n\t\tports: ports,\n\t\tallow: allow,\n\t}\n\treturn rule, rule.Validate()\n}\n\nfunc (r *Rule) Validate() error {\n\tif r.ipNet == nil {\n\t\treturn fmt.Errorf(\"no ipnet set on the rule\")\n\t}","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ipaccess/access.go#L24-L60","documentation":"After confirming the prefix is non-empty, NewRuleByCIDR parses it with net.ParseCIDR. Any string that is not a valid CIDR notation (bad IP, invalid mask, extra characters) produces this error, echoing the unparseable prefix back to the caller.","triggerScenarios":"Calling NewRuleByCIDR with strings like `10.0.0.0/33`, `999.1.1.0/24`, `10.0.0.0` (no mask), or `10.0.0.0/8 extra` — directly or via config-driven paths (originRequestFromConfig, setIPRules, validateIngress).","commonSituations":"Typos in config.yaml CIDRs, using host addresses without the /mask, IPv6/IPv4 confusion, or trailing whitespace/comments in the prefix value.","solutions":["Correct the CIDR string to valid notation, e.g. `192.168.0.0/16`","Validate with net.ParseCIDR (or an online tool) before writing it to config","Ensure host addresses include a mask (use /32 or /128 for a single host)","Trim whitespace from the prefix value"],"exampleFix":"// before\n- prefix: 10.0.0.0/33\n// after\n- prefix: 10.0.0.0/8","handlingStrategy":"validation","validationCode":"func validCIDR(s string) bool {\n\t_, _, err := net.ParseCIDR(strings.TrimSpace(s))\n\treturn err == nil\n}","typeGuard":null,"tryCatchPattern":"rule, err := ipaccess.NewRuleByCIDR(&prefix, ports, allow)\nif err != nil {\n\tif strings.Contains(err.Error(), \"unable to parse cidr\") {\n\t\treturn fmt.Errorf(\"fix CIDR notation for %q (expected a.b.c.d/mask)\", prefix)\n\t}\n\treturn err\n}","preventionTips":["Use /32 (or /128 for IPv6) for single hosts instead of bare IPs","Trim whitespace from CIDR inputs","Validate CIDRs with net.ParseCIDR in config tooling"],"tags":["ip-access","cidr","validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}