{"record":{"id":"ee44c13f91d47d84","repo":"crowdsecurity/crowdsec","slug":"while-parsing-capi-whitelist-file-s-w","errorCode":null,"errorMessage":"while parsing capi whitelist file '%s': %w","messagePattern":"while parsing capi whitelist file '(.+?)': %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/api.go","lineNumber":506,"sourceCode":"}\n\nfunc (c *LocalApiServerCfg) LoadCapiWhitelists() error {\n\tif c.CapiWhitelistsPath == \"\" {\n\t\treturn nil\n\t}\n\n\tlog.Warn(\"capi_whitelists_path is deprecated, please use centralized allowlists instead. See https://docs.crowdsec.net/docs/next/local_api/centralized_allowlists.\")\n\n\tfd, err := os.Open(c.CapiWhitelistsPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while opening capi whitelist file: %w\", err)\n\t}\n\n\tdefer fd.Close()\n\n\tc.CapiWhitelists, err = parseCapiWhitelists(fd)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while parsing capi whitelist file '%s': %w\", c.CapiWhitelistsPath, err)\n\t}\n\n\treturn nil\n}\n\nfunc (c *Config) LoadAPIClient() error {\n\tif c.API == nil || c.API.Client == nil || c.API.Client.CredentialsFilePath == \"\" || c.DisableAgent {\n\t\treturn errors.New(\"no API client section in configuration\")\n\t}\n\n\treturn c.API.Client.Load()\n}\n\nfunc (c *LocalApiServerCfg) LoadAutoRegister() error {\n\tif c.AutoRegister == nil {\n\t\tc.AutoRegister = &LocalAPIAutoRegisterCfg{\n\t\t\tEnable: new(false),\n\t\t}","sourceCodeStart":488,"sourceCodeEnd":524,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/api.go#L488-L524","documentation":"After successfully opening the capi whitelist file, LoadCapiWhitelists parses it as YAML via parseCapiWhitelists, which also validates each entry as an IP (netip.ParseAddr) or CIDR (netip.ParsePrefix). Any parse/validation failure — including an empty file — is wrapped with this prefix.","triggerScenarios":"capi_whitelists_path file exists but contains invalid YAML, an empty file, a malformed IP in the `ips` list, or a malformed CIDR in the `cidrs` list.","commonSituations":"Empty placeholder file created with `touch`; hand-written entry like `192.168.1.0/24 ` with stray characters or `10.0.0.1/33` invalid prefix; YAML tabs instead of spaces.","solutions":["Read the inner error: it names the invalid value or 'empty file'","Populate the file with valid `ips:` / `cidrs:` YAML lists, or delete it and unset capi_whitelists_path","Validate each entry (`ipcalc`, `python3 -c \"import ipaddress;ipaddress.ip_network('10.0.0.0/8')\"`)","Migrate to centralized allowlists, which have tooling to catch bad entries"],"exampleFix":"// before (capi_whitelists.yaml)\ncidrs:\n  - 192.168.0.0/16\n  - 10.0.0.0/33\n// after\ncidrs:\n  - 192.168.0.0/16\n  - 10.0.0.0/8","handlingStrategy":"validation","validationCode":"for _, c := range cidrs {\n\tif _, err := netip.ParsePrefix(c); err != nil { return fmt.Errorf(\"bad cidr %q: %w\", c, err) }\n}\nfor _, ip := range ips {\n\tif _, err := netip.ParseAddr(ip); err != nil { return fmt.Errorf(\"bad ip %q: %w\", ip, err) }\n}","typeGuard":null,"tryCatchPattern":"if err := serverCfg.LoadCapiWhitelists(); err != nil {\n\tif strings.Contains(err.Error(), \"while parsing capi whitelist\") {\n\t\tlog.Fatalf(\"fix %s: %v\", serverCfg.CapiWhitelistsPath, err)\n\t}\n\treturn err\n}","preventionTips":["Never ship an empty whitelist file — delete it instead","Validate entries with netip.ParseAddr/ParsePrefix or an online CIDR checker","Use spaces, never tabs, in YAML lists"],"tags":["yaml","whitelist","cidr","config","parsing"],"backgroundTag":"yaml-parse-error","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}