{"record":{"id":"f582616340d4ee9e","repo":"grpc/grpc-java","slug":"failed-to-create-cidrrange","errorCode":null,"errorMessage":"Failed to create CidrRange","messagePattern":"Failed to create CidrRange","errorType":"exception","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":466,"sourceCode":"\n  private static FilterChainMatch parseFilterChainMatch(\n      io.envoyproxy.envoy.config.listener.v3.FilterChainMatch proto)\n      throws ResourceInvalidException {\n    ImmutableList.Builder<CidrRange> prefixRanges = ImmutableList.builder();\n    ImmutableList.Builder<CidrRange> sourcePrefixRanges = ImmutableList.builder();\n    try {\n      for (io.envoyproxy.envoy.config.core.v3.CidrRange range : proto.getPrefixRangesList()) {\n        prefixRanges.add(\n            CidrRange.create(InetAddresses.forString(range.getAddressPrefix()),\n                range.getPrefixLen().getValue()));\n      }\n      for (io.envoyproxy.envoy.config.core.v3.CidrRange range\n          : proto.getSourcePrefixRangesList()) {\n        sourcePrefixRanges.add(CidrRange.create(\n            InetAddresses.forString(range.getAddressPrefix()), range.getPrefixLen().getValue()));\n      }\n    } catch (IllegalArgumentException ex) {\n      throw new ResourceInvalidException(\"Failed to create CidrRange\", ex);\n    }\n\n    ConnectionSourceType sourceType;\n    switch (proto.getSourceType()) {\n      case ANY:\n        sourceType = ConnectionSourceType.ANY;\n        break;\n      case EXTERNAL:\n        sourceType = ConnectionSourceType.EXTERNAL;\n        break;\n      case SAME_IP_OR_LOOPBACK:\n        sourceType = ConnectionSourceType.SAME_IP_OR_LOOPBACK;\n        break;\n      default:\n        throw new ResourceInvalidException(\"Unknown source-type: \" + proto.getSourceType());\n    }\n    return FilterChainMatch.create(\n        proto.getDestinationPort().getValue(),","sourceCodeStart":448,"sourceCodeEnd":484,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L448-L484","documentation":"A CidrRange in the FilterChainMatch (destination or source prefix ranges) could not be constructed because the address prefix string is not a valid IP address or the prefix length is invalid. XdsListenerResource wraps the IllegalArgumentException in a ResourceInvalidException and rejects the Listener.","triggerScenarios":"FilterChainMatch proto with destination_prefix_ranges or source_prefix_ranges whose address_prefix is malformed (not an IPv4/IPv6 literal, e.g. a hostname, empty string, or '10.0.0.256') or whose prefix_len is negative or exceeds the address bit width, raised in parseFilterChainMatch.","commonSituations":"Typos in CIDR blocks in bootstrap YAML, hostnames used instead of IP literals, IPv6 prefix lengths misapplied to IPv4 addresses, or templating bugs that emit placeholder values like '{{CIDR}}' into address_prefix.","solutions":["Fix address_prefix to be a valid IP literal (e.g. '10.0.0.0' or 'fd00::/8' base address without the '/len' suffix; length goes in prefix_len).","Verify prefix_len is within 0..32 for IPv4 and 0..128 for IPv6.","Replace any hostname or templating placeholder with a resolved IP address."],"exampleFix":"// before\nprefix_ranges: [{ address_prefix: \"my-host.example.com\", prefix_len: 24 }]\n// after\nprefix_ranges: [{ address_prefix: \"10.0.0.0\", prefix_len: 24 }]","handlingStrategy":"validation","validationCode":"// validate CIDR fields before building the resource\nfor (CidrRangeProto r : match.getPrefixRangesList()) {\n  InetAddress a = InetAddresses.forString(r.getAddressPrefix()); // throws if invalid\n  int max = (a instanceof Inet4Address) ? 32 : 128;\n  if (r.getPrefixLen().getValue() < 0 || r.getPrefixLen().getValue() > max)\n    throw new IllegalArgumentException(\"bad prefix_len for \" + r.getAddressPrefix());\n}","typeGuard":null,"tryCatchPattern":"try { applyResource(listener) } catch (ResourceInvalidException e) { if (e.getMessage().equals(\"Failed to create CidrRange\")) logBadCidr(matchProto); }","preventionTips":["Use IP literals, never hostnames, in address_prefix","Keep prefix_len within 0..32 (IPv4) / 0..128 (IPv6)","Render templates with strict checks so placeholders never reach address_prefix"],"tags":["grpc","xds","network","cidr"],"backgroundTag":"invalid-argument-format","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}