coredns/coredns · error

%s: %w

Error message

%s: %w

What it means

CoreDNS's proxyproto plugin failed to parse one of the CIDR arguments after the 'allow' directive in the Corefile. net.ParseCIDR rejected the value, and the plugin wraps it with the offending value via plugin.Error. The Corefile cannot be loaded until the CIDR is corrected.

Source

Thrown at plugin/proxyproto/setup.go:43

	var (
		allowedIPNets              []*net.IPNet
		policy                     = proxyproto.IGNORE
		defaultSet                 bool
		sessionTrackingTTL         time.Duration
		sessionTrackingMaxSessions int
	)
	for c.Next() {
		args := c.RemainingArgs()
		if len(args) != 0 {
			return plugin.Error("proxyproto", c.ArgErr())
		}
		for c.NextBlock() {
			switch c.Val() {
			case "allow":
				for _, v := range c.RemainingArgs() {
					_, ipnet, err := net.ParseCIDR(v)
					if err != nil {
						return plugin.Error("proxyproto", fmt.Errorf("%s: %w", v, err))
					}
					allowedIPNets = append(allowedIPNets, ipnet)
				}
			case "default":
				defaultSet = true
				v := c.RemainingArgs()
				if len(v) != 1 {
					return plugin.Error("proxyproto", c.ArgErr())
				}
				switch strings.ToLower(v[0]) {
				case "use":
					policy = proxyproto.USE
				case "ignore":
					policy = proxyproto.IGNORE
				case "reject":
					policy = proxyproto.REJECT
				case "skip":
					policy = proxyproto.SKIP

View on GitHub (pinned to 558c9757a9)

Solutions

1. Convert bare IPs to CIDR form: 10.0.0.1 becomes 10.0.0.1/32 (IPv4) or fd00::1/128 (IPv6).
2. Fix the prefix length if it is out of range for the address family (0-32 for IPv4, 0-128 for IPv6).
3. Validate the value locally with `net.ParseCIDR` or `cidr` tooling before adding it to the Corefile.

Example fix

// before
proxyproto {
    allow 10.0.0.1
}
// after
proxyproto {
    allow 10.0.0.1/32
}

_, ipnet, err := net.ParseCIDR(v)
if err != nil {
    return fmt.Errorf("proxyproto allow: %q is not a valid CIDR: %w", v, err)
}
_ = ipnet

func isCIDR(s string) bool { _, _, err := net.ParseCIDR(s); return err == nil }

When it happens

Trigger: A Corefile contains a 'proxyproto { allow <value> }' block where <value> is not a valid CIDR (e.g. '10.0.0.1' without a prefix length, '10.0.0.0/33', or a typo).

Common situations: Users listing individual IPs without the /32 or /128 prefix, copy-pasting addresses from other tools that don't use CIDR notation, or mistyping a prefix length.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• serve_stale_policy requires serve_stale
• udp_session_tracking: invalid duration %q: %w
• udp_session_tracking: invalid max sessions %q: must be a pos
• reload duration value is expected
• at least one address or interface name is expected

AI-assisted analysis of coredns/coredns@558c9757a9 (2026-09-06). Data as JSON: /api/errors/882d6eda60758f0c. Report an issue: GitHub.