crowdsecurity/crowdsec · error

auto_register: failed to parse allowed range '%s': %w

Error message

auto_register: failed to parse allowed range '%s': %w

What it means

LoadAutoRegister validates api.server.auto_register.allowed_ranges by parsing each entry with net.ParseCIDR. Any entry that is not a valid CIDR notation produces this wrapped error. This only runs when auto_register.enable is true.

Source

Thrown at pkg/csconfig/api.go:555

	if c.AutoRegister.Token == "" {
		return errors.New("missing token value for api.server.auto_register")
	}

	if len(c.AutoRegister.Token) < 32 {
		return errors.New("token value for api.server.auto_register is too short (min 32 characters)")
	}

	if c.AutoRegister.AllowedRanges == nil {
		return errors.New("missing allowed_ranges value for api.server.auto_register")
	}

	c.AutoRegister.AllowedRangesParsed = make([]*net.IPNet, 0, len(c.AutoRegister.AllowedRanges))

	for _, ipRange := range c.AutoRegister.AllowedRanges {
		_, ipNet, err := net.ParseCIDR(ipRange)
		if err != nil {
			return fmt.Errorf("auto_register: failed to parse allowed range '%s': %w", ipRange, err)
		}

		c.AutoRegister.AllowedRangesParsed = append(c.AutoRegister.AllowedRangesParsed, ipNet)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the range named in the error to strict CIDR notation (bare IP needs /32 or /128)
2. Remove invalid entries from allowed_ranges
3. Validate entries beforehand (e.g. `python3 -c "import ipaddress;ipaddress.ip_network('10.0.0.0/8')"`)
4. If you don't need auto-registration, disable it with auto_register.enable: false

Example fix

// before (config.yaml)
api:
  server:
    auto_register:
      enable: true
      allowed_ranges:
        - 10.0.0.5
// after
api:
  server:
    auto_register:
      enable: true
      allowed_ranges:
        - 10.0.0.5/32

for _, r := range allowedRanges {
	if _, _, err := net.ParseCIDR(r); err != nil {
		return fmt.Errorf("auto_register range %q is not valid CIDR: %w", r, err)
	}
}

if err := serverCfg.LoadAutoRegister(); err != nil {
	if strings.Contains(err.Error(), "failed to parse allowed range") {
		log.Fatalf("fix allowed_ranges in config.yaml: %v", err)
	}
	return err
}

When it happens

Trigger: crowdsec startup with auto_register enabled and an allowed_ranges entry like `192.168.1.0/24 extra`, `10.0.0.1` (no prefix), or `10.0.0.0/33`.

Common situations: User listed bare IPs instead of CIDRs (e.g. `10.0.0.5` instead of `10.0.0.5/32`); copy-pasted ranges with spaces or comments inline; typo'd prefix length out of range.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided
• headers is selected, but headers is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/3f4b20a54aab6677. Report an issue: GitHub.