crowdsecurity/crowdsec · error

declared range %s of %s can't be parsed

Error message

declared range %s of %s can't be parsed

What it means

eventSources optionally reads evt.Meta["SourceRange"] and parses it as a CIDR with net.ParseCIDR. If the value is present and non-empty but not a valid CIDR, this error is returned naming the range and the associated source IP. It means the parsed SourceRange metadata doesn't follow 'a.b.c.d/nn' notation.

Source

Thrown at pkg/leakybucket/overflows.go:158

				log.Warningf("bad latitude %s : %s", v, err)
			}

			src.Latitude = float32(l)
		}

		if v, ok := evt.Enriched["Longitude"]; ok {
			l, err := strconv.ParseFloat(v, 32)
			if err != nil {
				log.Warningf("bad longitude %s : %s", v, err)
			}

			src.Longitude = float32(l)
		}

		if v, ok := evt.Meta["SourceRange"]; ok && v != "" {
			_, ipNet, err := net.ParseCIDR(v)
			if err != nil {
				return srcs, fmt.Errorf("declared range %s of %s can't be parsed", v, src.IP)
			}

			if ipNet != nil {
				src.Range = ipNet.String()
				leaky.logger.Tracef("Valid range from %s : %s", src.IP, src.Range)
			}
		}

		if leaky.Factory.Spec.ScopeType.Scope == types.Ip {
			src.Value = &src.IP
		} else if leaky.Factory.Spec.ScopeType.Scope == types.Range {
			src.Value = &src.Range

			if leaky.Factory.Spec.ScopeType.RunTimeFilter != nil {
				retValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{"evt": &evt}, leaky.logger, leaky.Factory.Spec.Debug)
				if err != nil {
					return srcs, fmt.Errorf("while running scope filter: %w", err)
				}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the parser/enrichment to emit CIDR notation (e.g. append '/24' or use geoip enrichment that produces a proper CIDR).
2. Validate SourceRange with net.ParseCIDR in the parser before setting Meta.
3. Leave Meta["SourceRange"] unset if the log provides no range — empty/missing is tolerated.
4. Check the wrapped log source for format changes after an upgrade.

Example fix

// before
Meta: SourceRange: evt.Parsed.netmask  # '255.255.255.0'
// after
Meta: SourceRange: evt.Parsed.source_ip + "/24"

if r, ok := evt.Meta["SourceRange"]; ok && r != "" {
	if _, _, err := net.ParseCIDR(r); err != nil {
		// fix parser: SourceRange must be CIDR like 10.0.0.0/24
	}
}

srcs, err := leaky.SourceFromEvent(evt, leaky)
if err != nil && strings.Contains(err.Error(), "can't be parsed") {
	leaky.logger.Warnf("bad SourceRange metadata: %v", err)
	return nil
}

When it happens

Trigger: An event carrying Meta["SourceRange"] with a value like '192.168.1.0/33', '10.0.0.5' (missing prefix), or 'fe80::/invalid' reaches a bucket whose source is being built; net.ParseCIDR fails.

Common situations: Custom parser sets SourceRange from a log field that holds a plain IP or a netmask (255.255.255.0) rather than CIDR; hand-edited enrichment; upstream log changed format after a product update.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• no parser found. Please install the appropriate parser and r
• leakspeed is required
• duration is required
• a condition is required
• invalid threshold: must be > 0 and <= 1

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e36f9180d09ed921. Report an issue: GitHub.