crowdsecurity/crowdsec · error

empty file

Error message

empty file

What it means

parseCapiWhitelists reads a CAPI whitelist YAML file and rejects files that contain no YAML documents. The YAML decoder returns io.EOF for an empty stream, which the loader translates into a clear 'empty file' error instead of silently producing an empty whitelist.

Source

Thrown at pkg/csconfig/api.go:458

		}
	}

	return nil
}

// we cannot unmarshal to type net.IPNet, so we need to do it manually
type capiWhitelists struct {
	Ips   []string `yaml:"ips"`
	Cidrs []string `yaml:"cidrs"`
}

func parseCapiWhitelists(fd io.Reader) (*CapiWhitelist, error) {
	fromCfg := capiWhitelists{}

	decoder := yaml.NewDecoder(fd)
	if err := decoder.Decode(&fromCfg); err != nil {
		if errors.Is(err, io.EOF) {
			return nil, errors.New("empty file")
		}

		return nil, err
	}

	ret := &CapiWhitelist{
		Ips:   make([]netip.Addr, len(fromCfg.Ips)),
		Cidrs: make([]netip.Prefix, len(fromCfg.Cidrs)),
	}

	for idx, v := range fromCfg.Ips {
		ip, err := netip.ParseAddr(v)
		if err != nil {
			return nil, err
		}

		ret.Ips[idx] = ip
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add valid whitelist content (e.g. 'capecs: []' / 'cves: []' or the expected keys) to the file
2. Delete the whitelist file or remove its config reference if it is not needed
3. Restore the file from backup if it was truncated

Example fix

// before
# /etc/crowdsec/capi-whitelists.yaml (0 bytes)
// after
# /etc/crowdsec/capi-whitelists.yaml
capecs: []
cves: []

info, err := os.Stat(path)
if err != nil || info.Size() == 0 {
    // skip loading or create a valid skeleton whitelist file
}

wl, err := LoadCapiWhitelists(path)
if err != nil {
    if strings.Contains(err.Error(), "empty file") {
        wl = &CapiWhitelist{} // treat as no whitelists
    } else {
        return err
    }
}

When it happens

Trigger: Loading a capi whitelist file (via LoadCapiWhitelists) whose content is zero bytes or only comments/whitespace; decoder.Decode returns io.EOF.

Common situations: An empty whitelist file created by touch or truncated by a failed write; a config management tool templating an empty whitelist; mounting an empty file into a container config dir.

Related errors

• while parsing capi whitelist file '%s': %w
• failed to parse feature flags: %w
• empty cti key
• cannot use TLS with a unix socket
• user/password authentication and TLS authentication are mutu

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f54145252949bb4c. Report an issue: GitHub.