crowdsecurity/crowdsec · error

fail to apply StartIpEndIpFilter: %w

Error message

fail to apply StartIpEndIpFilter: %w

What it means

After parsing the range, CountDecisionsByValue applies decisionIPFilter, which converts the range into StartIp/EndIp ent predicates. If that conversion fails (e.g. mixed/inconsistent address families or internal filter construction error), the error is wrapped with this message, meaning the IP range could not be translated into a DB filter.

Source

Thrown at pkg/database/decisions.go:393

	}

	count, err := c.ExpireDecisions(ctx, toUpdate)

	return count, toUpdate, err
}

func (c *Client) CountDecisionsByValue(ctx context.Context, value string, since *time.Time, onlyActive bool) (int, error) {
	rng, err := csnet.NewRange(value)
	if err != nil {
		return 0, fmt.Errorf("unable to convert '%s' to int: %w", value, err)
	}

	contains := true
	decisions := c.Ent.Decision.Query()

	decisions, err = decisionIPFilter(decisions, contains, rng)
	if err != nil {
		return 0, fmt.Errorf("fail to apply StartIpEndIpFilter: %w", err)
	}

	if since != nil {
		decisions = decisions.Where(decision.CreatedAtGT(*since))
	}

	if onlyActive {
		decisions = decisions.Where(decision.UntilGT(time.Now().UTC()))
	}

	count, err := decisions.Count(ctx)
	if err != nil {
		return 0, fmt.Errorf("fail to count decisions: %w", err)
	}

	return count, nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Check the wrapped inner error to identify the predicate-construction failure
2. Ensure the crowdsec version's database schema matches (run migrations after upgrades)
3. Pass a plain single-IP or single-family CIDR; avoid exotic mixed-family inputs
4. If reproducible on standard input, report it — this path is expected to succeed for valid ranges

Example fix

// before
rng, _ := csnet.ParseRange("::ffff:1.2.3.4/120") // mixed-family edge
// after
rng, err := csnet.ParseRange("1.2.3.0/24")
if err != nil { return err }

rng, err := csnet.NewRange(value)
if err != nil { return err } // catches bad input before decisionIPFilter
if rng.Contains(net.ParseIP("127.0.0.1")) == false && strings.Contains(value, ":") && strings.Contains(value, ".") {
    return errors.New("mixed-family range")
}

if _, err := client.CountDecisionsByValue(ctx, value, since, onlyActive); err != nil {
    if strings.Contains(err.Error(), "StartIpEndIpFilter") {
        // predicate construction failed; log value + unwrapped error
    }
    return err
}

When it happens

Trigger: decisionIPFilter returning an error while processing the parsed range for the count query — typically an internal predicate-construction failure rather than user input error.

Common situations: Upgrading crowdsec with schema/predicate mismatches; pathological ranges spanning IPv4/IPv6 boundaries; custom forks modifying decisionIPFilter.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• fail to apply StartIpEndIpFilter: %w
• unknown ip size %d: %w
• invalid contains value: %w: %w
• unable to parse type
• invalid ip address / range

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/14d43b4193da397c. Report an issue: GitHub.