crowdsecurity/crowdsec · error

fail to apply StartIpEndIpFilter: %w

Error message

fail to apply StartIpEndIpFilter: %w

What it means

applyDecisionFilter wraps the error returned by decisionIPFilter when building the IP/range predicates for the query fails — i.e. the parsed range could not be turned into SQL predicates (StartIp/EndIp filters), not that the range string itself was unparsable.

Source

Thrown at pkg/database/decisionfilter.go:108

			offset, err := strconv.Atoi(value[0])
			if err != nil {
				return nil, fmt.Errorf("invalid offset value: %w: %w", err, InvalidFilter)
			}

			query = query.Offset(offset)
		case "id_gt":
			id, err := strconv.Atoi(value[0])
			if err != nil {
				return nil, fmt.Errorf("invalid id_gt value: %w: %w", err, InvalidFilter)
			}

			query = query.Where(decision.IDGT(id))
		}
	}

	query, err = decisionIPFilter(query, contains, rng)
	if err != nil {
		return nil, fmt.Errorf("fail to apply StartIpEndIpFilter: %w", err)
	}

	return query, nil
}

func decisionIPv4Filter(decisions *ent.DecisionQuery, contains bool, rng csnet.Range) (*ent.DecisionQuery, error) {
	if contains {
		// Decision contains {start_ip,end_ip}
		return decisions.Where(decision.And(
			decision.StartIPLTE(rng.Start.Addr),
			decision.EndIPGTE(rng.End.Addr),
			decision.IPSizeEQ(int64(rng.Size())))), nil
	}

	// Decision is contained within {start_ip,end_ip}
	return decisions.Where(decision.And(
		decision.StartIPGTE(rng.Start.Addr),
		decision.EndIPLTE(rng.End.Addr),

View on GitHub (pinned to 909b515798)

Solutions

1. Look at the wrapped inner error from decisionIPFilter for the root cause.
2. Retry with a narrower, conventional CIDR (e.g. /24 for IPv4) to rule out edge-case ranges.
3. Test the range with cscli or a small Go snippet calling csnet.NewRange plus the filter path.
4. Update crowdsec — version skew fixes for range handling appear over time.

rng, err := csnet.NewRange(ipOrCIDR)
if err != nil {
    return fmt.Errorf("invalid range %q: %w", ipOrCIDR, err)
}
if s := rng.Size(); s != 4 && s != 16 && s != 0 {
    return fmt.Errorf("unsupported range size %d", s)
}

q, err := applyDecisionFilter(query, filter)
if err != nil {
    if strings.Contains(err.Error(), "StartIpEndIpFilter") {
        return fmt.Errorf("ip filter could not be applied: %w", err)
    }
    return err
}

When it happens

Trigger: A syntactically valid range that decisionIPFilter/decisionIPv4Filter/decisionIPv6Filter still cannot apply (e.g. internal predicate construction error, or an error propagated from the v4/v6 sub-filters while computing StartIp/EndIp bounds).

Common situations: Unusual but valid ranges (e.g. huge IPv6 blocks) hitting edge cases in range-to-bounds conversion; version skew between API layer and csnet range handling.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

• unknown ip size %d: %w
• fail to apply StartIpEndIpFilter: %w
• unable to parse type
• invalid ip address / range
• invalid filter

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/894d43c05924bec5. Report an issue: GitHub.