crowdsecurity/crowdsec · warning

invalid ip address / range

Error message

invalid ip address / range

What it means

InvalidIPOrRange is a sentinel error meaning a filter value that should be an IP address or CIDR range could not be converted by csnet.NewRange. It is returned when applying decision filters or expiring decisions with an unparseable 'ip'/'range' value.

Source

Thrown at pkg/database/errors.go:19

package database

import "errors"

var (
	UserExists        = errors.New("user already exist")
	UserNotExists     = errors.New("user doesn't exist")
	HashError         = errors.New("unable to hash")
	InsertFail        = errors.New("unable to insert row")
	QueryFail         = errors.New("unable to query")
	UpdateFail        = errors.New("unable to update")
	DeleteFail        = errors.New("unable to delete")
	ItemNotFound      = errors.New("object not found")
	ParseTimeFail     = errors.New("unable to parse time")
	ParseDurationFail = errors.New("unable to parse duration")
	MarshalFail       = errors.New("unable to serialize")
	BulkError         = errors.New("unable to insert bulk")
	ParseType         = errors.New("unable to parse type")
	InvalidIPOrRange  = errors.New("invalid ip address / range")
	InvalidFilter     = errors.New("invalid filter")
)

View on GitHub (pinned to 909b515798)

Solutions

  1. Fix the IP/CIDR syntax: valid IPv4/IPv6 or CIDR like 1.2.3.4 or 10.0.0.0/8 (prefix <= 32 or 128).
  2. Validate before calling: net.ParseIP / net.ParseCIDR (or csnet.ParseIP) on the value.
  3. If the input is a hostname, resolve it with net.LookupHost first and use the resulting IP.
  4. Check the wrapped inner error for the exact offending value echoed in the message.

Example fix

// before
ipParam := "192.168.1." // truncated
err := client.ExpireDecisionsWithFilter(ctx, map[string][]string{"ip": {ipParam}})
// after
if net.ParseIP(ipParam) == nil {
    return fmt.Errorf("invalid ip %q", ipParam)
}
err := client.ExpireDecisionsWithFilter(ctx, map[string][]string{"ip": {ipParam}})
Defensive patterns

Strategy: validation

Validate before calling

// Go: validate IP/CIDR before building filters
func validIPOrRange(s string) bool {
    if net.ParseIP(s) != nil { return true }
    _, _, err := net.ParseCIDR(s)
    return err == nil
}

Try / catch

if _, err := client.ExpireDecisionsWithFilter(ctx, filter); err != nil {
    if errors.Is(err, database.InvalidIPOrRange) {
        return fmt.Errorf("bad ip/range in filter: %w", err)
    }
    return err
}

Prevention

When it happens

Trigger: applyDecisionFilter or ExpireDecisionsWithFilter (and decisions.go IP filtering) with value like "192.168.1." (truncated), "10.0.0.0/33" (bad prefix), a hostname, or an IPv6 string in an IPv4-only context.

Common situations: Hand-edited cscli decisions delete --ip values, scripts interpolating unvalidated user input into IP filters, copy/paste dropping part of a CIDR, hostnames used where only IPs/CIDRs are accepted.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b69c1e186222d009. Report an issue: GitHub.