What causes "invalid ip range '%s': %w" in crowdsecurity/crowdsec?

Validate the string with net.ParseCIDR or `ipaddress.ip_network(...)` before passing it in

invalid ip range '%s': %w

Error message

invalid ip range '%s': %w

What it means

Addr2Ints converts any IP or CIDR string into integer range bounds. When the string contains '/', it is parsed with net.ParseCIDR; failure produces "invalid ip range '%s'" wrapping the net error. Callers such as NewRange (used by bouncers/alert range handling) rely on this to reject malformed network specifications.

Source

Thrown at pkg/types/ip.go:41

			ip[9] | ^n.Mask[9], ip[10] | ^n.Mask[10], ip[11] | ^n.Mask[11],
			ip[12] | ^n.Mask[12], ip[13] | ^n.Mask[13], ip[14] | ^n.Mask[14],
			ip[15] | ^n.Mask[15],
		}
	}

	return net.IPv4(
		ip[0]|^n.Mask[0],
		ip[1]|^n.Mask[1],
		ip[2]|^n.Mask[2],
		ip[3]|^n.Mask[3])
}

/*returns a range for any ip or range*/
func Addr2Ints(anyIP string) (int, int64, int64, int64, int64, error) {
	if strings.Contains(anyIP, "/") {
		_, net, err := net.ParseCIDR(anyIP)
		if err != nil {
			return -1, 0, 0, 0, 0, fmt.Errorf("invalid ip range '%s': %w", anyIP, err)
		}

		return Range2Ints(*net)
	}

	ip := net.ParseIP(anyIP)
	if ip == nil {
		return -1, 0, 0, 0, 0, fmt.Errorf("invalid ip address '%s'", anyIP)
	}

	sz, start, end, err := IP2Ints(ip)
	if err != nil {
		return -1, 0, 0, 0, 0, fmt.Errorf("invalid ip address '%s': %w", anyIP, err)
	}

	return sz, start, end, start, end, nil
}

View on GitHub (pinned to 909b515798)

Solutions

Validate the string with net.ParseCIDR or `ipaddress.ip_network(...)` before passing it in
Correct the CIDR: full address, valid octets, prefix 0–32/0–128, no spaces
If the input may be a bare IP without mask, ensure it does not contain '/' or normalize it first
Inspect the wrapped net error to see exactly which character/field failed

Example fix

// before
r, err := types.NewRange("192.168.1/24")
// after
r, err := types.NewRange("192.168.1.0/24")

Defensive patterns

Strategy: validation

Validate before calling

import "net"
func validCIDR(s string) bool {
  _, _, err := net.ParseCIDR(s)
  return err == nil
}

Type guard

func isCIDRString(s string) bool {
  return strings.Contains(s, "/") && net.ParseCIDR(s) != nil
}

Try / catch

r, err := types.NewRange(input)
if err != nil {
  if strings.Contains(err.Error(), "invalid ip range") {
    return fmt.Errorf("rejecting malformed range %q: %v", input, err)
  }
  return err
}

Prevention

Validate all external CIDR input with net.ParseCIDR before conversion
Normalize user input (trim spaces, require full address + prefix)
Unit-test range parsing with malformed fixtures

When it happens

Trigger: Calling Addr2Ints (directly or via NewRange/TestAdd2Int) with a slash-containing string that is not valid CIDR, e.g. '10.0.0/24', '10.0.0.0/33', '10.0.0.0/ 24'.

Common situations: Machines/bouncers posting alerts with a malformed range field; parsing untrusted user input as a range; config value with a typo in the CIDR; missing octet in an address.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ac5e476aed7de0fc. Report an issue: GitHub.