What causes "parsing whitelist: %w" in crowdsecurity/crowdsec?

Move CIDR entries from `ip:` to `cidr:` in the whitelist section

parsing whitelist: %w

Error message

parsing whitelist: %w

What it means

CompileWLs compiles the static IP whitelist entries declared in a parser/postoverflow node. Each entry under `whitelist: ip:` is parsed with netip.ParseAddr; if the string is not a valid IP address, the error is wrapped as "parsing whitelist". This surfaces at config load time so a malformed whitelist never silently disables itself.

Source

Thrown at pkg/parser/whitelist.go:116

			if out {
				n.Logger.Debugf("Event is whitelisted by expr, reason [%s]", n.Whitelist.Reason)
				isWhitelisted = true
			}
		default:
			n.Logger.Errorf("unexpected type %t (%v) while running '%s'", output, output, n.Whitelist.Exprs[eidx])
		}
	}
	if isWhitelisted {
		n.bumpWhitelistMetric(metrics.NodesWlHitsOk, p)
	}
	return isWhitelisted, nil
}

func (n *Node) CompileWLs() (bool, error) {
	for _, v := range n.Whitelist.Ips {
		addr, err := netip.ParseAddr(v)
		if err != nil {
			return false, fmt.Errorf("parsing whitelist: %w", err)
		}

		n.Whitelist.B_Ips = append(n.Whitelist.B_Ips, addr)
		n.Logger.Debugf("adding ip %s to whitelists", addr)
	}

	for _, v := range n.Whitelist.Cidrs {
		tnet, err := netip.ParsePrefix(v)
		if err != nil {
			return false, fmt.Errorf("parsing whitelist: %w", err)
		}
		n.Whitelist.B_Cidrs = append(n.Whitelist.B_Cidrs, tnet)
		n.Logger.Debugf("adding cidr %s to whitelists", tnet)
	}

	for _, filter := range n.Whitelist.Exprs {
		var err error
		expression := &ExprWhitelist{}

View on GitHub (pinned to 909b515798)

Solutions

Move CIDR entries from `ip:` to `cidr:` in the whitelist section
Use only bare IPs in `ip:` (e.g. 1.2.3.4, ::1); validate with `python3 -c "import ipaddress;ipaddress.ip_address('X')"`
If you need hostnames or conditions, use an `expression:` whitelist instead
Read the wrapped netip error to see the exact offending value

Example fix

// before
whitelist:
  reason: office
  ip: 192.168.0.0/16   # wrong field
// after
whitelist:
  reason: office
  cidr:
    - 192.168.0.0/16

Defensive patterns

Strategy: validation

Validate before calling

import "net/netip"
func validWLIPs(ips []string) error {
  for _, v := range ips {
    if _, err := netip.ParseAddr(v); err != nil {
      return fmt.Errorf("whitelist ip %q invalid: %w", v, err)
    }
  }
  return nil
}

Try / catch

ok, err := node.CompileWLs()
if err != nil {
  if strings.Contains(err.Error(), "parsing whitelist") {
    log.Fatalf("bad whitelist entry in %s: %v", node.Name, err)
  }
  return err
}

Prevention

Never put CIDRs in the `ip:` field — use `cidr:`
Use `expression:` whitelists for hostnames or conditions
Validate edited whitelist files with `cscli explain` or a quick netip.ParseAddr check before restart

When it happens

Trigger: A node's Whitelist.Ips entry (YAML key `ip:`) is not a parseable IP (e.g. a hostname, '1.2.3.4/32' with a mask, empty string) when CompileWLs runs during parser compilation.

Common situations: Putting a CIDR in the `ip:` field instead of `cidr:`; pasting a hostname or FQDN; whitespace or a trailing character copied from a document; IPv6 abbreviated incorrectly.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/114bf36f26bb01c7. Report an issue: GitHub.