crowdsecurity/crowdsec · error · InvalidFilter

unknown ip size %d: %w

Error message

unknown ip size %d: %w

What it means

Returned by handleAlertIPPredicates when the parsed IP range's address size is neither 4 nor 16 bytes nor 0, meaning the netip.Prefix/range holds an address family the filter code does not handle. Wraps the size and the InvalidFilter sentinel.

Source

Thrown at pkg/database/alertfilter.go:150

					alert.HasDecisionsWith(decision.EndSuffixLTE(rng.End.Sfx)),
				),
			),
		))
	}
}

func handleAlertIPPredicates(rng csnet.Range, contains bool, predicates *[]predicate.Alert) error {
	switch rng.Size() {
	case 4:
		handleAlertIPv4Predicates(rng, contains, predicates)
		return nil
	case 16:
		handleAlertIPv6Predicates(rng, contains, predicates)
		return nil
	case 0:
		return nil
	default:
		return fmt.Errorf("unknown ip size %d: %w", rng.Size(), InvalidFilter)
	}
}

func handleIncludeCapiFilter(value string, predicates *[]predicate.Alert) error {
	if value == "false" {
		*predicates = append(*predicates, alert.And(
			// do not show alerts with active decisions having origin CAPI or lists
			alert.And(
				alert.Not(alert.HasDecisionsWith(decision.OriginEQ(types.CAPIOrigin))),
				alert.Not(alert.HasDecisionsWith(decision.OriginEQ(types.ListOrigin))),
			),
			alert.Not(
				alert.And(
					// do not show neither alerts with no decisions if the Source Scope is lists: or CAPI
					alert.Not(alert.HasDecisions()),
					alert.Or(
						alert.SourceScopeHasPrefix(types.ListOrigin+":"),
						alert.SourceScopeEQ(types.CommunityBlocklistPullSourceScope),

View on GitHub (pinned to 909b515798)

Solutions

1. Send a valid IPv4 or IPv6 address/CIDR in the filter (e.g. 1.2.3.4 or 2001:db8::/32).
2. Validate the IP client-side with net.ParseIP / netip.ParsePrefix before querying.
3. If behind a proxy, ensure forwarded headers are sanitized to real IPs.
4. Check the client is not passing an empty-but-nonzero byte slice for the IP.

Example fix

// before
curl '.../alerts?range=999.1.1.1'
// after
curl '.../alerts?range=1.2.3.4'

prefix, err := netip.ParsePrefix(value)
if err != nil || (prefix.Addr().BitLen() != 32 && prefix.Addr().BitLen() != 128) {
    return fmt.Errorf("range %q is not a valid IPv4/IPv6 prefix", value)
}

if err := handleAlertIPPredicates(rng, contains, &preds); err != nil {
    if errors.Is(err, InvalidFilter) {
        return http.StatusBadRequest
    }
    return err
}

When it happens

Trigger: A 'range' or 'contains' style alert filter provides an IP value that parses to an unexpected address size — practically only with malformed/ambiguous input that produced a non-standard range.

Common situations: Scripts passing garbage IP strings into LAPI /v1/alerts range filters, proxy headers injecting malformed X-Forwarded-For-derived values, or custom integrations building filters programmatically.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• no listen_uri or listen_socket specified
• no API client section in configuration
• missing token value for api.server.auto_register
• missing allowed_ranges value for api.server.auto_register
• while parsing duration: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/daba86be8eae6556. Report an issue: GitHub.