grpc/grpc-java · error · ResourceInvalidException

Failed to create CidrRange

Error message

Failed to create CidrRange

What it means

A CidrRange in the FilterChainMatch (destination or source prefix ranges) could not be constructed because the address prefix string is not a valid IP address or the prefix length is invalid. XdsListenerResource wraps the IllegalArgumentException in a ResourceInvalidException and rejects the Listener.

Solutions

1. Fix address_prefix to be a valid IP literal (e.g. '10.0.0.0' or 'fd00::/8' base address without the '/len' suffix; length goes in prefix_len).
2. Verify prefix_len is within 0..32 for IPv4 and 0..128 for IPv6.
3. Replace any hostname or templating placeholder with a resolved IP address.

Example fix

// before
prefix_ranges: [{ address_prefix: "my-host.example.com", prefix_len: 24 }]
// after
prefix_ranges: [{ address_prefix: "10.0.0.0", prefix_len: 24 }]

// validate CIDR fields before building the resource
for (CidrRangeProto r : match.getPrefixRangesList()) {
  InetAddress a = InetAddresses.forString(r.getAddressPrefix()); // throws if invalid
  int max = (a instanceof Inet4Address) ? 32 : 128;
  if (r.getPrefixLen().getValue() < 0 || r.getPrefixLen().getValue() > max)
    throw new IllegalArgumentException("bad prefix_len for " + r.getAddressPrefix());
}

try { applyResource(listener) } catch (ResourceInvalidException e) { if (e.getMessage().equals("Failed to create CidrRange")) logBadCidr(matchProto); }

When it happens

Trigger: FilterChainMatch proto with destination_prefix_ranges or source_prefix_ranges whose address_prefix is malformed (not an IPv4/IPv6 literal, e.g. a hostname, empty string, or '10.0.0.256') or whose prefix_len is negative or exceeds the address bit width, raised in parseFilterChainMatch.

Common situations: Typos in CIDR blocks in bootstrap YAML, hostnames used instead of IP literals, IPv6 prefix lengths misapplied to IPv4 addresses, or templating bugs that emit placeholder values like '{{CIDR}}' into address_prefix.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• All xds transports for authority are in backoff
• A terminal HttpFilter must be the last filter
• Address is not an IP
• AndMatcher must have at least 2 predicates
• ca_certificate_provider_instance name

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/f582616340d4ee9e. Report an issue: GitHub.

Appendix: source

Thrown at xds/src/main/java/io/grpc/xds/XdsListenerResource.java:466

  private static FilterChainMatch parseFilterChainMatch(
      io.envoyproxy.envoy.config.listener.v3.FilterChainMatch proto)
      throws ResourceInvalidException {
    ImmutableList.Builder<CidrRange> prefixRanges = ImmutableList.builder();
    ImmutableList.Builder<CidrRange> sourcePrefixRanges = ImmutableList.builder();
    try {
      for (io.envoyproxy.envoy.config.core.v3.CidrRange range : proto.getPrefixRangesList()) {
        prefixRanges.add(
            CidrRange.create(InetAddresses.forString(range.getAddressPrefix()),
                range.getPrefixLen().getValue()));
      }
      for (io.envoyproxy.envoy.config.core.v3.CidrRange range
          : proto.getSourcePrefixRangesList()) {
        sourcePrefixRanges.add(CidrRange.create(
            InetAddresses.forString(range.getAddressPrefix()), range.getPrefixLen().getValue()));
      }
    } catch (IllegalArgumentException ex) {
      throw new ResourceInvalidException("Failed to create CidrRange", ex);
    }

    ConnectionSourceType sourceType;
    switch (proto.getSourceType()) {
      case ANY:
        sourceType = ConnectionSourceType.ANY;
        break;
      case EXTERNAL:
        sourceType = ConnectionSourceType.EXTERNAL;
        break;
      case SAME_IP_OR_LOOPBACK:
        sourceType = ConnectionSourceType.SAME_IP_OR_LOOPBACK;
        break;
      default:
        throw new ResourceInvalidException("Unknown source-type: " + proto.getSourceType());
    }
    return FilterChainMatch.create(
        proto.getDestinationPort().getValue(),

View on GitHub (pinned to 64daddc1f3)