slackhq/nebula · error

config `%s` has invalid CIDR: %s

Error message

config `%s` has invalid CIDR: %s

What it means

Each key in the calculated_remotes map must be a valid CIDR prefix parseable by netip.ParsePrefix (e.g. 10.0.42.0/24). The library throws this when a key fails to parse, naming the config key and the bad CIDR string.

Source

Thrown at calculated_remote.go:94

	return &ap
}

func NewCalculatedRemotesFromConfig(c *config.C, k string) (*bart.Table[[]*calculatedRemote], error) {
	value := c.Get(k)
	if value == nil {
		return nil, nil
	}

	calculatedRemotes := new(bart.Table[[]*calculatedRemote])

	rawMap, ok := value.(map[string]any)
	if !ok {
		return nil, fmt.Errorf("config `%s` has invalid type: %T", k, value)
	}
	for rawCIDR, rawValue := range rawMap {
		cidr, err := netip.ParsePrefix(rawCIDR)
		if err != nil {
			return nil, fmt.Errorf("config `%s` has invalid CIDR: %s", k, rawCIDR)
		}

		entry, err := newCalculatedRemotesListFromConfig(cidr, rawValue)
		if err != nil {
			return nil, fmt.Errorf("config '%s.%s': %w", k, rawCIDR, err)
		}

		calculatedRemotes.Insert(cidr, entry)
	}

	return calculatedRemotes, nil
}

func newCalculatedRemotesListFromConfig(cidr netip.Prefix, raw any) ([]*calculatedRemote, error) {
	rawList, ok := raw.([]any)
	if !ok {
		return nil, fmt.Errorf("calculated_remotes entry has invalid type: %T", raw)
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Fix the map key to be a full CIDR including prefix length (e.g. 10.0.42.0/24)
2. Test the key with Go's netip.ParsePrefix to confirm it parses
3. Quote the key in YAML if it contains characters that break parsing

Example fix

// before
lighthouse:
  calculated_remotes:
    10.0.42.0:
      - mask: 10.0.0.0/8
        port: 4242
// after
lighthouse:
  calculated_remotes:
    10.0.42.0/24:
      - mask: 10.0.0.0/8
        port: 4242

for key := range rawMap {
	if _, err := netip.ParsePrefix(key); err != nil {
		return fmt.Errorf("key %q is not a valid CIDR: %v", key, err)
	}
}

func isParseableCIDR(s string) bool {
	_, err := netip.ParsePrefix(s)
	return err == nil
}

tbl, err := NewCalculatedRemotesFromConfig(c, k)
if err != nil {
	if strings.Contains(err.Error(), "has invalid CIDR") {
		// extract and report the bad key from the message
		return fmt.Errorf("fix CIDR key in %s config: %w", k, err)
	}
	return err
}

When it happens

Trigger: NewCalculatedRemotesFromConfig iterating the rawMap encounters a key like `10.0.42.0` (missing prefix length), `10.0.42.0/33` (bits out of range), `not-a-cidr`, or a bare host IP with no /mask.

Common situations: Omitting the /prefix-length in a YAML key, quoting mistakes that leave stray characters in the key, or using a hostname instead of a CIDR in lighthouse.calculated_remotes.

Related errors

• invalid port: %d
• stats.host can not be empty
• stats.listen should not be empty
• stats.path should not be empty
• config `%s` has invalid type: %T

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/ae3dc503634ae813. Report an issue: GitHub.