FAILURE MAP
← Case archive

FA-74166 / Feature flag rollout bucketing / Open access

Network allowlist clause: A bare address allows every source · case 01

Listing a single office IP without "/32" opens the feature to the whole internet.

Verified by executionVariant 1 · 8 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

A missing prefix length defaults to 0 instead of 32.

VERIFIED REPAIR

Treat an entry without "/n" as a /32 host route.

Unsuccessful approach: Defaulting to /24 still widens a single address to its neighbours.

Case contract

ip is dotted-quad IPv4 with octets 0..255 (else return None). Each cidr is "a.b.c.d/n" with 0 <= n <= 32, or a bare address meaning /32; malformed entries are skipped. An entry matches when the top n bits of ip and of its address agree (host bits of the entry are ignored). Return [True, index of first match] or [False, -1].

Why this case matters

Office and VPN allowlists gate internal features by source network.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(ip, cidrs):
    def parse(s):
        parts = s.split('.')
        if len(parts) != 4 or not all(p.isdigit() and int(p) <= 255 for p in parts):
            return None
        v = 0
        for p in parts:
            v = v * 256 + int(p)
        return v
    addr = parse(ip)
    if addr is None:
        return None
    for i, c in enumerate(cidrs):
        net, _, bits = c.partition('/')
        bits = bits or '0'
        base = parse(net)
        if base is None or not bits.isdigit() or int(bits) > 32:
            continue
        n = int(bits)
        mask = ((1 << n) - 1) << (32 - n)
        if addr & mask == base & mask:
            return [True, i]
    return [False, -1]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[('slash 24 matches inside the network', ['10.1.2.3', ['192.168.0.0/16', '10.1.2.0/24']], [True, 1]),
  ('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),
  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('network sample 1', ['10.1.2.0', ['8.8.8.0', '10.1.2.3/32', '10.0.0.0/8']], [True, 2]),
  ('network sample 2', ['8.8.8.8', ['10.1.2.3/32']], [False, -1]),
  ('network sample 3', ['10.1.2.0', ['1.0.0.256/8']], [False, -1])],
 [('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),
  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),
  ('network sample 35', ['172.16.5.4', ['8.8.8.0']], [False, -1]),
  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1])],
 [('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),
  ('network sample 11', ['10.1.2.3', ['192.168.1.0/24']], [False, -1]),
  ('network sample 12', ['0.0.0.0', ['0.0.0.0/0', '172.16.0.0/12']], [True, 0])],
 [('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),
  ('network sample 16', ['10.1.2.0', ['1.0.0.256/8']], [False, -1]),
  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1]),
  ('network sample 48', ['0.0.0.0', ['8.8.8.0', '192.168.1.0/24', '172.16.5.4/30']], [False, -1])],
 [('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),
  ('prefix longer than 32 is skipped', ['10.0.0.1', ['10.0.0.0/33', '10.0.0.0/8']], [True, 1]),
  ('network sample 14', ['172.16.5.4', ['10.0.0.0/33', '10.1.2.3/32', '8.8.8.0']], [False, -1]),
  ('network sample 21', ['10.1.2.3', ['10.1.2.3', '192.168.1.0/24']], [True, 0]),
  ('network sample 22', ['10.1.2.0', ['192.168.0.0/16', '10.0.0.0/8', '8.8.8.0']], [True, 1])]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
slash 24 matches inside the network[True, 1][True, 1]Passed
slash 0 matches everything[True, 0][True, 0]Passed
octet 256 in an entry is malformed[False, -1][False, -1]Passed
octet 255 is valid[True, 0][True, 0]Passed
bare address means host route[True, 0][False, -1]Failed
network sample 1[True, 0][True, 2]Failed
network sample 2[False, -1][False, -1]Passed
network sample 3[False, -1][False, -1]Passed

SHA-256 / 8e8fc4ab5ed0e3f34c084440ed207c4c8e77b7db22a15458e59921d62a2b396e

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(ip, cidrs):
    def parse(s):
        parts = s.split('.')
        if len(parts) != 4 or not all(p.isdigit() and int(p) <= 255 for p in parts):
            return None
        v = 0
        for p in parts:
            v = v * 256 + int(p)
        return v
    addr = parse(ip)
    if addr is None:
        return None
    for i, c in enumerate(cidrs):
        net, _, bits = c.partition('/')
        bits = bits or '24'
        base = parse(net)
        if base is None or not bits.isdigit() or int(bits) > 32:
            continue
        n = int(bits)
        mask = ((1 << n) - 1) << (32 - n)
        if addr & mask == base & mask:
            return [True, i]
    return [False, -1]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[('slash 24 matches inside the network', ['10.1.2.3', ['192.168.0.0/16', '10.1.2.0/24']], [True, 1]),
  ('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),
  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('network sample 1', ['10.1.2.0', ['8.8.8.0', '10.1.2.3/32', '10.0.0.0/8']], [True, 2]),
  ('network sample 2', ['8.8.8.8', ['10.1.2.3/32']], [False, -1]),
  ('network sample 3', ['10.1.2.0', ['1.0.0.256/8']], [False, -1])],
 [('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),
  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),
  ('network sample 35', ['172.16.5.4', ['8.8.8.0']], [False, -1]),
  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1])],
 [('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),
  ('network sample 11', ['10.1.2.3', ['192.168.1.0/24']], [False, -1]),
  ('network sample 12', ['0.0.0.0', ['0.0.0.0/0', '172.16.0.0/12']], [True, 0])],
 [('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),
  ('network sample 16', ['10.1.2.0', ['1.0.0.256/8']], [False, -1]),
  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1]),
  ('network sample 48', ['0.0.0.0', ['8.8.8.0', '192.168.1.0/24', '172.16.5.4/30']], [False, -1])],
 [('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),
  ('prefix longer than 32 is skipped', ['10.0.0.1', ['10.0.0.0/33', '10.0.0.0/8']], [True, 1]),
  ('network sample 14', ['172.16.5.4', ['10.0.0.0/33', '10.1.2.3/32', '8.8.8.0']], [False, -1]),
  ('network sample 21', ['10.1.2.3', ['10.1.2.3', '192.168.1.0/24']], [True, 0]),
  ('network sample 22', ['10.1.2.0', ['192.168.0.0/16', '10.0.0.0/8', '8.8.8.0']], [True, 1])]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
slash 24 matches inside the network[True, 1][True, 1]Passed
slash 0 matches everything[True, 0][True, 0]Passed
octet 256 in an entry is malformed[False, -1][False, -1]Passed
octet 255 is valid[True, 0][True, 0]Passed
bare address means host route[True, 0][False, -1]Failed
network sample 1[True, 2][True, 2]Passed
network sample 2[False, -1][False, -1]Passed
network sample 3[False, -1][False, -1]Passed

SHA-256 / 69418630331c454a7294dd9799a98c209a672d58e47cc9632a1e2da6b7fc85cf

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(ip, cidrs):
    def parse(s):
        parts = s.split('.')
        if len(parts) != 4 or not all(p.isdigit() and int(p) <= 255 for p in parts):
            return None
        v = 0
        for p in parts:
            v = v * 256 + int(p)
        return v
    addr = parse(ip)
    if addr is None:
        return None
    for i, c in enumerate(cidrs):
        net, _, bits = c.partition('/')
        bits = bits or '32'
        base = parse(net)
        if base is None or not bits.isdigit() or int(bits) > 32:
            continue
        n = int(bits)
        mask = ((1 << n) - 1) << (32 - n)
        if addr & mask == base & mask:
            return [True, i]
    return [False, -1]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[('slash 24 matches inside the network', ['10.1.2.3', ['192.168.0.0/16', '10.1.2.0/24']], [True, 1]),
  ('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),
  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('network sample 1', ['10.1.2.0', ['8.8.8.0', '10.1.2.3/32', '10.0.0.0/8']], [True, 2]),
  ('network sample 2', ['8.8.8.8', ['10.1.2.3/32']], [False, -1]),
  ('network sample 3', ['10.1.2.0', ['1.0.0.256/8']], [False, -1])],
 [('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),
  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),
  ('network sample 35', ['172.16.5.4', ['8.8.8.0']], [False, -1]),
  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1])],
 [('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),
  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),
  ('network sample 11', ['10.1.2.3', ['192.168.1.0/24']], [False, -1]),
  ('network sample 12', ['0.0.0.0', ['0.0.0.0/0', '172.16.0.0/12']], [True, 0])],
 [('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),
  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),
  ('network sample 16', ['10.1.2.0', ['1.0.0.256/8']], [False, -1]),
  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1]),
  ('network sample 48', ['0.0.0.0', ['8.8.8.0', '192.168.1.0/24', '172.16.5.4/30']], [False, -1])],
 [('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),
  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),
  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),
  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),
  ('prefix longer than 32 is skipped', ['10.0.0.1', ['10.0.0.0/33', '10.0.0.0/8']], [True, 1]),
  ('network sample 14', ['172.16.5.4', ['10.0.0.0/33', '10.1.2.3/32', '8.8.8.0']], [False, -1]),
  ('network sample 21', ['10.1.2.3', ['10.1.2.3', '192.168.1.0/24']], [True, 0]),
  ('network sample 22', ['10.1.2.0', ['192.168.0.0/16', '10.0.0.0/8', '8.8.8.0']], [True, 1])]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
slash 24 matches inside the network[True, 1][True, 1]Passed
slash 0 matches everything[True, 0][True, 0]Passed
octet 256 in an entry is malformed[False, -1][False, -1]Passed
octet 255 is valid[True, 0][True, 0]Passed
bare address means host route[False, -1][False, -1]Passed
network sample 1[True, 2][True, 2]Passed
network sample 2[False, -1][False, -1]Passed
network sample 3[False, -1][False, -1]Passed

SHA-256 / 846b75e5c9cb3082550258d97ef02d3d9838e94078ad53b830eb9ef936f3ee98

Verification & scope

A deterministic toy flag-evaluation model with a stipulated contract; it does not reproduce any vendor SDK byte for byte. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:48:54.174193+00:00.

Case digest / f122d0c109c645407accef9a187d9e59ea85c7f7fb030c6b84afa19335e1f50a