apache/dubbo · error · IllegalArgumentException

If you config ip expression that contains '*' or '-', please

Error message

If you config ip expression that contains '*' or '-', please fill qualified ip pattern like 234e:0:4567:0:0:0:3d:*. 

What it means

NetUtils.checkHostPattern enforces that IPv6 patterns containing wildcard '*' or range '-' must be fully qualified with exactly 8 segments (e.g. 234e:0:4567:0:0:0:3d:*). A short/abbreviated IPv6 pattern with expressions is ambiguous and rejected.

Source

Thrown at dubbo-common/src/main/java/org/apache/dubbo/common/utils/NetUtils.java:865

        int i = host.indexOf('.');
        if (i > 0) {
            String prefix = host.substring(0, i);
            if (StringUtils.isNumber(prefix)) {
                int p = Integer.parseInt(prefix);
                return p >= 224 && p <= 239;
            }
        }
        return false;
    }

    private static boolean ipPatternContainExpression(String pattern) {
        return pattern.contains("*") || pattern.contains("-");
    }

    private static void checkHostPattern(String pattern, String[] mask, boolean isIpv4) {
        if (!isIpv4) {
            if (mask.length != 8 && ipPatternContainExpression(pattern)) {
                throw new IllegalArgumentException(
                        "If you config ip expression that contains '*' or '-', please fill qualified ip pattern like 234e:0:4567:0:0:0:3d:*. ");
            }
            if (mask.length != 8 && !pattern.contains("::")) {
                throw new IllegalArgumentException(
                        "The host is ipv6, but the pattern is not ipv6 pattern : " + pattern);
            }
        } else {
            if (mask.length != 4) {
                throw new IllegalArgumentException(
                        "The host is ipv4, but the pattern is not ipv4 pattern : " + pattern);
            }
        }
    }

    private static String[] getPatternHostAndPort(String pattern, boolean isIpv4) {
        String[] result = new String[2];
        if (pattern.startsWith("[") && pattern.contains("]:")) {
            int end = pattern.indexOf("]:");

View on GitHub (pinned to 3a3043227f)

Solutions

1. Expand the IPv6 pattern to all 8 segments, replacing elided groups with explicit 0, before adding '*' or '-'
2. If you need '::' abbreviation, do not combine it with '*' or '-' expressions
3. Validate that the pattern has 8 segments before applying it

Example fix

# before
allow-ip: 234e::3d:*
# after
allow-ip: 234e:0:0:0:0:0:3d:*

String pattern = ...;
String[] mask = pattern.split(":");
boolean isIpv6 = !host.contains(".");
if (isIpv6 && (pattern.contains("*") || pattern.contains("-")) && mask.length != 8) {
    /* expand to full 8 segments before passing to NetUtils */
}

static boolean validIpv6ExpressionPattern(String p) {
    if (!(p.contains("*") || p.contains("-"))) return true;
    return p.split(":").length == 8;
}

try { NetUtils.matchIpRange(pattern, host, port); }
catch (IllegalArgumentException e) { /* IPv6 pattern needed full 8 segments */ }

When it happens

Trigger: Configuring an IPv6 IP rule with '*' or '-' but providing fewer than 8 colon-separated segments (no '::' expansion allowed when expressions are present).

Common situations: Writing a compact IPv6 rule like '234e::3d:*' that omits zero-groups while also using a wildcard; miscounting segments in an ACL rule.

Related errors

• There is wrong format of ip Address: ${mask[i]}
• Invalid configurator rule, please specify at least one param
• service field in configuration is null.
• Illegal affinity rule!
• Illegal route rule!

AI-assisted analysis of apache/dubbo@3a3043227f (2026-08-14). Data as JSON: /api/errors/2aa8af684b7476a3. Report an issue: GitHub.