apache/dubbo · error · IllegalArgumentException

The host is ipv6, but the pattern is not ipv6 pattern : ${pa

Error message

The host is ipv6, but the pattern is not ipv6 pattern : ${pattern}

What it means

Thrown by NetUtils.matchIpRange when the resolved host address is IPv6 (isIpv4=false) but the supplied IP pattern does not look like a valid IPv6 address. Specifically, splitting the pattern by ':' does not yield 8 groups and the pattern does not contain '::' (the IPv6 zero-compression marker). The library rejects it because the pattern cannot be safely matched against the host segments.

Source

Thrown at dubbo-common/src/main/java/org/apache/dubbo/common/utils/NetUtils.java:869

                int p = Integer.parseInt(prefix);
                return p >= 224 && p <= 239;
            }
        }
        return false;
    }

    private static boolean ipPatternContainExpression(String pattern) {
        return pattern.contains("*") || pattern.contains("-");
    }

    private static void checkHostPattern(String pattern, String[] mask, boolean isIpv4) {
        if (!isIpv4) {
            if (mask.length != 8 && ipPatternContainExpression(pattern)) {
                throw new IllegalArgumentException(
                        "If you config ip expression that contains '*' or '-', please fill qualified ip pattern like 234e:0:4567:0:0:0:3d:*. ");
            }
            if (mask.length != 8 && !pattern.contains("::")) {
                throw new IllegalArgumentException(
                        "The host is ipv6, but the pattern is not ipv6 pattern : " + pattern);
            }
        } else {
            if (mask.length != 4) {
                throw new IllegalArgumentException(
                        "The host is ipv4, but the pattern is not ipv4 pattern : " + pattern);
            }
        }
    }

    private static String[] getPatternHostAndPort(String pattern, boolean isIpv4) {
        String[] result = new String[2];
        if (pattern.startsWith("[") && pattern.contains("]:")) {
            int end = pattern.indexOf("]:");
            result[0] = pattern.substring(1, end);
            result[1] = pattern.substring(end + 2);
            return result;
        } else if (pattern.startsWith("[") && pattern.endsWith("]")) {

View on GitHub (pinned to 3a3043227f)

Solutions

1. If the host is genuinely IPv6, supply a fully-qualified 8-group IPv6 pattern (e.g. '234e:0:4567:0:0:0:3d:*') or a pattern containing '::' compression (e.g. '234e::3d:1').
2. If you intended to match an IPv4 host, verify the host value actually resolves to IPv4 — use an explicit IPv4 literal instead of a hostname to avoid the OS returning an AAAA record.
3. For wildcard IPv6 patterns with '*' or '-', use the full 8-group form; abbreviated forms without '::' and without 8 groups are rejected (the preceding check at line 864 enforces this).
4. Review the matchIpRange call site (often in QoS/registry filter config) and align the pattern family with the actual address family of the host.

Example fix

// before
NetUtils.matchIpRange("192.168.1.*", "fe80::1", 20880);
// after — match against the IPv6 address family
NetUtils.matchIpRange("fe80::*", "fe80::1", 20880);
// or force IPv4 resolution
NetUtils.matchIpRange("192.168.1.*", "192.168.1.10", 20880);

// Validate pattern matches host address family before calling matchIpRange
InetAddress addr = InetAddress.getByName(host);
boolean isIpv4 = addr instanceof Inet4Address;
if (isIpv4) {
    String[] octets = pattern.split("\\.");
    if (octets.length != 4) {
        throw new IllegalArgumentException("Pattern must be 4-octet IPv4: " + pattern);
    }
} else {
    // For IPv6, require 8 groups or '::' compression
    if (pattern.split(":").length < 2 && !pattern.contains("::")) {
        throw new IllegalArgumentException("Pattern must be IPv6 format: " + pattern);
    }
}
NetUtils.matchIpRange(pattern, host, port);

try {
    return NetUtils.matchIpRange(pattern, host, port);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("not ipv6 pattern") || e.getMessage().contains("not ipv4 pattern")) {
        logger.warn("IP pattern '{}' does not match host '{}' address family", pattern, host);
        return false; // or fall back to exact match
    }
    throw e;
}

When it happens

Trigger: Calling NetUtils.matchIpRange(pattern, host, port) where the host resolves to an IPv6 address (e.g. 'fe80::1') but the pattern argument is an IPv4-style string (e.g. '192.168.1.*'), a hostname, or a malformed IPv6 string without '::' that doesn't have 8 colon-separated groups. Internally, getPatternHostAndPort strips brackets, the pattern is split by SPLIT_IPV6_CHARACTER (':'), and if mask.length != 8 and pattern has no '::', checkHostPattern throws.

Common situations: Configuring an IP allow/deny list in Dubbo's QoS, registry, orTelnet access control where the server runs on a dual-stack or IPv6-only network but the filter patterns were written for IPv4. Also occurs when copy-pasting IPv4 patterns into a config that targets IPv6 hosts, or when a hostname resolves to an AAAA record and the pattern was written expecting dotted-quad.

Related errors

• The host is ipv4, but the pattern is not ipv4 pattern : ${pa
• If you config ip expression that contains '*' or '-', please
• not an valid CIDR format!
• Illegal Argument pattern or hostName. Pattern:${pattern}, Ho
• There is wrong format of ip Address: ${mask[i]}

AI-assisted analysis of apache/dubbo@3a3043227f (2026-08-14). Data as JSON: /api/errors/e6d12b27159b7df1. Report an issue: GitHub.