apache/dubbo · error · IllegalArgumentException

There is wrong format of ip Address: ${mask[i]}

Error message

There is wrong format of ip Address: ${mask[i]}

What it means

Inside IP-range matching, a segment containing '-' is split on '-' and must yield exactly two parts (min-max). If a segment like '1-2-3' or '-5' splits into != 2 parts, the range is malformed and IllegalArgumentException is thrown.

Source

Thrown at dubbo-common/src/main/java/org/apache/dubbo/common/utils/NetUtils.java:819

        if (pattern.equals(host)) {
            return true;
        }

        // short name condition
        if (!ipPatternContainExpression(pattern)) {
            InetAddress patternAddress = InetAddress.getByName(pattern);
            return patternAddress.getHostAddress().equals(host);
        }

        String[] ipAddress = host.split(splitCharacter);

        for (int i = 0; i < mask.length; i++) {
            if ("*".equals(mask[i]) || mask[i].equals(ipAddress[i])) {
                continue;
            } else if (mask[i].contains("-")) {
                String[] rangeNumStrs = StringUtils.split(mask[i], '-');
                if (rangeNumStrs.length != 2) {
                    throw new IllegalArgumentException("There is wrong format of ip Address: " + mask[i]);
                }
                Integer min = getNumOfIpSegment(rangeNumStrs[0], isIpv4);
                Integer max = getNumOfIpSegment(rangeNumStrs[1], isIpv4);
                Integer ip = getNumOfIpSegment(ipAddress[i], isIpv4);
                if (ip < min || ip > max) {
                    return false;
                }
            } else if ("0".equals(ipAddress[i])
                    && ("0".equals(mask[i])
                            || "00".equals(mask[i])
                            || "000".equals(mask[i])
                            || "0000".equals(mask[i]))) {
                continue;
            } else if (!mask[i].equals(ipAddress[i])) {
                return false;
            }
        }
        return true;

View on GitHub (pinned to 3a3043227f)

Solutions

1. Correct the segment to a single 'min-max' range (e.g. '192.168.1.1-3')
2. Validate each segment splits into exactly two numeric parts before applying the rule
3. Use '*' for whole-segment wildcards instead of malformed ranges

Example fix

# before
allow-ip: 192.168.1.1-2-3
# after
allow-ip: 192.168.1.1-3

for (String seg : mask) {
    if (seg.contains("-")) {
        String[] parts = seg.split("-");
        if (parts.length != 2) { /* malformed; reject rule before NetUtils sees it */ }
    }
}

static boolean validRangeSegment(String seg) {
    if (!seg.contains("-")) return true;
    String[] p = seg.split("-");
    return p.length == 2;
}

try { NetUtils.matchIpRange(pattern, host, port); }
catch (IllegalArgumentException e) { /* a range segment was malformed */ }

When it happens

Trigger: Configuring an IP pattern segment with multiple hyphens or a dangling hyphen, e.g. '192.168.1.1-2-3' or '10.0.0.-5', which fails the two-part range expectation.

Common situations: Hand-edited ACL/rule files with typos in range segments; copy-paste errors; misunderstanding that ranges are min-max only (no chained ranges).

Related errors

• Illegal Argument pattern or hostName. Pattern:${pattern}, Ho
• If you config ip expression that contains '*' or '-', please
• Invalid configurator rule, please specify at least one param
• service field in configuration is null.
• Illegal affinity rule!

AI-assisted analysis of apache/dubbo@3a3043227f (2026-08-14). Data as JSON: /api/errors/49b102c05178faeb. Report an issue: GitHub.