apache/hadoop · error · IllegalArgumentException

ipAddress is null.

Error message

ipAddress is null.

What it means

MachineList evaluates whether a client host matches a configured list of addresses/CIDR ranges (used for host allow lists such as proxyuser restrictions). In includes(String), when the list is not the wildcard '*' (all) and ipAddress is null, it throws IllegalArgumentException("ipAddress is null.") before any DNS resolution. With a '*' list the method returns true for anything, so the throw only occurs for concrete lists.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/MachineList.java:152

      entries = Collections.emptyList();
    }
  }
  /**
   * Accepts an ip address and return true if ipAddress is in the list.
   * {@link #includes(InetAddress)} should be preferred
   * to avoid possibly re-resolving the ip address.
   *
   * @param ipAddress ipAddress.
   * @return true if ipAddress is part of the list
   */
  public boolean includes(String ipAddress) {
    
    if (all) {
      return true;
    }
    
    if (ipAddress == null) {
      throw new IllegalArgumentException("ipAddress is null.");
    }

    try {
      return includes(addressFactory.getByName(ipAddress));
    } catch (UnknownHostException e) {
      return false;
    }
  }

  /**
   * Accepts an inet address and return true if address is in the list.
   * @param address address.
   * @return true if address is part of the list
   */
  public boolean includes(InetAddress address) {
    if (all) {
      return true;
    }

View on GitHub (pinned to 2add963021)

Solutions

1. Null/empty-check the address and fail closed (deny) before calling includes()
2. Fall back to request.getRemoteAddr() when the primary header is missing
3. Fix the fronting proxy to always send the expected header

Example fix

// before
String ip = request.getHeader("X-Forwarded-For");
if (machineList.includes(ip)) { allow(); }

// after
String ip = request.getHeader("X-Forwarded-For");
if (ip == null || ip.isEmpty()) ip = request.getRemoteAddr();
if (ip != null && machineList.includes(ip)) { allow(); } else { deny(); }

String remote = request.getHeader("X-Forwarded-For");
if (remote == null || remote.trim().isEmpty()) remote = request.getRemoteAddr();
boolean allowed = remote != null && machineList.includes(remote);

try { allowed = machineList.includes(remote); } catch (IllegalArgumentException e) { allowed = false; /* fail closed on null/blank address */ }

When it happens

Trigger: includes((String) null) against a non-'*' list; calling with a remote-address variable that was never populated — typically an X-Forwarded-For header absent behind a proxy or a test invocation with no remote address.

Common situations: Filter/handler code reading a header the proxy did not send; refactors that changed where the address comes from; unit tests passing null directly.

Related errors

• address is null.
• value can not be null
• key can not be null
• Collection<Key> can not be null
• ArrayList<Key> can not be null

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ee5ba04fff04a78d. Report an issue: GitHub.