{"record":{"id":"38e18506f7094043","repo":"apache/dubbo","slug":"the-host-is-ipv4-but-the-pattern-is-not-ipv4-patt","errorCode":null,"errorMessage":"The host is ipv4, but the pattern is not ipv4 pattern : ${pattern}","messagePattern":"The host is ipv4, but the pattern is not ipv4 pattern : (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"dubbo-common/src/main/java/org/apache/dubbo/common/utils/NetUtils.java","lineNumber":874,"sourceCode":"    }\n\n    private static boolean ipPatternContainExpression(String pattern) {\n        return pattern.contains(\"*\") || pattern.contains(\"-\");\n    }\n\n    private static void checkHostPattern(String pattern, String[] mask, boolean isIpv4) {\n        if (!isIpv4) {\n            if (mask.length != 8 && ipPatternContainExpression(pattern)) {\n                throw new IllegalArgumentException(\n                        \"If you config ip expression that contains '*' or '-', please fill qualified ip pattern like 234e:0:4567:0:0:0:3d:*. \");\n            }\n            if (mask.length != 8 && !pattern.contains(\"::\")) {\n                throw new IllegalArgumentException(\n                        \"The host is ipv6, but the pattern is not ipv6 pattern : \" + pattern);\n            }\n        } else {\n            if (mask.length != 4) {\n                throw new IllegalArgumentException(\n                        \"The host is ipv4, but the pattern is not ipv4 pattern : \" + pattern);\n            }\n        }\n    }\n\n    private static String[] getPatternHostAndPort(String pattern, boolean isIpv4) {\n        String[] result = new String[2];\n        if (pattern.startsWith(\"[\") && pattern.contains(\"]:\")) {\n            int end = pattern.indexOf(\"]:\");\n            result[0] = pattern.substring(1, end);\n            result[1] = pattern.substring(end + 2);\n            return result;\n        } else if (pattern.startsWith(\"[\") && pattern.endsWith(\"]\")) {\n            result[0] = pattern.substring(1, pattern.length() - 1);\n            result[1] = null;\n            return result;\n        } else if (isIpv4 && pattern.contains(\":\")) {\n            int end = pattern.indexOf(\":\");","sourceCodeStart":856,"sourceCodeEnd":892,"githubUrl":"https://github.com/apache/dubbo/blob/3a3043227f5571d25eb2889de5bca22f2914843b/dubbo-common/src/main/java/org/apache/dubbo/common/utils/NetUtils.java#L856-L892","documentation":"Thrown by NetUtils.matchIpRange when the resolved host address is IPv4 (isIpv4=true) but the supplied IP pattern does not split into exactly 4 dot-separated octets. The library rejects non-quad patterns because it cannot index into the four IPv4 octet segments for range or wildcard matching.","triggerScenarios":"Calling NetUtils.matchIpRange(pattern, host, port) where the host resolves to an IPv4 address but the pattern is an IPv6 string, a bare hostname, or a malformed IPv4 with fewer/more than 4 dot-separated groups. Internally, pattern.split('.') must produce mask.length == 4, otherwise checkHostPattern throws.","commonSituations":"Writing IP allow/deny lists for Dubbo QoS telnet access control or registry filters where a typo produces 3 or 5 octets. Also when a config uses a CIDR notation like '192.168.1.0/24' (which splits into an unexpected group) instead of the wildcard/range format '192.168.1.*' that matchIpRange expects.","solutions":["Ensure the pattern is a valid dotted-quad IPv4 with exactly 4 groups, using '*' or '-' for wildcards/ranges (e.g. '192.168.1.*' or '192.168.1.10-20').","Do not use CIDR notation; matchIpRange expects glob/range patterns, not '/24' suffixes.","If the host is actually IPv6, switch the pattern to IPv6 format and vice versa — the address family of the host determines which pattern format is valid.","Double-check for trailing dots or extra segments in the pattern string."],"exampleFix":"// before\nNetUtils.matchIpRange(\"192.168.1.0/24\", \"192.168.1.10\", 20880);\n// after — use glob format, not CIDR\nNetUtils.matchIpRange(\"192.168.1.*\", \"192.168.1.10\", 20880);","handlingStrategy":"validation","validationCode":"// Validate IPv4 pattern has exactly 4 dot-separated octets\nString[] octets = pattern.split(\"\\\\.\");\nif (octets.length != 4) {\n    throw new IllegalArgumentException(\n        \"IPv4 pattern must have 4 octets, got \" + octets.length + \": \" + pattern);\n}\nNetUtils.matchIpRange(pattern, host, port);","typeGuard":null,"tryCatchPattern":"try {\n    return NetUtils.matchIpRange(pattern, host, port);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"not ipv4 pattern\")) {\n        logger.warn(\"Invalid IPv4 pattern '{}': expected 4 octets\", pattern);\n        return false;\n    }\n    throw e;\n}","preventionTips":["Never use CIDR notation in matchIpRange patterns — use glob/range format (e.g. '192.168.1.*').","Validate config-time IP patterns on application startup, not just at match time.","Unit-test IP filter patterns against known IPv4 and IPv6 addresses."],"tags":["network","ipv4","ip-filter","config-validation"],"backgroundTag":null,"analyzedSha":"3a3043227f5571d25eb2889de5bca22f2914843b","analyzedAt":"2026-08-14T00:43:19.853Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}