{"record":{"id":"8e604713ccd9c3f8","repo":"apache/rocketmq","slug":"the-source-ip-is-invalid","errorCode":null,"errorMessage":"The source ip is invalid.","messagePattern":"The source ip is invalid\\.","errorType":"validation","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java","lineNumber":262,"sourceCode":"            throw new AuthorizationException(\"The resource type is null.\");\n        }\n        if (resource.getResourcePattern() == null) {\n            throw new AuthorizationException(\"The resource pattern is null.\");\n        }\n        if (CollectionUtils.isEmpty(entry.getActions())) {\n            throw new AuthorizationException(\"The actions is empty.\");\n        }\n        if (entry.getActions().contains(Action.ANY)) {\n            throw new AuthorizationException(\"The actions can not be Any.\");\n        }\n        Environment environment = entry.getEnvironment();\n        if (environment != null && CollectionUtils.isNotEmpty(environment.getSourceIps())) {\n            for (String sourceIp : environment.getSourceIps()) {\n                if (StringUtils.isBlank(sourceIp)) {\n                    throw new AuthorizationException(\"The source ip is empty.\");\n                }\n                if (!IPAddressUtils.isValidIPOrCidr(sourceIp)) {\n                    throw new AuthorizationException(\"The source ip is invalid.\");\n                }\n            }\n        }\n        if (entry.getDecision() == null) {\n            throw new AuthorizationException(\"The decision is null or illegal.\");\n        }\n    }\n\n    private <T> CompletableFuture<T> handleException(Exception e) {\n        CompletableFuture<T> result = new CompletableFuture<>();\n        Throwable throwable = ExceptionUtils.getRealException(e);\n        result.completeExceptionally(throwable);\n        return result;\n    }\n\n    private AuthenticationMetadataProvider getAuthenticationMetadataProvider() {\n        if (authenticationMetadataProvider == null) {\n            throw new IllegalStateException(\"The authenticationMetadataProvider is not configured.\");","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java#L244-L280","documentation":"Thrown by AuthorizationMetadataManagerImpl.validate() when a source IP entry in the policy's environment fails IPAddressUtils.isValidIPOrCidr(). Each sourceIps element must be a well-formed IPv4/IPv6 address or CIDR block (e.g. 192.168.1.10 or 10.0.0.0/8). Malformed tokens such as hostnames, partial CIDRs, or ranges are rejected.","triggerScenarios":"createAcl/updateAcl where environment.sourceIps contains values like \"my-host.example.com\", \"192.168.1\", \"10.0.0.0/8/24\", or \"192.168.1.1-192.168.1.5\" (ranges are not supported, only single IPs and CIDR).","commonSituations":"Users assume IP ranges (start-end) are allowed; DNS hostnames are supplied instead of IPs; IPv6 addresses with wrong notation; stray units or whitespace-embedded text after trimming.","solutions":["Convert each entry to a valid single IP or CIDR block (replace ranges like 192.168.1.1-192.168.1.5 with the CIDR 192.168.1.0/24 or list the individual IPs)","Resolve hostnames to IPs before writing the policy — hostnames are not accepted","Double-check IPv6 formatting (e.g. 2001:db8::/32) and remove stray characters"],"exampleFix":"// before\nenv.setSourceIps(Arrays.asList(\"192.168.1.10-192.168.1.20\"));\n\n// after\nenv.setSourceIps(Arrays.asList(\"192.168.1.10\", \"192.168.1.20\"));\n// or express the whole range as CIDR: env.setSourceIps(Arrays.asList(\"192.168.1.0/24\"));","handlingStrategy":"validation","validationCode":"boolean allValidIps(List<String> ips) {\n    return ips.stream().allMatch(ip -> IPAddressUtils.isValidIPOrCidr(ip));\n}\nif (!allValidIps(env.getSourceIps())) throw new IllegalArgumentException(\"bad source ip\");","typeGuard":null,"tryCatchPattern":"try { metadataManager.createAcl(acl).join(); }\ncatch (AuthorizationException e) { /* surface which ip failed, fix format, resubmit */ }","preventionTips":["Use only single IPs or CIDR blocks; IP ranges (a-b) are not supported","Resolve hostnames to IPs before writing policies","Unit-test IP list formatting with IPAddressUtils.isValidIPOrCidr"],"tags":["auth","authorization","acl","ip-filter","cidr","validation","rocketmq"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}