{"record":{"id":"d6768798e853f6b7","repo":"apache/rocketmq","slug":"netaddress-examine-scope-exception-netaddress-is","errorCode":null,"errorMessage":"NetAddress examine scope Exception netAddress is %s","messagePattern":"NetAddress examine scope Exception netAddress is (.+?)","errorType":"validation","errorClass":"AclException","httpStatus":null,"severity":"error","filePath":"client/src/main/java/org/apache/rocketmq/acl/common/AclUtils.java","lineNumber":74,"sourceCode":"        if (b1 == null || b1.length == 0) return b2;\n        if (b2 == null || b2.length == 0) return b1;\n        byte[] total = new byte[b1.length + b2.length];\n        System.arraycopy(b1, 0, total, 0, b1.length);\n        System.arraycopy(b2, 0, total, b1.length, b2.length);\n        return total;\n    }\n\n    public static String calSignature(byte[] data, String secretKey) {\n        return AclSigner.calSignature(data, secretKey);\n    }\n\n    public static void IPv6AddressCheck(String netAddress) {\n        if (isAsterisk(netAddress) || isMinus(netAddress)) {\n            int asterisk = netAddress.indexOf(\"*\");\n            int minus = netAddress.indexOf(\"-\");\n            // '*' must be the end of netAddress if it exists\n            if (asterisk > -1 && asterisk != netAddress.length() - 1) {\n                throw new AclException(String.format(\"NetAddress examine scope Exception netAddress is %s\", netAddress));\n            }\n\n            // format like \"2::ac5:78:1-200:*\" or \"2::ac5:78:1-200\" is legal\n            if (minus > -1) {\n                if (asterisk == -1) {\n                    if (minus <= netAddress.lastIndexOf(\":\")) {\n                        throw new AclException(String.format(\"NetAddress examine scope Exception netAddress is %s\", netAddress));\n                    }\n                } else {\n                    if (minus <= netAddress.lastIndexOf(\":\", netAddress.lastIndexOf(\":\") - 1)) {\n                        throw new AclException(String.format(\"NetAddress examine scope Exception netAddress is %s\", netAddress));\n                    }\n                }\n            }\n        }\n    }\n\n    public static String v6ipProcess(String netAddress) {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/client/src/main/java/org/apache/rocketmq/acl/common/AclUtils.java#L56-L92","documentation":"AclUtils.IPv6AddressCheck validates the IPv6 address patterns allowed in plain_acl.yml (wildcard '*' and range '-') and throws when '*' appears anywhere but the last character. ACL rules may only end with a trailing wildcard like '2::ac5:78:*'; an embedded '*' such as '2::*:78' is rejected.","triggerScenarios":"Broker startup or client ACL load where an account's IPv6 white/black host entry contains '*' that is not the final character (e.g. '2001::*:5') or a host like '*:1::1'.","commonSituations":"Hand-editing plain_acl.yml IPv6 entries by analogy with IPv4 (where '192.168.*.*' style habits carry over); copy-pasting IPv6 templates that put the wildcard in the middle.","solutions":["Move the '*' to the very end of the address: '2::ac5:78:*' instead of '2::*:78'.","Use a range instead of a middle wildcard where possible: '2::ac5:78:1-200'.","After editing, validate the file by restarting the broker in foreground and watching for the AclException before it serves traffic."],"exampleFix":"# before (plain_acl.yml)\nwhiteRemoteAddress: '2::*:78'\n\n# after\nwhiteRemoteAddress: '2::ac5:78:*'","handlingStrategy":"validation","validationCode":"static boolean validIpv6AclPattern(String addr) {\n    int a = addr.indexOf('*');\n    if (a > -1 && a != addr.length() - 1) return false;\n    // further rules: see errors 124/125 for '-' placement\n    return true;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only trailing '*' wildcards in IPv6 ACL entries.","Lint plain_acl.yml in CI with a regex like ^[0-9a-fA-F:]+(-[0-9a-fA-F]+)?(:\\*)?$.","Document the legal IPv6 shapes ('fixed:lo-hi', 'prefix:*', 'prefix:lo-hi:*') next to the ACL file."],"tags":["rocketmq","acl","ipv6","configuration","validation"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}