What causes "invalid IP address: %w" in cilium/cilium?

Correct the IP portion to a valid dotted-quad or IPv6 literal, e.g. 192.168.1.10@3 or fd00::a@3

invalid IP address: %w

Error message

invalid IP address: %w

What it means

After splitting on '@', the IP portion is validated with index.NetIPAddrString; an unparseable or invalid IP yields this wrapped error. It protects the neighbor map from keys containing malformed addresses.

Source

Thrown at pkg/datapath/neighbor/desired_neighbor.go:60

}

func (dn DesiredNeighborKey) TableKey() index.Key {
	return append(index.Int(dn.IfIndex), index.NetIPAddr(dn.IP)...)
}

func (dn *DesiredNeighborKey) String() string {
	return fmt.Sprintf("%s@%d", dn.IP.String(), dn.IfIndex)
}

func desiredNeighborKeyFromString(s string) (index.Key, error) {
	ipStr, ifIndexStr, ok := strings.Cut(s, "@")
	if !ok {
		return nil, fmt.Errorf("invalid key format: '%s' expected {ip}@{ifindex}", s)
	}

	ip, err := index.NetIPAddrString(ipStr)
	if err != nil {
		return nil, fmt.Errorf("invalid IP address: %w", err)
	}

	ifIndex, err := index.IntString(ifIndexStr)
	if err != nil {
		return nil, fmt.Errorf("invalid interface index: %w", err)
	}

	return append(ifIndex, ip...), nil
}

func (dn *DesiredNeighbor) TableHeader() []string {
	return []string{
		"IP",
		"Link",
		"Status",
	}
}

View on GitHub (pinned to ac7b90affa)

Solutions

Correct the IP portion to a valid dotted-quad or IPv6 literal, e.g. 192.168.1.10@3 or fd00::a@3
Strip any port/zone suffixes before passing the string
Build the key programmatically from a net.IP via DesiredNeighborKey to avoid string mistakes

Example fix

// before
key, err := desiredNeighborKeyFromString("host.example@3")
// after
key, err := desiredNeighborKeyFromString("192.168.1.10@3")

Defensive patterns

Strategy: validation

Validate before calling

func validIPPortion(s string) bool { a, _, ok := strings.Cut(s, "@"); return ok && net.ParseIP(a) != nil }

Try / catch

if net.ParseIP(ipStr) == nil { log.Warnf("bad IP in neighbor key %q", s); return nil }

Prevention

Strip ports/zones from IP strings before key construction
Use net.IPNet/net.IP objects rather than raw strings when composing keys
Add unit tests for malformed IP inputs to the key parser

When it happens

Trigger: desiredNeighborKeyFromString called with '{bad-ip}@<ifindex>' where bad-ip fails net.ParseIP/IPAddr parsing — e.g. empty string, hostname, or truncated IPv6.

Common situations: Hand-written keys using hostnames instead of IPs; locale/typo errors; parsing outputs where extra characters got glued to the IP (ports, zone specifiers).

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/b866c1e1b1d71e0e. Report an issue: GitHub.