grpc/grpc-java · error · IllegalArgumentException

IP address can not be found: " + ex

Error message

IP address can not be found: " + ex

What it means

RbacFilter.resolve converts a CIDR range's address prefix into an InetAddress using InetAddress.getByName. If the host cannot be resolved (UnknownHostException), it wraps the failure in this IllegalArgumentException, meaning the RBAC config contains an IP literal or prefix that cannot be turned into an address.

Source

Thrown at xds/src/main/java/io/grpc/xds/RbacFilter.java:363

  private static DestinationPortRangeMatcher parseDestinationPortRangeMatcher(Int32Range range) {
    return DestinationPortRangeMatcher.create(range.getStart(), range.getEnd());
  }

  private static DestinationIpMatcher createDestinationIpMatcher(CidrRange cidrRange) {
    return DestinationIpMatcher.create(Matchers.CidrMatcher.create(
            resolve(cidrRange), cidrRange.getPrefixLen().getValue()));
  }

  private static SourceIpMatcher createSourceIpMatcher(CidrRange cidrRange) {
    return SourceIpMatcher.create(Matchers.CidrMatcher.create(
            resolve(cidrRange), cidrRange.getPrefixLen().getValue()));
  }

  private static InetAddress resolve(CidrRange cidrRange) {
    try {
      return InetAddress.getByName(cidrRange.getAddressPrefix());
    } catch (UnknownHostException ex) {
      throw new IllegalArgumentException("IP address can not be found: " + ex);
    }
  }
}

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Fix the address_prefix in the RBAC config to a valid IP literal (IPv4 or IPv6)
2. Remove any CIDR range entries with invalid or unresolvable addresses
3. Verify DNS resolution is available if a hostname is intentionally used

Example fix

// before
{"sourceIp": {"addressPrefix": "10.0.0.256", "prefixLen": 32}}
// after
{"sourceIp": {"addressPrefix": "10.0.0.1", "prefixLen": 32}}

try {
  InetAddress addr = InetAddress.getByName(cidr.getAddressPrefix());
} catch (UnknownHostException e) {
  throw new IllegalArgumentException("Invalid CIDR address prefix: " + cidr.getAddressPrefix(), e);
}

try {
  rbacFilter.parseFrom(proto);
} catch (IllegalArgumentException e) {
  logger.atWarning().withCause(e).log("Rejecting RBAC config: %s", e.getMessage());
  return Status.INVALID_ARGUMENT.withDescription(e.getMessage()).asException();
}

When it happens

Trigger: parsePermission/parsePrincipal building an IP or source-IP matcher from a CidrRange whose addressPrefix is an unresolvable hostname or malformed address string.

Common situations: Typo in an IP literal (e.g. '300.1.2.3'), using a DNS name in an environment without DNS, or IPv6 addresses written incorrectly in RBAC policy configs.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Address is not an IP
• Unknown permission rule case: " + permission.getRuleCase()
• Unknown principal identifier case: " + principal.getIdentifi
• Unknown path matcher rule type: " + proto.getRuleCase()
• Invalid header matcher config: [grpc-] prefixed header name

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/f990a3334999a9dd. Report an issue: GitHub.