What causes "invalid ip address: %s" in kgretzky/evilginx2?

Pass a bare, valid IPv4/IPv6 address (e.g. 192.168.1.15 or ::1) to AddIP

invalid ip address: %s

Error message

invalid ip address: %s

What it means

AddIP validates its argument with net.ParseIP and throws this error when the string is not a valid IPv4 or IPv6 address. The IP is neither added to the in-memory blocklist nor appended to the config file, so the blacklist state remains unchanged. It is a fail-fast input validation error.

Source

Thrown at core/blacklist.go:85

	log.Info("blacklist: loaded %d ip addresses and %d ip masks", len(bl.ips), len(bl.masks))
	return bl, nil
}

func (bl *Blacklist) GetStats() (int, int) {
	return len(bl.ips), len(bl.masks)
}

func (bl *Blacklist) AddIP(ip string) error {
	if bl.IsBlacklisted(ip) {
		return nil
	}

	ipv4 := net.ParseIP(ip)
	if ipv4 != nil {
		bl.ips[ipv4.String()] = &BlockIP{ipv4: ipv4, mask: nil}
	} else {
		return fmt.Errorf("invalid ip address: %s", ip)
	}

	// write to file
	f, err := os.OpenFile(bl.configPath, os.O_APPEND|os.O_WRONLY, 0644)
	if err != nil {
		return err
	}
	defer f.Close()

	_, err = f.WriteString(ipv4.String() + "\n")
	if err != nil {
		return err
	}

	return nil
}

func (bl *Blacklist) IsBlacklisted(ip string) bool {

View on GitHub (pinned to 4c0988a1d9)

Solutions

Pass a bare, valid IPv4/IPv6 address (e.g. 192.168.1.15 or ::1) to AddIP
Validate with net.ParseIP in the caller before calling AddIP and reject bad input at the HTTP layer
If you need to block a range, resolve or enumerate it yourself and add individual IPs, or extend the BlockIP mask support
Trim whitespace and strip any port (use net.SplitHostPort) before passing the value

Example fix

// before
err := bl.AddIP(r.URL.Query().Get("ip")) // ip="192.168.0.0/24"
// after
ip, _, _ := net.SplitHostPort(r.RemoteAddr)
if net.ParseIP(ip) == nil {
    http.Error(w, "bad ip", 400)
    return
}
err := bl.AddIP(ip)

Defensive patterns

Strategy: validation

Validate before calling

func validIP(s string) bool {
    return net.ParseIP(strings.TrimSpace(s)) != nil
}
// reject before AddIP if !validIP(input)

Type guard

func asIP(s string) (net.IP, bool) {
    ip := net.ParseIP(strings.TrimSpace(s))
    return ip, ip != nil
}

Try / catch

if err := bl.AddIP(raw); err != nil {
    if strings.HasPrefix(err.Error(), "invalid ip address:") {
        http.Error(w, "provide a bare IPv4/IPv6 address", http.StatusBadRequest)
        return
    }
    return err
}

Prevention

Validate with net.ParseIP before adding
Strip CIDR suffixes and ports; CIDR notation is not accepted
Trim whitespace from user-supplied input
Never pass hostnames where IPs are expected; resolve first

When it happens

Trigger: Calling AddIP (e.g. from the blacklist HTTP handler <anonymous> function) with a value like "banana", "256.1.1.1", "10.0.0.999", a CIDR like "192.168.0.0/24" (CIDR notation is not accepted here), or an empty string obtained from a missing query parameter.

Common situations: Automated scripts adding IPs with CIDR notation instead of a bare address; client sending a hostname instead of an IP; whitespace or junk in the remote_addr/query string; IPv6 with zone specifier like fe80::1%eth0.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/faa55de0ebc08834. Report an issue: GitHub.