stamparm/maltrail · error · ValueError

[x] invalid IP address

Error message

[x] invalid IP address '%s'

What it means

ipcat_lookup() parses the given address with addr_to_int() to query the local ranges table; when that fails (or the DB query errors) it deliberately re-raises as ValueError. It means the caller passed a string that is not a parseable IPv4/IPv6 address.

Solutions

1. Validate the address with a proper parser before calling (e.g. socket.inet_pton or ipaddress.ip_address())
2. Trim whitespace and strip port/scope from the input string
3. Reject/resolve hostnames to IPs first if hostnames are expected
4. Catch ValueError around ipcat_lookup and treat as unknown/invalid IP

Example fix

// before
retval = ipcat_lookup(user_input)
// after
import ipaddress
try:
    ip = str(ipaddress.ip_address(user_input.strip()))
    retval = ipcat_lookup(ip)
except ValueError:
    retval = None  # not a valid IP

import ipaddress, socket
def is_valid_ip(s):
    if not isinstance(s, str):
        return False
    try:
        ipaddress.ip_address(s.strip())
        return True
    except ValueError:
        return False

def looks_like_ip(s):
    try:
        socket.inet_pton(socket.AF_INET, s)
        return True
    except (OSError, TypeError):
        try:
            socket.inet_pton(socket.AF_INET6, s.split('%')[0])
            return True
        except (OSError, TypeError):
            return False

try:
    owner = ipcat_lookup(address)
except ValueError:
    owner = None  # unparseable address

When it happens

Trigger: ipcat_lookup('not-an-ip'), empty string, hostname ('example.com') instead of an IP, or IPv6 forms addr_to_int does not support.

Common situations: Unvalidated user/CGI input, log lines with hostnames, misparsed fields before calling _check_ip or _meta, stale cache logic after address normalization changes.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• not a Maltrail provenance sidecar (bad magic)
• provenance sidecar is truncated
• packet too short for header-protection sample
• trail bin too small
• bad trail bin magic

AI-assisted analysis of stamparm/maltrail@77cfb06d76 (2026-09-13). Data as JSON: /api/errors/2789f97e94ddfa54. Report an issue: GitHub.

Appendix: source

Thrown at core/common.py:282

                    _ipcat_cache[value] = name

    if address in _ipcat_cache:
        retval = _ipcat_cache[address]
    elif address in _ipcat_dynamic_cache:
        retval = _ipcat_dynamic_cache[address]
    else:
        retval = ""

        if os.path.isfile(IPCAT_SQLITE_FILE):
            with sqlite3.connect(IPCAT_SQLITE_FILE, isolation_level=None) as conn:
                cursor = conn.cursor()
                try:
                    _ = addr_to_int(address)
                    cursor.execute("SELECT name FROM ranges WHERE start_int <= ? AND end_int >= ?", (_, _))
                    _ = cursor.fetchone()
                    retval = str(_[0]) if _ else retval
                except Exception:
                    raise ValueError("[x] invalid IP address '%s'" % address)

                _ipcat_dynamic_cache[address] = retval

    return retval

def worst_asns(address):
    if not address:
        return None

    try:
        _ = addr_to_int(address)
        for prefix, mask, name in WORST_ASNS.get(address.split('.')[0], {}):
            if _ & mask == prefix:
                return name
    except (IndexError, ValueError):
        pass

    return None

View on GitHub (pinned to 77cfb06d76)