dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-09 01:21:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disallow IPv6 multicast as bridge n/w subnet

Browse Source 
Signed-off-by: Rob Murray <rob.murray@docker.com>
This commit is contained in:
Rob Murray
2024-05-01 14:42:01 +01:00
parent aa3a86c038
commit a5f82ba4bf
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libnetwork/drivers/bridge/bridge_linux.go
View File

@@ -193,6 +193,9 @@ func validateIPv6Subnet(addr netip.Prefix) error {
if !addr.Addr().Is6() || addr.Addr().Is4In6() {
return fmt.Errorf("'%s' is not a valid IPv6 subnet", addr)
}
if addr.Addr().IsMulticast() {
return fmt.Errorf("multicast subnet '%s' is not allowed", addr)
}
if addr.Masked() != linkLocalPrefix && linkLocalPrefix.Overlaps(addr) {
return fmt.Errorf("'%s' clashes with the Link-Local prefix 'fe80::/64'", addr)
}

5
libnetwork/drivers/bridge/bridge_linux_test.go
View File

@@ -1046,6 +1046,11 @@ func TestValidateFixedCIDRV6(t *testing.T) {
input: "nonsense",
expectedErr: "invalid fixed-cidr-v6: netip.ParsePrefix(\"nonsense\"): no '/'",
},
{
doc: "multicast IPv6 subnet",
input: "ff05::/64",
expectedErr: "invalid fixed-cidr-v6: multicast subnet 'ff05::/64' is not allowed",
},
}
for _, tc := range tests {
tc := tc