From a5f82ba4bf9771c65b07d62e5a7a6adcf7fd4473 Mon Sep 17 00:00:00 2001 From: Rob Murray Date: Wed, 1 May 2024 14:42:01 +0100 Subject: [PATCH] Disallow IPv6 multicast as bridge n/w subnet Signed-off-by: Rob Murray --- libnetwork/drivers/bridge/bridge_linux.go | 3 +++ libnetwork/drivers/bridge/bridge_linux_test.go | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/libnetwork/drivers/bridge/bridge_linux.go b/libnetwork/drivers/bridge/bridge_linux.go index 43de259526..825f5ceef3 100644 --- a/libnetwork/drivers/bridge/bridge_linux.go +++ b/libnetwork/drivers/bridge/bridge_linux.go @@ -193,6 +193,9 @@ func validateIPv6Subnet(addr netip.Prefix) error { if !addr.Addr().Is6() || addr.Addr().Is4In6() { return fmt.Errorf("'%s' is not a valid IPv6 subnet", addr) } + if addr.Addr().IsMulticast() { + return fmt.Errorf("multicast subnet '%s' is not allowed", addr) + } if addr.Masked() != linkLocalPrefix && linkLocalPrefix.Overlaps(addr) { return fmt.Errorf("'%s' clashes with the Link-Local prefix 'fe80::/64'", addr) } diff --git a/libnetwork/drivers/bridge/bridge_linux_test.go b/libnetwork/drivers/bridge/bridge_linux_test.go index cc8fee45b0..bf8da3c2c1 100644 --- a/libnetwork/drivers/bridge/bridge_linux_test.go +++ b/libnetwork/drivers/bridge/bridge_linux_test.go @@ -1046,6 +1046,11 @@ func TestValidateFixedCIDRV6(t *testing.T) { input: "nonsense", expectedErr: "invalid fixed-cidr-v6: netip.ParsePrefix(\"nonsense\"): no '/'", }, + { + doc: "multicast IPv6 subnet", + input: "ff05::/64", + expectedErr: "invalid fixed-cidr-v6: multicast subnet 'ff05::/64' is not allowed", + }, } for _, tc := range tests { tc := tc