CompareIpByte silently continues after invalid IP bytes, causing wrong service address diffs
- Dominant language
- Go
- Stars
- 757
- Forks
- 276
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 2
Description
CompareIpByte in pkg/nets/nets.go logs an error when netip.AddrFromSlice fails but doesn't stop:
go
ip, ok := netip.AddrFromSlice(item)
if !ok {
log.Error("cannot compared IP: Unsupported data types")
}
aSet[ip.String()] = item
On failure ip is zero-value, ip.String() returns a fixed "invalid IP" string regardless of input. Multiple malformed items in a collide under the same key in aSet - only the last survives. Same bug in the second loop over b.
Used in workload_processor.go:824 to diff service addresses on update. A wrong diff here means a stale address never gets removed from the BPF map, or a valid one gets incorrectly removed.
Fix: continue after logging, in both loops, instead of falling through with a zero-value IP.
Contributor guide
Assessment
This issue has not been assessed yet.