Merge pull request #110364 from danbudris/automated-cherry-pick-of-#1…

…07402-upstream-release-1.21 Automated cherry pick of #107402: Reject proxy requests to 0.0.0.0 as well
kubernetes · Jun 7, 2022 · 80390b8 · 80390b8
2 parents a24eb09 + 1419c08
commit 80390b8
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/pkg/proxy/util/utils.go b/pkg/proxy/util/utils.go
@@ -96,7 +96,7 @@ func IsProxyableIP(ip string) error {
 }
 
 func isProxyableIP(ip net.IP) error {
-	if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsInterfaceLocalMulticast() {
+	if !ip.IsGlobalUnicast() {
 		return ErrAddressNotAllowed
 	}
 	return nil

diff --git a/pkg/proxy/util/utils_test.go b/pkg/proxy/util/utils_test.go
@@ -104,6 +104,7 @@ func TestIsProxyableIP(t *testing.T) {
 		ip   string
 		want error
 	}{
+		{"0.0.0.0", ErrAddressNotAllowed},
 		{"127.0.0.1", ErrAddressNotAllowed},
 		{"127.0.0.2", ErrAddressNotAllowed},
 		{"169.254.169.254", ErrAddressNotAllowed},
@@ -113,6 +114,7 @@ func TestIsProxyableIP(t *testing.T) {
 		{"192.168.0.1", nil},
 		{"172.16.0.1", nil},
 		{"8.8.8.8", nil},
+		{"::", ErrAddressNotAllowed},
 		{"::1", ErrAddressNotAllowed},
 		{"fe80::", ErrAddressNotAllowed},
 		{"ff02::", ErrAddressNotAllowed},