reject ipv6

Signed-off-by: Arko Dasgupta <arko@tetrate.io>
envoyproxy · Oct 20, 2023 · 3834fe2 · 3834fe2
1 parent 53d159e
commit 3834fe2
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 2 deletions.
diff --git a/api/v1alpha1/validation/envoyproxy_validate.go b/api/v1alpha1/validation/envoyproxy_validate.go
@@ -101,8 +101,8 @@ func validateService(spec *egv1a1.EnvoyProxySpec) []error {
 				errs = append(errs, fmt.Errorf("loadBalancerIP can only be set for %v type", egv1a1.ServiceTypeLoadBalancer))
 			}
 
-			if net.ParseIP(*serviceLoadBalancerIP) == nil {
-				errs = append(errs, fmt.Errorf("loadBalancerIP:%s is an invalid IP address", *serviceLoadBalancerIP))
+			if ip := net.ParseIP(*serviceLoadBalancerIP); ip == nil || ip.To4() == nil {
+				errs = append(errs, fmt.Errorf("loadBalancerIP:%s is an invalid IPv4 address", *serviceLoadBalancerIP))
 			}
 		}
 	}

diff --git a/api/v1alpha1/validation/envoyproxy_validate_test.go b/api/v1alpha1/validation/envoyproxy_validate_test.go
@@ -255,6 +255,28 @@ func TestValidateEnvoyProxy(t *testing.T) {
 			},
 			expected: false,
 		},
+		{
+			name: "envoy service type 'LoadBalancer' with ipv6 loadBalancerIP",
+			proxy: &egv1a1.EnvoyProxy{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "test",
+					Name:      "test",
+				},
+				Spec: egv1a1.EnvoyProxySpec{
+					Provider: &egv1a1.EnvoyProxyProvider{
+						Type: egv1a1.ProviderTypeKubernetes,
+						Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
+							EnvoyService: &egv1a1.KubernetesServiceSpec{
+								Type:           egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+								LoadBalancerIP: ptr.To("2001:db8::68"),
+							},
+						},
+					},
+				},
+			},
+			expected: false,
+		},
+
 		{
 			name: "valid user bootstrap replace type",
 			proxy: &egv1a1.EnvoyProxy{