kubeovn / kube-ovn / 23737944679

25%

push

github

fix(daemon): harden protocol iteration and bounds checks in gateway (#6547)

* fix(daemon): use append pattern for protocols slice in gateway functions

setIPSet, gcIPSet, and setPolicyRouting used make([]string, 2) with index
assignment, causing an empty string iteration in non-dual-stack mode.
Use make([]string, 0, 2) + append to match the existing setIptables style.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* fix(daemon): guard ips[1] access and handle unknown nat policy action

In getLocalPodIPsNeedPR, `ips` has at most 1 element per protocol, so
the else branch accessing ips[1] would panic if reached (e.g. in
IPv6-first dual-stack clusters where PodIPs ordering is reversed).
Add len(ips) >= 2 bounds check.

In generateNatOutgoingPolicyChainRules, add default: continue to the
action switch to skip unknown actions instead of generating invalid
iptables rules with an empty --set-xmark value.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* fix(daemon): log warning for unknown nat outgoing policy action

Address review feedback: log a warning with subnet name and action
value before skipping rules with unknown actions, so misconfigurations
are visible rather than silently dropped.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

---------

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

0 of 13 new or added lines in 1 file covered. (0.0%)

13534 of 55687 relevant lines covered (24.3%)

0.28 hits per line