CompareIpByte in pkg/nets/nets.go logs an error when netip.AddrFromSlice fails but doesn't stop:
go
ip, ok := netip.AddrFromSlice(item)
if !ok {
log.Error("cannot compared IP: Unsupported data types")
}
aSet[ip.String()] = item
On failure ip is zero-value, ip.String() returns a fixed "invalid IP" string regardless of input. Multiple malformed items in a collide under the same key in aSet - only the last survives. Same bug in the second loop over b.
Used in workload_processor.go:824 to diff service addresses on update. A wrong diff here means a stale address never gets removed from the BPF map, or a valid one gets incorrectly removed.
Fix: continue after logging, in both loops, instead of falling through with a zero-value IP.
CompareIpByte in pkg/nets/nets.go logs an error when netip.AddrFromSlice fails but doesn't stop:
go
ip, ok := netip.AddrFromSlice(item)
if !ok {
log.Error("cannot compared IP: Unsupported data types")
}
aSet[ip.String()] = item
On failure ip is zero-value, ip.String() returns a fixed "invalid IP" string regardless of input. Multiple malformed items in a collide under the same key in aSet - only the last survives. Same bug in the second loop over b.
Used in workload_processor.go:824 to diff service addresses on update. A wrong diff here means a stale address never gets removed from the BPF map, or a valid one gets incorrectly removed.
Fix: continue after logging, in both loops, instead of falling through with a zero-value IP.