Skip to content

cli/command/container: don't silently drop invalid --ip and --link-local-ip values #7335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
breken-ai wants to merge 2 commits into
base: master
Choose a base branch
from
+24 −5
Open

cli/command/container: don't silently drop invalid --ip and --link-local-ip values #7335

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b48c22e
cli/command/container: reject --ip and --ip6 values of the wrong family
breken-ai Sep 25, 2026
db8f7b0
cli/command/container: validate --link-local-ip values
breken-ai Sep 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions cli/command/container/opts.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ func addFlags(flags *pflag.FlagSet) *containerOptions {
groupAdd: opts.NewListOpts(nil),
labels: opts.NewListOpts(opts.ValidateLabel),
labelsFile: opts.NewListOpts(nil),
linkLocalIPs: opts.NewListOpts(nil),
linkLocalIPs: opts.NewListOpts(opts.ValidateIPAddress),
links: opts.NewListOpts(opts.ValidateLink),
loggingOpts: opts.NewListOpts(nil),
publish: opts.NewListOpts(nil),
Expand Down Expand Up @@ -843,14 +843,18 @@ func applyContainerOptions(n *opts.NetworkAttachmentOpts, copts *containerOption
copy(n.Links, copts.links.GetSlice())
}
if copts.ipv4Address != nil {
if ipv4, ok := netip.AddrFromSlice(copts.ipv4Address.To4()); ok {
n.IPv4Address = ipv4
ipv4, ok := netip.AddrFromSlice(copts.ipv4Address.To4())
if !ok {
return invalidParameter(fmt.Errorf("invalid IPv4 address for --ip: %s", copts.ipv4Address))
}
n.IPv4Address = ipv4
}
if copts.ipv6Address != nil {
if ipv6, ok := netip.AddrFromSlice(copts.ipv6Address.To16()); ok {
n.IPv6Address = ipv6
ipv6, ok := netip.AddrFromSlice(copts.ipv6Address.To16())
if !ok || copts.ipv6Address.To4() != nil {
return invalidParameter(fmt.Errorf("invalid IPv6 address for --ip6: %s", copts.ipv6Address))
}
n.IPv6Address = ipv6
}
if copts.macAddress != "" {
n.MacAddress = copts.macAddress
Expand Down
15 changes: 15 additions & 0 deletions cli/command/container/opts_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -756,6 +756,21 @@ func TestParseNetworkConfig(t *testing.T) {
flags: []string{"--network", "name=net1,mac-address=foobar"},
expectedErr: "foobar is not a valid mac address",
},
{
name: "invalid-ip-is-ipv6",
flags: []string{"--network", "net1", "--ip", "2001:db8::8822"},
expectedErr: "invalid IPv4 address for --ip: 2001:db8::8822",
},
{
name: "invalid-ip6-is-ipv4",
flags: []string{"--network", "net1", "--ip6", "172.20.88.22"},
expectedErr: "invalid IPv6 address for --ip6: 172.20.88.22",
},
{
name: "invalid-link-local-ip",
flags: []string{"--network", "net1", "--link-local-ip", "foobar"},
expectedErr: `invalid argument "foobar" for "--link-local-ip" flag: IP address is not correctly formatted: foobar`,
},
}

for _, tc := range tests {
Expand Down