From 5131b9281094eee0da285b32985dfa075d09e190 Mon Sep 17 00:00:00 2001 From: Maximilian Rink Date: Mon, 24 Aug 2026 21:46:05 +0200 Subject: [PATCH 1/2] test(endpoints): follow WireGuard clear refactor Signed-off-by: Maximilian Rink --- pkg/endpoints/endpoints_wireguard_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/endpoints/endpoints_wireguard_test.go b/pkg/endpoints/endpoints_wireguard_test.go index 3f9abc55..5173f6b4 100644 --- a/pkg/endpoints/endpoints_wireguard_test.go +++ b/pkg/endpoints/endpoints_wireguard_test.go @@ -6,7 +6,7 @@ import ( v1 "k8s.io/api/core/v1" ) -func TestWireguardDeleteDoesNotDereferenceNilServiceContext(t *testing.T) { +func TestWireguardClearDoesNotDereferenceNilServiceContext(t *testing.T) { worker := &wireguardWorker{} service := &v1.Service{} From d6e57534642811ee89fc2d6749baa5968515b587 Mon Sep 17 00:00:00 2001 From: Maximilian Rink Date: Sun, 23 Aug 2026 23:00:11 +0200 Subject: [PATCH 2/2] fix(vip): apply per-call DAD skip instead of leaking it into persistent state Signed-off-by: Maximilian Rink --- pkg/vip/address.go | 10 ++++++--- pkg/vip/address_dad_linux_test.go | 37 +++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 3 deletions(-) create mode 100644 pkg/vip/address_dad_linux_test.go diff --git a/pkg/vip/address.go b/pkg/vip/address.go index 0ecb4f85..1ed86f94 100644 --- a/pkg/vip/address.go +++ b/pkg/vip/address.go @@ -469,9 +469,13 @@ func (configurator *network) AddIP(precheck bool, skipDAD bool, minLifetime ...i // an address that we know should be ours (e.g., after DADFAILED recovery). // We also allow to globally configure NODAD in case user knows they are running in an // environment where multiple nodes may advertise the same VIP (e.g., ECMP routing). - if configurator.shouldSkipDAD(skipDAD) && utils.IsIPv6(configurator.address.IP.String()) { - configurator.address.Flags |= unix.IFA_F_NODAD - log.Debug("Setting IFA_F_NODAD flag for IPv6 address to skip DAD", "ip", configurator.address.IP.String()) + if utils.IsIPv6(configurator.address.IP.String()) { + if configurator.shouldSkipDAD(skipDAD) { + configurator.address.Flags |= unix.IFA_F_NODAD + log.Debug("Setting IFA_F_NODAD flag for IPv6 address to skip DAD", "ip", configurator.address.IP.String()) + } else { + configurator.address.Flags &^= unix.IFA_F_NODAD + } } log.Debug("replacing IP", "address", configurator.address) diff --git a/pkg/vip/address_dad_linux_test.go b/pkg/vip/address_dad_linux_test.go new file mode 100644 index 00000000..a2ec6d46 --- /dev/null +++ b/pkg/vip/address_dad_linux_test.go @@ -0,0 +1,37 @@ +//go:build linux + +package vip + +import ( + "testing" + + "github.com/kube-vip/kube-vip/pkg/networkinterface" + "github.com/vishvananda/netlink" + "golang.org/x/sys/unix" +) + +func TestAddIPPerCallDADSkipDoesNotPersist(t *testing.T) { + address, err := netlink.ParseAddr("2001:db8::10/128") + if err != nil { + t.Fatal(err) + } + + configurator := &network{ + address: address, + link: &networkinterface.Link{ + Intf: &netlink.Dummy{LinkAttrs: netlink.LinkAttrs{Name: "kube-vip-dad-test"}}, + }, + } + + // The netlink operation may fail without CAP_NET_ADMIN, but the address + // flags are set before that operation and are what this test exercises. + _, _ = configurator.AddIP(false, true) + if configurator.address.Flags&unix.IFA_F_NODAD == 0 { + t.Fatal("skipDAD=true did not set IFA_F_NODAD") + } + + _, _ = configurator.AddIP(false, false) + if configurator.address.Flags&unix.IFA_F_NODAD != 0 { + t.Fatal("IFA_F_NODAD persisted into a normal AddIP call") + } +}