cli: Only bind ephemeral ports on localhost (#7838)

Most of our port forwards are created against localhost, except for when exposing the dashboard with a user-specified host. Our socket binding (for ephemeral ports), however, binds against all interfaces. This change modifies ephemeral port binding to only occur on the loopback interface. Signed-off-by: Oliver Gould <ver@buoyant.io>
linkerd · Dec 2, 2022 · 732d2e9 · 732d2e9
1 parent c013224
commit 732d2e9
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/pkg/k8s/portforward.go b/pkg/k8s/portforward.go
@@ -142,6 +142,10 @@ func newPortForward(
 
 	var err error
 	if localPort == 0 {
+		if host != "localhost" {
+			return nil, fmt.Errorf("local port must be specified when host is not localhost")
+		}
+
 		localPort, err = getEphemeralPort()
 		if err != nil {
 			return nil, err
@@ -247,7 +251,7 @@ func (pf *PortForward) AddressAndPort() string {
 // getEphemeralPort selects a port for the port-forwarding. It binds to a free
 // ephemeral port and returns the port number.
 func getEphemeralPort() (int, error) {
-	ln, err := net.Listen("tcp", ":0")
+	ln, err := net.Listen("tcp", "localhost:0")
 	if err != nil {
 		return 0, err
 	}