fix(*): localhost exposed application shouldn't be reachable

app/kuma-dp/cmd/run.go

@@ -1,7 +1,6 @@
 package cmd
 
 import (
-	"net"
 	"os"
 	"path/filepath"
 	"time"
@@ -26,6 +25,7 @@ import (
 	"github.com/kumahq/kuma/pkg/util/proto"
 	kuma_version "github.com/kumahq/kuma/pkg/version"
 	"github.com/kumahq/kuma/pkg/xds/bootstrap/types"
+	xds_generator "github.com/kumahq/kuma/pkg/xds/generator"
 )
 
 var runLog = dataplaneLog.WithName("run")
@@ -300,7 +300,7 @@ func getApplicationsToScrape(kumaSidecarConfiguration *types.KumaSidecarConfigur
 				Name:          item.Name,
 				Path:          item.Path,
 				Port:          item.Port,
-				IsIPv6:        isIPv6(item.Address),
+				IsIPv6:        xds_generator.IsAddressIPv6(item.Address),
 				QueryModifier: metrics.RemoveQueryParameters,
 			})
 		}
@@ -324,15 +324,3 @@ func writeFile(filename string, data []byte, perm os.FileMode) error {
 	}
 	return os.WriteFile(filename, data, perm)
 }
-
-func isIPv6(address string) bool {
-	if address == "" {
-		return false
-	}
-	ip := net.ParseIP(address)
-	if ip == nil {
-		return false
-	}
-
-	return ip.To4() == nil
-}

pkg/xds/bootstrap/generator.go

@@ -208,12 +208,9 @@ func (b *bootstrapGenerator) getMetricsConfig(
 	}
 
 	var address string
-	var isIPv6 bool
 	if b.enableLocalhostInboundCluster {
-		isIPv6 = false
 		address = core_mesh.IPv4Loopback.String()
 	} else {
-		isIPv6 = dataplane.IsIPv6()
 		address = dataplane.Spec.GetNetworking().GetAddress()
 	}
 
@@ -228,7 +225,6 @@ func (b *bootstrapGenerator) getMetricsConfig(
 				Name:    config.Name,
 				Port:    config.Port,
 				Path:    config.Path,
-				IsIPv6:  isIPv6,
 			})
 		}
 		kumaDpBootstrap.AggregateMetricsConfig = aggregateConfig

pkg/xds/bootstrap/handler.go

@@ -121,7 +121,6 @@ func createBootstrapResponse(bootstrap []byte, config *KumaDpBootstrap) *types.B
 			Name:    value.Name,
 			Port:    value.Port,
 			Path:    value.Path,
-			IsIPv6:  value.IsIPv6,
 		})
 	}
 	bootstrapConfig.KumaSidecarConfiguration = types.KumaSidecarConfiguration{

pkg/xds/bootstrap/parameters.go

@@ -15,7 +15,6 @@ type AggregateMetricsConfig struct {
 	Path    string
 	Address string
 	Port    uint32
-	IsIPv6  bool
 }
 
 type configParameters struct {

pkg/xds/bootstrap/types/bootstrap_response.go

@@ -29,5 +29,4 @@ type Aggregate struct {
 	Address string `json:"address"`
 	Port    uint32 `json:"port"`
 	Path    string `json:"path"`
-	IsIPv6  bool   `json:"isIPv6"`
 }

pkg/xds/generator/inbound_proxy_generator.go

@@ -43,7 +43,7 @@ func (g InboundProxyGenerator) Generate(ctx xds_context.Context, proxy *core_xds
 		// localhost traffic is routed dirrectly to the application, in case of other interface we are going to set source address to
 		// 127.0.0.6 to avoid redirections and thanks to first iptables rule just return fast
 		if endpoint.WorkloadIP != core_mesh.IPv4Loopback.String() || endpoint.WorkloadIP != core_mesh.IPv6Loopback.String() {
-			switch proxy.Dataplane.IsIPv6() {
+			switch IsAddressIPv6(endpoint.WorkloadIP) {
 			case true:
 				clusterBuilder.Configure(envoy_clusters.UpstreamBindConfig(inPassThroughIPv6, 0))
 			case false:

pkg/xds/generator/utils.go

@@ -0,0 +1,16 @@
+package generator
+
+import "net"
+
+func IsAddressIPv6(address string) bool {
+	if address == "" {
+		return false
+	}
+
+	ip := net.ParseIP(address)
+	if ip == nil {
+		return false
+	}
+
+	return ip.To4() == nil
+}

test/e2e_env/multizone/inbound_communication/inbound_passthrough_disabled.go

@@ -18,7 +18,6 @@ func InboundPassthroughDisabled() {
 		localhostAddress := "127.0.0.1"
 		wildcardAddress := "0.0.0.0"
 		if Config.IPV6 {
-			localhostAddress = "::1"
 			wildcardAddress = "::"
 		}