Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate Service.Spec.publicIPs to be a valid IP that is not a localhost #5508

Merged
merged 1 commit into from
Mar 25, 2015
+65 −0
Merged

Validate Service.Spec.publicIPs to be a valid IP that is not a localhost #5508

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions pkg/api/validation/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -758,6 +758,14 @@ func ValidateService(service *api.Service) errs.ValidationErrorList {
}
}

for _, ip := range service.Spec.PublicIPs {
if ip == "0.0.0.0" {
allErrs = append(allErrs, errs.NewFieldInvalid("spec.publicIPs", ip, "is not an IP address"))
} else if util.IsValidIP(ip) && net.ParseIP(ip).IsLoopback() {
allErrs = append(allErrs, errs.NewFieldInvalid("spec.publicIPs", ip, "publicIP cannot be a loopback"))
}
}

return allErrs
}

Expand Down
21 changes: 21 additions & 0 deletions pkg/api/validation/validation_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1170,6 +1170,27 @@ func TestValidateService(t *testing.T) {
},
numErrs: 1,
},
{
name: "invalid publicIPs localhost",
makeSvc: func(s *api.Service) {
s.Spec.PublicIPs = []string{"127.0.0.1"}
},
numErrs: 1,
},
{
name: "invalid publicIPs",
makeSvc: func(s *api.Service) {
s.Spec.PublicIPs = []string{"0.0.0.0"}
},
numErrs: 1,
},
{
name: "valid publicIPs host",
makeSvc: func(s *api.Service) {
s.Spec.PublicIPs = []string{"myhost.mydomain"}
},
numErrs: 0,
},
{
name: "nil selector",
makeSvc: func(s *api.Service) {
Expand Down
6 changes: 6 additions & 0 deletions pkg/util/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ limitations under the License.
package util

import (
"net"
"regexp"
)

Expand Down Expand Up @@ -94,3 +95,8 @@ func IsCIdentifier(value string) bool {
func IsValidPortNum(port int) bool {
return 0 < port && port < 65536
}

// IsValidIP tests that the argument is a valid IPv4 address.
func IsValidIP(value string) bool {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you rename it to IsValidIPv4, to make it more explicit.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be honest I'd prefer to keep the name as is, because from k8s perspective this verifies whether it's a valid IP (because k8s works only for v4).

return net.ParseIP(value) != nil && net.ParseIP(value).To4() != nil
}
30 changes: 30 additions & 0 deletions pkg/util/validation_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,3 +222,33 @@ func TestIsValidLabelValue(t *testing.T) {
}
}
}

func TestIsValidIP(t *testing.T) {
goodValues := []string{
"1.1.1.1",
"1.1.1.01",
"255.0.0.1",
"1.0.0.0",
"0.0.0.0",
}
for _, val := range goodValues {
if !IsValidIP(val) {
t.Errorf("expected true for %q", val)
}
}

badValues := []string{
"2a00:79e0:2:0:f1c3:e797:93c1:df80", // This is valid IPv6
"a",
"myhost.mydomain",
"-1.0.0.0",
"1.0.0.256",
"1.0.0.1.1",
"1.0.0.1.",
}
for _, val := range badValues {
if IsValidIP(val) {
t.Errorf("expected false for %q", val)
}
}
}