github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check loopback and link-local multicast endpoints

Browse Source 
Previously we just disallowed link-local (unicast).  This disallows loopback
and link-local multicast.
This commit is contained in:
Tim Hockin
2015-07-03 21:05:15 -07:00
parent b5a4a548df
commit 86f4535871
7 changed files with 47 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
pkg/api/validation/validation.go
View File

@@ -1734,24 +1734,25 @@ func validateEndpointSubsets(subsets []api.EndpointSubset) errs.ValidationErrorL
return allErrs
}
var linkLocalNet *net.IPNet
func validateEndpointAddress(address *api.EndpointAddress) errs.ValidationErrorList {
if linkLocalNet == nil {
var err error
_, linkLocalNet, err = net.ParseCIDR("169.254.0.0/16")
if err != nil {
glog.Errorf("Failed to parse link-local CIDR: %v", err)
}
}
allErrs := errs.ValidationErrorList{}
if !util.IsValidIPv4(address.IP) {
allErrs = append(allErrs, errs.NewFieldInvalid("ip", address.IP, "invalid IPv4 address"))
return allErrs
}
if linkLocalNet.Contains(net.ParseIP(address.IP)) {
// We disallow some IPs as endpoints. Specifically, loopback addresses are
// nonsensical and link-local addresses tend to be used for node-centric
// purposes (e.g. metadata service).
ip := net.ParseIP(address.IP)
if ip.IsLoopback() {
allErrs = append(allErrs, errs.NewFieldInvalid("ip", address.IP, "may not be in the loopback range (127.0.0.0/8)"))
}
if ip.IsLinkLocalUnicast() {
allErrs = append(allErrs, errs.NewFieldInvalid("ip", address.IP, "may not be in the link-local range (169.254.0.0/16)"))
}
if ip.IsLinkLocalMulticast() {
allErrs = append(allErrs, errs.NewFieldInvalid("ip", address.IP, "may not be in the link-local multicast range (224.0.0.0/24)"))
}
return allErrs
}

26
pkg/api/validation/validation_test.go
View File

@@ -3948,6 +3948,19 @@ func TestValidateEndpoints(t *testing.T) {
},
errorType: "FieldValueRequired",
},
"Address is loopback": {
endpoints: api.Endpoints{
ObjectMeta: api.ObjectMeta{Name: "mysvc", Namespace: "namespace"},
Subsets: []api.EndpointSubset{
{
Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
Ports: []api.EndpointPort{{Name: "p", Port: 93, Protocol: "TCP"}},
},
},
},
errorType: "FieldValueInvalid",
errorDetail: "loopback",
},
"Address is link-local": {
endpoints: api.Endpoints{
ObjectMeta: api.ObjectMeta{Name: "mysvc", Namespace: "namespace"},
@@ -3961,6 +3974,19 @@ func TestValidateEndpoints(t *testing.T) {
errorType: "FieldValueInvalid",
errorDetail: "link-local",
},
"Address is link-local multicast": {
endpoints: api.Endpoints{
ObjectMeta: api.ObjectMeta{Name: "mysvc", Namespace: "namespace"},
Subsets: []api.EndpointSubset{
{
Addresses: []api.EndpointAddress{{IP: "224.0.0.1"}},
Ports: []api.EndpointPort{{Name: "p", Port: 93, Protocol: "TCP"}},
},
},
},
errorType: "FieldValueInvalid",
errorDetail: "link-local multicast",
},
}
for k, v := range errorCases {