github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-04 18:00:08 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #86578 from tnqn/except-validation

Browse Source 
Validate Except of IPBlock for NetworkPolicy spec
This commit is contained in:
Kubernetes Prow Robot 2020-02-08 14:45:53 -08:00 committed by GitHub
commit 0c6470115e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/apis/networking/validation/validation.go
View File

@ -165,8 +165,10 @@ func ValidateIPBlock(ipb *networking.IPBlock, fldPath *field.Path) field.ErrorLi
allErrs = append(allErrs, field.Invalid(exceptPath, exceptIP, "not a valid CIDR")) allErrs = append(allErrs, field.Invalid(exceptPath, exceptIP, "not a valid CIDR"))
return allErrs return allErrs
} }
if !cidrIPNet.Contains(exceptCIDR.IP) { cidrMaskLen, _ := cidrIPNet.Mask.Size()
allErrs = append(allErrs, field.Invalid(exceptPath, exceptCIDR.IP, "not within CIDR range")) exceptMaskLen, _ := exceptCIDR.Mask.Size()
if !cidrIPNet.Contains(exceptCIDR.IP) || cidrMaskLen >= exceptMaskLen {
allErrs = append(allErrs, field.Invalid(exceptPath, exceptIP, "must be a strict subset of `cidr`"))
} }
} }
return allErrs return allErrs

20
pkg/apis/networking/validation/validation_test.go
View File

@ -715,6 +715,26 @@ func TestValidateNetworkPolicy(t *testing.T) {
}, },
}, },
}, },
"except IP is not strictly within CIDR range": {
ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
Spec: networking.NetworkPolicySpec{
PodSelector: metav1.LabelSelector{
MatchLabels: map[string]string{"a": "b"},
},
Ingress: []networking.NetworkPolicyIngressRule{
{
From: []networking.NetworkPolicyPeer{
{
IPBlock: &networking.IPBlock{
CIDR: "192.168.0.0/24",
Except: []string{"192.168.0.0/24"},
},
},
},
},
},
},
},
"except IPv6 is outside of CIDR range": { "except IPv6 is outside of CIDR range": {
ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"}, ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
Spec: networking.NetworkPolicySpec{ Spec: networking.NetworkPolicySpec{