Skip to content
This repository was archived by the owner on May 28, 2021. It is now read-only.

Commit 31143c5

Browse files
gianlucaborelloprydie
authored andcommitted
CIDR fixes and kops support (#184)
* Better validation for private address ranges. Signed-off-by: Gianluca Borello <g.borello@gmail.com> * Support RFC 6598 addresses, improperly used by kops. Signed-off-by: Gianluca Borello <g.borello@gmail.com>
1 parent 8c80924 commit 31143c5

File tree

2 files changed

+45
-9
lines changed

2 files changed

+45
-9
lines changed

pkg/cluster/instance.go

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -129,16 +129,25 @@ func (i *Instance) PodName() string {
129129

130130
// WhitelistCIDR returns the CIDR range to whitelist for GR based on the Pod's IP.
131131
func (i *Instance) WhitelistCIDR() (string, error) {
132-
switch i.IP.To4()[0] {
133-
case 10:
134-
return "10.0.0.0/8", nil
135-
case 172:
136-
return "172.16.0.0/12", nil
137-
case 192:
138-
return "192.168.0.0/16", nil
139-
default:
140-
return "", errors.Errorf("pod IP %q is not a private IPv4 address", i.IP.String())
132+
var privateRanges []*net.IPNet
133+
134+
for _, addrRange := range []string{
135+
"10.0.0.0/8",
136+
"172.16.0.0/12",
137+
"192.168.0.0/16",
138+
"100.64.0.0/10", // IPv4 shared address space (RFC 6598), improperly used by kops
139+
} {
140+
_, block, _ := net.ParseCIDR(addrRange)
141+
privateRanges = append(privateRanges, block)
141142
}
143+
144+
for _, block := range privateRanges {
145+
if block.Contains(i.IP) {
146+
return block.String(), nil
147+
}
148+
}
149+
150+
return "", errors.Errorf("pod IP %q is not a private IPv4 address", i.IP.String())
142151
}
143152

144153
// statefulPodRegex is a regular expression that extracts the parent StatefulSet

pkg/cluster/instance_test.go

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
package cluster
1616

1717
import (
18+
"net"
1819
"testing"
1920

2021
"github.com/stretchr/testify/assert"
@@ -75,3 +76,29 @@ func TestGetPodName(t *testing.T) {
7576
})
7677
}
7778
}
79+
80+
func TestWhitelistCIDR(t *testing.T) {
81+
testCases := []struct {
82+
ip string
83+
expected string
84+
}{
85+
{ip: "192.168.0.1", expected: "192.168.0.0/16"},
86+
{ip: "192.167.0.1", expected: ""},
87+
{ip: "10.1.1.1", expected: "10.0.0.0/8"},
88+
{ip: "172.15.0.1", expected: ""},
89+
{ip: "172.16.0.1", expected: "172.16.0.0/12"},
90+
{ip: "172.17.0.1", expected: "172.16.0.0/12"},
91+
{ip: "100.64.0.1", expected: "100.64.0.0/10"},
92+
{ip: "100.63.0.1", expected: ""},
93+
{ip: "1.2.3.4", expected: ""},
94+
}
95+
96+
for _, tt := range testCases {
97+
i := Instance{IP: net.ParseIP(tt.ip)}
98+
99+
cidr, _ := i.WhitelistCIDR()
100+
if cidr != tt.expected {
101+
t.Errorf("ip: %v, cidr: %v, expected: %v", tt.ip, cidr, tt.expected)
102+
}
103+
}
104+
}

0 commit comments

Comments
 (0)