Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduces a Validation Package #597

Merged
merged 1 commit into from
Apr 8, 2021
Merged

Introduces a Validation Package #597

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions apis/v1alpha1/validation/doc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
/*
Copyright 2021 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// Package validation has functions for validating the correctness of api
// objects and explaining what's wrong with them when they're not valid.
package validation // import "sigs.k8s.io/gateway-api/apis/v1alpha1/validation"
77 changes: 77 additions & 0 deletions apis/v1alpha1/validation/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
/*
Copyright 2021 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package validation

import (
"net"
"strings"

gatewayv1a1 "sigs.k8s.io/gateway-api/apis/v1alpha1"

"k8s.io/apimachinery/pkg/util/validation"
"k8s.io/apimachinery/pkg/util/validation/field"
)

// ValidateGateway validates gw according to the Gateway API specification.
// For additional details of the Gateway spec, refer to:
// https://gateway-api.sigs.k8s.io/spec/#networking.x-k8s.io/v1alpha1.Gateway
func ValidateGateway(gw *gatewayv1a1.Gateway) field.ErrorList {
bowei marked this conversation as resolved.
Show resolved Hide resolved
return validateGatewaySpec(&gw.Spec, field.NewPath("spec"))
}

// validateGatewaySpec validates whether required fields of spec are set according to the
// Gateway API specification.
func validateGatewaySpec(spec *gatewayv1a1.GatewaySpec, path *field.Path) field.ErrorList {
// TODO [danehans]: Add additional validation of spec fields.
return validateGatewayListeners(spec.Listeners, path.Child("listeners"))
}

// validateGatewayListeners validates whether required fields of listeners are set according
// to the Gateway API specification.
func validateGatewayListeners(listeners []gatewayv1a1.Listener, path *field.Path) field.ErrorList {
// TODO [danehans]: Add additional validation of listener fields.
return validateListenerHostname(listeners, path)
}

// validateListenerHostname validates each listener hostname is not an IP address and is one
// of the following:
// - A fully qualified domain name of a network host, as defined by RFC 3986.
// - A DNS subdomain as defined by RFC 1123.
// - A wildcard DNS subdomain as defined by RFC 1034 (section 4.3.3).
func validateListenerHostname(listeners []gatewayv1a1.Listener, path *field.Path) field.ErrorList {
var errs field.ErrorList
for i, h := range listeners {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggest early breaks to improve readability:

for i, h := range listeners {
        if h.Hostname == nil {
                continue
        }
        switch *h.Hostname {
        case  "": 
                // is this really valid?
        case "*":
                // valid wildcard
        default:
                // parse and check
        }
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I refactored the conditional logic that I think makes it easier to follow.

// When unspecified, “”, or *, all hostnames are matched.
if h.Hostname == nil || (*h.Hostname == "" || *h.Hostname == "*") {
continue
}
hostname := string(*h.Hostname)
if ip := net.ParseIP(hostname); ip != nil {
errs = append(errs, field.Invalid(path.Index(i).Child("hostname"), hostname, "must be a DNS hostname, not an IP address"))
}
if strings.Contains(hostname, "*") {
for _, msg := range validation.IsWildcardDNS1123Subdomain(hostname) {
errs = append(errs, field.Invalid(path.Index(i).Child("hostname"), hostname, msg))
}
} else {
for _, msg := range validation.IsDNS1123Subdomain(hostname) {
errs = append(errs, field.Invalid(path.Index(i).Child("hostname"), hostname, msg))
}
}
}
return errs
}
162 changes: 162 additions & 0 deletions apis/v1alpha1/validation/validation_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,162 @@
/*
Copyright 2021 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package validation

import (
"testing"

gatewayv1a1 "sigs.k8s.io/gateway-api/apis/v1alpha1"

metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

func TestValidateGateway(t *testing.T) {
listeners := []gatewayv1a1.Listener{
{
Hostname: nil,
},
}
baseGateway := gatewayv1a1.Gateway{
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
Namespace: metav1.NamespaceDefault,
},
Spec: gatewayv1a1.GatewaySpec{
GatewayClassName: "foo",
Listeners: listeners,
},
}

testCases := map[string]struct {
mutate func(gw *gatewayv1a1.Gateway)
expectErrsOnFields []string
}{
"nil hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {},
expectErrsOnFields: []string{},
},
"empty string hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{},
},
"wildcard hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("*")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{},
},
"wildcard-prefixed hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("*.example.com")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{},
},
"valid dns subdomain": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("foo.example.com")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{},
},
// Invalid use cases
"IPv4 address hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("1.2.3.4")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
"Invalid IPv4 address hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("1.2.3..4")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
"IPv4 address with port hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("1.2.3.4:8080")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
"IPv6 address hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("2001:db8::68")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname", "spec.listeners[0].hostname"},
},
"IPv6 link-local address hostname": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("fe80::/10")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
"dns subdomain with port": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("foo.example.com:8080")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
"dns subdomain with invalid wildcard label": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("*.*.com")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
"dns subdomain with multiple wildcards": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("*.foo.*.com")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
"dns subdomain with wildcard root label": {
mutate: func(gw *gatewayv1a1.Gateway) {
hostname := gatewayv1a1.Hostname("*.foo.*.com")
gw.Spec.Listeners[0].Hostname = &hostname
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
}

for name, tc := range testCases {
tc := tc
t.Run(name, func(t *testing.T) {
gw := baseGateway.DeepCopy()
tc.mutate(gw)
errs := ValidateGateway(gw)
if len(tc.expectErrsOnFields) != len(errs) {
t.Fatalf("Expected %d errors, got %d errors: %v", len(tc.expectErrsOnFields), len(errs), errs)
}
for i, err := range errs {
if err.Field != tc.expectErrsOnFields[i] {
t.Errorf("Expected error on field: %s, got: %s", tc.expectErrsOnFields[i], err.Error())
}
}
})
}
}