NodeConfig defaults + code-quality pass + fuzz tests + README
NodeConfig.Spec.Defaults adds per-node IPv6/IPv4 family defaults that pod annotations can override; built-in baseline (v6=true, v4=false) still applies when the field is omitted. bird.Render now validates every operator-supplied value (peer addresses, CIDRs, anycast IPs, source addresses) before templating — fuzz found a peer address containing `}` produced unbalanced braces in bird.conf. Failing input preserved as a regression seed. Fuzz targets added for ParseAnnotations, ParseCNIArgs, HostIfaceName, canonical, IPAM allocate sequences, embed.Embed, and bird.Render. Hardened canonical/ipToU32 against nil and non-IPv4 inputs. README rewritten for outside readers — quickstart, NodeConfig + annotation reference with worked examples, anycast use cases, comparison vs Calico and Cilium, requirements, limitations. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Donavan Fritz
+129
-6
@@ -9,6 +9,7 @@ import (
|
||||
"fmt"
|
||||
"net"
|
||||
"sort"
|
||||
"strings"
|
||||
"text/template"
|
||||
)
|
||||
|
||||
@@ -118,28 +119,150 @@ protocol bgp upstream4_{{$i}} {
|
||||
{{end}}{{end}}`
|
||||
|
||||
// Render produces the bird.conf text.
|
||||
//
|
||||
// The output is deterministic: the same NodeBGP input always produces the
|
||||
// same string. CIDR lists, anycast lists, and peer lists are sorted before
|
||||
// templating so that the only way the rendered config changes is when
|
||||
// semantically meaningful inputs change. This stability matters because
|
||||
// BirdManager compares Render output against the last-written config to
|
||||
// avoid superfluous birdc reloads.
|
||||
//
|
||||
// Render validates every operator-supplied value that flows into the
|
||||
// templated output (peer addresses, CIDRs, anycast IPs, source addresses)
|
||||
// so a malformed NodeConfig or annotation cannot produce a malformed
|
||||
// bird.conf — even one that BIRD would later reject.
|
||||
func Render(in NodeBGP) (string, error) {
|
||||
if in.RouterID == "" {
|
||||
return "", fmt.Errorf("RouterID is required")
|
||||
return "", fmt.Errorf("bird render: RouterID is required")
|
||||
}
|
||||
if net.ParseIP(in.RouterID) == nil {
|
||||
return "", fmt.Errorf("bird render: RouterID %q is not a valid IP", in.RouterID)
|
||||
}
|
||||
if in.LocalASN == 0 {
|
||||
return "", fmt.Errorf("LocalASN is required")
|
||||
return "", fmt.Errorf("bird render: LocalASN is required")
|
||||
}
|
||||
// Stable order — important so config changes only when something real
|
||||
// changes (avoids needless birdc reloads).
|
||||
if err := validateLocalSource(in.LocalV6, "v6"); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := validateLocalSource(in.LocalV4, "v4"); err != nil {
|
||||
return "", err
|
||||
}
|
||||
for i, p := range in.Peers {
|
||||
if err := validatePeer(p); err != nil {
|
||||
return "", fmt.Errorf("bird render: peer[%d]: %w", i, err)
|
||||
}
|
||||
}
|
||||
if err := validateCIDRs(in.CIDR6, "v6"); err != nil {
|
||||
return "", fmt.Errorf("bird render: cidr6: %w", err)
|
||||
}
|
||||
if err := validateCIDRs(in.CIDR4, "v4"); err != nil {
|
||||
return "", fmt.Errorf("bird render: cidr4: %w", err)
|
||||
}
|
||||
if err := validateAnycastIPs(in.Anycast6, "v6"); err != nil {
|
||||
return "", fmt.Errorf("bird render: anycast6: %w", err)
|
||||
}
|
||||
if err := validateAnycastIPs(in.Anycast4, "v4"); err != nil {
|
||||
return "", fmt.Errorf("bird render: anycast4: %w", err)
|
||||
}
|
||||
|
||||
in = normalize(in)
|
||||
|
||||
t, err := template.New("bird").Parse(tpl)
|
||||
if err != nil {
|
||||
return "", err
|
||||
return "", fmt.Errorf("bird template parse: %w", err)
|
||||
}
|
||||
var buf bytes.Buffer
|
||||
if err := t.Execute(&buf, in); err != nil {
|
||||
return "", err
|
||||
return "", fmt.Errorf("bird template execute: %w", err)
|
||||
}
|
||||
return buf.String(), nil
|
||||
}
|
||||
|
||||
// validatePeer checks that a peer entry has a parseable IP whose family
|
||||
// matches its declared Family field, and a non-zero ASN.
|
||||
func validatePeer(p Peer) error {
|
||||
if p.ASN == 0 {
|
||||
return fmt.Errorf("ASN must be non-zero")
|
||||
}
|
||||
ip := net.ParseIP(p.Address)
|
||||
if ip == nil {
|
||||
return fmt.Errorf("address %q is not a valid IP", p.Address)
|
||||
}
|
||||
isV4 := ip.To4() != nil
|
||||
switch p.Family {
|
||||
case "v6":
|
||||
if isV4 {
|
||||
return fmt.Errorf("address %q is IPv4 but Family is v6", p.Address)
|
||||
}
|
||||
case "v4":
|
||||
if !isV4 {
|
||||
return fmt.Errorf("address %q is IPv6 but Family is v4", p.Address)
|
||||
}
|
||||
default:
|
||||
return fmt.Errorf("Family %q must be v6 or v4", p.Family)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// validateCIDRs parses each entry as a CIDR and rejects family mismatches.
|
||||
// fam must be "v6" or "v4".
|
||||
func validateCIDRs(cidrs []string, fam string) error {
|
||||
for _, c := range cidrs {
|
||||
_, n, err := net.ParseCIDR(c)
|
||||
if err != nil {
|
||||
return fmt.Errorf("invalid CIDR %q: %w", c, err)
|
||||
}
|
||||
isV4 := n.IP.To4() != nil
|
||||
if fam == "v6" && isV4 {
|
||||
return fmt.Errorf("CIDR %q is IPv4, expected IPv6", c)
|
||||
}
|
||||
if fam == "v4" && !isV4 {
|
||||
return fmt.Errorf("CIDR %q is IPv6, expected IPv4", c)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// validateAnycastIPs parses each entry as a literal IP (no prefix) and rejects
|
||||
// family mismatches.
|
||||
func validateAnycastIPs(ips []string, fam string) error {
|
||||
for _, s := range ips {
|
||||
ip := net.ParseIP(s)
|
||||
if ip == nil {
|
||||
return fmt.Errorf("invalid IP %q", s)
|
||||
}
|
||||
isV4 := ip.To4() != nil
|
||||
if fam == "v6" && isV4 {
|
||||
return fmt.Errorf("IP %q is IPv4, expected IPv6", s)
|
||||
}
|
||||
if fam == "v4" && !isV4 {
|
||||
return fmt.Errorf("IP %q is IPv6, expected IPv4", s)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// validateLocalSource validates an optional LocalV6/LocalV4 source address.
|
||||
// Empty is allowed (BIRD picks its own); non-empty must be a parseable IP of
|
||||
// the matching family.
|
||||
func validateLocalSource(s, fam string) error {
|
||||
if s == "" {
|
||||
return nil
|
||||
}
|
||||
ip := net.ParseIP(s)
|
||||
if ip == nil {
|
||||
return fmt.Errorf("bird render: Local%s %q is not a valid IP", strings.ToUpper(fam), s)
|
||||
}
|
||||
isV4 := ip.To4() != nil
|
||||
if fam == "v6" && isV4 {
|
||||
return fmt.Errorf("bird render: LocalV6 %q is IPv4", s)
|
||||
}
|
||||
if fam == "v4" && !isV4 {
|
||||
return fmt.Errorf("bird render: LocalV4 %q is IPv6", s)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func normalize(in NodeBGP) NodeBGP {
|
||||
cp := in
|
||||
cp.CIDR6 = sortedUnique(in.CIDR6)
|
||||
|
||||
@@ -0,0 +1,93 @@
|
||||
package bird
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// FuzzRender drives the bird template with a wide range of inputs and
|
||||
// confirms two safety properties:
|
||||
//
|
||||
// 1. Render never panics.
|
||||
// 2. On nil-error return, the output is deterministic (calling Render
|
||||
// twice with the same input yields byte-identical output) and contains
|
||||
// no unbalanced braces (a smoke test for malformed template branches).
|
||||
func FuzzRender(f *testing.F) {
|
||||
type seed struct {
|
||||
routerID string
|
||||
asn uint32
|
||||
peerAddr string
|
||||
peerASN uint32
|
||||
cidr6 string
|
||||
cidr4 string
|
||||
anycast6 string
|
||||
anycast4 string
|
||||
localV6 string
|
||||
localV4 string
|
||||
}
|
||||
seeds := []seed{
|
||||
{routerID: "10.0.0.1", asn: 65101, peerAddr: "2001:db8::1", peerASN: 65000, cidr6: "2001:db8:f001::/64"},
|
||||
{routerID: "172.25.25.101", asn: 65101, peerAddr: "172.25.25.1", peerASN: 65000, cidr4: "172.25.210.0/24"},
|
||||
{routerID: "10.0.0.1", asn: 65101, peerAddr: "2001:db8::1", peerASN: 65000, cidr6: "2001:db8:f001::/64", anycast6: "2001:db8:a::1"},
|
||||
{routerID: "10.0.0.1", asn: 65101, peerAddr: "10.0.0.2", peerASN: 65000, cidr4: "10.0.0.0/24", anycast4: "10.255.0.1"},
|
||||
{routerID: "10.0.0.1", asn: 65101}, // no peer, no cidrs
|
||||
{routerID: "", asn: 65101, peerAddr: "10.0.0.2", peerASN: 1}, // empty routerID → expect error
|
||||
{routerID: "10.0.0.1", asn: 0, peerAddr: "10.0.0.2", peerASN: 1}, // zero ASN → expect error
|
||||
// Backtick-bearing inputs to defend the template against accidental
|
||||
// closure of the raw-string literal.
|
||||
{routerID: "10.0.0.1`", asn: 65101},
|
||||
// Newlines and template-meta in user-supplied addresses
|
||||
{routerID: "10.0.0.1", asn: 65101, peerAddr: "2001:db8::1\n{{kaboom}}", peerASN: 65000, cidr6: "2001:db8:f001::/64"},
|
||||
}
|
||||
for _, s := range seeds {
|
||||
f.Add(s.routerID, s.asn, s.peerAddr, s.peerASN, s.cidr6, s.cidr4, s.anycast6, s.anycast4, s.localV6, s.localV4)
|
||||
}
|
||||
|
||||
f.Fuzz(func(t *testing.T, routerID string, asn uint32, peerAddr string, peerASN uint32, cidr6, cidr4, anycast6, anycast4, localV6, localV4 string) {
|
||||
in := NodeBGP{
|
||||
RouterID: routerID,
|
||||
LocalASN: asn,
|
||||
LocalV6: localV6,
|
||||
LocalV4: localV4,
|
||||
}
|
||||
// Add the peer in whichever family it belongs to, if any. FamilyOf
|
||||
// returns "" for non-IPs; that test exercises the "skip unknown
|
||||
// family" branch in the bird agent code path.
|
||||
if fam := FamilyOf(peerAddr); fam != "" {
|
||||
in.Peers = []Peer{{Family: fam, Address: peerAddr, ASN: peerASN}}
|
||||
}
|
||||
if cidr6 != "" {
|
||||
in.CIDR6 = []string{cidr6}
|
||||
}
|
||||
if cidr4 != "" {
|
||||
in.CIDR4 = []string{cidr4}
|
||||
}
|
||||
if anycast6 != "" {
|
||||
in.Anycast6 = []string{anycast6}
|
||||
}
|
||||
if anycast4 != "" {
|
||||
in.Anycast4 = []string{anycast4}
|
||||
}
|
||||
|
||||
out, err := Render(in)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
// Determinism.
|
||||
out2, err := Render(in)
|
||||
if err != nil {
|
||||
t.Fatalf("Render became flaky: first ok, second %v", err)
|
||||
}
|
||||
if out != out2 {
|
||||
t.Fatalf("Render not deterministic on identical input")
|
||||
}
|
||||
|
||||
// Smoke test for balanced braces. The template uses `{` and `}`
|
||||
// as BIRD's block delimiters; if our template engine ever
|
||||
// produced an unbalanced output we'd catch it here.
|
||||
if got := strings.Count(out, "{") - strings.Count(out, "}"); got != 0 {
|
||||
t.Fatalf("unbalanced braces: %d", got)
|
||||
}
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
go test fuzz v1
|
||||
string("0")
|
||||
uint32(65101)
|
||||
string("0")
|
||||
uint32(1)
|
||||
string("")
|
||||
string("")
|
||||
string("")
|
||||
string("}")
|
||||
string("")
|
||||
string("")
|
||||
Reference in New Issue
Block a user