istio

1
// Copyright Istio Authors
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//     http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14

15
package config
16

17
import (
18
	"fmt"
19
	"net/netip"
20
)
21

22
const (
23
	// Due to implementation constraints, we have to impose a limit on the
24
	// number of owner groups whose outgoing traffic should be redirected
25
	// to Envoy.
26
	//
27
	// Since all included groups will be translated into a single Iptables
28
	// rule that combines N match expressions `-m owner ! --gid-owner <GID>`,
29
	// we need to be sure it won't be too long.
30
	//
31
	// Most common Linux distributions allow no more than 128-1200
32
	// match expressions per rule.
33
	maxOwnerGroupsInclude = 64
34
)
35

36
func ValidateOwnerGroups(include, exclude string) error {
37
	filter := ParseInterceptFilter(include, exclude)
38
	if !filter.Except && len(filter.Values) > maxOwnerGroupsInclude {
39
		return fmt.Errorf("number of owner groups whose outgoing traffic "+
40
			"should be redirected to Envoy cannot exceed %d, got %d: %v",
41
			maxOwnerGroupsInclude, len(filter.Values), filter.Values)
42
	}
43
	return nil
44
}
45

46
func ValidateIPv4LoopbackCidr(cidr string) error {
47
	ipp, err := netip.ParsePrefix(cidr)
48
	if err != nil {
49
		return fmt.Errorf("failed to parse CIDR %s: %v", cidr, err)
50
	}
51

52
	if !ipp.Addr().Is4() || !ipp.Addr().IsLoopback() {
53
		return fmt.Errorf("expected valid IPv4 loopback address in CIDR %s; found %v", cidr, ipp.Addr())
54
	}
55

56
	ones := ipp.Bits()
57
	if ones < 8 || ones > 32 {
58
		return fmt.Errorf("expected CIDR %s to have mask in range [8, 32]; found %v", cidr, ones)
59
	}
60
	return nil
61
}
62