github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-05-05 17:06:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: blocking non valid external IP

Browse Source
This commit is contained in:
Dario Tranchitella
2021-06-18 15:31:28 +02:00
parent 7237972b80
commit 5681228789
1 changed files with 22 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
pkg/webhook/services/validating.go
View File

@@ -78,22 +78,32 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder
return admission.Allowed("")
}
for _, allowed := range tnt.Spec.ExternalServiceIPs.Allowed {
if !strings.Contains(string(allowed), "/") {
allowed += "/32"
}
_, allowedIP, _ := net.ParseCIDR(string(allowed))
for _, externalIP := range svc.Spec.ExternalIPs {
IP := net.ParseIP(externalIP)
if allowedIP.Contains(IP) {
return admission.Allowed("")
ipInCIDR := func(ip net.IP) bool {
for _, allowed := range tnt.Spec.ExternalServiceIPs.Allowed {
if !strings.Contains(string(allowed), "/") {
allowed += "/32"
}
_, allowedIP, _ := net.ParseCIDR(string(allowed))
if allowedIP.Contains(ip) {
return true
}
}
return false
}
for _, externalIP := range svc.Spec.ExternalIPs {
ip := net.ParseIP(externalIP)
if !ipInCIDR(ip) {
recorder.Eventf(&tnt, corev1.EventTypeWarning, "ForbiddenExternalServiceIP", "Service %s/%s external IP %s is forbidden for the current Tenant", req.Namespace, req.Name, ip.String())
return admission.Errored(http.StatusBadRequest, NewExternalServiceIPForbidden(tnt.Spec.ExternalServiceIPs.Allowed))
}
}
recorder.Eventf(&tnt, corev1.EventTypeWarning, "ExternalServiceIP", "Service %s/%s external IPs %s are not in the expected range for the current Tenant", req.Namespace, req.Name, strings.Join(svc.Spec.ExternalIPs, ","))
return admission.Errored(http.StatusBadRequest, NewExternalServiceIPForbidden(tnt.Spec.ExternalServiceIPs.Allowed))
return admission.Allowed("")
}
func (r *handler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {