containernetworking / plugins / 32019706688

53%

master: 55%

Pull #1293

github

pkg/ip, host-local: fix panic on a RangeStart at the top of a family

{"ipam":{"type":"host-local","ranges":[[{"subnet":"255.255.255.252/30","rangeStart":"255.255.255.255","gateway":"255.255.255.255"}]]}}

LoadIPAMConfig accepts this config. RangeEnd is not set, so Canonicalize
defaults it to 255.255.255.254, one below the explicit RangeStart. The
first call to Get skips RangeStart because it equals Gateway, asks the
iterator for the next address, and NextIP(255.255.255.255) carries into
a 5th byte. intToIP then computes make([]byte, 4-5) and panics with
"makeslice: len out of range", so a single malformed CNI ADD config can
crash the plugin. The same shape reaches an all-ones IPv6 RangeStart.

Two gaps let this through:

1. intToIP assumes the incremented value fits in the address family's
   byte width and never checks the overflow direction. NextIP's own doc
   comment says invalid input returns nil, but intToIP didn't hold to
   that once the carry needed more bytes than the family, so the nil
   contract only worked for the too-few-bytes case fixed by #782/#783.

2. Range.Canonicalize validates RangeStart against Contains before
   RangeEnd has been assigned a value (explicit or defaulted), so an
   explicit RangeStart that only conflicts with the *defaulted* RangeEnd
   was never checked against it.

Fix intToIP to return nil when the carry overflows the family width,
matching NextIP's contract. Fix Canonicalize to reject RangeStart >
RangeEnd once both are resolved, which also covers the general case of
an explicit RangeStart landing on a subnet's broadcast address with a
defaulted RangeEnd, not just the top of the whole address family.

Tests: NextIP cases for the last address of both families, a
Canonicalize case for RangeStart landing after a defaulted RangeEnd
(both a plain subnet and the top-of-family case), and a LoadIPAMConfig
regression test using the exact reported config.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

9 of 9 new or added lines in 2 files covered. (100.0%)

5012 of 9540 relevant lines covered (52.54%)

27.87 hits per line