417 lines
15 KiB
Go
417 lines
15 KiB
Go
/*
|
|
Copyright 2014 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package validation
|
|
|
|
import (
|
|
"fmt"
|
|
"math"
|
|
"net"
|
|
"regexp"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"k8s.io/apimachinery/pkg/util/validation/field"
|
|
)
|
|
|
|
const qnameCharFmt string = "[A-Za-z0-9]"
|
|
const qnameExtCharFmt string = "[-A-Za-z0-9_.]"
|
|
const qualifiedNameFmt string = "(" + qnameCharFmt + qnameExtCharFmt + "*)?" + qnameCharFmt
|
|
const qualifiedNameErrMsg string = "must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character"
|
|
const qualifiedNameMaxLength int = 63
|
|
|
|
var qualifiedNameRegexp = regexp.MustCompile("^" + qualifiedNameFmt + "$")
|
|
|
|
// IsQualifiedName tests whether the value passed is what Kubernetes calls a
|
|
// "qualified name". This is a format used in various places throughout the
|
|
// system. If the value is not valid, a list of error strings is returned.
|
|
// Otherwise an empty list (or nil) is returned.
|
|
func IsQualifiedName(value string) []string {
|
|
var errs []string
|
|
parts := strings.Split(value, "/")
|
|
var name string
|
|
switch len(parts) {
|
|
case 1:
|
|
name = parts[0]
|
|
case 2:
|
|
var prefix string
|
|
prefix, name = parts[0], parts[1]
|
|
if len(prefix) == 0 {
|
|
errs = append(errs, "prefix part "+EmptyError())
|
|
} else if msgs := IsDNS1123Subdomain(prefix); len(msgs) != 0 {
|
|
errs = append(errs, prefixEach(msgs, "prefix part ")...)
|
|
}
|
|
default:
|
|
return append(errs, "a qualified name "+RegexError(qualifiedNameErrMsg, qualifiedNameFmt, "MyName", "my.name", "123-abc")+
|
|
" with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')")
|
|
}
|
|
|
|
if len(name) == 0 {
|
|
errs = append(errs, "name part "+EmptyError())
|
|
} else if len(name) > qualifiedNameMaxLength {
|
|
errs = append(errs, "name part "+MaxLenError(qualifiedNameMaxLength))
|
|
}
|
|
if !qualifiedNameRegexp.MatchString(name) {
|
|
errs = append(errs, "name part "+RegexError(qualifiedNameErrMsg, qualifiedNameFmt, "MyName", "my.name", "123-abc"))
|
|
}
|
|
return errs
|
|
}
|
|
|
|
// IsFullyQualifiedName checks if the name is fully qualified.
|
|
func IsFullyQualifiedName(fldPath *field.Path, name string) field.ErrorList {
|
|
var allErrors field.ErrorList
|
|
if len(name) == 0 {
|
|
return append(allErrors, field.Required(fldPath, ""))
|
|
}
|
|
if errs := IsDNS1123Subdomain(name); len(errs) > 0 {
|
|
return append(allErrors, field.Invalid(fldPath, name, strings.Join(errs, ",")))
|
|
}
|
|
if len(strings.Split(name, ".")) < 3 {
|
|
return append(allErrors, field.Invalid(fldPath, name, "should be a domain with at least three segments separated by dots"))
|
|
}
|
|
return allErrors
|
|
}
|
|
|
|
const labelValueFmt string = "(" + qualifiedNameFmt + ")?"
|
|
const labelValueErrMsg string = "a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character"
|
|
|
|
// LabelValueMaxLength is a label's max length
|
|
const LabelValueMaxLength int = 63
|
|
|
|
var labelValueRegexp = regexp.MustCompile("^" + labelValueFmt + "$")
|
|
|
|
// IsValidLabelValue tests whether the value passed is a valid label value. If
|
|
// the value is not valid, a list of error strings is returned. Otherwise an
|
|
// empty list (or nil) is returned.
|
|
func IsValidLabelValue(value string) []string {
|
|
var errs []string
|
|
if len(value) > LabelValueMaxLength {
|
|
errs = append(errs, MaxLenError(LabelValueMaxLength))
|
|
}
|
|
if !labelValueRegexp.MatchString(value) {
|
|
errs = append(errs, RegexError(labelValueErrMsg, labelValueFmt, "MyValue", "my_value", "12345"))
|
|
}
|
|
return errs
|
|
}
|
|
|
|
const dns1123LabelFmt string = "[a-z0-9]([-a-z0-9]*[a-z0-9])?"
|
|
const dns1123LabelErrMsg string = "a DNS-1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character"
|
|
|
|
// DNS1123LabelMaxLength is a label's max length in DNS (RFC 1123)
|
|
const DNS1123LabelMaxLength int = 63
|
|
|
|
var dns1123LabelRegexp = regexp.MustCompile("^" + dns1123LabelFmt + "$")
|
|
|
|
// IsDNS1123Label tests for a string that conforms to the definition of a label in
|
|
// DNS (RFC 1123).
|
|
func IsDNS1123Label(value string) []string {
|
|
var errs []string
|
|
if len(value) > DNS1123LabelMaxLength {
|
|
errs = append(errs, MaxLenError(DNS1123LabelMaxLength))
|
|
}
|
|
if !dns1123LabelRegexp.MatchString(value) {
|
|
errs = append(errs, RegexError(dns1123LabelErrMsg, dns1123LabelFmt, "my-name", "123-abc"))
|
|
}
|
|
return errs
|
|
}
|
|
|
|
const dns1123SubdomainFmt string = dns1123LabelFmt + "(\\." + dns1123LabelFmt + ")*"
|
|
const dns1123SubdomainErrorMsg string = "a DNS-1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
|
|
|
|
// DNS1123SubdomainMaxLength is a subdomain's max length in DNS (RFC 1123)
|
|
const DNS1123SubdomainMaxLength int = 253
|
|
|
|
var dns1123SubdomainRegexp = regexp.MustCompile("^" + dns1123SubdomainFmt + "$")
|
|
|
|
// IsDNS1123Subdomain tests for a string that conforms to the definition of a
|
|
// subdomain in DNS (RFC 1123).
|
|
func IsDNS1123Subdomain(value string) []string {
|
|
var errs []string
|
|
if len(value) > DNS1123SubdomainMaxLength {
|
|
errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
|
|
}
|
|
if !dns1123SubdomainRegexp.MatchString(value) {
|
|
errs = append(errs, RegexError(dns1123SubdomainErrorMsg, dns1123SubdomainFmt, "example.com"))
|
|
}
|
|
return errs
|
|
}
|
|
|
|
const dns1035LabelFmt string = "[a-z]([-a-z0-9]*[a-z0-9])?"
|
|
const dns1035LabelErrMsg string = "a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character"
|
|
|
|
// DNS1035LabelMaxLength is a label's max length in DNS (RFC 1035)
|
|
const DNS1035LabelMaxLength int = 63
|
|
|
|
var dns1035LabelRegexp = regexp.MustCompile("^" + dns1035LabelFmt + "$")
|
|
|
|
// IsDNS1035Label tests for a string that conforms to the definition of a label in
|
|
// DNS (RFC 1035).
|
|
func IsDNS1035Label(value string) []string {
|
|
var errs []string
|
|
if len(value) > DNS1035LabelMaxLength {
|
|
errs = append(errs, MaxLenError(DNS1035LabelMaxLength))
|
|
}
|
|
if !dns1035LabelRegexp.MatchString(value) {
|
|
errs = append(errs, RegexError(dns1035LabelErrMsg, dns1035LabelFmt, "my-name", "abc-123"))
|
|
}
|
|
return errs
|
|
}
|
|
|
|
// wildcard definition - RFC 1034 section 4.3.3.
|
|
// examples:
|
|
// - valid: *.bar.com, *.foo.bar.com
|
|
// - invalid: *.*.bar.com, *.foo.*.com, *bar.com, f*.bar.com, *
|
|
const wildcardDNS1123SubdomainFmt = "\\*\\." + dns1123SubdomainFmt
|
|
const wildcardDNS1123SubdomainErrMsg = "a wildcard DNS-1123 subdomain must start with '*.', followed by a valid DNS subdomain, which must consist of lower case alphanumeric characters, '-' or '.' and end with an alphanumeric character"
|
|
|
|
// IsWildcardDNS1123Subdomain tests for a string that conforms to the definition of a
|
|
// wildcard subdomain in DNS (RFC 1034 section 4.3.3).
|
|
func IsWildcardDNS1123Subdomain(value string) []string {
|
|
wildcardDNS1123SubdomainRegexp := regexp.MustCompile("^" + wildcardDNS1123SubdomainFmt + "$")
|
|
|
|
var errs []string
|
|
if len(value) > DNS1123SubdomainMaxLength {
|
|
errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
|
|
}
|
|
if !wildcardDNS1123SubdomainRegexp.MatchString(value) {
|
|
errs = append(errs, RegexError(wildcardDNS1123SubdomainErrMsg, wildcardDNS1123SubdomainFmt, "*.example.com"))
|
|
}
|
|
return errs
|
|
}
|
|
|
|
const cIdentifierFmt string = "[A-Za-z_][A-Za-z0-9_]*"
|
|
const identifierErrMsg string = "a valid C identifier must start with alphabetic character or '_', followed by a string of alphanumeric characters or '_'"
|
|
|
|
var cIdentifierRegexp = regexp.MustCompile("^" + cIdentifierFmt + "$")
|
|
|
|
// IsCIdentifier tests for a string that conforms the definition of an identifier
|
|
// in C. This checks the format, but not the length.
|
|
func IsCIdentifier(value string) []string {
|
|
if !cIdentifierRegexp.MatchString(value) {
|
|
return []string{RegexError(identifierErrMsg, cIdentifierFmt, "my_name", "MY_NAME", "MyName")}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// IsValidPortNum tests that the argument is a valid, non-zero port number.
|
|
func IsValidPortNum(port int) []string {
|
|
if 1 <= port && port <= 65535 {
|
|
return nil
|
|
}
|
|
return []string{InclusiveRangeError(1, 65535)}
|
|
}
|
|
|
|
// IsInRange tests that the argument is in an inclusive range.
|
|
func IsInRange(value int, min int, max int) []string {
|
|
if value >= min && value <= max {
|
|
return nil
|
|
}
|
|
return []string{InclusiveRangeError(min, max)}
|
|
}
|
|
|
|
// Now in libcontainer UID/GID limits is 0 ~ 1<<31 - 1
|
|
// TODO: once we have a type for UID/GID we should make these that type.
|
|
const (
|
|
minUserID = 0
|
|
maxUserID = math.MaxInt32
|
|
minGroupID = 0
|
|
maxGroupID = math.MaxInt32
|
|
)
|
|
|
|
// IsValidGroupID tests that the argument is a valid Unix GID.
|
|
func IsValidGroupID(gid int64) []string {
|
|
if minGroupID <= gid && gid <= maxGroupID {
|
|
return nil
|
|
}
|
|
return []string{InclusiveRangeError(minGroupID, maxGroupID)}
|
|
}
|
|
|
|
// IsValidUserID tests that the argument is a valid Unix UID.
|
|
func IsValidUserID(uid int64) []string {
|
|
if minUserID <= uid && uid <= maxUserID {
|
|
return nil
|
|
}
|
|
return []string{InclusiveRangeError(minUserID, maxUserID)}
|
|
}
|
|
|
|
var portNameCharsetRegex = regexp.MustCompile("^[-a-z0-9]+$")
|
|
var portNameOneLetterRegexp = regexp.MustCompile("[a-z]")
|
|
|
|
// IsValidPortName check that the argument is valid syntax. It must be
|
|
// non-empty and no more than 15 characters long. It may contain only [-a-z0-9]
|
|
// and must contain at least one letter [a-z]. It must not start or end with a
|
|
// hyphen, nor contain adjacent hyphens.
|
|
//
|
|
// Note: We only allow lower-case characters, even though RFC 6335 is case
|
|
// insensitive.
|
|
func IsValidPortName(port string) []string {
|
|
var errs []string
|
|
if len(port) > 15 {
|
|
errs = append(errs, MaxLenError(15))
|
|
}
|
|
if !portNameCharsetRegex.MatchString(port) {
|
|
errs = append(errs, "must contain only alpha-numeric characters (a-z, 0-9), and hyphens (-)")
|
|
}
|
|
if !portNameOneLetterRegexp.MatchString(port) {
|
|
errs = append(errs, "must contain at least one letter or number (a-z, 0-9)")
|
|
}
|
|
if strings.Contains(port, "--") {
|
|
errs = append(errs, "must not contain consecutive hyphens")
|
|
}
|
|
if len(port) > 0 && (port[0] == '-' || port[len(port)-1] == '-') {
|
|
errs = append(errs, "must not begin or end with a hyphen")
|
|
}
|
|
return errs
|
|
}
|
|
|
|
// IsValidIP tests that the argument is a valid IP address.
|
|
func IsValidIP(value string) []string {
|
|
if net.ParseIP(value) == nil {
|
|
return []string{"must be a valid IP address, (e.g. 10.9.8.7)"}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
const percentFmt string = "[0-9]+%"
|
|
const percentErrMsg string = "a valid percent string must be a numeric string followed by an ending '%'"
|
|
|
|
var percentRegexp = regexp.MustCompile("^" + percentFmt + "$")
|
|
|
|
// IsValidPercent checks that string is in the form of a percentage
|
|
func IsValidPercent(percent string) []string {
|
|
if !percentRegexp.MatchString(percent) {
|
|
return []string{RegexError(percentErrMsg, percentFmt, "1%", "93%")}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
const httpHeaderNameFmt string = "[-A-Za-z0-9]+"
|
|
const httpHeaderNameErrMsg string = "a valid HTTP header must consist of alphanumeric characters or '-'"
|
|
|
|
var httpHeaderNameRegexp = regexp.MustCompile("^" + httpHeaderNameFmt + "$")
|
|
|
|
// IsHTTPHeaderName checks that a string conforms to the Go HTTP library's
|
|
// definition of a valid header field name (a stricter subset than RFC7230).
|
|
func IsHTTPHeaderName(value string) []string {
|
|
if !httpHeaderNameRegexp.MatchString(value) {
|
|
return []string{RegexError(httpHeaderNameErrMsg, httpHeaderNameFmt, "X-Header-Name")}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
const envVarNameFmt = "[-._a-zA-Z][-._a-zA-Z0-9]*"
|
|
const envVarNameFmtErrMsg string = "a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit"
|
|
|
|
var envVarNameRegexp = regexp.MustCompile("^" + envVarNameFmt + "$")
|
|
|
|
// IsEnvVarName tests if a string is a valid environment variable name.
|
|
func IsEnvVarName(value string) []string {
|
|
var errs []string
|
|
if !envVarNameRegexp.MatchString(value) {
|
|
errs = append(errs, RegexError(envVarNameFmtErrMsg, envVarNameFmt, "my.env-name", "MY_ENV.NAME", "MyEnvName1"))
|
|
}
|
|
|
|
errs = append(errs, hasChDirPrefix(value)...)
|
|
return errs
|
|
}
|
|
|
|
const configMapKeyFmt = `[-._a-zA-Z0-9]+`
|
|
const configMapKeyErrMsg string = "a valid config key must consist of alphanumeric characters, '-', '_' or '.'"
|
|
|
|
var configMapKeyRegexp = regexp.MustCompile("^" + configMapKeyFmt + "$")
|
|
|
|
// IsConfigMapKey tests for a string that is a valid key for a ConfigMap or Secret
|
|
func IsConfigMapKey(value string) []string {
|
|
var errs []string
|
|
if len(value) > DNS1123SubdomainMaxLength {
|
|
errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
|
|
}
|
|
if !configMapKeyRegexp.MatchString(value) {
|
|
errs = append(errs, RegexError(configMapKeyErrMsg, configMapKeyFmt, "key.name", "KEY_NAME", "key-name"))
|
|
}
|
|
errs = append(errs, hasChDirPrefix(value)...)
|
|
return errs
|
|
}
|
|
|
|
// MaxLenError returns a string explanation of a "string too long" validation
|
|
// failure.
|
|
func MaxLenError(length int) string {
|
|
return fmt.Sprintf("must be no more than %d characters", length)
|
|
}
|
|
|
|
// RegexError returns a string explanation of a regex validation failure.
|
|
func RegexError(msg string, fmt string, examples ...string) string {
|
|
if len(examples) == 0 {
|
|
return msg + " (regex used for validation is '" + fmt + "')"
|
|
}
|
|
msg += " (e.g. "
|
|
for i := range examples {
|
|
if i > 0 {
|
|
msg += " or "
|
|
}
|
|
msg += "'" + examples[i] + "', "
|
|
}
|
|
msg += "regex used for validation is '" + fmt + "')"
|
|
return msg
|
|
}
|
|
|
|
// EmptyError returns a string explanation of a "must not be empty" validation
|
|
// failure.
|
|
func EmptyError() string {
|
|
return "must be non-empty"
|
|
}
|
|
|
|
func prefixEach(msgs []string, prefix string) []string {
|
|
for i := range msgs {
|
|
msgs[i] = prefix + msgs[i]
|
|
}
|
|
return msgs
|
|
}
|
|
|
|
// InclusiveRangeError returns a string explanation of a numeric "must be
|
|
// between" validation failure.
|
|
func InclusiveRangeError(lo, hi int) string {
|
|
return fmt.Sprintf(`must be between %d and %d, inclusive`, lo, hi)
|
|
}
|
|
|
|
func hasChDirPrefix(value string) []string {
|
|
var errs []string
|
|
switch {
|
|
case value == ".":
|
|
errs = append(errs, `must not be '.'`)
|
|
case value == "..":
|
|
errs = append(errs, `must not be '..'`)
|
|
case strings.HasPrefix(value, ".."):
|
|
errs = append(errs, `must not start with '..'`)
|
|
}
|
|
return errs
|
|
}
|
|
|
|
// IsValidSocketAddr checks that string represents a valid socket address
|
|
// as defined in RFC 789. (e.g 0.0.0.0:10254 or [::]:10254))
|
|
func IsValidSocketAddr(value string) []string {
|
|
var errs []string
|
|
ip, port, err := net.SplitHostPort(value)
|
|
if err != nil {
|
|
errs = append(errs, "must be a valid socket address format, (e.g. 0.0.0.0:10254 or [::]:10254)")
|
|
return errs
|
|
}
|
|
portInt, _ := strconv.Atoi(port)
|
|
errs = append(errs, IsValidPortNum(portInt)...)
|
|
errs = append(errs, IsValidIP(ip)...)
|
|
return errs
|
|
}
|