Skip to content

fix: add unix domain socket path length validation #6150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mukeshmahato17 wants to merge 3 commits into from
Closed

fix: add unix domain socket path length validation #6150

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1aae7aa
add unix domain socket path length validation
mukeshmahato17 May 22, 2025
96946b2
removed redundant validation
mukeshmahato17 May 22, 2025
878331f
add unix domain socket path length validation
mukeshmahato17 May 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions api/v1alpha1/backend_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,10 @@ type FQDNEndpoint struct {
// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#config-core-v3-pipe
type UnixSocket struct {
// Path defines the unix domain socket path of the backend endpoint.
// The path length must not exceed 108 characters.
//
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=108
Path string `json:"path"`
}

Expand Down
7 changes: 5 additions & 2 deletions charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,8 +119,11 @@ spec:
description: Unix defines the unix domain socket endpoint
properties:
path:
description: Path defines the unix domain socket path of
the backend endpoint.
description: |-
Path defines the unix domain socket path of the backend endpoint.
The path length must not exceed 108 characters.
maxLength: 108
minLength: 1
type: string
required:
- path
Expand Down
7 changes: 5 additions & 2 deletions charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backends.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,8 +118,11 @@ spec:
description: Unix defines the unix domain socket endpoint
properties:
path:
description: Path defines the unix domain socket path of
the backend endpoint.
description: |-
Path defines the unix domain socket path of the backend endpoint.
The path length must not exceed 108 characters.
maxLength: 108
minLength: 1
type: string
required:
- path
Expand Down
2 changes: 1 addition & 1 deletion site/content/en/latest/api/extension_types.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4757,7 +4757,7 @@ _Appears in:_

| Field | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `path` | _string_ | true | | Path defines the unix domain socket path of the backend endpoint. |
| `path` | _string_ | true | | Path defines the unix domain socket path of the backend endpoint.<br />The path length must not exceed 108 characters. |


#### Wasm
Expand Down
17 changes: 4 additions & 13 deletions test/cel-validation/backend_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ import (

metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/ptr"
gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"

egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
)
Expand Down Expand Up @@ -276,28 +275,20 @@ func TestBackend(t *testing.T) {
wantErrors: []string{"DynamicResolver type cannot have endpoints and appProtocols specified"},
},
{
desc: "tls settings on non-dynamic resolver",
Copy link
Copy Markdown
Member

@rudrakhp rudrakhp May 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we have a new test instead of replacing an existing one?

Copy link
Copy Markdown
Contributor Author

@mukeshmahato17 mukeshmahato17 May 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually this was merge conflict. i resolved the conflict only

desc: "Invalid Unix socket path length",
mutate: func(backend *egv1a1.Backend) {
backend.Spec = egv1a1.BackendSpec{
AppProtocols: []egv1a1.AppProtocolType{egv1a1.AppProtocolTypeH2C},
Endpoints: []egv1a1.BackendEndpoint{
{
FQDN: &egv1a1.FQDNEndpoint{
Hostname: "example.com",
Port: 443,
},
},
},
TLS: &egv1a1.BackendTLSSettings{
CACertificateRefs: []gwapiv1.LocalObjectReference{
{
Name: "ca-certificate",
Unix: &egv1a1.UnixSocket{
Path: "/path/to/a/very/long/unix/socket/path/that/exceeds/the/maximum/allowed/length/of/108/characters/and/should/fail/validation.sock",
},
},
},
}
},
wantErrors: []string{"TLS settings can only be specified for DynamicResolver backends"},
wantErrors: []string{"spec.endpoints[0].unix.path: Too long: may not be more than 108 bytes"},
},
}

Expand Down
7 changes: 5 additions & 2 deletions test/helm/gateway-crds-helm/all.out.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17431,8 +17431,11 @@ spec:
description: Unix defines the unix domain socket endpoint
properties:
path:
description: Path defines the unix domain socket path of
the backend endpoint.
description: |-
Path defines the unix domain socket path of the backend endpoint.
The path length must not exceed 108 characters.
maxLength: 108
minLength: 1
type: string
required:
- path
Expand Down
7 changes: 5 additions & 2 deletions test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,8 +119,11 @@ spec:
description: Unix defines the unix domain socket endpoint
properties:
path:
description: Path defines the unix domain socket path of
the backend endpoint.
description: |-
Path defines the unix domain socket path of the backend endpoint.
The path length must not exceed 108 characters.
maxLength: 108
minLength: 1
type: string
required:
- path
Expand Down