Ipv4 check #276

tedteng · 2020-08-26T02:21:33Z

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #275

Special notes for your reviewer:

Release note:

Support valid Public IP for IPv4 and IPv6 in aws bastion security group when `ssh`

neo-liang-sap · 2020-08-26T02:26:34Z

please hold this PR until #274 , currently under review from @petersutter for urlencoding

tedteng · 2020-08-26T02:32:49Z

please hold this PR until #274 , currently under review from @petersutter for urlencoding

sure, definitely this PR merge will wait for #274

tedteng · 2020-08-27T07:53:44Z

find one issue before rebase, will waiting for the fix #273 (comment)

tedteng · 2020-08-28T03:15:26Z

/lgtm

tedteng · 2020-08-28T03:47:22Z

/remove reviewed/lgtm

petersutter · 2020-08-28T07:56:54Z

pkg/cmd/ssh_aws.go

+	if isIP(a.MyPublicIP) {
+		arguments = fmt.Sprintf("aws ec2 authorize-security-group-ingress --group-id %s --protocol tcp --port 22 --cidr %s/32", a.BastionSecurityGroupID, a.MyPublicIP)
+	} else {
+		arguments = fmt.Sprintf("aws ec2 authorize-security-group-ingress --group-id %s --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,Ipv6Ranges=[{CidrIpv6=%s/64}]", a.BastionSecurityGroupID, a.MyPublicIP)
+	}


isIP is a custom implemented function to check for ipv4 addresses. Replace the custom implementation by using net.ParseIP and return netIP != nil && netIP.To4() != nil to check for ipv4
see also https://github.com/kubernetes/kubernetes/blob/dc025534afb0c3106b3aab166f88b971102135d1/vendor/k8s.io/utils/net/net.go#L116-L125 as example for the ipv6 check

In the end the code should look something like:
if isIPv4String(a.MyPublicIP) {
...
} else if IsIPv6String(a.MyPublicIP) {
...
} else {
// error
}

petersutter · 2020-08-28T13:10:42Z

pkg/cmd/ssh_aws.go

@@ -180,10 +181,17 @@ func (a *AwsInstanceAttribute) createBastionHostSecurityGroup() {
 	a.BastionSecurityGroupID = strings.Trim((capturedOutput), "\n")
 	arguments = fmt.Sprintf("aws ec2 create-tags --resources %s  --tags Key=component,Value=gardenctl", a.BastionSecurityGroupID)
 	operate("aws", arguments)
-	arguments = fmt.Sprintf("aws ec2 authorize-security-group-ingress --group-id %s --protocol tcp --port 22 --cidr %s", a.BastionSecurityGroupID, a.MyPublicIP)
+
+	ip := net.ParseIP(a.MyPublicIP)


If the string is not a valid textual representation of an IP address, ParseIP returns nil. Hence you also need to check for nil and that's why I suggested initially to move that code into utils/miscellaneous and dump/replace the isIP function that is already there

update isIP method which return bool to check whether IP is valid for ipv4 or ipv6.
also change to logic in here, add exit after print the "IP not valid:" + a.MyPublicIP.

petersutter · 2020-08-31T07:31:57Z

pkg/cmd/miscellaneous.go

+func isIP(host string) bool {
+	return net.ParseIP(host) != nil
 }


Even if the function was named isIP, the old implementation would only return true in case it was an ipv4 address.
Now it will return true if it's an ipv6 and ipv4 address..

should I rename isIP to like isIPv4 something like that then check and return only valid ipv4 address
?

yes I guess this would be better. It's only used in one place currently createBastionHostInstance (gcp). Not sure if this will work with ipv6 addresses..

fixed, so far GCP createBastionHostInstance not support ipv6 yet I think, but I will check it later when I work on support GCP host in the user role later.

petersutter

/lgtm, thanks
however I haven't tested it

petersutter · 2020-08-31T08:34:47Z

pkg/cmd/miscellaneous.go

@@ -356,5 +342,9 @@ func getPublicIP() string {
 	defer resp.Body.Close()
 	ip, err := ioutil.ReadAll(resp.Body)
 	checkError(err)
+	if !isIP(string(ip)) {


Suggested change

if !isIP(string(ip)) {

if !isIPv4(string(ip)) {

shouldn't this be isIPv4?

yes thanks.

neo-liang-sap

this commit should not exist in this PR
these three commits are dummy content, should not exist in this PR

aws IPv6 support use net.ParseIP identify ipv4 or ipv6 modify isIP method rename isIP() to isIPv4()

neo-liang-sap

/lgtm
however i haven't tested, confirmed with @tedteng he's fully confidence with it

tedteng requested a review from a team as a code owner August 26, 2020 02:21

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 26, 2020

gardener-robot-ci-3 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Aug 26, 2020

tedteng force-pushed the ipv4_check branch from 8b3089c to f68fe2c Compare August 26, 2020 02:30

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 26, 2020

gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 26, 2020

petersutter mentioned this pull request Aug 27, 2020

ipv4 check after get public IP #275

Closed

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 28, 2020

gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 28, 2020

gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Aug 28, 2020

gardener-robot added the reviewed/lgtm Has approval for merging label Aug 28, 2020

gardener-robot removed the reviewed/lgtm Has approval for merging label Aug 28, 2020

petersutter reviewed Aug 28, 2020

View reviewed changes

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 28, 2020

gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 28, 2020

petersutter reviewed Aug 28, 2020

View reviewed changes

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 31, 2020

gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 31, 2020

petersutter reviewed Aug 31, 2020

View reviewed changes

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 31, 2020

gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 31, 2020

petersutter approved these changes Aug 31, 2020

View reviewed changes

tedteng force-pushed the ipv4_check branch from 9a88274 to b91db20 Compare August 31, 2020 08:30

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 31, 2020

petersutter reviewed Aug 31, 2020

View reviewed changes

tedteng force-pushed the ipv4_check branch from b91db20 to 23e3c55 Compare August 31, 2020 09:53

gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 31, 2020

neo-liang-sap suggested changes Aug 31, 2020

View reviewed changes

Public IP ipv4 check

4804ec0

aws IPv6 support use net.ParseIP identify ipv4 or ipv6 modify isIP method rename isIP() to isIPv4()

tedteng force-pushed the ipv4_check branch from 23e3c55 to 4804ec0 Compare August 31, 2020 14:41

gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 31, 2020

gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 31, 2020

neo-liang-sap approved these changes Sep 1, 2020

View reviewed changes

gardener-robot added the reviewed/lgtm Has approval for merging label Sep 1, 2020

neo-liang-sap merged commit 91e3070 into gardener-attic:master Sep 1, 2020

tedteng deleted the ipv4_check branch September 15, 2020 01:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ipv4 check #276

Ipv4 check #276

tedteng commented Aug 26, 2020 •

edited

Loading

neo-liang-sap commented Aug 26, 2020

tedteng commented Aug 26, 2020

tedteng commented Aug 27, 2020 •

edited

Loading

tedteng commented Aug 28, 2020

tedteng commented Aug 28, 2020 •

edited

Loading

petersutter Aug 28, 2020

petersutter Aug 28, 2020

tedteng Aug 31, 2020

petersutter Aug 31, 2020

tedteng Aug 31, 2020 •

edited

Loading

petersutter Aug 31, 2020

tedteng Aug 31, 2020

petersutter left a comment

petersutter Aug 31, 2020

tedteng Aug 31, 2020

neo-liang-sap left a comment

neo-liang-sap left a comment

Ipv4 check #276

Ipv4 check #276

Conversation

tedteng commented Aug 26, 2020 • edited Loading

neo-liang-sap commented Aug 26, 2020

tedteng commented Aug 26, 2020

tedteng commented Aug 27, 2020 • edited Loading

tedteng commented Aug 28, 2020

tedteng commented Aug 28, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tedteng Aug 31, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

petersutter left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

neo-liang-sap left a comment

Choose a reason for hiding this comment

neo-liang-sap left a comment

Choose a reason for hiding this comment

tedteng commented Aug 26, 2020 •

edited

Loading

tedteng commented Aug 27, 2020 •

edited

Loading

tedteng commented Aug 28, 2020 •

edited

Loading

tedteng Aug 31, 2020 •

edited

Loading