(01) validator

config/Cargo.toml

@@ -5,6 +5,9 @@ license.workspace = true
 publish.workspace = true
 version.workspace = true
 
+[features]
+bolero = ["dep:bolero", "lpm/bolero"]
+
 [dependencies]
 # internal
 common = { workspace = true }
@@ -16,6 +19,7 @@ net = { workspace = true }
 
 # external
 arc-swap = { workspace = true }
+bolero = { workspace = true, optional = true, default-features = false, features = ["alloc"] }
 chrono = { workspace = true, features = ["alloc", "std"] }
 derive_builder = { workspace = true, features = [] }
 ipnet = { workspace = true }

config/src/converters/k8s/config/expose.rs

@@ -491,7 +491,7 @@ mod test {
                 "10.0.4.0/24".parse::<Prefix>().unwrap(),
             ),
         ]);
-        let expose_gen = k8s_intf::bolero::expose::LegalValueExposeGenerator::new(&subnets);
+        let expose_gen = k8s_intf::bolero::expose::AnyExposeGenerator::new(0, &subnets);
         bolero::check!()
             .with_generator(expose_gen)
             .for_each(|k8s_expose| {
@@ -549,6 +549,7 @@ mod test {
                     })
                     .unwrap_or(vec![]);
                 k8s_nots.sort();
+                k8s_nots.dedup();
                 let k8s_subnets = k8s_expose
                     .ips
                     .as_ref()
@@ -566,6 +567,7 @@ mod test {
                     .unwrap_or(vec![]);
                 k8s_ips.extend(k8s_subnets);
                 k8s_ips.sort();
+                k8s_ips.dedup();
 
                 let k8s_as = k8s_expose.r#as.as_ref().map(|r#as| {
                     let mut ret = r#as
@@ -574,6 +576,7 @@ mod test {
                         .map(|r#as| r#as.cidr.as_ref().unwrap().clone())
                         .collect::<Vec<_>>();
                     ret.sort();
+                    ret.dedup();
                     ret
                 });
 
@@ -584,6 +587,7 @@ mod test {
                         .map(|r#as| r#as.not.as_ref().unwrap().clone())
                         .collect::<Vec<_>>();
                     ret.sort();
+                    ret.dedup();
                     ret
                 });
 

config/src/converters/k8s/config/peering.rs

@@ -91,14 +91,17 @@ mod test {
     use k8s_intf::bolero::peering::{
         LegalValuePeeringsGenerator, LegalValuePeeringsPeeringGenerator,
     };
+    use k8s_intf::bolero::{AddressFamily, NatFlavour};
     use lpm::prefix::Prefix;
 
     use crate::converters::k8s::config::{SubnetMap, VpcSubnetMap};
 
     #[test]
     fn test_vpc_manifest_conversion() {
         let subnets = SubnetMap::new(); // Let this be empty since we are test subnet conversion elsewhere
-        let generator = LegalValuePeeringsPeeringGenerator::new(&subnets);
+        let flavours = NatFlavour::all();
+        let generator =
+            LegalValuePeeringsPeeringGenerator::new(&subnets, &flavours, AddressFamily::V4, 3, 0);
         bolero::check!()
             .with_generator(generator)
             .for_each(|peering| {
@@ -169,7 +172,11 @@ mod test {
                 ]),
             ),
         ]);
-        let generator = LegalValuePeeringsGenerator::new(&subnets).unwrap();
+        let flavours = NatFlavour::all();
+        let families = AddressFamily::all();
+        let groups = vec!["gwgroup-0".to_string()];
+        let generator =
+            LegalValuePeeringsGenerator::new(&subnets, &flavours, &families, 3, &groups).unwrap();
         bolero::check!()
             .with_generator(generator)
             .for_each(|peering| {

config/src/errors.rs

@@ -46,6 +46,8 @@ pub enum ConfigError {
     FailureApply(String),
     #[error("Forbidden: {0}")]
     Forbidden(&'static str),
+    #[error("Not supported yet: {0}")]
+    Unsupported(&'static str),
     #[error("Bad VPC Id")]
     BadVpcId(String),
     #[error("Bad VTEP local address {0}: {1}")]
@@ -75,8 +77,21 @@ pub enum ConfigError {
     #[error("Invalid ACL configuration: {0}")]
     InvalidAcl(String),
     // NAT-specific
-    #[error("Mismatched prefixes sizes for static NAT: {0:?} and {1:?}")]
+    #[error(
+        "Mismatched sizes for static NAT: the exposed prefixes and the range they translate to \
+         must cover the same number of address-port pairs (they cover {0:?} and {1:?})"
+    )]
     MismatchedPrefixSizes(PrefixWithPortsSize, PrefixWithPortsSize),
+    #[error(
+        "Mismatched prefix lengths for port forwarding: /{private} exposed and /{public} \
+         translated to; a rule maps addresses one for one, so the two must be the same length"
+    )]
+    MismatchedPrefixLengths { private: u8, public: u8 },
+    #[error(
+        "Mismatched port range sizes for port forwarding: {private} ports exposed and {public} \
+         translated to; a rule maps ports one for one, so the two must be the same size"
+    )]
+    MismatchedPortRangeSizes { private: usize, public: usize },
     #[error("Peering {0} has manifests using incompatible NAT modes")]
     IncompatibleNatModes(String),
     #[error("Vpc {0} has a peering with no exposes")]

config/src/external/mod.rs

@@ -93,6 +93,67 @@ impl ExternalConfig {
         Ok(())
     }
 
+    /// Refuse a peering *this* gateway would have to render and cannot.
+    ///
+    /// The routing configuration built from a peering is IPv4-only: its prefix lists and
+    /// route-maps are `IpVer::V4` throughout and nothing in the builder has a v6
+    /// counterpart. `build_internal_config` used to be where that was discovered, which
+    /// made it a refusal at apply time: the configuration was accepted, reported good to
+    /// whoever submitted it, and then rejected as a whole when it was applied, taking its
+    /// IPv4 vpcs with it. Anything accepted here has to apply cleanly, so the refusal
+    /// belongs here.
+    ///
+    /// The predicate has to be the builder's, though, and not "any IPv6 peering
+    /// anywhere". `build_routing_config` renders a peering only when this gateway is a
+    /// member of the group the peering names and a community exists for its rank, and
+    /// `build_internal_config` skips the overlay entirely when the underlay carries no
+    /// BGP. A peering outside all of that is never rendered, so it cannot fail to render,
+    /// and refusing it would reject a configuration over an IPv6 peering some *other*
+    /// gateway is responsible for -- taking this gateway's own IPv4 peerings down with
+    /// it, for a configuration that built perfectly well before.
+    ///
+    /// It belongs here, and not on `Peering` or `Overlay`, for a related reason: the
+    /// limitation is the gateway's and not the overlay model's. The ACL filter builds
+    /// from a `ValidatedOverlay` and handles IPv6 perfectly well, and twelve of its tests
+    /// say so.
+    ///
+    /// `Peering::validate` has already established that a peering's two manifests agree
+    /// on their IP version, so `is_v4` speaks for the whole peering.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ConfigError::Unsupported`] if a peering this gateway renders carries
+    /// IPv6 prefixes.
+    fn check_rendered_peerings_are_ipv4(
+        gwname: &str,
+        overlay: &ValidatedOverlay,
+        underlay: &Underlay,
+        gwgroups: &GwGroupTable,
+        communities: &PriorityCommunityTable,
+    ) -> ConfigResult {
+        if underlay.vrf.bgp.is_none() {
+            // No underlay BGP means no overlay routing configuration is built at all.
+            return Ok(());
+        }
+        let renders = |peering: &ValidatedPeering| {
+            gwgroups
+                .get_group_member_rank(peering.gwgroup(), gwname)
+                .is_some_and(|rank| communities.get_community(rank).is_some())
+        };
+        if overlay
+            .vpc_table()
+            .peerings()
+            .filter(|peering| renders(peering))
+            .all(ValidatedPeering::is_v4)
+        {
+            return Ok(());
+        }
+        Err(ConfigError::Unsupported(
+            "IPv6 prefixes in a vpc peering: the routing configuration built from a peering is \
+             IPv4-only, so such a peering cannot be rendered",
+        ))
+    }
+
     /// Validate the external configuration.
     /// This method consumes `ExternalConfig` and outputs a `ValidatedGwConfig` on success.
     ///
@@ -107,6 +168,13 @@ impl ExternalConfig {
         let overlay = self.overlay.validate()?;
         let peerings = overlay.vpc_table().peerings();
         self.check_peering_gwgroups_exist(peerings)?;
+        Self::check_rendered_peerings_are_ipv4(
+            &self.gwname,
+            &overlay,
+            &underlay,
+            &self.gwgroups,
+            &self.communities,
+        )?;
 
         // if there are vpcs configured, there MUST be a vtep configured
         if !overlay.vpc_table().is_empty() && underlay.vtep.is_none() {

config/src/external/overlay/validation_tests.rs

@@ -646,7 +646,13 @@ mod test {
             .unwrap();
         let result = expose.validate();
         assert!(
-            matches!(result, Err(ConfigError::MismatchedPrefixSizes(_, _))),
+            matches!(
+                result,
+                Err(ConfigError::MismatchedPrefixLengths {
+                    private: 24,
+                    public: 25
+                })
+            ),
             "{result:?}",
         );
     }