Skip to content

fix(unikernels): validate inputs in IsIPInSubnet#755

Open
DevMhrn wants to merge 1 commit into
urunc-dev:mainfrom
DevMhrn:fix/unikernels-isipinsubnet-validate-inputs
Open

fix(unikernels): validate inputs in IsIPInSubnet#755
DevMhrn wants to merge 1 commit into
urunc-dev:mainfrom
DevMhrn:fix/unikernels-isipinsubnet-validate-inputs

Conversation

@DevMhrn

@DevMhrn DevMhrn commented Jun 8, 2026

Copy link
Copy Markdown

Description

This just adds a small nil-check to IsIPInSubnet in pkg/unikontainers/unikernels/linux.go. IsIPInSubnet decides if Linux unikernel needs URUNIT_DEFROUTE=1 boot param, and currently it just returns true if any of its three string parameters (Address, Gateway, Mask) fails to parse-effectively silently turning off the flag added in #284.

Default to false seems safer. If we're using this for Docker with a malformed mask, we just enable one extra optional URUNIT_DEFROUTE=1 flag which will harmlessly overwrite the eth0 default route, which would likely work fine anyways. The previous default risked silently losing egress in k8s, which is worse.

I've also added a small table-driven test, in a new file pkg/unikontainers/unikernels/linux_network_test.go covering two known-good cases (same subnet, different subnet) as regression guards, plus the 5 malformed-mask cases mentioned in the issue (empty string, garbage string, partial mask, IP literal mask, /24 style mask) plus the fully empty cases.

Related issues

How was this tested?

Locally, inside a Linux container (host is macOS, so e2e is left to CI).

docker run --rm -v "$PWD":/src -w /src -e CGO_ENABLED=0 golang:1.25 \
    go test -v -count=1 -run TestIsIPInSubnet ./pkg/unikontainers/unikernels/
Screenshot 2026-06-08 at 5 56 08 PM

LLM usage

N/A

Checklist

  • I have read the contribution guide.
  • The linter passes locally (make lint).
  • The e2e tests of at least one tool pass locally (make test_ctr, make test_nerdctl, make test_docker, make test_crictl).
  • If LLMs were used: I have read the llm policy.

Introduce a new test file for LinuxNet subnet validation, covering various scenarios including same subnet, different subnet, and invalid masks. Enhance the IsIPInSubnet function to handle edge cases by returning false for invalid inputs.

Signed-off-by: DevMhrn <debashismaharana7854@gmail.com>
Copilot AI review requested due to automatic review settings June 8, 2026 12:30
@netlify

netlify Bot commented Jun 8, 2026

Copy link
Copy Markdown

Deploy Preview for urunc canceled.

Name Link
🔨 Latest commit 1eb2e4d
🔍 Latest deploy log https://app.netlify.com/projects/urunc/deploys/6a26b5eaaa4f7c00092eb318

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds defensive handling and unit tests for IsIPInSubnet to ensure invalid IP/mask inputs return false rather than producing incorrect behavior.

Changes:

  • Added early-return validation in IsIPInSubnet when address, gateway, or mask fail to parse.
  • Introduced table-driven tests covering valid and several invalid mask formats.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
pkg/unikontainers/unikernels/linux_network_test.go Adds unit tests for IsIPInSubnet, primarily around mask parsing/validation.
pkg/unikontainers/unikernels/linux.go Adds nil-check guard to return false on unparsable address/gateway/mask.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +71 to +75
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
assert.Equal(t, tt.want, IsIPInSubnet(tt.net))
})
}
Comment on lines +23 to +28
func TestIsIPInSubnet(t *testing.T) {
tests := []struct {
name string
net LinuxNet
want bool
}{
@DevMhrn

DevMhrn commented Jun 8, 2026

Copy link
Copy Markdown
Author

As @cmainas pointed out on the issue, this isn't a user-visible failure in practice, by the time IsIPInSubnet runs, urunc's network setup has already validated the inputs, so any malformed data would cause the VM to fail to boot earlier rather than boot with URUNIT_DEFROUTE=1 incorrectly suppressed. The change here is purely defensive: the function should not silently return "same subnet" on inputs it can't parse, regardless of what callers do upstream.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

IsIPInSubnet silently drops URUNIT_DEFROUTE when network inputs are malformed

2 participants