From 500eff0ae93b17a7b9258455fb870a95330bc6db Mon Sep 17 00:00:00 2001 From: Albin Kerouanton Date: Tue, 7 May 2024 08:55:01 +0200 Subject: [PATCH] libnet/i/defaultipam: improve address pools validation Nothing was validating whether address pools' `base` prefix were larger than the target subnet `size` they're associated to. As such invalid address pools would yield no subnet, the error could go unnoticed. Signed-off-by: Albin Kerouanton --- libnetwork/ipams/defaultipam/allocator.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libnetwork/ipams/defaultipam/allocator.go b/libnetwork/ipams/defaultipam/allocator.go index 645f1dfa8a..a211843ca9 100644 --- a/libnetwork/ipams/defaultipam/allocator.go +++ b/libnetwork/ipams/defaultipam/allocator.go @@ -95,6 +95,9 @@ func splitByIPFamily(s []*ipamutils.NetworkToSplit) ([]*ipamutils.NetworkToSplit if !n.Base.IsValid() || n.Size == 0 { return []*ipamutils.NetworkToSplit{}, []*ipamutils.NetworkToSplit{}, fmt.Errorf("network at index %d (%v) is not in canonical form", i, n) } + if n.Base.Bits() > n.Size { + return []*ipamutils.NetworkToSplit{}, []*ipamutils.NetworkToSplit{}, fmt.Errorf("network at index %d (%v) has a smaller prefix (/%d) than the target size of that pool (/%d)", i, n, n.Base.Bits(), n.Size) + } n.Base, _ = n.Base.Addr().Unmap().Prefix(n.Base.Bits())