mirror of
https://github.com/apple/container.git
synced 2026-10-14 10:09:10 +00:00
Maxime Grenu
1951816427
## What Add a `DNS.validate()` method that verifies all nameserver entries are valid IPv4 or IPv6 addresses. The method is called from `Vminitd.configureDNS()` before applying the configuration. ## Why Closes #467. Currently, any arbitrary string can be passed as a nameserver in `DNSConfiguration`, which silently results in an invalid `/etc/resolv.conf` inside the container. Hostname strings like `dns.example.com` would be written to resolv.conf but would not work as nameservers. ## How - Added `DNS.validate() throws` method in `DNSConfiguration.swift` that iterates over all nameservers and attempts to parse each as either an `IPv4Address` or `IPv6Address` (using the existing parsers in `ContainerizationExtras`) - Added `import ContainerizationExtras` to `DNSConfiguration.swift` (the `Containerization` target already depends on `ContainerizationExtras`) - Called `config.validate()` at the start of `Vminitd.configureDNS()` so validation happens before any GRPC call ## Testing Added 6 new unit tests in `DNSTests.swift`: - ✅ Valid IPv4 nameservers accepted - ✅ Valid IPv6 nameservers accepted - ✅ Mixed IPv4/IPv6 nameservers accepted - ✅ Empty nameserver list accepted - ❌ Hostname rejected - ❌ Invalid address rejected ## Checklist - [x] Tests added - [x] No breaking changes to existing API (validate() is a new method, existing init is unchanged) - [x] Follows existing patterns (uses ContainerizationExtras IP address types, ContainerizationError for errors) Signed-off-by: Maxime Grenu <maxime.grenu@gmail.com>
92 lines
3.1 KiB
Swift
92 lines
3.1 KiB
Swift
//===----------------------------------------------------------------------===//
|
|
// Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// https://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
import ContainerizationError
|
|
import ContainerizationExtras
|
|
|
|
/// DNS configuration for a container. The values will be used to
|
|
/// construct /etc/resolv.conf for a given container.
|
|
public struct DNS: Sendable {
|
|
/// The set of default nameservers to use if none are provided
|
|
/// in the constructor.
|
|
public static let defaultNameservers = ["1.1.1.1"]
|
|
|
|
/// The nameservers a container should use.
|
|
public var nameservers: [String]
|
|
/// The DNS domain to use.
|
|
public var domain: String?
|
|
/// The DNS search domains to use.
|
|
public var searchDomains: [String]
|
|
/// The DNS options to use.
|
|
public var options: [String]
|
|
|
|
public init(
|
|
nameservers: [String] = defaultNameservers,
|
|
domain: String? = nil,
|
|
searchDomains: [String] = [],
|
|
options: [String] = []
|
|
) {
|
|
self.nameservers = nameservers
|
|
self.domain = domain
|
|
self.searchDomains = searchDomains
|
|
self.options = options
|
|
}
|
|
|
|
/// Validates the DNS configuration.
|
|
///
|
|
/// Ensures that all nameserver entries are valid IPv4 or IPv6 addresses.
|
|
/// Arbitrary hostnames are not permitted as nameservers.
|
|
///
|
|
/// - Throws: ``ContainerizationError`` with code `.invalidArgument` if
|
|
/// any nameserver is not a valid IP address.
|
|
public func validate() throws {
|
|
for nameserver in nameservers {
|
|
let isValidIPv4 = (try? IPv4Address(nameserver)) != nil
|
|
let isValidIPv6 = (try? IPv6Address(nameserver)) != nil
|
|
if !isValidIPv4 && !isValidIPv6 {
|
|
throw ContainerizationError(
|
|
.invalidArgument,
|
|
message: "nameserver '\(nameserver)' is not a valid IPv4 or IPv6 address"
|
|
)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
extension DNS {
|
|
public var resolvConf: String {
|
|
var text = ""
|
|
|
|
if !nameservers.isEmpty {
|
|
text += nameservers.map { "nameserver \($0)" }.joined(separator: "\n") + "\n"
|
|
}
|
|
|
|
if let domain {
|
|
text += "domain \(domain)\n"
|
|
}
|
|
|
|
if !searchDomains.isEmpty {
|
|
text += "search \(searchDomains.joined(separator: " "))\n"
|
|
}
|
|
|
|
if !options.isEmpty {
|
|
text += "options \(options.joined(separator: " "))\n"
|
|
}
|
|
|
|
return text
|
|
}
|
|
}
|