Repository: istio/istio
File: cni/pkg/plugin/sidecar_redirect.go (Go)

Code before:
	includeInboundPortsKey  = annotation.SidecarTrafficIncludeInboundPorts.Name
	excludeOutboundPortsKey = annotation.SidecarTrafficExcludeOutboundPorts.Name
	includeOutboundPortsKey = annotation.SidecarTrafficIncludeOutboundPorts.Name
	excludeInterfacesKey    = annotation.SidecarTrafficExcludeInterfaces.Name

	sidecarInterceptModeKey = annotation.SidecarInterceptionMode.Name
	sidecarPortListKey      = annotation.SidecarStatusPort.Name

	kubevirtInterfacesKey    = annotation.SidecarTrafficKubevirtInterfaces.Name
	rerouteVirtInterfacesKey = annotation.IoIstioRerouteVirtualInterfaces.Name

	annotationRegistry = map[string]*annotationParam{
		"inject":                     {injectAnnotationKey, "", alwaysValidFunc},
		"status":                     {sidecarStatusKey, "", alwaysValidFunc},
		"redirectMode":               {sidecarInterceptModeKey, defaultRedirectMode, validateInterceptionMode},
		"ports":                      {sidecarPortListKey, "", validatePortList},
		"includeIPCidrs":             {includeIPCidrsKey, defaultRedirectIPCidr, validateCIDRListWithWildcard},
		"excludeIPCidrs":             {excludeIPCidrsKey, defaultRedirectExcludeIPCidr, validateCIDRList},
		"excludeInboundPorts":        {excludeInboundPortsKey, defaultRedirectExcludePort, validatePortListWithWildcard},
		"includeInboundPorts":        {includeInboundPortsKey, defaultIncludeInboundPorts, validatePortListWithWildcard},
		"excludeOutboundPorts":       {excludeOutboundPortsKey, defaultRedirectExcludePort, validatePortListWithWildcard},
		"includeOutboundPorts":       {includeOutboundPortsKey, defaultIncludeOutboundPorts, validatePortListWithWildcard},
		"kubevirtInterfaces":         {kubevirtInterfacesKey, defaultKubevirtInterfaces, alwaysValidFunc}, // DEPRECATED
		"reroute-virtual-interfaces": {rerouteVirtInterfacesKey, defaultKubevirtInterfaces, alwaysValidFunc},
		"excludeInterfaces":          {excludeInterfacesKey, defaultExcludeInterfaces, netutil.ValidateInterfaceNames},
	}
)

// Redirect -- the istio-cni redirect object
type Redirect struct {
	targetPort               string
	redirectMode             string
	noRedirectUID            string
	noRedirectGID            string
	includeIPCidrs           string
	excludeIPCidrs           string
	excludeInboundPorts      string
	excludeOutboundPorts     string
	includeInboundPorts      string
	includeOutboundPorts     string
	rerouteVirtualInterfaces string
	excludeInterfaces        string
	dnsRedirect              bool
	dualStack                bool
	invalidDrop              bool
}

type annotationValidationFunc func(value string) error

type annotationParam struct {
	key        string

Review comment (security):
per https://github.com/istio/istio/issues/58836 Both `kubevirtInterfaces` and `reroute-virtual-interfaces` use alwaysValidFunc and are vulnerable to the same injection attack.
Should be:
```
"kubevirtInterfaces":         {kubevirtInterfacesKey, defaultKubevirtInterfaces, netutil.ValidateInterfaceNames},
"reroute-virtual-interfaces": {rerouteVirtInterfacesKey, defaultKubevirtInterfaces, netutil.ValidateInterfaceNames},
```

Code after:
	includeInboundPortsKey  = annotation.SidecarTrafficIncludeInboundPorts.Name
	excludeOutboundPortsKey = annotation.SidecarTrafficExcludeOutboundPorts.Name
	includeOutboundPortsKey = annotation.SidecarTrafficIncludeOutboundPorts.Name
	excludeInterfacesKey    = annotation.SidecarTrafficExcludeInterfaces.Name

	sidecarInterceptModeKey = annotation.SidecarInterceptionMode.Name
	sidecarPortListKey      = annotation.SidecarStatusPort.Name

	kubevirtInterfacesKey    = annotation.SidecarTrafficKubevirtInterfaces.Name
	rerouteVirtInterfacesKey = annotation.IoIstioRerouteVirtualInterfaces.Name

	annotationRegistry = map[string]*annotationParam{
		"inject":                     {injectAnnotationKey, "", alwaysValidFunc},
		"status":                     {sidecarStatusKey, "", alwaysValidFunc},
		"redirectMode":               {sidecarInterceptModeKey, defaultRedirectMode, validateInterceptionMode},
		"ports":                      {sidecarPortListKey, "", validatePortList},
		"includeIPCidrs":             {includeIPCidrsKey, defaultRedirectIPCidr, validateCIDRListWithWildcard},
		"excludeIPCidrs":             {excludeIPCidrsKey, defaultRedirectExcludeIPCidr, validateCIDRList},
		"excludeInboundPorts":        {excludeInboundPortsKey, defaultRedirectExcludePort, validatePortListWithWildcard},
		"includeInboundPorts":        {includeInboundPortsKey, defaultIncludeInboundPorts, validatePortListWithWildcard},
		"excludeOutboundPorts":       {excludeOutboundPortsKey, defaultRedirectExcludePort, validatePortListWithWildcard},
		"includeOutboundPorts":       {includeOutboundPortsKey, defaultIncludeOutboundPorts, validatePortListWithWildcard},
		"kubevirtInterfaces":         {kubevirtInterfacesKey, defaultKubevirtInterfaces, netutil.ValidateInterfaceNames}, // DEPRECATED
		"reroute-virtual-interfaces": {rerouteVirtInterfacesKey, defaultKubevirtInterfaces, netutil.ValidateInterfaceNames},
		"excludeInterfaces":          {excludeInterfacesKey, defaultExcludeInterfaces, netutil.ValidateInterfaceNames},
	}
)

// Redirect -- the istio-cni redirect object
type Redirect struct {
	targetPort               string
	redirectMode             string
	noRedirectUID            string
	noRedirectGID            string
	includeIPCidrs           string
	excludeIPCidrs           string
	excludeInboundPorts      string
	excludeOutboundPorts     string
	includeInboundPorts      string
	includeOutboundPorts     string
	rerouteVirtualInterfaces string
	excludeInterfaces        string
	dnsRedirect              bool
	dualStack                bool
	invalidDrop              bool
}

type annotationValidationFunc func(value string) error

type annotationParam struct {
	key        string