Skip to content

Validate nodeattrib IPs and MACs - #252

Draft
Obihoernchen wants to merge 2 commits into
xcat2:masterfrom
Obihoernchen:validate
Draft

Validate nodeattrib IPs and MACs#252
Obihoernchen wants to merge 2 commits into
xcat2:masterfrom
Obihoernchen:validate

Conversation

@Obihoernchen

@Obihoernchen Obihoernchen commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

This is just a POC for now.
It validates nodeattrib net.hwaddr, net.ipv4_address, net.ipv6_address, net.ipv4_gateway, net.ipv6_gateway.
nodeattribexpressions are validated with a best effort approach.

Not sure this will ever be useful but it might be a good starting point for some discussion about additional attribute validation.

Some examples:

[root@confluent-alma10 ~]# # MAC validation
[root@confluent-alma10 ~]# nodeattrib c1 net.test.hwaddr=123
Error: Bad Request - net.test.hwaddr on node c1: "123" is not a valid hardware address (expected colon or hyphen delimited hex octets)
[root@confluent-alma10 ~]# nodeattrib c1 net.test.hwaddr=12:23:34
Error: Bad Request - net.test.hwaddr on node c1: "12:23:34" has 3 octets, expected 6 (Ethernet), 8 (EUI-64) or 20 (InfiniBand)
[root@confluent-alma10 ~]# nodeattrib c1 net.test.hwaddr=12:23:34:45:65:944
Error: Bad Request - net.test.hwaddr on node c1: "12:23:34:45:65:944" is not a valid hardware address (expected colon or hyphen delimited hex octets)
[root@confluent-alma10 ~]# nodeattrib c1 net.test.hwaddr=12:23:34:45:65:94
c1: 12:23:34:45:65:94

[root@confluent-alma10 ~]# # IP validation
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_address=123.300.100.100
Error: Bad Request - net.test.ipv4_address on node c1: "123.300.100.100" is not a valid IPv4 address
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_address=123.255.100.100
c1: 123.255.100.100
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_address=123.255.100.100/10
c1: 123.255.100.100/10
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_address=123.255.100.100/100
Error: Bad Request - net.test.ipv4_address on node c1: "123.255.100.100/100" has an invalid prefix length

[root@confluent-alma10 ~]# # IP gateway validation
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_gateway=1.2.3.4/24
Error: Bad Request - net.test.ipv4_gateway on node c1: "1.2.3.4/24" must be a plain IPv4 address without a /prefix
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_gateway=1.2.3.4
c1: 1.2.3.4
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_gateway=1.2.3.400
Error: Bad Request - net.test.ipv4_gateway on node c1: "1.2.3.400" is not a valid IPv4 address

[root@confluent-alma10 ~]# # nodeattribexpression best-effort examples
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_address=192.168.0.{n1}
c1: 192.168.0.1
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_address=192.168.0.{n1+300}
Error: Bad Request - net.test.ipv4_address expression "192.168.0.{n1+300}" on node c1 evaluates to an invalid value: "192.168.0.301" is not a valid IPv4 address
[root@confluent-alma10 ~]# nodeattrib c1 net.test.ipv4_address=192.168.0.{n1+200}
c1: 192.168.0.201
[root@confluent-alma10 ~]# nodegroupdefine test
test: created
[root@confluent-alma10 ~]# nodedefine c200 groups=test
c200: created
[root@confluent-alma10 ~]# nodegroupattrib test net.ipv4_address=192.168.0.{n1}
[root@confluent-alma10 ~]# nodeattrib c200 net.ipv4_address
c200: net.ipv4_address: 192.168.0.200
[root@confluent-alma10 ~]# nodedefine c300 groups=test # validation doesn't work when new nodes create invalid IPs
c300: created
[root@confluent-alma10 ~]# nodeattrib c300 net.ipv4_address
c300: net.ipv4_address: 192.168.0.300

@Obihoernchen
Validate net address and hwaddr attribute values on write
6940c43 
net.ipv4_address, net.ipv4_gateway, net.ipv6_address, net.ipv6_gateway
and net.hwaddr (including interface-scoped forms like
net.eth0.ipv4_address) previously accepted any string, deferring
discovery of typos to deployment time.

Extend the declarative attribute schema with a 'validate' callable and
enforce it in the common attribute set path in configmanager, covering
nodeattrib, nodegroupattrib and the HTTP API alike.  Addresses accept
an optional /prefix suffix (gateways do not), and hardware addresses
accept colon or hyphen delimited hex octets of length 6 (Ethernet),
8 (EUI-64) or 20 (InfiniBand).

Expression values such as 172.16.1.{n1} continue to be accepted
unexamined; empty values and clears are unaffected.
@Obihoernchen
Best-effort validation of expression-valued net attributes
bc10987 
Expression values such as net.ipv4_address=172.16.1.{n1} were accepted
without any inspection of what they would produce.  Now, when setting
such an expression on an attribute that declares a format validator,
evaluate it against the current configuration and validate the result:
per target node when set on a node, and per current member node when
set on a group.

The check is best effort by design: an expression that cannot be
evaluated yet (the node is still being created in the same request, a
dependency attribute is not set, or group membership changes later) is
let through unexamined; only a cleanly evaluated but malformed result
is rejected.  Results are also not re-validated when expressions are
re-evaluated on later renames or dependency changes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Obihoernchen