validator: ensure no network backend path

cmd/webhook/admission/admission_test.go

@@ -133,6 +133,11 @@ func TestRouteGroupAdmitter(t *testing.T) {
 			inputFile: "rg-with-multiple-predicates.json",
 			message:   `single predicate expected at \"Method(\\\"GET\\\") && Path(\\\"/\\\")\"\nsingle predicate expected at \" \"`,
 		},
+		{
+			name:      "routegroup with invalid backends",
+			inputFile: "rg-with-invalid-backend-path.json",
+			message:   `backend address \"http://example.com/foo\" contains path\nbackend address \"http://example.com/foo/bar\" contains path\nbackend address \"http://example.com/foo/\" contains path\nbackend address \"/foo\" contains path\nbackend address \"http://example.com/\" contains path\nbackend address \"example.com/\" contains path\nbackend address \"example.com/foo\" contains path`,
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			expectedResponse := responseAllowedFmt

cmd/webhook/admission/testdata/rg/rg-with-invalid-backend-path.json

@@ -0,0 +1,93 @@
+{
+  "request": {
+    "uid": "req-uid",
+    "name": "req1",
+    "operation": "create",
+    "kind": {
+      "group": "zalando",
+      "version": "v1",
+      "kind": "RouteGroup"
+    },
+    "namespace": "n1",
+    "object": {
+      "metadata": {
+        "name": "rg1",
+        "namespace": "n1"
+      },
+      "spec": {
+        "backends": [
+          {
+            "name": "valid-backend1",
+            "type": "shunt"
+          },
+          {
+            "name": "invalid-backend1",
+            "type": "network",
+            "address": "http://example.com"
+          },
+          {
+            "name": "invalid-backend2",
+            "type": "network",
+            "address": "http://example.com/foo"
+          },
+          {
+            "name": "invalid-backend3",
+            "type": "network",
+            "address": "http://example.com/foo/bar"
+          },
+          {
+            "name": "invalid-backend4",
+            "type": "network",
+            "address": "http://example.com/foo/"
+          },
+          {
+            "name": "invalid-backend5",
+            "type": "network",
+            "address": "/foo"
+          },
+          {
+            "name": "valid-backend2",
+            "type": "network",
+            "address": "http://user:[email protected]"
+          },
+          {
+            "name": "invalid-backend6",
+            "type": "network",
+            "address": "http://example.com/"
+          },
+          {
+            "name": "invalid-backend7",
+            "type": "network",
+            "address": "example.com/"
+          },
+          {
+            "name" : "invalid-backend8",
+            "type" : "network",
+            "address" : "example.com/foo"
+          }
+        ],
+        "defaultBackends": [
+          {
+            "backendName": "valid-backend1"
+          }
+        ],
+        "routes": [
+          {
+            "backends": [
+              {
+                "backendName": "valid-backend1"
+              }
+            ],
+            "filters": [
+              "status(201)"
+            ],
+            "path": "/",
+            "predicates": [
+              "Method(\"GET\")"
+            ]
+          }
+        ]
+      }
+    }
+  }
+}

dataclients/kubernetes/definitions/routegroupvalidator.go

@@ -3,6 +3,7 @@ package definitions
 import (
 	"errors"
 	"fmt"
+	"net/url"
 
 	"github.com/zalando/skipper/eskip"
 )
@@ -37,6 +38,7 @@ func (rgv *RouteGroupValidator) Validate(item *RouteGroupItem) error {
 	var errs []error
 	errs = append(errs, rgv.filtersValidation(item))
 	errs = append(errs, rgv.predicatesValidation(item))
+	errs = append(errs, rgv.validateBackends(item))
 
 	return errorsJoin(errs...)
 }
@@ -91,6 +93,19 @@ func (rgv *RouteGroupValidator) predicatesValidation(item *RouteGroupItem) error
 	return errorsJoin(errs...)
 }
 
+func (rgv *RouteGroupValidator) validateBackends(item *RouteGroupItem) error {
+	var errs []error
+	for _, backend := range item.Spec.Backends {
+		address, err := url.Parse(backend.Address)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("failed to parse backend address %q: %w", backend.Address, err))
+		} else if address.Path != "" {
+			errs = append(errs, fmt.Errorf("backend address %q contains path", backend.Address))
+		}
+	}
+	return errorsJoin(errs...)
+}
+
 // TODO: we need to pass namespace/name in all errors
 func (rg *RouteGroupSpec) validate() error {
 	// has at least one backend:

dataclients/kubernetes/definitions/testdata/errorwrapdata/errors.log

@@ -4,3 +4,8 @@ single predicate expected at "Path(\"/foo\") && Method(\"GET\")"
 single predicate expected at ""
 single filter expected at "inlineContent(\"/foo\") -> status(200)"
 single filter expected at " "
+backend address "http://example.com/foo" contains path
+backend address "http://example.com/foo/bar" contains path
+backend address "http://example.com/foo/" contains path
+backend address "/foo" contains path
+backend address "example.com/" contains path

dataclients/kubernetes/definitions/testdata/errorwrapdata/routegroups.json

@@ -134,6 +134,72 @@
                     }
                 ]
             }
+        },
+        {
+            "apiVersion": "zalando.org/v1",
+            "metadata": {
+                "name": "rg1"
+            },
+            "kind": "RouteGroup",
+            "spec": {
+                "backends": [
+                    {
+                        "name": "backend1",
+                        "type": "network",
+                        "address": "http://example.com"
+                    },
+                    {
+                        "name": "backend2",
+                        "type": "network",
+                        "address": "http://example.com/foo"
+                    },
+                    {
+                        "name": "backend3",
+                        "type": "network",
+                        "address": "http://example.com/foo/bar"
+                    },
+                    {
+                        "name": "backend4",
+                        "type": "network",
+                        "address": "http://example.com/foo/"
+                    },
+                    {
+                        "name": "backend5",
+                        "type": "network",
+                        "address": "/foo"   
+                    },
+                    {
+                        "name": "backend6",
+                        "type": "network",
+                        "address": "example.com/"
+                    },
+                    {
+                        "name": "backend7",
+                        "type": "network",
+                        "address": "http://user:[email protected]"
+                    },
+                    {
+                        "name": "shunt",
+                        "type": "shunt"
+                    }
+                ],
+                "hosts": [
+                    "test.example.com"
+                ],
+                "routes": [
+                    {
+                        "backends": [
+                            {
+                                "backendName": "shunt"
+                            }
+                        ],
+                        "filters": [
+                            "inlineContent(\"/foo\")"
+                        ],
+                        "path": "/foo"
+                    }
+                ]
+            }
         }
     ]
 }

dataclients/kubernetes/definitions/testdata/validation/route-with-invalid-backend-with-path.log

@@ -0,0 +1,6 @@
+backend address \\\"http://example\.com/foo\\\" contains path
+backend address \\\"http://example\.com/foo/bar\\\" contains path
+backend address \\\"/foo\\\" contains path
+backend address \\\"/foo/bar\\\" contains path
+backend address \\\"example\.com/foo\\\" contains path
+backend address \\\"http://example\.com/\\\" contains path

dataclients/kubernetes/definitions/testdata/validation/route-with-invalid-backend-with-path.yaml

@@ -0,0 +1,50 @@
+apiVersion: zalando.org/v1
+kind: RouteGroup
+metadata:
+  name: test-route-group
+spec:
+  hosts:
+  - example.org
+  backends:
+  - name: app
+    type: service
+    serviceName: app-svc
+    servicePort: 80
+  - name: backend1
+    type: network
+    address: http://example.com
+  - name: backend2
+    type: network
+    address: http://example.com/foo
+  - name: backend3
+    type: network
+    address: http://example.com/foo/bar
+  - name: backend4
+    type: network
+    address: /foo
+  - name: backend5
+    type: network
+    address: /foo/bar
+  - name: backend6
+    type: network
+    address: example.com/foo
+  - name: backend7
+    type: network
+    address: http://example.com/
+  - name: backend8
+    type: network
+    address: http://user:[email protected]
+  defaultBackends:
+  - backendName: app
+  routes:
+  - path: /
+    methods:
+    - GET
+    - HEAD
+    predicates:
+    - Foo("X-Bar", "42")
+    filters:
+    - foo(42)
+    - bar(24)
+    backends:
+    - backendName: app

dataclients/kubernetes/definitions/testdata/validation/route-with-multiple-filters-one-item.log

@@ -1 +1 @@
-single filter expected
+single filter expected at \\\"foo\(42\) -> bar\(24\)\\\"

dataclients/kubernetes/definitions/testdata/validation/route-with-multiple-predicates-one-item.log

@@ -1 +1 @@
-single predicate expected
+single predicate expected at \\\"Foo\(\\\\\\"X-Bar\\\\\\", \\\\\\"42\\\\\\"\) && Bar\(\\\\\\"X-Foo\\\\\\", \\\\\\"24\\\\\\"\)\\\"