validator

config/Cargo.toml

@@ -5,6 +5,9 @@ license.workspace = true
 publish.workspace = true
 version.workspace = true
 
+[features]
+bolero = ["dep:bolero", "lpm/bolero"]
+
 [dependencies]
 # internal
 common = { workspace = true }
@@ -16,6 +19,7 @@ net = { workspace = true }
 
 # external
 arc-swap = { workspace = true }
+bolero = { workspace = true, optional = true, default-features = false, features = ["alloc"] }
 chrono = { workspace = true, features = ["alloc", "std"] }
 derive_builder = { workspace = true, features = [] }
 ipnet = { workspace = true }

config/src/converters/k8s/config/expose.rs

@@ -491,7 +491,7 @@ mod test {
                 "10.0.4.0/24".parse::<Prefix>().unwrap(),
             ),
         ]);
-        let expose_gen = k8s_intf::bolero::expose::LegalValueExposeGenerator::new(&subnets);
+        let expose_gen = k8s_intf::bolero::expose::AnyExposeGenerator::new(0, &subnets);
         bolero::check!()
             .with_generator(expose_gen)
             .for_each(|k8s_expose| {
@@ -549,6 +549,7 @@ mod test {
                     })
                     .unwrap_or(vec![]);
                 k8s_nots.sort();
+                k8s_nots.dedup();
                 let k8s_subnets = k8s_expose
                     .ips
                     .as_ref()
@@ -566,6 +567,7 @@ mod test {
                     .unwrap_or(vec![]);
                 k8s_ips.extend(k8s_subnets);
                 k8s_ips.sort();
+                k8s_ips.dedup();
 
                 let k8s_as = k8s_expose.r#as.as_ref().map(|r#as| {
                     let mut ret = r#as
@@ -574,6 +576,7 @@ mod test {
                         .map(|r#as| r#as.cidr.as_ref().unwrap().clone())
                         .collect::<Vec<_>>();
                     ret.sort();
+                    ret.dedup();
                     ret
                 });
 
@@ -584,6 +587,7 @@ mod test {
                         .map(|r#as| r#as.not.as_ref().unwrap().clone())
                         .collect::<Vec<_>>();
                     ret.sort();
+                    ret.dedup();
                     ret
                 });
 

config/src/converters/k8s/config/peering.rs

@@ -91,14 +91,17 @@ mod test {
     use k8s_intf::bolero::peering::{
         LegalValuePeeringsGenerator, LegalValuePeeringsPeeringGenerator,
     };
+    use k8s_intf::bolero::{AddressFamily, NatFlavour};
     use lpm::prefix::Prefix;
 
     use crate::converters::k8s::config::{SubnetMap, VpcSubnetMap};
 
     #[test]
     fn test_vpc_manifest_conversion() {
         let subnets = SubnetMap::new(); // Let this be empty since we are test subnet conversion elsewhere
-        let generator = LegalValuePeeringsPeeringGenerator::new(&subnets);
+        let flavours = NatFlavour::all();
+        let generator =
+            LegalValuePeeringsPeeringGenerator::new(&subnets, &flavours, AddressFamily::V4, 3, 0);
         bolero::check!()
             .with_generator(generator)
             .for_each(|peering| {
@@ -169,7 +172,11 @@ mod test {
                 ]),
             ),
         ]);
-        let generator = LegalValuePeeringsGenerator::new(&subnets).unwrap();
+        let flavours = NatFlavour::all();
+        let families = AddressFamily::all();
+        let groups = vec!["gwgroup-0".to_string()];
+        let generator =
+            LegalValuePeeringsGenerator::new(&subnets, &flavours, &families, 3, &groups).unwrap();
         bolero::check!()
             .with_generator(generator)
             .for_each(|peering| {

config/src/errors.rs

@@ -46,6 +46,8 @@ pub enum ConfigError {
     FailureApply(String),
     #[error("Forbidden: {0}")]
     Forbidden(&'static str),
+    #[error("Not supported yet: {0}")]
+    Unsupported(&'static str),
     #[error("Bad VPC Id")]
     BadVpcId(String),
     #[error("Bad VTEP local address {0}: {1}")]
@@ -75,8 +77,21 @@ pub enum ConfigError {
     #[error("Invalid ACL configuration: {0}")]
     InvalidAcl(String),
     // NAT-specific
-    #[error("Mismatched prefixes sizes for static NAT: {0:?} and {1:?}")]
+    #[error(
+        "Mismatched sizes for static NAT: the exposed prefixes and the range they translate to \
+         must cover the same number of address-port pairs (they cover {0:?} and {1:?})"
+    )]
     MismatchedPrefixSizes(PrefixWithPortsSize, PrefixWithPortsSize),
+    #[error(
+        "Mismatched prefix lengths for port forwarding: /{private} exposed and /{public} \
+         translated to; a rule maps addresses one for one, so the two must be the same length"
+    )]
+    MismatchedPrefixLengths { private: u8, public: u8 },
+    #[error(
+        "Mismatched port range sizes for port forwarding: {private} ports exposed and {public} \
+         translated to; a rule maps ports one for one, so the two must be the same size"
+    )]
+    MismatchedPortRangeSizes { private: usize, public: usize },
     #[error("Peering {0} has manifests using incompatible NAT modes")]
     IncompatibleNatModes(String),
     #[error("Vpc {0} has a peering with no exposes")]

config/src/external/overlay/validation_tests.rs

@@ -646,7 +646,13 @@ mod test {
             .unwrap();
         let result = expose.validate();
         assert!(
-            matches!(result, Err(ConfigError::MismatchedPrefixSizes(_, _))),
+            matches!(
+                result,
+                Err(ConfigError::MismatchedPrefixLengths {
+                    private: 24,
+                    public: 25
+                })
+            ),
             "{result:?}",
         );
     }