Split out of review feedback on #724.
Problem
Address and CIDR handling for network policy is implemented per backend rather than once. The LXC path in network_iptables.rs parses CIDR prefixes, classifies IPv4 versus IPv6, and buckets resolved addresses by family; equivalent logic exists elsewhere for other backends. Duplicated parsing of security-relevant input is how two backends end up disagreeing about what a policy means, and a fix applied to one silently leaves the other wrong.
Suggested shape
Extract a single module owning:
- CIDR parsing and validation, including prefix-length bounds per family.
- IPv4 versus IPv6 classification, including IPv4-mapped IPv6 forms.
- Bucketing a resolver result into per-family destination lists.
Then have each backend depend on it rather than reimplementing it.
Why it was not done in #724
#724 is a behavior fix for IPv6 destinations and CIDR ranges in firewall mode. Extracting a shared module touches every backend that does address handling and would turn a scoped fix into a cross-backend refactor, which is a worse change to review and a worse change to revert.
Not verified
This describes duplication observed by reading the backends, not a divergence observed at runtime. Whether the implementations currently disagree on any specific input has not been established -- that is worth checking as the first step of the extraction, since any disagreement found is a live bug rather than just duplication.
Split out of review feedback on #724.
Problem
Address and CIDR handling for network policy is implemented per backend rather than once. The LXC path in
network_iptables.rsparses CIDR prefixes, classifies IPv4 versus IPv6, and buckets resolved addresses by family; equivalent logic exists elsewhere for other backends. Duplicated parsing of security-relevant input is how two backends end up disagreeing about what a policy means, and a fix applied to one silently leaves the other wrong.Suggested shape
Extract a single module owning:
Then have each backend depend on it rather than reimplementing it.
Why it was not done in #724
#724 is a behavior fix for IPv6 destinations and CIDR ranges in firewall mode. Extracting a shared module touches every backend that does address handling and would turn a scoped fix into a cross-backend refactor, which is a worse change to review and a worse change to revert.
Not verified
This describes duplication observed by reading the backends, not a divergence observed at runtime. Whether the implementations currently disagree on any specific input has not been established -- that is worth checking as the first step of the extraction, since any disagreement found is a live bug rather than just duplication.