[istio] fix: handle wildcard hosts in VirtualServices

pkg/i2gw/providers/istio/converter.go

@@ -18,6 +18,8 @@ package istio
 
 import (
 	"fmt"
+	"net"
+	"regexp"
 	"strings"
 
 	"github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw"
@@ -289,10 +291,36 @@ func (c *converter) convertGateway(gw *istioclientv1beta1.Gateway, fieldPath *fi
 	}, nil
 }
 
-func (c *converter) convertVsHTTPRoutes(virtualService metav1.ObjectMeta, istioHTTPRoutes []*istiov1beta1.HTTPRoute, allowedHostnames []string, fieldPath *field.Path) ([]*gatewayv1.HTTPRoute, field.ErrorList) {
+var hostnameRegexp = regexp.MustCompile(`^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
+
+// convertHostnames set istio hostnames as is, without extra filters.
+// If it's not a fqdn, it would be rejected by K8S API implementation
+func convertHostnames(hosts []string) []gatewayv1.Hostname {
+	var resHostnames []gatewayv1.Hostname
+	for _, host := range hosts {
+		// '*' is valid in istio, but not in HTTPRoute
+		if !hostnameRegexp.MatchString(host) {
+			klog.Warningf("ignoring host %s, which is not allowed in Gateway API HTTPRoute", host)
+			continue
+		}
+
+		// IP addresses are not allowed in Gateway API
+		if net.ParseIP(host) != nil {
+			klog.Warningf("ignoring host %s, which is an IP address", host)
+			continue
+		}
+
+		resHostnames = append(resHostnames, gatewayv1.Hostname(host))
+	}
+	return resHostnames
+}
+
+func (c *converter) convertVsHTTPRoutes(virtualService metav1.ObjectMeta, istioHTTPRoutes []*istiov1beta1.HTTPRoute, istioHTTPHosts []string, fieldPath *field.Path) ([]*gatewayv1.HTTPRoute, field.ErrorList) {
 	var errList field.ErrorList
 	var resHTTPRoutes []*gatewayv1.HTTPRoute
 
+	allowedHostnames := convertHostnames(istioHTTPHosts)
+
 	for i, httpRoute := range istioHTTPRoutes {
 		httpRouteFieldName := fmt.Sprintf("%v", i)
 		if httpRoute.GetName() != "" {
@@ -580,12 +608,6 @@ func (c *converter) convertVsHTTPRoutes(virtualService metav1.ObjectMeta, istioH
 			}
 		}
 
-		// set istio hostnames as is, without extra filters. If it's not a fqdn, it would be rejected by K8S API implementation
-		hostnames := make([]gatewayv1.Hostname, 0, len(allowedHostnames))
-		for _, host := range allowedHostnames {
-			hostnames = append(hostnames, gatewayv1.Hostname(host))
-		}
-
 		routeName := fmt.Sprintf("%v-idx-%v", virtualService.Name, i)
 		if httpRoute.GetName() != "" {
 			routeName = fmt.Sprintf("%v-%v", virtualService.Name, httpRoute.GetName())
@@ -600,7 +622,7 @@ func (c *converter) convertVsHTTPRoutes(virtualService metav1.ObjectMeta, istioH
 				OwnerReferences: virtualService.OwnerReferences,
 				Finalizers:      virtualService.Finalizers,
 			},
-			hostnames:   hostnames,
+			hostnames:   allowedHostnames,
 			matches:     gwHTTPRouteMatches,
 			filters:     gwHTTPRouteFilters,
 			backendRefs: backendRefs,

pkg/i2gw/providers/istio/converter_test.go

@@ -1245,6 +1245,58 @@ func Test_converter_convertVsHTTPRoutes(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "hosts with '*'",
+			args: args{
+				virtualService: metav1.ObjectMeta{
+					Name:      "test",
+					Namespace: "ns",
+				},
+				istioHTTPRoutes: []*istiov1beta1.HTTPRoute{
+					{
+						Headers: &istiov1beta1.Headers{
+							Request: &istiov1beta1.Headers_HeaderOperations{
+								Add: map[string]string{
+									"h2": "v2",
+								},
+							},
+						},
+					},
+				},
+				allowedHostnames: []string{"*"},
+			},
+			want: []*gatewayv1.HTTPRoute{
+				{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       "HTTPRoute",
+						APIVersion: "gateway.networking.k8s.io/v1",
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-idx-0",
+						Namespace: "ns",
+					},
+					Spec: gatewayv1.HTTPRouteSpec{
+						Rules: []gatewayv1.HTTPRouteRule{
+							{
+								Filters: []gatewayv1.HTTPRouteFilter{
+									{
+										Type: gatewayv1.HTTPRouteFilterRequestHeaderModifier,
+										RequestHeaderModifier: &gatewayv1.HTTPHeaderFilter{
+											Add: []gatewayv1.HTTPHeader{
+												{
+													Name:  "h2",
+													Value: "v2",
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1945,3 +1997,46 @@ func Test_converter_generateReferences(t *testing.T) {
 		})
 	}
 }
+
+func Test_convertHostnames(t *testing.T) {
+	cases := []struct {
+		name      string
+		hostnames []string
+		expected  []gatewayv1alpha2.Hostname
+	}{
+		{
+			name:      "default",
+			hostnames: []string{"*.com", "test.net", "*.example.com"},
+			expected:  []gatewayv1alpha2.Hostname{"*.com", "test.net", "*.example.com"},
+		},
+		{
+			name:      "* is not allowed",
+			hostnames: []string{"*"},
+			expected:  []gatewayv1alpha2.Hostname{},
+		},
+		{
+			name:      "IP is not allowed",
+			hostnames: []string{"192.0.2.1", "2001:db8::68", "::ffff:192.0.2.1"},
+			expected:  []gatewayv1alpha2.Hostname{},
+		},
+		{
+			name:      "The wildcard label must appear by itself as the first character",
+			hostnames: []string{"example*.com"},
+			expected:  []gatewayv1alpha2.Hostname{},
+		},
+		{
+			name:      "mix",
+			hostnames: []string{"192.0.2.1", "2001:db8::68", "::ffff:192.0.2.1", "*", "*.com", "test.net", "*.example.com"},
+			expected:  []gatewayv1alpha2.Hostname{"*.com", "test.net", "*.example.com"},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := convertHostnames(tc.hostnames)
+			if !apiequality.Semantic.DeepEqual(actual, tc.expected) {
+				t.Errorf("convertHostnames() = %v, want %v", actual, tc.expected)
+			}
+		})
+	}
+}