Validate execCPUAffinity of the runtime process spec

Cargo.toml

@@ -32,6 +32,8 @@ derive_builder = "0.20.0"
 getset = "0.1.1"
 strum = "0.26.2"
 strum_macros = "0.26.2"
+regex = "1.10.5"
+once_cell = "1.19.0"
 
 [dev-dependencies]
 tempfile = "3.2.0"

src/runtime/process.rs

@@ -4,7 +4,9 @@ use crate::{
 };
 use derive_builder::Builder;
 use getset::{CopyGetters, Getters, MutGetters, Setters};
-use serde::{Deserialize, Serialize};
+use once_cell::sync::Lazy;
+use regex::Regex;
+use serde::{de, Deserialize, Deserializer, Serialize};
 use std::path::PathBuf;
 use strum_macros::{Display as StrumDisplay, EnumString};
 
@@ -566,29 +568,77 @@ impl Default for LinuxSchedulerFlag {
     default,
     pattern = "owned",
     setter(into, strip_option),
-    build_fn(error = "OciSpecError")
+    build_fn(validate = "Self::validate", error = "OciSpecError")
 )]
 #[getset(get = "pub", set = "pub")]
 /// ExecCPUAffinity specifies CPU affinity used to execute the process.
 /// This setting is not applicable to the container's init process.
 pub struct ExecCPUAffinity {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "deserialize"
+    )]
     /// cpu_affinity_initial is a list of CPUs a runtime parent process to be run on
     /// initially, before the transition to container's cgroup.
     /// This is a a comma-separated list, with dashes to represent ranges.
     /// For example, `0-3,7` represents CPUs 0,1,2,3, and 7.
     cpu_affinity_initial: Option<String>,
 
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "deserialize"
+    )]
     /// cpu_affinity_final is a list of CPUs the process will be run on after the transition
     /// to container's cgroup. The format is the same as for `initial`. If omitted or empty,
     /// the container's default CPU affinity, as defined by cpu.cpus property, is used.
     cpu_affinity_final: Option<String>,
 }
 
+impl ExecCPUAffinityBuilder {
+    fn validate(&self) -> Result<(), OciSpecError> {
+        if let Some(Some(ref s)) = self.cpu_affinity_initial {
+            validate_cpu_affinity(s).map_err(|e| OciSpecError::Other(e.to_string()))?;
+        }
+
+        if let Some(Some(ref s)) = self.cpu_affinity_final {
+            validate_cpu_affinity(s).map_err(|e| OciSpecError::Other(e.to_string()))?;
+        }
+
+        Ok(())
+    }
+}
+
+fn deserialize<'de, D>(deserializer: D) -> Result<Option<String>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let value: Option<String> = Option::deserialize(deserializer)?;
+
+    if let Some(ref s) = value {
+        validate_cpu_affinity(s).map_err(de::Error::custom)?;
+    }
+
+    Ok(value)
+}
+
+static EXEC_CPU_AFFINITY_REGEX: Lazy<Regex> = Lazy::new(|| {
+    Regex::new(r"^(\d+(-\d+)?)(,\d+(-\d+)?)*$").expect("Failed to create regex for execCPUAffinity")
+});
+
+fn validate_cpu_affinity(s: &str) -> Result<(), String> {
+    if !EXEC_CPU_AFFINITY_REGEX.is_match(s) {
+        return Err(format!("Invalid execCPUAffinity format: {}", s));
+    }
+
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
+    use serde_json::json;
 
     // PosixRlimitType test cases
     #[test]
@@ -621,4 +671,116 @@ mod tests {
         let unknown_rlimit = invalid_posix_rlimit_type_str.parse::<PosixRlimitType>();
         assert!(unknown_rlimit.is_err());
     }
+
+    #[test]
+    fn exec_cpu_affinity_valid_initial_final() {
+        let json = json!({"cpu_affinity_initial": "0-3,7", "cpu_affinity_final": "4-6,8"});
+        let result: Result<ExecCPUAffinity, _> = serde_json::from_value(json);
+        assert!(result.is_ok());
+
+        let json = json!({"cpu_affinity_initial": "0-3", "cpu_affinity_final": "4-6"});
+        let result: Result<ExecCPUAffinity, _> = serde_json::from_value(json);
+        assert!(result.is_ok());
+
+        let json = json!({"cpu_affinity_initial": "0", "cpu_affinity_final": "4"});
+        let result: Result<ExecCPUAffinity, _> = serde_json::from_value(json);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn exec_cpu_affinity_invalid_initial() {
+        let json = json!({"cpu_affinity_initial": "0-3,,7", "cpu_affinity_final": "4-6,8"});
+        let result: Result<ExecCPUAffinity, _> = serde_json::from_value(json);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn exec_cpu_affinity_invalid_final() {
+        let json = json!({"cpu_affinity_initial": "0-3,7", "cpu_affinity_final": "4-6.,8"});
+        let result: Result<ExecCPUAffinity, _> = serde_json::from_value(json);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn exec_cpu_affinity_valid_final() {
+        let json = json!({"cpu_affinity_final": "0,1,2,3"});
+        let result: Result<ExecCPUAffinity, _> = serde_json::from_value(json);
+        assert!(result.is_ok());
+        assert!(result.unwrap().cpu_affinity_initial.is_none());
+    }
+
+    #[test]
+    fn exec_cpu_affinity_valid_initial() {
+        let json = json!({"cpu_affinity_initial": "0-1,2-5"});
+        let result: Result<ExecCPUAffinity, _> = serde_json::from_value(json);
+        assert!(result.is_ok());
+        assert!(result.unwrap().cpu_affinity_final.is_none());
+    }
+
+    #[test]
+    fn exec_cpu_affinity_empty() {
+        let json = json!({});
+        let result: Result<ExecCPUAffinity, _> = serde_json::from_value(json);
+        assert!(result.is_ok());
+        let affinity = result.unwrap();
+        assert!(affinity.cpu_affinity_initial.is_none());
+        assert!(affinity.cpu_affinity_final.is_none());
+    }
+
+    #[test]
+    fn test_build_valid_input() {
+        let affinity = ExecCPUAffinityBuilder::default()
+            .cpu_affinity_initial("0-3,7,8,9,10".to_string())
+            .cpu_affinity_final("4-6,8".to_string())
+            .build();
+        assert!(affinity.is_ok());
+        let affinity = affinity.unwrap();
+        assert_eq!(
+            affinity.cpu_affinity_initial,
+            Some("0-3,7,8,9,10".to_string())
+        );
+        assert_eq!(affinity.cpu_affinity_final, Some("4-6,8".to_string()));
+    }
+
+    #[test]
+    fn test_build_invalid_initial() {
+        let affinity = ExecCPUAffinityBuilder::default()
+            .cpu_affinity_initial("0-3,i".to_string())
+            .cpu_affinity_final("4-6,8".to_string())
+            .build();
+        let err = affinity.unwrap_err();
+        assert_eq!(err.to_string(), "Invalid execCPUAffinity format: 0-3,i");
+
+        let affinity = ExecCPUAffinityBuilder::default()
+            .cpu_affinity_initial("-".to_string())
+            .cpu_affinity_final("4-6,8".to_string())
+            .build();
+        let err = affinity.unwrap_err();
+        assert_eq!(err.to_string(), "Invalid execCPUAffinity format: -");
+    }
+
+    #[test]
+    fn test_build_invalid_final() {
+        let affinity = ExecCPUAffinityBuilder::default()
+            .cpu_affinity_initial("0-3,7".to_string())
+            .cpu_affinity_final("0-l1".to_string())
+            .build();
+        let err = affinity.unwrap_err();
+        assert_eq!(err.to_string(), "Invalid execCPUAffinity format: 0-l1");
+
+        let affinity = ExecCPUAffinityBuilder::default()
+            .cpu_affinity_initial("0-3,7".to_string())
+            .cpu_affinity_final(",1,2".to_string())
+            .build();
+        let err = affinity.unwrap_err();
+        assert_eq!(err.to_string(), "Invalid execCPUAffinity format: ,1,2");
+    }
+
+    #[test]
+    fn test_build_empty() {
+        let affinity = ExecCPUAffinityBuilder::default().build();
+        let affinity = affinity.unwrap();
+        assert!(affinity.cpu_affinity_initial.is_none());
+        assert!(affinity.cpu_affinity_final.is_none());
+    }
 }