Trim whitespace from ENI DNS fields sent by ACS - #5112
Open
arnarpall wants to merge 1 commit into
Open
Conversation
An ENI's DomainNameServers and DomainName values originate from the VPC DHCP
option set, which stores each value exactly as it was typed and performs no
validation of its own. An option set configured as
domain-name-servers 10.0.0.2, 10.0.0.3
yields a second value with a leading space. That value was copied verbatim into
NetworkInterface and surfaced by the task metadata endpoint, where " 10.0.0.3"
is not a valid IP address. A consumer that parses the response strictly fails
the whole document rather than the single field, losing unrelated metadata such
as the task ARN, cluster and family. Retries do not help because the payload
never changes.
Trim surrounding whitespace off each value in InterfaceFromACS, and in the V2N
tunnel and VETH pair constructors, which read the same fields from the same
payload.
Contributor
|
@arnarpall thanks so much for creating this PR. Could you please also run |
mye956
reviewed
Sep 1, 2026
| // as it was typed and performs no validation of its own. An option set configured as | ||
| // "domain-name-servers 10.0.0.2, 10.0.0.3" therefore yields a second value with a leading space, | ||
| // which is not a valid IP address by the time it reaches the task metadata response. | ||
| func trimSpaceAll(values []*string) []string { |
Contributor
There was a problem hiding this comment.
There's also the ENIFromACS function (ref) where we could add the same trimming. Although, it doesn't seem like it's used in our codebase anywhere currently. Will leave this up to you if you're up for the task!
Author
There was a problem hiding this comment.
Yeah I actually did notice this one, and that it was not used anywhere so I decided against adding to it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
An ENI's DomainNameServers and DomainName values originate from the VPC DHCP option set, which stores each value exactly as it was typed and performs no validation of its own. An option set configured as
yields a second value with a leading space. That value was copied verbatim into NetworkInterface and surfaced by the task metadata endpoint, where " 10.0.0.3" is not a valid IP address. A consumer that parses the response strictly fails the whole document rather than the single field, losing unrelated metadata such as the task ARN, cluster and family. Retries do not help because the payload never changes.
Trim surrounding whitespace off each value in InterfaceFromACS, and in the V2N tunnel and VETH pair constructors, which read the same fields from the same payload.
Implementation details
Testing
unit tests implemented an exectuted
New tests cover the changes:
Description for the changelog
Licensing
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.