A public ip on the farm public IP list cannot be the same as the gateway

[muhamadazmy]

Describe the bug

While investigating an issue with some node public ip not reachable we found out that the VM has been assigned a bad IP config where the Ip actually matches the gatway

This is an invalid setup IP validation must be hardened so that

• The gateway IP must be in the same subnet as the IP
• The gateway IP must not be same as the public ip

[muhamadazmy]

Can we kick out bad ips that did not match this during migration ?

[renauter]

2 things here:

1. I checked in code and, indeed, when creating a farm (by calling create_farm()) the provided list of public ips is not checked in terms of validity what could have led to this situation
   So it requires some changes here

2. Meanwhile, a validity check is provided here
   

   tfchain/substrate-node/support/src/types.rs

   Line 132 in 0b8aa91

   pub fn is_valid(&self) -> Result<(), PublicIpError> {

   
   and used when calling add_farm_ip()
   but is it enough for the following requested validation?

(a) The gateway IP must be in the same subnet as the IP

(b) The gateway IP must not be same as the public ip

I see in code that (a) is checked but not sure about (b)... what gateway IP must not be same as the public ip means exactly?

[renauter]

Can we kick out bad ips that did not match this during migration ?

Perfectly doable yes.
I guess it is better to have nothing informed than to have some wrong data.

This make me think that we could simplify the creating farm flow.
Instead of being able to set public ips by calling create_farm(), inserting it as argument, and after being able to add public ips by calling add_farm_ip()...
Why not only allowing to add public ips by calling add_farm_ip() getting rid of this possibility in create_farm()?
@LeeSmet @muhamadazmy

[muhamadazmy]

I am not sure why IPs can also be provided during creations but validation of ips can also done in farm creation by passing the ip object to the validator method.

But i am also not sure if anything actually uses the create farm with the public IPs hence i can't decide if we can remove it without breaking some API

[A-Harby]

Verified, Devnet
addFarmIp(farmId, ip, gw) function have now a public ip validation,

The gateway IP must not be same as the public ip

The gateway IP must be in the same subnet as the IP

[A-Harby]

I tried another case where the subnet is different, and IPs were added,

And I also tried adding public ips using createFarm(name, publicIps) and it was also added,

And same with addNodePublicConfig(farmId, nodeId, publicConfig).

[A-Harby]

I tried another case where the subnet is different, and IPs were added, And I also tried adding public ips using createFarm(name, publicIps) and it was also added, And same with addNodePublicConfig(farmId, nodeId, publicConfig).

closing the issue as verified, since I formatted the subnet like this 125.25../16, all the gw with 125.25.. are contained in subnet