Validate existing bridge subnet mask against config

Author: cursoragent

lib/network/bridge_linux.go

@@ -51,6 +51,37 @@ func listBridgeAddrsWithRetry(link netlink.Link) ([]netlink.Addr, error) {
 	return nil, err
 }
 
+func bridgeAddrMatchesGatewayAndMask(addrs []netlink.Addr, expectedGateway net.IP, expectedMask net.IPMask) (bool, bool, []string, []string) {
+	expectedOnes, expectedBits := expectedMask.Size()
+	hasGateway := false
+	hasGatewayWithMask := false
+	actualIPs := make([]string, 0, len(addrs))
+	gatewayCIDRs := make([]string, 0, 1)
+
+	for _, addr := range addrs {
+		actualCIDR := "<nil>"
+		if addr.IPNet != nil {
+			actualCIDR = addr.IPNet.String()
+		}
+		actualIPs = append(actualIPs, actualCIDR)
+		if !addr.IP.Equal(expectedGateway) {
+			continue
+		}
+		hasGateway = true
+		gatewayCIDRs = append(gatewayCIDRs, actualCIDR)
+		if addr.IPNet == nil {
+			continue
+		}
+
+		ones, bits := addr.IPNet.Mask.Size()
+		if ones == expectedOnes && bits == expectedBits {
+			hasGatewayWithMask = true
+		}
+	}
+
+	return hasGateway, hasGatewayWithMask, actualIPs, gatewayCIDRs
+}
+
 // checkSubnetConflicts checks if the configured subnet conflicts with existing routes.
 // Returns an error if a conflict is detected, with guidance on how to resolve it.
 func (m *manager) checkSubnetConflicts(ctx context.Context, subnet string) error {
@@ -128,14 +159,10 @@ func (m *manager) createBridge(ctx context.Context, name, gateway, subnet string
 		}
 
 		expectedGW := net.ParseIP(gateway)
-		hasExpectedIP := false
-		var actualIPs []string
-		for _, addr := range addrs {
-			actualIPs = append(actualIPs, addr.IPNet.String())
-			if addr.IP.Equal(expectedGW) {
-				hasExpectedIP = true
-			}
+		if expectedGW == nil {
+			return fmt.Errorf("invalid gateway IP: %s", gateway)
 		}
+		hasExpectedIP, hasExpectedMask, actualIPs, gatewayCIDRs := bridgeAddrMatchesGatewayAndMask(addrs, expectedGW, ipNet.Mask)
 
 		if !hasExpectedIP {
 			ones, _ := ipNet.Mask.Size()
@@ -145,6 +172,14 @@ func (m *manager) createBridge(ctx context.Context, name, gateway, subnet string
 				"or (3) delete the bridge with: sudo ip link delete %s",
 				name, actualIPs, gateway, ones, name)
 		}
+		if !hasExpectedMask {
+			ones, _ := ipNet.Mask.Size()
+			return fmt.Errorf("bridge %s exists with gateway %s but mask does not match expected /%d (gateway addresses: %v). "+
+				"Options: (1) update SUBNET_CIDR and SUBNET_GATEWAY to match the existing bridge, "+
+				"(2) use a different BRIDGE_NAME, "+
+				"or (3) delete the bridge with: sudo ip link delete %s",
+				name, gateway, ones, gatewayCIDRs, name)
+		}
 
 		// Bridge exists with correct IP, verify it's up
 		if err := netlink.LinkSetUp(existing); err != nil {

lib/network/bridge_linux_test.go

@@ -3,9 +3,12 @@
 package network
 
 import (
+	"net"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/vishvananda/netlink"
 )
 
 func TestParseBridgeFilters(t *testing.T) {
@@ -66,3 +69,37 @@ func TestPlanOrphanedBridgeTCBailsWhenNoRTIIFParses(t *testing.T) {
 	assert.Nil(t, staleFilters)
 	assert.Nil(t, staleClasses)
 }
+
+func TestBridgeAddrMatchesGatewayAndMask(t *testing.T) {
+	addrs := []netlink.Addr{
+		{IPNet: &net.IPNet{IP: net.ParseIP("10.244.0.1"), Mask: net.CIDRMask(24, 32)}},
+		{IPNet: &net.IPNet{IP: net.ParseIP("10.244.0.2"), Mask: net.CIDRMask(24, 32)}},
+	}
+
+	hasGateway, hasMask, actualIPs, gatewayCIDRs := bridgeAddrMatchesGatewayAndMask(
+		addrs,
+		net.ParseIP("10.244.0.1"),
+		net.CIDRMask(24, 32),
+	)
+
+	require.True(t, hasGateway)
+	require.True(t, hasMask)
+	assert.Equal(t, []string{"10.244.0.1/24", "10.244.0.2/24"}, actualIPs)
+	assert.Equal(t, []string{"10.244.0.1/24"}, gatewayCIDRs)
+}
+
+func TestBridgeAddrMatchesGatewayAndMaskDetectsMaskMismatch(t *testing.T) {
+	addrs := []netlink.Addr{
+		{IPNet: &net.IPNet{IP: net.ParseIP("10.244.0.1"), Mask: net.CIDRMask(16, 32)}},
+	}
+
+	hasGateway, hasMask, _, gatewayCIDRs := bridgeAddrMatchesGatewayAndMask(
+		addrs,
+		net.ParseIP("10.244.0.1"),
+		net.CIDRMask(24, 32),
+	)
+
+	require.True(t, hasGateway)
+	require.False(t, hasMask)
+	assert.Equal(t, []string{"10.244.0.1/16"}, gatewayCIDRs)
+}