refactor(validation): inline annotation qualified name check (#5601)

Replace the single use of k8s.io/apimachinery/pkg/util/validation .IsQualifiedName (annotation key validation in pkg/config/v1/validation) with a local implementation in pkg/util/validation. Newer apimachinery versions link klog only for IP/CIDR warning helpers, which grows frpc and frps, and this was the only frp import of that package. The local IsQualifiedName keeps the exact behavior and error messages of apimachinery v0.28.8, including the qualified-name (label key) format and the DNS-1123 subdomain prefix rules. Annotation keys are still lowercased before validation, so the accepted set is unchanged. Verified against apimachinery v0.28.8 on 228,220 inputs (exhaustive short strings, boundary lengths and seeded random data, including lowercased variants): every error message matches. No dependency versions change; go.mod and go.sum are untouched.
2026-11-04 19:59:26 +08:00
parent 0368148cc3
commit 4c07ebda5b
4 changed files with 242 additions and 3 deletions
@@ -0,0 +1,123 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package validation
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// Annotation keys follow the Kubernetes "qualified name" (label key) format.
+// The constants below mirror k8s.io/apimachinery/pkg/util/validation's
+// qualified-name validation (v0.28.8 semantics and messages) so that frp does
+// not need to import that package; newer versions of the package link klog.
+const (
+	qualifiedNameCharFmt    = "[A-Za-z0-9]"
+	qualifiedNameExtCharFmt = "[-A-Za-z0-9_.]"
+	qualifiedNameFmt        = "(" + qualifiedNameCharFmt + qualifiedNameExtCharFmt + "*)?" + qualifiedNameCharFmt
+	qualifiedNameErrMsg     = "must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character"
+	qualifiedNameMaxLength  = 63
+
+	dns1123LabelFmt          = "[a-z0-9]([-a-z0-9]*[a-z0-9])?"
+	dns1123SubdomainFmt      = dns1123LabelFmt + `(\.` + dns1123LabelFmt + ")*"
+	dns1123SubdomainErrorMsg = "a lowercase RFC 1123 subdomain must consist of lower case " +
+		"alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
+	dns1123SubdomainMaxLength = 253
+)
+
+var (
+	qualifiedNameRegexp    = regexp.MustCompile("^" + qualifiedNameFmt + "$")
+	dns1123SubdomainRegexp = regexp.MustCompile("^" + dns1123SubdomainFmt + "$")
+)
+
+// IsQualifiedName reports whether value is a valid Kubernetes qualified name
+// (label key), the format used by frp for proxy annotation keys. If value is
+// invalid, it returns one message per violation; an empty result means valid.
+//
+// The function does not normalize case: callers that accept case-insensitive
+// keys must lowercase value themselves (frp's annotation validation passes
+// strings.ToLower(key)).
+func IsQualifiedName(value string) []string {
+	var errs []string
+	parts := strings.Split(value, "/")
+	var name string
+	switch len(parts) {
+	case 1:
+		name = parts[0]
+	case 2:
+		var prefix string
+		prefix, name = parts[0], parts[1]
+		if len(prefix) == 0 {
+			errs = append(errs, "prefix part "+emptyError())
+		} else if msgs := dns1123SubdomainErrors(prefix); len(msgs) != 0 {
+			errs = append(errs, prefixEach(msgs, "prefix part ")...)
+		}
+	default:
+		return append(errs, "a qualified name "+regexError(qualifiedNameErrMsg, qualifiedNameFmt, "MyName", "my.name", "123-abc")+
+			" with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')")
+	}
+
+	if len(name) == 0 {
+		errs = append(errs, "name part "+emptyError())
+	} else if len(name) > qualifiedNameMaxLength {
+		errs = append(errs, "name part "+maxLenError(qualifiedNameMaxLength))
+	}
+	if !qualifiedNameRegexp.MatchString(name) {
+		errs = append(errs, "name part "+regexError(qualifiedNameErrMsg, qualifiedNameFmt, "MyName", "my.name", "123-abc"))
+	}
+	return errs
+}
+
+func dns1123SubdomainErrors(value string) []string {
+	var errs []string
+	if len(value) > dns1123SubdomainMaxLength {
+		errs = append(errs, maxLenError(dns1123SubdomainMaxLength))
+	}
+	if !dns1123SubdomainRegexp.MatchString(value) {
+		errs = append(errs, regexError(dns1123SubdomainErrorMsg, dns1123SubdomainFmt, "example.com"))
+	}
+	return errs
+}
+
+func maxLenError(length int) string {
+	return fmt.Sprintf("must be no more than %d characters", length)
+}
+
+func emptyError() string {
+	return "must be non-empty"
+}
+
+func regexError(msg string, re string, examples ...string) string {
+	if len(examples) == 0 {
+		return msg + " (regex used for validation is '" + re + "')"
+	}
+	msg += " (e.g. "
+	for i := range examples {
+		if i > 0 {
+			msg += " or "
+		}
+		msg += "'" + examples[i] + "', "
+	}
+	msg += "regex used for validation is '" + re + "')"
+	return msg
+}
+
+func prefixEach(msgs []string, prefix string) []string {
+	for i := range msgs {
+		msgs[i] = prefix + msgs[i]
+	}
+	return msgs
+}