[sunilteja93]

Summary

Fix the Go SDK gateway-name validation to support CLI-generated FQDN and IPv4 gateway names while maintaining portable filesystem naming rules across operating systems.

Related Issue

Closes #4509

Changes

• Support host-derived gateway names such as gw.example.com and 192.0.2.1.
• Restrict gateway names to portable ASCII letters, digits, hyphens, underscores, and appropriately placed dots.
• Reject Windows-reserved device names, including names with extensions.
• Reject invalid dot placement, Windows-reserved filename characters, and path traversal.
• Reject raw IPv6 names until a portable encoding is defined.
• Add Windows-specific regression tests while preserving gateway loading, active gateway resolution, and listing coverage.

Release Notes

The Go SDK now supports FQDN and IPv4-derived gateway names while enforcing Windows-safe filename validation.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Validation performed:

• go test ./... -count=1 from sdk/go (passed)
• Targeted gateway-name regression tests (passed)
• Windows/amd64 gateway test cross-compilation (passed)
• gofmt and git diff --check (passed)

Windows-specific validation cases execute on macOS. Windows-target tests were cross-compiled but not executed on Windows.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[sunilteja93]

I have read the DCO document and I hereby sign the DCO.

[sunilteja93]

Hi @rhuss,

#4509 has been accepted, and my contributor vouch was approved. I've opened this PR with the fix and regression tests. The full go sdk test suite passes locally.

Appreciate your earlier offer to review. Would you mind taking a look when you get a chance?

Also, thanks @TaylorMutch for accepting the issue and approving my vouch request. Really appreciate your help in getting this moving!

Thanks!

[TaylorMutch]

/ok to test 9b71277

[TaylorMutch]

No actionable findings.

The change aligns the Go SDK with the CLI's safe single-component gateway-name behavior while preserving rejection of empty names, dot components, path separators, and NUL. The regression coverage exercises named loading, active-gateway resolution, and gateway listing for host-derived names.

Validation:

• Reviewed commit 9b71277832d68994a7b5eb8b8e3c389c92d69f60.
• Full mise run go:ci passed locally on the exact PR commit, including formatting, build, lint, proto/docs checks, and all Go tests.
• GitHub Branch Checks, Go SDK, Helm, issue acceptance, DCO, E2E, and GPU E2E checks passed.

[sunilteja93]

Thanks @TaylorMutch! Really appreciate the thorough review and running the full CI suite. Thanks again for helping get this contribution through the process!

[TaylorMutch]

I’m withdrawing my earlier approval. I apologize—the first review missed a Windows path-normalization edge case in the broadened validator.

Please keep this change narrowly scoped: allow host-derived FQDN and IPv4 names while retaining a cross-platform-safe component grammar. Validation needs to ensure every accepted name remains a distinct path component under Windows filesystem rules, with regression coverage for the Windows-specific cases. Raw IPv6 names also need an explicit portable encoding rather than accepting filename characters that Windows reserves.

The Unix separator and dot-component checks look sound, and the FQDN/IPv4 regression coverage is useful. This should be a small change to the validator and its tests, followed by a straightforward re-review.

I’m keeping the detailed security analysis out of the public review.

[sunilteja93]

Hi @TaylorMutch,

Thanks for catching the windows path-normalization issue.

I've pushed a new follow-up commit narrowing the validator to support FQDN and IPv4 names while enforcing portable filename rules. The changes should now reject windows reserved device names, invalid dot placement, reserved filename characters, and raw IPv6 names. I've also added Windows-specific regression tests and preserved the existing gateway loading, active resolution, and listing coverage.

The full go sdk test suite and targeted regression tests pass locally. Windows/amd64 test cross-compilation also passes.

I've updated the PR description to reflect the narrower scope.

Would appreciate another review when you have a chance.

Thanks!

[TaylorMutch]

/ok to test 8542676

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. go-sdk — No explicit risk acceptance found

gateway.NewClient, LoadConfig, and ListGateways previously accepted configured alphanumeric names such as CON or COM1, but now reject or omit Windows-device-like names on every OS.

• Impact: Unix consumers with existing CLI-created or provisioned gateways named CON, PRN, AUX, NUL, COM0–COM9, or LPT0–LPT9 receive ErrInvalidGatewayName or ErrNoActiveGateway, while ListGateways silently omits them.
• Action: Keep baseline-valid names readable and listable in v0.1.6, or defer their rejection to a minor release with notice and actionable gateway-renaming guidance.
• PR: fix(sdk/go): accept CLI-compatible gateway names #4767

Review details

• Execution: complete
• Candidate: PR #4767 (ea3cd3c66cae8729dd49bdca0ba01d224cf41b91)
• Baseline: 465324a8311a2566e6e5e562b9e7b29e47d4b6a4 (465324a8311a2566e6e5e562b9e7b29e47d4b6a4)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[sunilteja93]

@TaylorMutch The Rust aarch64-darwin job failed because a crates.io dependency download timed out. Could you rerun it when you get a chance? Thanks!

[TaylorMutch]

Acceptable risk given the gateway names are likely uncommon.