test: invalid MAC address length

Author: Keith Nguyen

cns/imds/client.go

@@ -46,17 +46,18 @@ func RetryAttempts(attempts uint) ClientOption {
 }
 
 const (
-	vmUniqueIDProperty    = "vmId"
-	imdsComputePath       = "/metadata/instance/compute"
-	imdsNetworkPath       = "/metadata/instance/network"
-	imdsVersionsPath      = "/metadata/versions"
-	imdsDefaultAPIVersion = "api-version=2021-01-01"
-	imdsNCDetailsVersion  = "api-version=2025-07-24"
-	imdsFormatJSON        = "format=json"
-	metadataHeaderKey     = "Metadata"
-	metadataHeaderValue   = "true"
-	defaultRetryAttempts  = 3
-	defaultIMDSEndpoint   = "http://169.254.169.254"
+	vmUniqueIDProperty         = "vmId"
+	imdsComputePath            = "/metadata/instance/compute"
+	imdsNetworkPath            = "/metadata/instance/network"
+	imdsVersionsPath           = "/metadata/versions"
+	imdsDefaultAPIVersion      = "api-version=2021-01-01"
+	imdsNCDetailsVersion       = "api-version=2025-07-24"
+	imdsMACAddressStringLength = 12 // 6 bytes in hex equals 12 characters
+	imdsFormatJSON             = "format=json"
+	metadataHeaderKey          = "Metadata"
+	metadataHeaderValue        = "true"
+	defaultRetryAttempts       = 3
+	defaultIMDSEndpoint        = "http://169.254.169.254"
 )
 
 var (
@@ -231,7 +232,7 @@ func (h *HardwareAddr) UnmarshalJSON(data []byte) error {
 // parseMacAddress is a wrapper around net.ParseMAC to handle Windows MAC address. Windows MAC addresse is a pure hex
 // dump without delimiter, so we need to add delimiters. This happens when CNS gets MAC address from IMDS.
 func parseMacAddress(s string) (net.HardwareAddr, error) {
-	if !strings.ContainsAny(s, ":-.") && len(s)%2 == 0 {
+	if !strings.ContainsAny(s, ":-.") && len(s) == imdsMACAddressStringLength {
 		var sb strings.Builder
 		for i := 0; i < len(s); i += 2 {
 			if i > 0 {

cns/imds/client_test.go

@@ -160,6 +160,39 @@ func TestGetNetworkInterfaces(t *testing.T) {
 	assert.NotEqual(t, firstMAC.String(), secondMAC.String(), "MAC addresses should be different")
 }
 
+func TestGetNetworkInterfacesInvalidMAC(t *testing.T) {
+	networkInterfaces := []byte(`{
+        "interface": [
+            {
+                "interfaceCompartmentID": "nc-12345-67890",
+                "macAddress": "00005e00530"
+            },
+        ]
+    }`)
+
+	mockIMDSServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// request header "Metadata: true" must be present
+		metadataHeader := r.Header.Get("Metadata")
+		assert.Equal(t, "true", metadataHeader)
+
+		// verify path is network metadata
+		assert.Contains(t, r.URL.Path, "/metadata/instance/network")
+
+		w.WriteHeader(http.StatusOK)
+		_, writeErr := w.Write(networkInterfaces)
+		if writeErr != nil {
+			t.Errorf("error writing response: %v", writeErr)
+			return
+		}
+	}))
+	defer mockIMDSServer.Close()
+
+	imdsClient := imds.NewClient(imds.Endpoint(mockIMDSServer.URL))
+	interfaces, err := imdsClient.GetNetworkInterfaces(context.Background())
+	require.Error(t, err, "expected error for invalid MAC address")
+	require.Nil(t, interfaces, "expected nil interfaces on error")
+}
+
 func TestGetNetworkInterfacesInvalidEndpoint(t *testing.T) {
 	imdsClient := imds.NewClient(imds.Endpoint(string([]byte{0x7f})), imds.RetryAttempts(1))
 	_, err := imdsClient.GetNetworkInterfaces(context.Background())