OCPBUGS-21672: http2: trim connetions and buffers #80

ibihim · 2023-10-19T15:26:51Z

What

Replace/bump go.opentelemetry.io/contrib/instrumentation.
Add capability to disable HTTP/2.
Add capability to fine-tune resources for HTTP/2.

Why

CVE on opentelemetry, which didn't affect KRP, but caused security bots to go haywire.
CVE-2023-44487: Rapid Reset on Streams enables DDOS attacks.

CHANGELOG: v0.14.2, add Make-,Dockerfile change

It is necessary to have more fine grained and rigid versioning to be able to use k8s' versioning.

version: set version flag values properly

Release 0.14.3

Makefile: revert VERSION, add VERSION_SEMVER

Bump golang.org/x/net to address CVE-2023-44487

Release 0.14.4

deps: patch cve-2023-45142, not affecting krp

s-urbaniak · 2023-10-20T07:47:56Z

pkg/filters/auth.go

+			// limit this connection to just this request,
+			// and then send a GOAWAY and tear down the TCP connection
+			// https://github.com/golang/net/commit/97aa3a539ec716117a9d15a4659a911f50d13c3c
+			w.Header().Set("Connection", "close")


aren't we supposed to return here? you are continuing the handler chain.

s-urbaniak · 2023-10-20T08:02:25Z

/rename OCPBUGS-21672: http2: trim connetions and buffers

s-urbaniak · 2023-10-20T09:06:10Z

/retitle OCPBUGS-21672: http2: trim connetions and buffers

openshift-ci-robot · 2023-10-20T09:06:18Z

@ibihim: This pull request references Jira Issue OCPBUGS-21672, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xingxingxia

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

What

Set boundaries to http/2.

Why

This would enable us to keep http/2 enabled and
reducing our attack surface.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wallylewis · 2023-10-21T13:42:24Z

/retest-required

wallylewis · 2023-10-22T20:20:03Z

/retest-required

xingxingxia · 2023-10-23T04:55:31Z

Hello all, I pre-merge tested this PR, got panics, details are in OCPBUGS-21672 comment:

panic: version string "" doesn't match expected regular expression: "^v(\d+\.\d+\.\d+)"

goroutine 1 [running]:
k8s.io/component-base/metrics.parseVersion({{0x0, 0x0}, {0x0, 0x0}, {0x1bc1454, 0x0}, {0x1bd0b20, 0x28}, {0x0, 0x0}, ...})
	/go/src/github.com/brancz/kube-rbac-proxy/vendor/k8s.io/component-base/metrics/version_parser.go:47 +0x274
k8s.io/component-base/metrics.newKubeRegistry({{0x0, 0x0}, {0x0, 0x0}, {0x1bc1454, 0x0}, {0x1bd0b20, 0x28}, {0x0, 0x0}, ...})
	/go/src/github.com/brancz/kube-rbac-proxy/vendor/k8s.io/component-base/metrics/registry.go:320 +0x119
k8s.io/component-base/metrics.NewKubeRegistry()
	/go/src/github.com/brancz/kube-rbac-proxy/vendor/k8s.io/component-base/metrics/registry.go:335 +0x78
k8s.io/component-base/metrics/legacyregistry.init()
	/go/src/github.com/brancz/kube-rbac-proxy/vendor/k8s.io/component-base/metrics/legacyregistry/registry.go:29 +0x1d

The env variable VERSION is set in the image and overwrites the version from kube-rbac-proxy.

s-urbaniak · 2023-10-23T10:25:31Z

/lgtm

s-urbaniak · 2023-10-23T10:26:07Z

(we pair programmed here together)

openshift-ci · 2023-10-23T10:27:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ibihim, s-urbaniak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [ibihim,s-urbaniak]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2023-10-23T10:46:06Z

@ibihim: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-10-23T10:49:15Z

@ibihim: Jira Issue OCPBUGS-21672: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-21672 has been moved to the MODIFIED state.

In response to this:

What

Replace/bump go.opentelemetry.io/contrib/instrumentation.

Add capability to disable HTTP/2.

Add capability to fine-tune resources for HTTP/2.

Why

CVE on opentelemetry, which didn't affect KRP, but caused security bots to go haywire.

CVE-2023-44487: Rapid Reset on Streams enables DDOS attacks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Includes openshift/kube-rbac-proxy#80 Signed-off-by: Or Shoval <oshoval@redhat.com>

Includes openshift/kube-rbac-proxy#80 KubeRbacProxyImageDefault was updated manually. Each test/release/x.go file was updated according the version it had in its variable. Since the tests validate the release on the upgrade test, both for the old and latest, if there were any errors we would see. Signed-off-by: Or Shoval <oshoval@redhat.com>

Includes openshift/kube-rbac-proxy#80 Signed-off-by: Or Shoval <oshoval@redhat.com>

Includes openshift/kube-rbac-proxy#80 Affects CNAO and KMP. KubeRbacProxyImageDefault was updated manually. Each test/release/x.go file was updated according the version it had in its variable. Since the tests validate the release on the upgrade test, both for the old and latest, if there were any errors we would see. Since the image might change, it can't use the variable which exists only on the latest candid 99.0.0, but should have an hardcoded value per each release. Signed-off-by: Or Shoval <oshoval@redhat.com>

openshift-bot · 2023-11-14T07:57:15Z

[ART PR BUILD NOTIFIER]

This PR has been included in build kube-rbac-proxy-container-v4.15.0-202311140732.p0.ge8e8c84.assembly.stream for distgit kube-rbac-proxy.
All builds following this will include this PR.

Includes openshift/kube-rbac-proxy#80 Affects CNAO and KMP. KubeRbacProxyImageDefault was updated manually. Each test/release/x.go file was updated according the version it had in its variable. Since the tests validate the release on the upgrade test, both for the old and latest, if there were any errors we would see. Since the image might change, it can't use the variable which exists only on the latest candid 99.0.0, but should have an hardcoded value per each release. Signed-off-by: Or Shoval <oshoval@redhat.com>

Includes openshift/kube-rbac-proxy#80 Signed-off-by: Or Shoval <oshoval@redhat.com>

Includes openshift/kube-rbac-proxy#80 Affects CNAO and KMP. KubeRbacProxyImageDefault was updated manually. Each test/release/x.go file was updated according the version it had in its variable. Since the tests validate the release on the upgrade test, both for the old and latest, if there were any errors we would see. Since the image might change, it can't use the variable which exists only on the latest candid 99.0.0, but should have an hardcoded value per each release. Signed-off-by: Or Shoval <oshoval@redhat.com>

ibihim and others added 15 commits June 5, 2023 17:24

CHANGELOG: v0.14.2, add Make-,Dockerfile change

b90c95c

Merge pull request brancz#242 from ibihim/v0.14.2-changelog-update

707f21b

CHANGELOG: v0.14.2, add Make-,Dockerfile change

version: Makefile variable shifting

bcc5773

It is necessary to have more fine grained and rigid versioning to be able to use k8s' versioning.

version: add ldflags with versioning

e82d1a1

Merge pull request brancz#253 from ibihim/version-flag-ldflags

2b8fb20

version: set version flag values properly

go*: update dependencies

2540d5f

cut release v0.14.3

3e2ea8f

Merge pull request brancz#254 from ibihim/release-0.14.3

b8b0b55

Release 0.14.3

Makefile: revert VERSION, add VERSION_SEMVER

96da89f

Merge pull request brancz#258 from ibihim/v0.14.3-fix

3ed1e58

Makefile: revert VERSION, add VERSION_SEMVER

Bump golang.org/x/net to address CVE-2023-44487

1ef0e21

Bump golang version to address CVE-2023-44487

3893e96

Merge pull request brancz#261 from ReToCode/bump-go

188f80a

Bump golang.org/x/net to address CVE-2023-44487

cut release v0.14.4

0bc66fd

Merge pull request brancz#262 from ibihim/cut-release-v0.14.4

b0fa6e5

Release 0.14.4

openshift-ci bot requested review from deads2k and s-urbaniak October 19, 2023 15:27

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 19, 2023

ibihim mentioned this pull request Oct 19, 2023

OCPBUGS-20717: http2: trim connetions and buffers, v4.14 #81

Merged

deps: patch cve-2023-45142, not affecting krp

fe65a9a

ibihim force-pushed the CVE-2023-44487-trimming-http2 branch from ab150f0 to 569f97f Compare October 19, 2023 19:38

Merge pull request brancz#264 from ibihim/cve-2023-45142

9f6aa5c

deps: patch cve-2023-45142, not affecting krp

s-urbaniak reviewed Oct 20, 2023

View reviewed changes

openshift-ci bot changed the title ~~http2: trim connetions and buffers~~ OCPBUGS-21672: http2: trim connetions and buffers Oct 20, 2023

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Oct 20, 2023

openshift-ci bot requested a review from xingxingxia October 20, 2023 09:06

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 23, 2023

ibihim force-pushed the CVE-2023-44487-trimming-http2 branch 2 times, most recently from 2cbfef0 to 9969ff7 Compare October 23, 2023 09:10

Dockerfile: pin env variable VERSION to ./VERSION

9969ff7

The env variable VERSION is set in the image and overwrites the version from kube-rbac-proxy.

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 23, 2023

openshift-ci bot merged commit e8e8c84 into openshift:master Oct 23, 2023

oshoval mentioned this pull request Nov 2, 2023

Bump kube-rbac-proxy k8snetworkplumbingwg/kubemacpool#404

Merged

oshoval added a commit to oshoval/cluster-network-addons-operator that referenced this pull request Nov 2, 2023

Bump kube-rbac-proxy

18167f8

Includes openshift/kube-rbac-proxy#80 Signed-off-by: Or Shoval <oshoval@redhat.com>

oshoval mentioned this pull request Nov 2, 2023

Bump kube-rbac-proxy kubevirt/cluster-network-addons-operator#1653

Merged

oshoval added a commit to oshoval/cluster-network-addons-operator that referenced this pull request Nov 5, 2023

Bump kube-rbac-proxy

1484335

Includes openshift/kube-rbac-proxy#80 Signed-off-by: Or Shoval <oshoval@redhat.com>

oshoval added a commit to oshoval/kubemacpool that referenced this pull request Nov 12, 2023

Bump kube-rbac-proxy

fe25e40

Includes openshift/kube-rbac-proxy#80 Signed-off-by: Or Shoval <oshoval@redhat.com>

oshoval added a commit to oshoval/kubemacpool that referenced this pull request Nov 12, 2023

Bump kube-rbac-proxy

d71cbc9

Includes openshift/kube-rbac-proxy#80 Signed-off-by: Or Shoval <oshoval@redhat.com>

kubevirt-bot pushed a commit to k8snetworkplumbingwg/kubemacpool that referenced this pull request Dec 4, 2023

Bump kube-rbac-proxy (#404)

ad90843

Includes openshift/kube-rbac-proxy#80 Signed-off-by: Or Shoval <oshoval@redhat.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-21672: http2: trim connetions and buffers #80

OCPBUGS-21672: http2: trim connetions and buffers #80

ibihim commented Oct 19, 2023 •

edited

Loading

s-urbaniak Oct 20, 2023

s-urbaniak commented Oct 20, 2023

s-urbaniak commented Oct 20, 2023

openshift-ci-robot commented Oct 20, 2023

What

Why

wallylewis commented Oct 21, 2023

wallylewis commented Oct 22, 2023

xingxingxia commented Oct 23, 2023

s-urbaniak commented Oct 23, 2023

s-urbaniak commented Oct 23, 2023

openshift-ci bot commented Oct 23, 2023

openshift-ci bot commented Oct 23, 2023

openshift-ci-robot commented Oct 23, 2023

What

Why

openshift-bot commented Nov 14, 2023

OCPBUGS-21672: http2: trim connetions and buffers #80

OCPBUGS-21672: http2: trim connetions and buffers #80

Conversation

ibihim commented Oct 19, 2023 • edited Loading

What

Why

s-urbaniak Oct 20, 2023

Choose a reason for hiding this comment

s-urbaniak commented Oct 20, 2023

s-urbaniak commented Oct 20, 2023

openshift-ci-robot commented Oct 20, 2023

What

Why

wallylewis commented Oct 21, 2023

wallylewis commented Oct 22, 2023

xingxingxia commented Oct 23, 2023

s-urbaniak commented Oct 23, 2023

s-urbaniak commented Oct 23, 2023

openshift-ci bot commented Oct 23, 2023

openshift-ci bot commented Oct 23, 2023

openshift-ci-robot commented Oct 23, 2023

What

Why

openshift-bot commented Nov 14, 2023

ibihim commented Oct 19, 2023 •

edited

Loading