STRLCPY/CVE-2023-22480_KubeOperator

Merge branch 'master' of https://github.com/KubeOperator/KubeOperator
wangzhengkun committed 2 years ago

b0ae036e

2 parents
6f391ddf
503b4f41

Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)

■ ■ ■ ■ ■ ■

migration/132_upgrade_vsphere.up.sql

1	1		INSERT INTO `ko`.`ko_storage_provisioner_dic`(`id`, `name`, `version`, `architecture`, `vars`, `created_at`, `updated_at`) VALUES (
2		-	UUID(), 'vsphere', 'v2.5.1', 'amd64', '{\"vsphere_csi_version\"=\"v2.5.1\", \"vsphere_csi_attacher_version\"=\"v3.4.0\", \"vsphere_csi_resizer_version\"=\"v1.4.0\", \"vsphere_csi_livenessprobe_version\"=\"v2.6.0\", \"vsphere_csi_provisioner_version\"=\"v3.1.0\", \"vsphere_csi_snapshotter_version\"=\"v5.0.1\", \"vsphere_csi_node_driver_registrar_version\"=\"v2.5.0\"}', date_add(now(), interval 8 HOUR), date_add(now(), interval 8 HOUR));
	2	+	UUID(), 'vsphere', 'v2.5.1', 'amd64', '{\"vsphere_csi_version\":\"v2.5.1\", \"govc_version\":\"v0.23.0\", \"vsphere_csi_attacher_version\":\"v3.4.0\", \"vsphere_csi_resizer_version\":\"v1.4.0\", \"vsphere_csi_livenessprobe_version\":\"v2.6.0\", \"vsphere_csi_provisioner_version\":\"v3.1.0\", \"vsphere_csi_snapshotter_version\":\"v5.0.1\", \"vsphere_csi_node_driver_registrar_version\":\"v2.5.0\"}', date_add(now(), interval 8 HOUR), date_add(now(), interval 8 HOUR));
3	3
4	4		UPDATE ko_cluster_manifest SET storage_vars='[{\"name\":\"external-ceph-block\",\"version\":\"v2.1.1-k8s1.11\"}, {\"name\":\"external-cephfs\",\"version\":\"v2.1.0-k8s1.11\"}, {\"name\":\"nfs\",\"version\":\"v3.1.0-k8s1.11\"}, {\"name\":\"vsphere\",\"version\":\"v2.5.1\"}, {\"name\":\"rook-ceph\",\"version\":\"v1.9.0\"}, {\"name\":\"oceanstor\",\"version\":\"v2.2.9\"}, {\"name\":\"cinder\",\"version\":\"v1.20.0\"}]';

■ ■ ■ ■ ■ ■

migration/135_add_manifest_12212.up.sql

		skipped 26 lines
27	27		'[{\"name\":\"kubernetes\",\"version\":\"v1.22.12\"},{\"name\":\"docker\",\"version\":\"20.10.12\"},{\"name\":\"etcd\",\"version\":\"v3.5.2\"},{\"name\":\"containerd\",\"version\":\"1.6.0\"}]',
28	28		'[{\"name\":\"calico\",\"version\":\"v3.21.4\"},{\"name\":\"flanneld\",\"version\":\"v0.15.1\"},{\"name\":\"cilium\",\"version\":\"v1.9.5\"}]',
29	29		'[{"name":"gatekeeper","version":"v3.7.0"},{"name":"loki","version":"v2.1.0"},{"name":"kubeapps","version":"2.4.2"},{"name":"prometheus","version":"2.34.0"},{"name":"chartmuseum","version":"v0.12.0"},{"name":"registry","version":"v2.7.1"}, {"name":"grafana","version":"8.3.1"},{"name":"logging","version":"v7.6.2"}]',
30		-	'[{\"name\":\"external-ceph-block\",\"version\":\"v2.1.1-k8s1.11\"}, {\"name\":\"external-cephfs\",\"version\":\"v2.1.0-k8s1.11\"}, {\"name\":\"nfs\",\"version\":\"v3.1.0-k8s1.11\"}, {\"name\":\"vsphere\",\"version\":\"v1.0.3\"}, {\"name\":\"rook-ceph\",\"version\":\"v1.9.0\"}, {\"name\":\"oceanstor\",\"version\":\"v2.2.9\"}, {\"name\":\"cinder\",\"version\":\"v1.20.0\"}]',
	30	+	'[{\"name\":\"external-ceph-block\",\"version\":\"v2.1.1-k8s1.11\"}, {\"name\":\"external-cephfs\",\"version\":\"v2.1.0-k8s1.11\"}, {\"name\":\"nfs\",\"version\":\"v3.1.0-k8s1.11\"}, {\"name\":\"vsphere\",\"version\":\"v2.5.1\"}, {\"name\":\"rook-ceph\",\"version\":\"v1.9.0\"}, {\"name\":\"oceanstor\",\"version\":\"v2.2.9\"}, {\"name\":\"cinder\",\"version\":\"v1.20.0\"}]',
31	31		'[{\"name\":\"coredns\",\"version\":\"1.8.4\"},{\"name\":\"dns-cache\",\"version\":\"1.17.0\"},{\"name\":\"traefik\",\"version\":\"v2.6.1\"},{\"name\":\"ingress-nginx\",\"version\":\"v1.2.1\"},{\"name\":\"metrics-server\",\"version\":\"v0.5.0\"},{\"name\":\"helm-v2\",\"version\":\"v2.17.0\"},{\"name\":\"helm-v3\",\"version\":\"v3.8.0\"}]',
32	32		date_add(now(), interval 8 HOUR),
33	33		date_add(now(), interval 8 HOUR),
		skipped 10 lines

■ ■ ■ ■ ■ ■

pkg/service/cluster_storage_provisioner.go

		skipped 288 lines
289	289		}
290	290		c.changeStatus(provisioner, constant.StatusRunning, nil)
291	291		case "vsphere":
292		-	if err := phases.WaitForStatefulSetsRunning(provisioner.Namespace, "vsphere-csi-controller", client); err != nil {
	292	+	if err := phases.WaitForDeployRunning(provisioner.Namespace, "vsphere-csi-controller", client); err != nil {
293	293		c.changeStatus(provisioner, constant.StatusFailed, err)
294	294		continue
295	295		}
		skipped 125 lines

■ ■ ■ ■ ■ ■

pkg/service/grade.go

		skipped 33 lines
34	34		Host: cluster.SpecConf.LbKubeApiserverIp,
35	35		Port: cluster.SpecConf.KubeApiServerPort,
36	36		Token: cluster.Secret.KubernetesToken,
	37	+
	38	+	AuthenticationMode: cluster.SpecConf.AuthenticationMode,
	39	+	CertDataStr: cluster.Secret.CertDataStr,
	40	+	KeyDataStr: cluster.Secret.KeyDataStr,
	41	+	ConfigContent: cluster.Secret.ConfigContent,
37	42		})
38	43		if err != nil {
39	44		return nil, err
		skipped 7 lines

■ ■ ■ ■ ■ ■

pkg/service/msg.go

		skipped 72 lines
73	73		if success {
74	74		msg.Level = constant.MsgInfo
75	75		if name, ok := content["detailName"]; ok {
76		-	content["title"] = fmt.Sprintf("%s %s 成功", title, name)
	76	+	content["title"] = fmt.Sprintf("%s成功 (%s)", title, name)
77	77		} else {
78	78		content["title"] = fmt.Sprintf("%s成功", title)
79	79		}
80	80		} else {
81	81		msg.Level = constant.MsgWarning
82	82		if name, ok := content["detailName"]; ok {
83		-	content["title"] = fmt.Sprintf("%s %s 失败", title, name)
	83	+	content["title"] = fmt.Sprintf("%s失败 (%s)", title, name)
84	84		} else {
85	85		content["title"] = fmt.Sprintf("%s失败", title)
86	86		}
		skipped 184 lines

■ ■ ■ ■ ■ ■

pkg/util/polaris/grade.go

		skipped 2 lines
3	3		import (
4	4		"context"
5	5		"fmt"
	6	+
	7	+	"github.com/KubeOperator/KubeOperator/pkg/constant"
6	8		"github.com/KubeOperator/KubeOperator/pkg/dto"
	9	+	"github.com/KubeOperator/KubeOperator/pkg/util/cluster"
7	10		conf "github.com/fairwindsops/polaris/pkg/config"
8	11		"github.com/fairwindsops/polaris/pkg/kube"
9	12		"github.com/fairwindsops/polaris/pkg/validator"
10	13		"k8s.io/client-go/dynamic"
11	14		"k8s.io/client-go/kubernetes"
12	15		"k8s.io/client-go/rest"
	16	+	"k8s.io/client-go/tools/clientcmd"
	17	+	"k8s.io/client-go/tools/clientcmd/api"
13	18		)
14	19
15	20		type Config struct {
16	21		Host string
17	22		Token string
18	23		Port int
	24	+
	25	+	AuthenticationMode string
	26	+	CertDataStr string
	27	+	KeyDataStr string
	28	+	ConfigContent string
19	29		}
20	30
21	31		func NewResourceProvider(c Config) (kube.ResourceProvider, error) {
22		-
23		-	kubeConf := &rest.Config{
24		-	Host: fmt.Sprintf("%s:%d", c.Host, c.Port),
25		-	BearerToken: c.Token,
26		-	TLSClientConfig: rest.TLSClientConfig{
27		-	Insecure: true,
28		-	},
	32	+	var connConf rest.Config
	33	+	connConf.Insecure = true
	34	+	switch c.AuthenticationMode {
	35	+	case constant.AuthenticationModeBearer:
	36	+	connConf.Host = fmt.Sprintf("%s:%d", c.Host, c.Port)
	37	+	connConf.BearerToken = c.Token
	38	+	case constant.AuthenticationModeCertificate:
	39	+	connConf.CertData = []byte(c.CertDataStr)
	40	+	connConf.KeyData = []byte(c.KeyDataStr)
	41	+	case constant.AuthenticationModeConfigFile:
	42	+	apiConfig, err := cluster.PauseConfigApi(&c.ConfigContent)
	43	+	if err != nil {
	44	+	return nil, err
	45	+	}
	46	+	getter := func() (*api.Config, error) {
	47	+	return apiConfig, nil
	48	+	}
	49	+	itemConfig, err := clientcmd.BuildConfigFromKubeconfigGetter("", getter)
	50	+	if err != nil {
	51	+	return nil, err
	52	+	}
	53	+	connConf = *itemConfig
29	54		}
30		-	api, err := kubernetes.NewForConfig(kubeConf)
	55	+
	56	+	api, err := kubernetes.NewForConfig(&connConf)
31	57		if err != nil {
32	58		return nil, err
33	59		}
34		-	dynamicInterface, err := dynamic.NewForConfig(kubeConf)
	60	+	dynamicInterface, err := dynamic.NewForConfig(&connConf)
35	61		if err != nil {
36	62		return nil, err
37	63		}
		skipped 174 lines

Merge branch 'master' of https://github.com/KubeOperator/KubeOperator