diff --git a/go.mod b/go.mod index 9ed8bd43..b5ad3ca0 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/containernetworking/cni v1.1.2 github.com/containernetworking/plugins v1.2.0 github.com/coreos/go-iptables v0.6.0 - github.com/docker/docker v24.0.7+incompatible + github.com/docker/docker v24.0.9+incompatible github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b github.com/docker/machine v0.14.0 github.com/fsouza/go-dockerclient v1.10.0 diff --git a/go.sum b/go.sum index 465fe39f..03e7f7e0 100644 --- a/go.sum +++ b/go.sum @@ -85,8 +85,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/docker/distribution v2.8.2-beta.1+incompatible h1:gILO60VLD2v28ozemv4aAwDb8ds5U2O/vD/sBXbd7Rw= github.com/docker/distribution v2.8.2-beta.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= -github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM= -github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/docker v24.0.9+incompatible h1:HPGzNmwfLZWdxHqK9/II92pyi1EpYKsAqcl4G0Of9v0= +github.com/docker/docker v24.0.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ= github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= diff --git a/reweave/CHANGELOG.md b/reweave/CHANGELOG.md index 337a8720..14b8e670 100644 --- a/reweave/CHANGELOG.md +++ b/reweave/CHANGELOG.md @@ -2,7 +2,15 @@ All changes made to the weave net codebase during the reweave effort will be documented in this file. -## 2.8.4 +## 2.8.5-beta1 + +### Changed + +* Upgraded github.com/docker/docker to 24.0.9+incompatible +* Ran `go mod vendor` +* Modified `reweave/build/Dockerfile`, to cater for timeouts and other errors during `apt` operations + +## 2.8.4 (c3afe552) ### Changed diff --git a/reweave/Makefile b/reweave/Makefile index ced1cb09..989fba57 100644 --- a/reweave/Makefile +++ b/reweave/Makefile @@ -1,4 +1,4 @@ -IMAGE_VERSION ?= 2.8.4 +IMAGE_VERSION ?= 2.8.5-beta1 REGISTRY_USER ?= rajchaudhuri ALPINE_BASEIMAGE ?= alpine:3.19.1 diff --git a/reweave/build/Dockerfile b/reweave/build/Dockerfile index 701ebae4..f6a9ac7d 100644 --- a/reweave/build/Dockerfile +++ b/reweave/build/Dockerfile @@ -7,7 +7,7 @@ ARG ALPINE_BASEIMAGE=alpine:3.19.1 # It will be built only once for a given build platform. Subsequent # stages will start from this and cross-compile for each target # architecture. -FROM --platform=${BUILDPLATFORM} golang:1.21.6-bullseye AS builderbase +FROM --platform=${BUILDPLATFORM} golang:1.21.9-bullseye AS builderbase # Support Raspberry Pi 2 and newer ENV GOARM 7 @@ -23,8 +23,11 @@ ENV DEB_CROSSPLATFORMS \ # Install the build-essential and crossbuild-essential-ARCH packages RUN < /etc/apt/apt.conf.d/80-retries for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done -apt-get update +apt-get update --error-on=any +apt-get upgrade -y apt-get install -y build-essential for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done apt-get clean diff --git a/reweave/scans/badge.json b/reweave/scans/badge.json index 47e309b9..da30a955 100644 --- a/reweave/scans/badge.json +++ b/reweave/scans/badge.json @@ -1 +1 @@ -{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "24", "color": "orange"} +{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "17", "color": "orange"} diff --git a/reweave/scans/report.md b/reweave/scans/report.md index 4e0eff09..0c249a7c 100644 --- a/reweave/scans/report.md +++ b/reweave/scans/report.md @@ -1,9 +1,9 @@ # Vulnerability Report ``` -Report date: 2024-03-30 -Unique vulnerability count: 24 -Images version: 2.8.4 +Report date: 2024-04-04 +Unique vulnerability count: 17 +Images version: 2.8.5-beta1 ``` ## Scanner Details @@ -23,116 +23,90 @@ Supported DB Schema: 5 ## Vulnerabilities -### weave-kube: (24) +### weave-kube: (17) ``` -NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY -busybox 1.36.1-r15 apk CVE-2023-42366 Medium -busybox 1.36.1-r15 apk CVE-2023-42365 Medium -busybox 1.36.1-r15 apk CVE-2023-42364 Medium -busybox 1.36.1-r15 apk CVE-2023-42363 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium -c-ares 1.24.0-r1 1.27.0-r0 apk CVE-2024-25629 Medium -curl 8.5.0-r0 apk CVE-2024-0853 Medium -curl 8.5.0-r0 apk CVE-2024-2466 Unknown -curl 8.5.0-r0 apk CVE-2024-2398 Unknown -curl 8.5.0-r0 apk CVE-2024-2004 Unknown -github.com/docker/docker v24.0.7+incompatible 24.0.9 go-module GHSA-xw73-rw38-6vjc Medium -libuv 1.47.0-r0 apk CVE-2024-24806 High -ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium -stdlib go1.21.6 go-module CVE-2024-24785 Unknown -stdlib go1.21.6 go-module CVE-2024-24784 Unknown -stdlib go1.21.6 go-module CVE-2024-24783 Unknown -stdlib go1.21.6 go-module CVE-2023-45290 Unknown -stdlib go1.21.6 go-module CVE-2023-45289 Unknown +NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY +busybox 1.36.1-r15 apk CVE-2023-42366 Medium +busybox 1.36.1-r15 apk CVE-2023-42365 Medium +busybox 1.36.1-r15 apk CVE-2023-42364 Medium +busybox 1.36.1-r15 apk CVE-2023-42363 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium +curl 8.5.0-r0 apk CVE-2024-0853 Medium +curl 8.5.0-r0 apk CVE-2024-2466 Unknown +curl 8.5.0-r0 apk CVE-2024-2398 Unknown +curl 8.5.0-r0 apk CVE-2024-2004 Unknown +libuv 1.47.0-r0 apk CVE-2024-24806 High +ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium ``` -### weave-npc: (17) +### weave-npc: (12) ``` -NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY -busybox 1.36.1-r15 apk CVE-2023-42366 Medium -busybox 1.36.1-r15 apk CVE-2023-42365 Medium -busybox 1.36.1-r15 apk CVE-2023-42364 Medium -busybox 1.36.1-r15 apk CVE-2023-42363 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium -stdlib go1.21.6 go-module CVE-2024-24785 Unknown -stdlib go1.21.6 go-module CVE-2024-24784 Unknown -stdlib go1.21.6 go-module CVE-2024-24783 Unknown -stdlib go1.21.6 go-module CVE-2023-45290 Unknown -stdlib go1.21.6 go-module CVE-2023-45289 Unknown +NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY +busybox 1.36.1-r15 apk CVE-2023-42366 Medium +busybox 1.36.1-r15 apk CVE-2023-42365 Medium +busybox 1.36.1-r15 apk CVE-2023-42364 Medium +busybox 1.36.1-r15 apk CVE-2023-42363 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium ``` -### weave: (24) +### weave: (17) ``` -NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY -busybox 1.36.1-r15 apk CVE-2023-42366 Medium -busybox 1.36.1-r15 apk CVE-2023-42365 Medium -busybox 1.36.1-r15 apk CVE-2023-42364 Medium -busybox 1.36.1-r15 apk CVE-2023-42363 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium -c-ares 1.24.0-r1 1.27.0-r0 apk CVE-2024-25629 Medium -curl 8.5.0-r0 apk CVE-2024-0853 Medium -curl 8.5.0-r0 apk CVE-2024-2466 Unknown -curl 8.5.0-r0 apk CVE-2024-2398 Unknown -curl 8.5.0-r0 apk CVE-2024-2004 Unknown -github.com/docker/docker v24.0.7+incompatible 24.0.9 go-module GHSA-xw73-rw38-6vjc Medium -libuv 1.47.0-r0 apk CVE-2024-24806 High -ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium -stdlib go1.21.6 go-module CVE-2024-24785 Unknown -stdlib go1.21.6 go-module CVE-2024-24784 Unknown -stdlib go1.21.6 go-module CVE-2024-24783 Unknown -stdlib go1.21.6 go-module CVE-2023-45290 Unknown -stdlib go1.21.6 go-module CVE-2023-45289 Unknown +NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY +busybox 1.36.1-r15 apk CVE-2023-42366 Medium +busybox 1.36.1-r15 apk CVE-2023-42365 Medium +busybox 1.36.1-r15 apk CVE-2023-42364 Medium +busybox 1.36.1-r15 apk CVE-2023-42363 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium +curl 8.5.0-r0 apk CVE-2024-0853 Medium +curl 8.5.0-r0 apk CVE-2024-2466 Unknown +curl 8.5.0-r0 apk CVE-2024-2398 Unknown +curl 8.5.0-r0 apk CVE-2024-2004 Unknown +libuv 1.47.0-r0 apk CVE-2024-24806 High +ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium ``` -### weaveexec: (24) +### weaveexec: (17) ``` -NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY -busybox 1.36.1-r15 apk CVE-2023-42366 Medium -busybox 1.36.1-r15 apk CVE-2023-42365 Medium -busybox 1.36.1-r15 apk CVE-2023-42364 Medium -busybox 1.36.1-r15 apk CVE-2023-42363 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium -busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium -c-ares 1.24.0-r1 1.27.0-r0 apk CVE-2024-25629 Medium -curl 8.5.0-r0 apk CVE-2024-0853 Medium -curl 8.5.0-r0 apk CVE-2024-2466 Unknown -curl 8.5.0-r0 apk CVE-2024-2398 Unknown -curl 8.5.0-r0 apk CVE-2024-2004 Unknown -github.com/docker/docker v24.0.7+incompatible 24.0.9 go-module GHSA-xw73-rw38-6vjc Medium -libuv 1.47.0-r0 apk CVE-2024-24806 High -ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium -ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium -stdlib go1.21.6 go-module CVE-2024-24785 Unknown -stdlib go1.21.6 go-module CVE-2024-24784 Unknown -stdlib go1.21.6 go-module CVE-2024-24783 Unknown -stdlib go1.21.6 go-module CVE-2023-45290 Unknown -stdlib go1.21.6 go-module CVE-2023-45289 Unknown +NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY +busybox 1.36.1-r15 apk CVE-2023-42366 Medium +busybox 1.36.1-r15 apk CVE-2023-42365 Medium +busybox 1.36.1-r15 apk CVE-2023-42364 Medium +busybox 1.36.1-r15 apk CVE-2023-42363 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium +busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium +curl 8.5.0-r0 apk CVE-2024-0853 Medium +curl 8.5.0-r0 apk CVE-2024-2466 Unknown +curl 8.5.0-r0 apk CVE-2024-2398 Unknown +curl 8.5.0-r0 apk CVE-2024-2004 Unknown +libuv 1.47.0-r0 apk CVE-2024-24806 High +ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium +ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium ``` diff --git a/vendor/github.com/docker/docker/api/swagger.yaml b/vendor/github.com/docker/docker/api/swagger.yaml index 7635b9f6..d98bc1bf 100644 --- a/vendor/github.com/docker/docker/api/swagger.yaml +++ b/vendor/github.com/docker/docker/api/swagger.yaml @@ -3011,8 +3011,6 @@ definitions: Name: "journald" - Type: "Log" Name: "json-file" - - Type: "Log" - Name: "logentries" - Type: "Log" Name: "splunk" - Type: "Log" @@ -5334,7 +5332,7 @@ definitions: type: "array" items: type: "string" - example: ["awslogs", "fluentd", "gcplogs", "gelf", "journald", "json-file", "logentries", "splunk", "syslog"] + example: ["awslogs", "fluentd", "gcplogs", "gelf", "journald", "json-file", "splunk", "syslog"] RegistryServiceConfig: diff --git a/vendor/github.com/docker/docker/client/container_wait.go b/vendor/github.com/docker/docker/client/container_wait.go index 2375eb1e..b7d80542 100644 --- a/vendor/github.com/docker/docker/client/container_wait.go +++ b/vendor/github.com/docker/docker/client/container_wait.go @@ -66,8 +66,12 @@ func (cli *Client) ContainerWait(ctx context.Context, containerID string, condit // // If there's a JSON parsing error, read the real error message // off the body and send it to the client. - _, _ = io.ReadAll(io.LimitReader(stream, containerWaitErrorMsgLimit)) - errC <- errors.New(responseText.String()) + if errors.As(err, new(*json.SyntaxError)) { + _, _ = io.ReadAll(io.LimitReader(stream, containerWaitErrorMsgLimit)) + errC <- errors.New(responseText.String()) + } else { + errC <- err + } return } diff --git a/vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go b/vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go index a4001c3b..2194c47d 100644 --- a/vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go +++ b/vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go @@ -11,17 +11,11 @@ import ( "os/exec" "path/filepath" "strconv" - "sync" "syscall" "github.com/opencontainers/runc/libcontainer/user" ) -var ( - entOnce sync.Once - getentCmd string -) - func mkdirAs(path string, mode os.FileMode, owner Identity, mkAll, chownExisting bool) error { path, err := filepath.Abs(path) if err != nil { @@ -162,10 +156,10 @@ func getentGroup(name string) (user.Group, error) { } func callGetent(database, key string) (io.Reader, error) { - entOnce.Do(func() { getentCmd, _ = resolveBinary("getent") }) - // if no `getent` command on host, can't do anything else - if getentCmd == "" { - return nil, fmt.Errorf("unable to find getent command") + getentCmd, err := resolveBinary("getent") + // if no `getent` command within the execution environment, can't do anything else + if err != nil { + return nil, fmt.Errorf("unable to find getent command: %w", err) } command := exec.Command(getentCmd, database, key) // we run getent within container filesystem, but without /dev so /dev/null is not available for exec to mock stdin diff --git a/vendor/github.com/docker/docker/pkg/ioutils/readers.go b/vendor/github.com/docker/docker/pkg/ioutils/readers.go index de00b95e..d82ae930 100644 --- a/vendor/github.com/docker/docker/pkg/ioutils/readers.go +++ b/vendor/github.com/docker/docker/pkg/ioutils/readers.go @@ -3,11 +3,15 @@ package ioutils // import "github.com/docker/docker/pkg/ioutils" import ( "context" "io" + "runtime/debug" + "sync/atomic" // make sure crypto.SHA256, crypto.sha512 and crypto.SHA384 are registered // TODO remove once https://github.com/opencontainers/go-digest/pull/64 is merged. _ "crypto/sha256" _ "crypto/sha512" + + "github.com/sirupsen/logrus" ) // ReadCloserWrapper wraps an io.Reader, and implements an io.ReadCloser @@ -16,10 +20,15 @@ import ( type ReadCloserWrapper struct { io.Reader closer func() error + closed atomic.Bool } // Close calls back the passed closer function func (r *ReadCloserWrapper) Close() error { + if !r.closed.CompareAndSwap(false, true) { + subsequentCloseWarn("ReadCloserWrapper") + return nil + } return r.closer() } @@ -87,6 +96,7 @@ type cancelReadCloser struct { cancel func() pR *io.PipeReader // Stream to read from pW *io.PipeWriter + closed atomic.Bool } // NewCancelReadCloser creates a wrapper that closes the ReadCloser when the @@ -146,6 +156,17 @@ func (p *cancelReadCloser) closeWithError(err error) { // Close closes the wrapper its underlying reader. It will cause // future calls to Read to return io.EOF. func (p *cancelReadCloser) Close() error { + if !p.closed.CompareAndSwap(false, true) { + subsequentCloseWarn("cancelReadCloser") + return nil + } p.closeWithError(io.EOF) return nil } + +func subsequentCloseWarn(name string) { + logrus.Error("subsequent attempt to close " + name) + if logrus.GetLevel() >= logrus.DebugLevel { + logrus.Errorf("stack trace: %s", string(debug.Stack())) + } +} diff --git a/vendor/github.com/docker/docker/pkg/ioutils/writers.go b/vendor/github.com/docker/docker/pkg/ioutils/writers.go index 61c67949..1f50602f 100644 --- a/vendor/github.com/docker/docker/pkg/ioutils/writers.go +++ b/vendor/github.com/docker/docker/pkg/ioutils/writers.go @@ -1,6 +1,9 @@ package ioutils // import "github.com/docker/docker/pkg/ioutils" -import "io" +import ( + "io" + "sync/atomic" +) // NopWriter represents a type which write operation is nop. type NopWriter struct{} @@ -29,9 +32,14 @@ func (f *NopFlusher) Flush() {} type writeCloserWrapper struct { io.Writer closer func() error + closed atomic.Bool } func (r *writeCloserWrapper) Close() error { + if !r.closed.CompareAndSwap(false, true) { + subsequentCloseWarn("WriteCloserWrapper") + return nil + } return r.closer() } diff --git a/vendor/modules.txt b/vendor/modules.txt index 9b07b0fe..d68dd32d 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -95,7 +95,7 @@ github.com/davecgh/go-spew/spew ## explicit github.com/docker/distribution/digestset github.com/docker/distribution/reference -# github.com/docker/docker v24.0.7+incompatible +# github.com/docker/docker v24.0.9+incompatible ## explicit github.com/docker/docker/api github.com/docker/docker/api/types