From 0935aa92219d3db192a98c183f58a5434cb658b1 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Wed, 28 Sep 2016 16:46:07 +0100 Subject: [PATCH 1/5] Build container FROM golang:1.7.3 --- build/Dockerfile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/build/Dockerfile b/build/Dockerfile index 46a011c2..e62d24e6 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -1,5 +1,4 @@ -FROM golang:1.5.2 -ENV GO15VENDOREXPERIMENT 1 +FROM golang:1.7.3 RUN apt-get update && apt-get install -y libpcap-dev python-requests time file RUN go get github.com/fzipp/gocyclo github.com/client9/misspell/cmd/misspell RUN go clean -i net && go install -tags netgo std From 8f9da95e5e9c6641f75f80f7afd002b59a6b79b3 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Wed, 5 Oct 2016 15:20:04 +0100 Subject: [PATCH 2/5] Restore golint --- build/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/Dockerfile b/build/Dockerfile index e62d24e6..713c4d63 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -1,6 +1,6 @@ FROM golang:1.7.3 RUN apt-get update && apt-get install -y libpcap-dev python-requests time file -RUN go get github.com/fzipp/gocyclo github.com/client9/misspell/cmd/misspell +RUN go get github.com/golang/lint/golint github.com/fzipp/gocyclo github.com/client9/misspell/cmd/misspell RUN go clean -i net && go install -tags netgo std RUN go install -race -tags netgo std COPY build.sh / From f73355abcc0613e9481ba29ab77650ea60ba1329 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 10 Oct 2016 17:03:40 +0100 Subject: [PATCH 3/5] Incorporate Docker's malformed host fix --- proxy/malformed_host_override.go | 122 +++++++++++++++++++++++++++++++ proxy/proxy.go | 2 +- 2 files changed, 123 insertions(+), 1 deletion(-) create mode 100644 proxy/malformed_host_override.go diff --git a/proxy/malformed_host_override.go b/proxy/malformed_host_override.go new file mode 100644 index 00000000..aff95db0 --- /dev/null +++ b/proxy/malformed_host_override.go @@ -0,0 +1,122 @@ +// (C) Docker, Inc. +// Redistributed under the Apache License 2.0 + +package proxy + +import "net" + +// MalformedHostHeaderOverride is a wrapper to be able +// to overcome the 400 Bad request coming from old docker +// clients that send an invalid Host header. +type MalformedHostHeaderOverride struct { + net.Listener +} + +// MalformedHostHeaderOverrideConn wraps the underlying unix +// connection and keeps track of the first read from http.Server +// which just reads the headers. +type MalformedHostHeaderOverrideConn struct { + net.Conn + first bool +} + +var closeConnHeader = []byte("\r\nConnection: close\r") + +// Read reads the first *read* request from http.Server to inspect +// the Host header. If the Host starts with / then we're talking to +// an old docker client which send an invalid Host header. To not +// error out in http.Server we rewrite the first bytes of the request +// to sanitize the Host header itself. +// In case we're not dealing with old docker clients the data is just passed +// to the server w/o modification. +func (l *MalformedHostHeaderOverrideConn) Read(b []byte) (n int, err error) { + // http.Server uses a 4k buffer + if l.first && len(b) == 4096 { + // This keeps track of the first read from http.Server which just reads + // the headers + l.first = false + // The first read of the connection by http.Server is done limited to + // DefaultMaxHeaderBytes (usually 1 << 20) + 4096. + // Here we do the first read which gets us all the http headers to + // be inspected and modified below. + c, err := l.Conn.Read(b) + if err != nil { + return c, err + } + + var ( + start, end int + firstLineFeed = -1 + buf []byte + ) + for i := 0; i <= c-1-7; i++ { + if b[i] == '\n' && firstLineFeed == -1 { + firstLineFeed = i + } + if b[i] != '\n' { + continue + } + + if b[i+1] == '\r' && b[i+2] == '\n' { + return c, nil + } + + if b[i+1] != 'H' { + continue + } + if b[i+2] != 'o' { + continue + } + if b[i+3] != 's' { + continue + } + if b[i+4] != 't' { + continue + } + if b[i+5] != ':' { + continue + } + if b[i+6] != ' ' { + continue + } + if b[i+7] != '/' { + continue + } + // ensure clients other than the docker clients do not get this hack + if i != firstLineFeed { + return c, nil + } + start = i + 7 + // now find where the value ends + for ii, bbb := range b[start:c] { + if bbb == '\n' { + end = start + ii + break + } + } + buf = make([]byte, 0, c+len(closeConnHeader)-(end-start)) + // strip the value of the host header and + // inject `Connection: close` to ensure we don't reuse this connection + buf = append(buf, b[:start]...) + buf = append(buf, closeConnHeader...) + buf = append(buf, b[end:c]...) + copy(b, buf) + break + } + if len(buf) == 0 { + return c, nil + } + return len(buf), nil + } + return l.Conn.Read(b) +} + +// Accept makes the listener accepts connections and wraps the connection +// in a MalformedHostHeaderOverrideConn initilizing first to true. +func (l *MalformedHostHeaderOverride) Accept() (net.Conn, error) { + c, err := l.Listener.Accept() + if err != nil { + return c, err + } + return &MalformedHostHeaderOverrideConn{c, true}, nil +} diff --git a/proxy/proxy.go b/proxy/proxy.go index 6c2d4017..be71befd 100644 --- a/proxy/proxy.go +++ b/proxy/proxy.go @@ -378,7 +378,7 @@ func (proxy *Proxy) listen(protoAndAddr string) (net.Listener, string, error) { Log.Fatalf("Invalid protocol format: %q", proto) } - return listener, fmt.Sprintf("%s://%s", proto, addr), nil + return &MalformedHostHeaderOverride{listener}, fmt.Sprintf("%s://%s", proto, addr), nil } // weavedocker.ContainerObserver interface From 915638d17ad9e8f032cea28fd7d289db43e0b287 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 10 Oct 2016 17:25:23 +0100 Subject: [PATCH 4/5] Address linter failures --- ipam/ring/ring_test.go | 4 ++-- npc/namespace.go | 4 ++-- prog/weaver/metrics.go | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ipam/ring/ring_test.go b/ipam/ring/ring_test.go index fa5e0c44..ca95744d 100644 --- a/ipam/ring/ring_test.go +++ b/ipam/ring/ring_test.go @@ -494,7 +494,7 @@ func TestTransfer(t *testing.T) { ring1.ClaimItAll() ring1.GrantRangeToHost(middle, end, peer2name) ring1.Transfer(peer2name, peer1name) - require.Equal(t, []address.Range{{start, middle}, {middle, end}}, ring1.OwnedRanges()) + require.Equal(t, []address.Range{{Start: start, End: middle}, {Start: middle, End: end}}, ring1.OwnedRanges()) // Second test is what happens when a token exists at the end of a range but is transferred // - does it get resurrected correctly? @@ -503,7 +503,7 @@ func TestTransfer(t *testing.T) { ring1.GrantRangeToHost(middle, end, peer2name) ring1.Transfer(peer2name, peer1name) ring1.GrantRangeToHost(dot10, middle, peer2name) - require.Equal(t, []address.Range{{start, dot10}, {middle, end}}, ring1.OwnedRanges()) + require.Equal(t, []address.Range{{Start: start, End: dot10}, {Start: middle, End: end}}, ring1.OwnedRanges()) } func TestOwner(t *testing.T) { diff --git a/npc/namespace.go b/npc/namespace.go index b2ae88d4..3974bf3a 100644 --- a/npc/namespace.go +++ b/npc/namespace.go @@ -319,13 +319,13 @@ func equals(a, b map[string]string) bool { } func isDefaultDeny(namespace *coreapi.Namespace) bool { - nnpJson, found := namespace.ObjectMeta.Annotations["net.beta.kubernetes.io/network-policy"] + nnpJSON, found := namespace.ObjectMeta.Annotations["net.beta.kubernetes.io/network-policy"] if !found { return false } var nnp NamespaceNetworkPolicy - if err := json.Unmarshal([]byte(nnpJson), &nnp); err != nil { + if err := json.Unmarshal([]byte(nnpJSON), &nnp); err != nil { log.Warn("Ignoring network policy annotation: unmarshal failed:", err) // If we can't understand the annotation, behave as if it isn't present return false diff --git a/prog/weaver/metrics.go b/prog/weaver/metrics.go index 296dd620..3ab4a4a9 100644 --- a/prog/weaver/metrics.go +++ b/prog/weaver/metrics.go @@ -43,7 +43,7 @@ func uint64Counter(desc *prometheus.Desc, val uint64, labels ...string) promethe return prometheus.MustNewConstMetric(desc, prometheus.CounterValue, float64(val), labels...) } -var metrics []metric = []metric{ +var metrics = []metric{ {desc("weave_connections", "Number of peer-to-peer connections.", "state"), func(s WeaveStatus, desc *prometheus.Desc, ch chan<- prometheus.Metric) { counts := make(map[string]int) From 41d127934b11a8d39bb246feb4ba7c0adbeb59cd Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Wed, 9 Nov 2016 12:13:24 +0000 Subject: [PATCH 5/5] Remove redundant GO15VENDOREXPERIMENT setting --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index c061bfc6..720901e8 100644 --- a/Makefile +++ b/Makefile @@ -182,7 +182,7 @@ tools/.git: git submodule update --init $(RUNNER_EXE): tools/.git - GO15VENDOREXPERIMENT=1 make -C tools/runner + make -C tools/runner $(PUBLISH): publish_%: $(IMAGES_UPTODATE) $(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker tag $(DOCKERHUB_USER)/$* $(DOCKERHUB_USER)/$*:$(WEAVE_VERSION)