| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869 |
- From 09306e7eb3c26ade69ef1e4c99d5b1fd9c0b7364 Mon Sep 17 00:00:00 2001
- From: Sebastiaan van Stijn <github@gone.nl>
- Date: Wed, 12 Jul 2023 15:07:59 +0200
- Subject: [PATCH] pkg/plugins: use a dummy hostname for local connections
- For local communications (npipe://, unix://), the hostname is not used,
- but we need valid and meaningful hostname.
- The current code used the socket path as hostname, which gets rejected by
- go1.20.6 and go1.19.11 because of a security fix for [CVE-2023-29406 ][1],
- which was implemented in https://go.dev/issue/60374.
- Prior versions go Go would clean the host header, and strip slashes in the
- process, but go1.20.6 and go1.19.11 no longer do, and reject the host
- header.
- Before this patch, tests would fail on go1.20.6:
- === FAIL: pkg/authorization TestAuthZRequestPlugin (15.01s)
- time="2023-07-12T12:53:45Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 1s"
- time="2023-07-12T12:53:46Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 2s"
- time="2023-07-12T12:53:48Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 4s"
- time="2023-07-12T12:53:52Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 8s"
- authz_unix_test.go:82: Failed to authorize request Post "http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq": http: invalid Host header
- [1]: https://github.com/advisories/GHSA-f8f7-69v5-w4vx
- Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- (cherry picked from commit 6b7705d5b29e226a24902a8dcc488836faaee33c)
- Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- ---
- pkg/plugins/client.go | 14 ++++++++++++--
- 1 file changed, 12 insertions(+), 2 deletions(-)
- diff --git a/pkg/plugins/client.go b/pkg/plugins/client.go
- index 752fecd0ae..e683eb777d 100644
- --- a/pkg/plugins/client.go
- +++ b/pkg/plugins/client.go
- @@ -18,6 +18,12 @@ import (
-
- const (
- defaultTimeOut = 30
- +
- + // dummyHost is a hostname used for local communication.
- + //
- + // For local communications (npipe://, unix://), the hostname is not used,
- + // but we need valid and meaningful hostname.
- + dummyHost = "plugin.moby.localhost"
- )
-
- func newTransport(addr string, tlsConfig *tlsconfig.Options) (transport.Transport, error) {
- @@ -44,8 +50,12 @@ func newTransport(addr string, tlsConfig *tlsconfig.Options) (transport.Transpor
- return nil, err
- }
- scheme := httpScheme(u)
- -
- - return transport.NewHTTPTransport(tr, scheme, socket), nil
- + hostName := u.Host
- + if hostName == "" || u.Scheme == "unix" || u.Scheme == "npipe" {
- + // Override host header for non-tcp connections.
- + hostName = dummyHost
- + }
- + return transport.NewHTTPTransport(tr, scheme, hostName), nil
- }
-
- // NewClient creates a new plugin client (http).
- --
- 2.41.0
|
