Skip to content

Commit

Permalink
upgrade to latest dependencies (knative#14551)
Browse files Browse the repository at this point in the history 
bumping knative.dev/caching 05a86ad...14d7888:
  > 14d7888 upgrade to latest dependencies (# 798)
bumping knative.dev/pkg df28fea...0c39ce4:
  > 0c39ce4 Allow to disable http2 for the webhook (# 2877)

Signed-off-by: Knative Automation <[email protected]>
  • Loading branch information
@knative-automation @nak3
knative-automation authored and nak3 committed Oct 24, 2023
1 parent f0f4127 commit f180c83
Show file tree
Hide file tree
Showing 4 changed files with 26 additions and 8 deletions.
4 changes: 2 additions & 2 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,11 +36,11 @@ require (
k8s.io/code-generator v0.25.4
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2
knative.dev/caching v0.0.0-20230418150356-05a86ad5d7db
knative.dev/caching v0.0.0-20231012200747-14d7888733e8
knative.dev/control-protocol v0.0.0-20230420145039-d9cda76c5b03
knative.dev/hack v0.0.0-20230417170854-f591fea109b3
knative.dev/networking v0.0.0-20231012063223-0b0f2107abef
knative.dev/pkg v0.0.0-20231011201526-df28feae6d34
knative.dev/pkg v0.0.0-20231023160942-0c39ce4b3a7f
sigs.k8s.io/yaml v1.3.0
)

Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1189,16 +1189,16 @@ k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+O
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
knative.dev/caching v0.0.0-20230418150356-05a86ad5d7db h1:69NjUKOsucU5tmCrnkdlULjai+2bZLHF97ZrA/v8PZI=
knative.dev/caching v0.0.0-20230418150356-05a86ad5d7db/go.mod h1:d261UN7aE93sODDnqVuhlaRcEUPjSBOyrUlBxuBp+UU=
knative.dev/caching v0.0.0-20231012200747-14d7888733e8 h1:DegTdKlMy+hVl1x5fn9aRjBZfCIXPDlosFh7MaT8NUY=
knative.dev/caching v0.0.0-20231012200747-14d7888733e8/go.mod h1:V/4Xi4xbGQp7raMgY1py9uKAMKBFk+pWsywFTPNA/MM=
knative.dev/control-protocol v0.0.0-20230420145039-d9cda76c5b03 h1:lbpfzz0rP4HtQkpH5IfUFdsDjrxHbtYWkOWrkwXzTT0=
knative.dev/control-protocol v0.0.0-20230420145039-d9cda76c5b03/go.mod h1:6IjiiR5I2DjCWdOsj0jLvrIjzDaKYaq4jUhT1ImrWwg=
knative.dev/hack v0.0.0-20230417170854-f591fea109b3 h1:+W4WBOq83tfGXKhtv8OB/uJeYqze3zh69GKiz1ucuqk=
knative.dev/hack v0.0.0-20230417170854-f591fea109b3/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
knative.dev/networking v0.0.0-20231012063223-0b0f2107abef h1:FSEKaGc2ztb65VPn4EiTsjAFsmmHlYHUq+j+CCPlDtU=
knative.dev/networking v0.0.0-20231012063223-0b0f2107abef/go.mod h1:rMVkShVT/14rtscYC4ZfC0hXghOXqj3EheFUDKYEqns=
knative.dev/pkg v0.0.0-20231011201526-df28feae6d34 h1:H+K37bEBZ2STSWMjCgrdilj38KKZGVxBbob22K99Y50=
knative.dev/pkg v0.0.0-20231011201526-df28feae6d34/go.mod h1:ZRgzFBFmdBsARm6+Pkr9WRG8bXys8rYq64ELfLG6+9w=
knative.dev/pkg v0.0.0-20231023160942-0c39ce4b3a7f h1:XCH1qZqW1riR8cjhMGjewxQXlWPrfgxeUorBjpC6lE4=
knative.dev/pkg v0.0.0-20231023160942-0c39ce4b3a7f/go.mod h1:ZRgzFBFmdBsARm6+Pkr9WRG8bXys8rYq64ELfLG6+9w=
pgregory.net/rapid v0.3.3 h1:jCjBsY4ln4Atz78QoBWxUEvAHaFyNDQg9+WU62aCn1U=
pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
Expand Down
18 changes: 18 additions & 0 deletions vendor/knative.dev/pkg/webhook/webhook.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,17 @@ type Options struct {
// GracePeriod is how long to wait after failing readiness probes
// before shutting down.
GracePeriod time.Duration

// EnableHTTP2 enables HTTP2 for webhooks.
// Mitigate CVE-2023-44487 by disabling HTTP2 by default until the Go
// standard library and golang.org/x/net are fully fixed.
// Right now, it is possible for authenticated and unauthenticated users to
// hold open HTTP2 connections and consume huge amounts of memory.
// See:
// * https://github.com/kubernetes/kubernetes/pull/121120
// * https://github.com/kubernetes/kubernetes/issues/121197
// * https://github.com/golang/go/issues/63417#issuecomment-1758858612
EnableHTTP2 bool
}

// Operation is the verb being operated on
Expand Down Expand Up @@ -219,11 +230,18 @@ func (wh *Webhook) Run(stop <-chan struct{}) error {
QuietPeriod: wh.Options.GracePeriod,
}

// If TLSNextProto is not nil, HTTP/2 support is not enabled automatically.
nextProto := map[string]func(*http.Server, *tls.Conn, http.Handler){}
if wh.Options.EnableHTTP2 {
nextProto = nil
}

server := &http.Server{
Handler: drainer,
Addr: fmt.Sprint(":", wh.Options.Port),
TLSConfig: wh.tlsConfig,
ReadHeaderTimeout: time.Minute, //https://medium.com/a-journey-with-go/go-understand-and-mitigate-slowloris-attack-711c1b1403f6
TLSNextProto: nextProto,
}

eg, ctx := errgroup.WithContext(ctx)
Expand Down
4 changes: 2 additions & 2 deletions vendor/modules.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1227,7 +1227,7 @@ k8s.io/utils/net
k8s.io/utils/pointer
k8s.io/utils/strings/slices
k8s.io/utils/trace
# knative.dev/caching v0.0.0-20230418150356-05a86ad5d7db
# knative.dev/caching v0.0.0-20231012200747-14d7888733e8
## explicit; go 1.18
knative.dev/caching/config
knative.dev/caching/pkg/apis/caching
Expand Down Expand Up @@ -1293,7 +1293,7 @@ knative.dev/networking/pkg/http/stats
knative.dev/networking/pkg/ingress
knative.dev/networking/pkg/k8s
knative.dev/networking/pkg/prober
# knative.dev/pkg v0.0.0-20231011201526-df28feae6d34
# knative.dev/pkg v0.0.0-20231023160942-0c39ce4b3a7f
## explicit; go 1.18
knative.dev/pkg/apiextensions/storageversion
knative.dev/pkg/apiextensions/storageversion/cmd/migrate
Expand Down

0 comments on commit f180c83

Please sign in to comment.