Files
kubeshark/cmd/common.go
T
f38980ea94 deps: bump indirect deps to clear critical/high Dependabot alerts (#1952)
* deps: bump indirect deps to clear critical/high Dependabot alerts

Bumps the vulnerable indirect dependencies flagged as critical or high
severity in Dependabot:

- golang.org/x/crypto  v0.39.0 -> v0.54.0  (7 critical + 2 high: SSH agent
  constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence
  check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on
  large channel writes, client-induced server deadlock, RSA/DSA DoS, byte
  arithmetic underflow panic)
- google.golang.org/grpc  v1.68.1 -> v1.83.0  (critical: authz bypass via
  missing leading slash in :path; high: xDS RBAC and HTTP/2 issues)
- github.com/containerd/containerd  v1.7.27 -> v1.7.34  (high: LABEL ->
  restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local
  privesc via wide CRI directory permissions)
- oras.land/oras-go/v2  v2.6.0 -> v2.6.2  (high: CVE-2026-50163 hardlink
  extract-dir escape, credential forwarding via unvalidated Location header)
- github.com/moby/spdystream  v0.5.0 -> v0.5.1  (high: DoS on CRI)

Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time,
x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy.

The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules);
the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no
workflow changes are needed.

go build ./... and go test ./... pass.

* ci: move golangci-lint to v2, fix resulting lint issues

golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with
go1.24 and refuses to run now that go.mod targets 1.25.0:

  can't load config: the Go language version (go1.24) used to build
  golangci-lint is lower than the targeted Go version (1.25.0)

Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml
mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and
unused, plus gofmt/goimports as formatters.

Fixes for the issues that surfaced:
- ST1005: lowercase error strings, drop trailing '!' in connect/hub.go
- SA4011: kubernetes/watch.go had a `break` inside a `select` default
  that broke the select rather than the loop, i.e. a no-op; removed
- QF1008: drop the embedded ChartPathOptions selector in helm.go
- QF1003: tagged switch on r.URL.Path in mcp_test.go
- QF1004: strings.Replace(..., -1) -> strings.ReplaceAll
- gofmt -s and goimports with a local prefix across the tree

errcheck is not in the enabled set, matching hub.

* cmd: clarify --time parse error in pcap dump

The error neither named the offending flag/value nor separated the
wrapped error from the message. Reported by Copilot on #1952.

---------

Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
2026-08-04 08:35:41 -07:00

119 lines
4.1 KiB
Go
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
package cmd
import (
"context"
"errors"
"fmt"
"path"
"regexp"
"time"
"github.com/rs/zerolog/log"
"github.com/kubeshark/kubeshark/config"
"github.com/kubeshark/kubeshark/errormessage"
"github.com/kubeshark/kubeshark/internal/connect"
"github.com/kubeshark/kubeshark/kubernetes"
"github.com/kubeshark/kubeshark/misc"
"github.com/kubeshark/kubeshark/misc/fsUtils"
)
func startProxyReportErrorIfAny(kubernetesProvider *kubernetes.Provider, ctx context.Context, serviceName string, podName string, proxyPortLabel string, srcPort uint16, dstPort uint16, healthCheck string) {
httpServer, err := kubernetes.StartProxy(kubernetesProvider, config.Config.Tap.Proxy.Host, srcPort, config.Config.Tap.Release.Namespace, serviceName)
if err != nil {
log.Error().
Err(errormessage.FormatError(err)).
Msg(fmt.Sprintf("Error occurred while running K8s proxy. Try setting different port using --%s", proxyPortLabel))
return
}
connector := connect.NewConnector(kubernetes.GetProxyOnPort(srcPort), connect.DefaultRetries, connect.DefaultTimeout)
if err := connector.TestConnection(healthCheck); err != nil {
log.Warn().
Str("service", serviceName).
Msg("Couldn't connect using proxy, stopping proxy and trying to create port-forward...")
if err := httpServer.Shutdown(ctx); err != nil {
log.Error().
Err(errormessage.FormatError(err)).
Msg("Error occurred while stopping proxy.")
}
podRegex, _ := regexp.Compile(podName)
if _, err := kubernetes.NewPortForward(kubernetesProvider, config.Config.Tap.Release.Namespace, podRegex, srcPort, dstPort, ctx); err != nil {
log.Error().
Str("pod-regex", podRegex.String()).
Err(errormessage.FormatError(err)).
Msg(fmt.Sprintf("Error occurred while running port forward. Try setting different port using --%s", proxyPortLabel))
return
}
connector = connect.NewConnector(kubernetes.GetProxyOnPort(srcPort), connect.DefaultRetries, connect.DefaultTimeout)
if err := connector.TestConnection(healthCheck); err != nil {
log.Error().
Str("service", serviceName).
Err(errormessage.FormatError(err)).
Msg("Couldn't connect to service.")
return
}
}
}
func getKubernetesProviderForCli(silent bool, dontCheckVersion bool) (*kubernetes.Provider, error) {
kubeConfigPath := config.Config.KubeConfigPath()
kubernetesProvider, err := kubernetes.NewProvider(kubeConfigPath, config.Config.Kube.Context)
if err != nil {
handleKubernetesProviderError(err)
return nil, err
}
if !silent {
log.Info().Str("path", kubeConfigPath).Msg("Using kubeconfig:")
}
if err := kubernetesProvider.ValidateNotProxy(); err != nil {
handleKubernetesProviderError(err)
return nil, err
}
if !dontCheckVersion {
kubernetesVersion, err := kubernetesProvider.GetKubernetesVersion()
if err != nil {
handleKubernetesProviderError(err)
return nil, err
}
if err := kubernetes.ValidateKubernetesVersion(kubernetesVersion); err != nil {
handleKubernetesProviderError(err)
return nil, err
}
}
return kubernetesProvider, nil
}
func handleKubernetesProviderError(err error) {
var clusterBehindProxyErr *kubernetes.ClusterBehindProxyError
if ok := errors.As(err, &clusterBehindProxyErr); ok {
log.Error().Msg(fmt.Sprintf("Cannot establish http-proxy connection to the Kubernetes cluster. If youre using Lens or similar tool, please run '%s' with regular kubectl config using --%v %v=$HOME/.kube/config flag", misc.Program, config.SetCommandName, config.KubeConfigPathConfigName))
} else {
log.Error().Err(err).Send()
}
}
func finishSelfExecution(kubernetesProvider *kubernetes.Provider) {
removalCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
defer cancel()
dumpLogsIfNeeded(removalCtx, kubernetesProvider)
}
func dumpLogsIfNeeded(ctx context.Context, kubernetesProvider *kubernetes.Provider) {
if !config.Config.DumpLogs {
return
}
dotDir := misc.GetDotFolderPath()
filePath := path.Join(dotDir, fmt.Sprintf("%s_logs_%s.zip", misc.Program, time.Now().Format("2006_01_02__15_04_05")))
if err := fsUtils.DumpLogs(ctx, kubernetesProvider, filePath, config.Config.Logs.Grep); err != nil {
log.Error().Err(err).Msg("Failed to dump logs.")
}
}