mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-08-25 00:47:27 +00:00
* deps: bump indirect deps to clear critical/high Dependabot alerts Bumps the vulnerable indirect dependencies flagged as critical or high severity in Dependabot: - golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on large channel writes, client-induced server deadlock, RSA/DSA DoS, byte arithmetic underflow panic) - google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via missing leading slash in :path; high: xDS RBAC and HTTP/2 issues) - github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL -> restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local privesc via wide CRI directory permissions) - oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink extract-dir escape, credential forwarding via unvalidated Location header) - github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI) Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time, x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy. The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules); the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no workflow changes are needed. go build ./... and go test ./... pass. * ci: move golangci-lint to v2, fix resulting lint issues golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with go1.24 and refuses to run now that go.mod targets 1.25.0: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0) Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and unused, plus gofmt/goimports as formatters. Fixes for the issues that surfaced: - ST1005: lowercase error strings, drop trailing '!' in connect/hub.go - SA4011: kubernetes/watch.go had a `break` inside a `select` default that broke the select rather than the loop, i.e. a no-op; removed - QF1008: drop the embedded ChartPathOptions selector in helm.go - QF1003: tagged switch on r.URL.Path in mcp_test.go - QF1004: strings.Replace(..., -1) -> strings.ReplaceAll - gofmt -s and goimports with a local prefix across the tree errcheck is not in the enabled set, matching hub. * cmd: clarify --time parse error in pcap dump The error neither named the offending flag/value nor separated the wrapped error from the message. Reported by Copilot on #1952. --------- Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
158 lines
4.2 KiB
Go
158 lines
4.2 KiB
Go
package connect
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"os"
|
|
"time"
|
|
|
|
"github.com/kubeshark/kubeshark/config"
|
|
"github.com/kubeshark/kubeshark/utils"
|
|
|
|
"github.com/rs/zerolog/log"
|
|
v1 "k8s.io/api/core/v1"
|
|
)
|
|
|
|
type Connector struct {
|
|
url string
|
|
retries int
|
|
client *http.Client
|
|
}
|
|
|
|
const DefaultRetries = 3
|
|
const DefaultTimeout = 2 * time.Second
|
|
const DefaultSleep = 1 * time.Second
|
|
|
|
func NewConnector(url string, retries int, timeout time.Duration) *Connector {
|
|
return &Connector{
|
|
url: url,
|
|
retries: retries,
|
|
client: &http.Client{
|
|
Timeout: timeout,
|
|
},
|
|
}
|
|
}
|
|
|
|
func (connector *Connector) TestConnection(path string) error {
|
|
retriesLeft := connector.retries
|
|
for retriesLeft > 0 {
|
|
if isReachable, err := connector.isReachable(path); err != nil || !isReachable {
|
|
log.Debug().Str("url", connector.url).Err(err).Msg("Not ready yet!")
|
|
} else {
|
|
log.Debug().Str("url", connector.url).Msg("Connection test passed successfully.")
|
|
break
|
|
}
|
|
retriesLeft -= 1
|
|
time.Sleep(5 * DefaultSleep)
|
|
}
|
|
|
|
if retriesLeft == 0 {
|
|
return fmt.Errorf("couldn't reach the URL: %s after %d retries", connector.url, connector.retries)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (connector *Connector) isReachable(path string) (bool, error) {
|
|
targetUrl := fmt.Sprintf("%s%s", connector.url, path)
|
|
if _, err := utils.Get(targetUrl, connector.client); err != nil {
|
|
return false, err
|
|
} else {
|
|
return true, nil
|
|
}
|
|
}
|
|
|
|
func (connector *Connector) PostWorkerPodToHub(pod *v1.Pod) {
|
|
postWorkerUrl := fmt.Sprintf("%s/pods/worker", connector.url)
|
|
|
|
if podMarshalled, err := json.Marshal(pod); err != nil {
|
|
log.Error().Err(err).Msg("Failed to marshal the Worker pod:")
|
|
} else {
|
|
ok := false
|
|
for !ok {
|
|
var resp *http.Response
|
|
if resp, err = utils.Post(postWorkerUrl, "application/json", bytes.NewBuffer(podMarshalled), connector.client, config.Config.License); err != nil || resp.StatusCode != http.StatusOK {
|
|
if _, ok := err.(*url.Error); ok {
|
|
break
|
|
}
|
|
log.Warn().Err(err).Msg("Failed sending the Worker pod to Hub. Retrying...")
|
|
} else {
|
|
log.Debug().Interface("worker-pod", pod).Msg("Reported worker pod to Hub:")
|
|
return
|
|
}
|
|
time.Sleep(DefaultSleep)
|
|
}
|
|
}
|
|
}
|
|
|
|
type postLicenseRequest struct {
|
|
License string `json:"license"`
|
|
}
|
|
|
|
func (connector *Connector) PostLicense(license string) {
|
|
postLicenseUrl := fmt.Sprintf("%s/license", connector.url)
|
|
|
|
payload := postLicenseRequest{
|
|
License: license,
|
|
}
|
|
|
|
if payloadMarshalled, err := json.Marshal(payload); err != nil {
|
|
log.Error().Err(err).Msg("Failed to marshal the payload:")
|
|
} else {
|
|
ok := false
|
|
for !ok {
|
|
var resp *http.Response
|
|
if resp, err = utils.Post(postLicenseUrl, "application/json", bytes.NewBuffer(payloadMarshalled), connector.client, config.Config.License); err != nil || resp.StatusCode != http.StatusOK {
|
|
if _, ok := err.(*url.Error); ok {
|
|
break
|
|
}
|
|
log.Warn().Err(err).Msg("Failed sending the license to Hub. Retrying...")
|
|
} else {
|
|
log.Debug().Str("license", license).Msg("Reported license to Hub:")
|
|
return
|
|
}
|
|
time.Sleep(DefaultSleep)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (connector *Connector) PostPcapsMerge(out *os.File) {
|
|
postEnvUrl := fmt.Sprintf("%s/pcaps/merge", connector.url)
|
|
|
|
if envMarshalled, err := json.Marshal(map[string]string{"query": ""}); err != nil {
|
|
log.Error().Err(err).Msg("Failed to marshal the env:")
|
|
} else {
|
|
ok := false
|
|
for !ok {
|
|
var resp *http.Response
|
|
if resp, err = utils.Post(postEnvUrl, "application/json", bytes.NewBuffer(envMarshalled), connector.client, config.Config.License); err != nil || resp.StatusCode != http.StatusOK {
|
|
if _, ok := err.(*url.Error); ok {
|
|
break
|
|
}
|
|
log.Warn().Err(err).Msg("Failed exported PCAP download. Retrying...")
|
|
} else {
|
|
defer resp.Body.Close()
|
|
|
|
// Check server response
|
|
if resp.StatusCode != http.StatusOK {
|
|
log.Error().Str("status", resp.Status).Err(err).Msg("Failed exported PCAP download.")
|
|
return
|
|
}
|
|
|
|
// Writer the body to file
|
|
_, err = io.Copy(out, resp.Body)
|
|
if err != nil {
|
|
log.Error().Err(err).Msg("Failed writing PCAP export:")
|
|
return
|
|
}
|
|
log.Info().Str("path", out.Name()).Msg("Downloaded exported PCAP:")
|
|
return
|
|
}
|
|
time.Sleep(DefaultSleep)
|
|
}
|
|
}
|
|
}
|