Skip to content

Commit 858fdf6

Browse files
aaurenaauren
committed
fix(lint): prevent against integer overflow errors
1 parent 5cdc417 commit 858fdf6

7 files changed

+118
-26
lines changed

‎go.mod

+1
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ require (
2929
require (
3030
github.com./Microsoft/go-winio v0.6.2 // indirect
3131
github.com./beorn7/perks v1.0.1 // indirect
32+
github.com./ccoveille/go-safecast v1.5.0 // indirect
3233
github.com./cespare/xxhash/v2 v2.3.0 // indirect
3334
github.com./containerd/log v0.1.0 // indirect
3435
github.com./davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

‎go.sum

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ github.com./aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk
66
github.com./aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
77
github.com./beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
88
github.com./beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
9+
github.com./ccoveille/go-safecast v1.5.0 h1:cT/3uVQ/i5PTiJvhvkSU81HeKNurtyQtBndXEH3hDg4=
10+
github.com./ccoveille/go-safecast v1.5.0/go.mod h1:QqwNjxQ7DAqY0C721OIO9InMk9zCwcsO7tnRuHytad8=
911
github.com./cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
1012
github.com./cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
1113
github.com./cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

‎pkg/controllers/proxy/linux_networking.go

+27-7
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"syscall"
1313
"time"
1414

15+
"github.com./ccoveille/go-safecast"
1516
"github.com./cloudnativelabs/kube-router/v2/pkg/cri"
1617
"github.com./cloudnativelabs/kube-router/v2/pkg/utils"
1718
"github.com./docker/docker/client"
@@ -265,10 +266,18 @@ func (ln *linuxNetworking) ipvsAddService(svcs []*ipvs.Service, vip net.IP, prot
265266
vip, svc.Address, protocol, svc.Protocol, port, svc.Port)
266267
if vip.Equal(svc.Address) && protocol == svc.Protocol && port == svc.Port {
267268
klog.V(2).Info("Service matched VIP")
269+
ptim, err := safecast.ToUint32(persistentTimeout)
270+
if err != nil {
271+
return svcs, nil, fmt.Errorf("failed to convert persistent timeout to uint32: %v", err)
272+
}
268273
if (persistent && (svc.Flags&ipvsPersistentFlagHex) == 0) ||
269274
(!persistent && (svc.Flags&ipvsPersistentFlagHex) != 0) ||
270-
svc.Timeout != uint32(persistentTimeout) {
271-
ipvsSetPersistence(svc, persistent, persistentTimeout)
275+
svc.Timeout != ptim {
276+
err = ipvsSetPersistence(svc, persistent, persistentTimeout)
277+
if err != nil {
278+
return svcs, nil, fmt.Errorf("failed to set persistence for service %s due to: %v",
279+
ipvsServiceString(svc), err)
280+
}
272281

273282
err = ln.ipvsUpdateService(svc)
274283
if err != nil {
@@ -323,7 +332,11 @@ func (ln *linuxNetworking) ipvsAddService(svcs []*ipvs.Service, vip net.IP, prot
323332
Netmask: ipMask,
324333
}
325334

326-
ipvsSetPersistence(&svc, persistent, persistentTimeout)
335+
err = ipvsSetPersistence(&svc, persistent, persistentTimeout)
336+
if err != nil {
337+
return svcs, nil, fmt.Errorf("failed to set persistence for service %s due to: %v",
338+
ipvsServiceString(&svc), err)
339+
}
327340
ipvsSetSchedFlags(&svc, flags)
328341

329342
klog.V(1).Infof("%s didn't match any existing IPVS services, creating a new IPVS service",
@@ -356,13 +369,17 @@ func (ln *linuxNetworking) ipvsAddFWMarkService(svcs []*ipvs.Service, fwMark uin
356369
if fwMark == svc.FWMark {
357370
if (persistent && (svc.Flags&ipvsPersistentFlagHex) == 0) ||
358371
(!persistent && (svc.Flags&ipvsPersistentFlagHex) != 0) {
359-
ipvsSetPersistence(svc, persistent, persistentTimeout)
372+
err := ipvsSetPersistence(svc, persistent, persistentTimeout)
373+
if err != nil {
374+
return nil, fmt.Errorf("failed to set persistence for service %s due to: %v",
375+
ipvsServiceString(svc), err)
376+
}
360377

361378
if changedIpvsSchedFlags(svc, flags) {
362379
ipvsSetSchedFlags(svc, flags)
363380
}
364381

365-
err := ln.ipvsUpdateService(svc)
382+
err = ln.ipvsUpdateService(svc)
366383
if err != nil {
367384
return nil, fmt.Errorf("failed to update persistence flags for service %s due to %v",
368385
ipvsServiceString(svc), err)
@@ -419,10 +436,13 @@ func (ln *linuxNetworking) ipvsAddFWMarkService(svcs []*ipvs.Service, fwMark uin
419436
SchedName: ipvs.RoundRobin,
420437
}
421438

422-
ipvsSetPersistence(&svc, persistent, persistentTimeout)
439+
err := ipvsSetPersistence(&svc, persistent, persistentTimeout)
440+
if err != nil {
441+
return nil, fmt.Errorf("failed to set persistence for service %s due to: %v", ipvsServiceString(&svc), err)
442+
}
423443
ipvsSetSchedFlags(&svc, flags)
424444

425-
err := ln.ipvsNewService(&svc)
445+
err = ln.ipvsNewService(&svc)
426446
if err != nil {
427447
return nil, err
428448
}

‎pkg/controllers/proxy/network_services_controller.go

+16-4
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"syscall"
1414
"time"
1515

16+
"github.com./ccoveille/go-safecast"
1617
"github.com./cloudnativelabs/kube-router/v2/pkg/healthcheck"
1718
"github.com./cloudnativelabs/kube-router/v2/pkg/metrics"
1819
"github.com./cloudnativelabs/kube-router/v2/pkg/options"
@@ -746,16 +747,20 @@ func (nsc *NetworkServicesController) publishMetrics(serviceInfoMap serviceInfoM
746747
protocol = convertSvcProtoToSysCallProto(svc.protocol)
747748
for _, ipvsSvc := range ipvsSvcs {
748749

750+
uPort, err := safecast.ToUint16(svc.port)
751+
if err != nil {
752+
klog.Errorf("failed to convert port %d to uint16: %v", svc.port, err)
753+
}
749754
switch svcAddress := ipvsSvc.Address.String(); svcAddress {
750755
case svc.clusterIP.String():
751-
if protocol == ipvsSvc.Protocol && uint16(svc.port) == ipvsSvc.Port {
756+
if protocol == ipvsSvc.Protocol && uPort == ipvsSvc.Port {
752757
pushMetric = true
753758
svcVip = svc.clusterIP.String()
754759
} else {
755760
pushMetric = false
756761
}
757762
case nsc.krNode.GetPrimaryNodeIP().String():
758-
if protocol == ipvsSvc.Protocol && uint16(svc.port) == ipvsSvc.Port {
763+
if protocol == ipvsSvc.Protocol && uPort == ipvsSvc.Port {
759764
pushMetric = true
760765
svcVip = nsc.krNode.GetPrimaryNodeIP().String()
761766
} else {
@@ -1556,14 +1561,21 @@ func ipvsDestinationString(d *ipvs.Destination) string {
15561561
return fmt.Sprintf("%s:%v (Family: %s, Weight: %v)", d.Address, d.Port, family, d.Weight)
15571562
}
15581563

1559-
func ipvsSetPersistence(svc *ipvs.Service, p bool, timeout int32) {
1564+
func ipvsSetPersistence(svc *ipvs.Service, p bool, timeout int32) error {
15601565
if p {
1566+
uTimeout, err := safecast.ToUint32(timeout)
1567+
if err != nil {
1568+
return fmt.Errorf("failed to convert timeout to uint32: %v", err)
1569+
}
1570+
15611571
svc.Flags |= ipvsPersistentFlagHex
1562-
svc.Timeout = uint32(timeout)
1572+
svc.Timeout = uTimeout
15631573
} else {
15641574
svc.Flags &^= ipvsPersistentFlagHex
15651575
svc.Timeout = 0
15661576
}
1577+
1578+
return nil
15671579
}
15681580

15691581
func ipvsSetSchedFlags(svc *ipvs.Service, s schedFlags) {

‎pkg/controllers/proxy/service_endpoints_sync.go

+39-9
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"syscall"
1212
"time"
1313

14+
"github.com./ccoveille/go-safecast"
1415
"github.com./cloudnativelabs/kube-router/v2/pkg/metrics"
1516
"github.com./cloudnativelabs/kube-router/v2/pkg/utils"
1617
"github.com./moby/ipvs"
@@ -135,6 +136,10 @@ func (nsc *NetworkServicesController) setupClusterIPServices(serviceInfoMap serv
135136
if err != nil {
136137
return fmt.Errorf("failed creating dummy interface: %v", err)
137138
}
139+
sPort, err := safecast.ToUint16(svc.port)
140+
if err != nil {
141+
return fmt.Errorf("failed to convert service port to uint16: %v", err)
142+
}
138143

139144
for family, famClusIPs := range clusterIPs {
140145
var nodeIP string
@@ -159,7 +164,7 @@ func (nsc *NetworkServicesController) setupClusterIPServices(serviceInfoMap serv
159164

160165
// create IPVS service for the service to be exposed through the cluster ip
161166
ipvsSvcs, svcID, ipvsSvc = nsc.addIPVSService(ipvsSvcs, activeServiceEndpointMap, svc, clusterIP,
162-
protocol, uint16(svc.port))
167+
protocol, sPort)
163168
// We weren't able to create the IPVS service, so we won't be able to add endpoints to it
164169
if svcID == "" {
165170
// not logging an error here because it was already logged in the addIPVSService function
@@ -241,13 +246,19 @@ func (nsc *NetworkServicesController) addEndpointsToIPVSService(endpoints []endp
241246
syscallINET = syscall.AF_INET6
242247
}
243248

249+
ePort, err := safecast.ToUint16(endpoint.port)
250+
if err != nil {
251+
klog.Errorf("failed to convert endpoint port to uint16: %v", err)
252+
continue
253+
}
254+
244255
dst := ipvs.Destination{
245256
Address: eIP,
246257
AddressFamily: syscallINET,
247-
Port: uint16(endpoint.port),
258+
Port: ePort,
248259
Weight: 1,
249260
}
250-
err := nsc.ln.ipvsAddServer(ipvsSvc, &dst)
261+
err = nsc.ln.ipvsAddServer(ipvsSvc, &dst)
251262
if err != nil {
252263
klog.Errorf("encountered error adding endpoint to service: %v", err)
253264
continue
@@ -282,6 +293,11 @@ func (nsc *NetworkServicesController) setupNodePortServices(serviceInfoMap servi
282293
continue
283294
}
284295

296+
nPort, err := safecast.ToUint16(svc.nodePort)
297+
if err != nil {
298+
return fmt.Errorf("failed to convert node port to uint16: %v", err)
299+
}
300+
285301
var svcID string
286302
var ipvsSvc *ipvs.Service
287303
if nsc.nodeportBindOnAllIP {
@@ -312,7 +328,7 @@ func (nsc *NetworkServicesController) setupNodePortServices(serviceInfoMap servi
312328
for _, addr := range addrs {
313329

314330
ipvsSvcs, svcID, ipvsSvc = nsc.addIPVSService(ipvsSvcs, activeServiceEndpointMap, svc, addr,
315-
protocol, uint16(svc.nodePort))
331+
protocol, nPort)
316332
// We weren't able to create the IPVS service, so we won't be able to add endpoints to it
317333
if svcID == "" {
318334
continue
@@ -322,7 +338,7 @@ func (nsc *NetworkServicesController) setupNodePortServices(serviceInfoMap servi
322338
}
323339
} else {
324340
ipvsSvcs, svcID, ipvsSvc = nsc.addIPVSService(ipvsSvcs, activeServiceEndpointMap, svc,
325-
nsc.krNode.GetPrimaryNodeIP(), protocol, uint16(svc.nodePort))
341+
nsc.krNode.GetPrimaryNodeIP(), protocol, nPort)
326342
// We weren't able to create the IPVS service, so we won't be able to add endpoints to it
327343
if svcID == "" {
328344
continue
@@ -416,6 +432,11 @@ func (nsc *NetworkServicesController) setupExternalIPForService(svc *serviceInfo
416432
return fmt.Errorf("failed get list of IPVS services due to: %v", err)
417433
}
418434

435+
sPort, err := safecast.ToUint16(svc.port)
436+
if err != nil {
437+
return fmt.Errorf("failed to convert service port to uint16: %v", err)
438+
}
439+
419440
// ensure director with vip assigned
420441
err = nsc.ln.ipAddrAdd(dummyVipInterface, externalIP.String(), nodeIP.String(), true)
421442
if err != nil && err.Error() != IfaceHasAddr {
@@ -424,8 +445,7 @@ func (nsc *NetworkServicesController) setupExternalIPForService(svc *serviceInfo
424445
}
425446

426447
// create IPVS service for the service to be exposed through the external ip
427-
_, svcID, ipvsExternalIPSvc = nsc.addIPVSService(ipvsSvcs, svcEndpointMap, svc, externalIP, protocol,
428-
uint16(svc.port))
448+
_, svcID, ipvsExternalIPSvc = nsc.addIPVSService(ipvsSvcs, svcEndpointMap, svc, externalIP, protocol, sPort)
429449
if svcID == "" {
430450
return fmt.Errorf("failed to create ipvs service for external ip: %s", externalIP)
431451
}
@@ -510,7 +530,12 @@ func (nsc *NetworkServicesController) setupExternalIPForDSRService(svcIn *servic
510530
return fmt.Errorf("failed to generate FW mark")
511531
}
512532

513-
ipvsExternalIPSvc, err := nsc.ln.ipvsAddFWMarkService(ipvsSvcs, fwMark, sysFamily, protocol, uint16(svcIn.port),
533+
sInPort, err := safecast.ToUint16(svcIn.port)
534+
if err != nil {
535+
return fmt.Errorf("failed to convert serviceIn port to uint16: %v", err)
536+
}
537+
538+
ipvsExternalIPSvc, err := nsc.ln.ipvsAddFWMarkService(ipvsSvcs, fwMark, sysFamily, protocol, sInPort,
514539
svcIn.sessionAffinity, svcIn.sessionAffinityTimeoutSeconds, svcIn.scheduler, svcIn.flags)
515540
if err != nil {
516541
return fmt.Errorf("failed to create IPVS service for FWMark service: %d (external IP: %s) due to: %s",
@@ -570,12 +595,17 @@ func (nsc *NetworkServicesController) setupExternalIPForDSRService(svcIn *servic
570595
syscallINET = syscall.AF_INET6
571596
}
572597

598+
ePort, err := safecast.ToUint16(endpoint.port)
599+
if err != nil {
600+
return fmt.Errorf("failed to convert endpoint port to uint16: %v", err)
601+
}
602+
573603
// create the basic IPVS destination record
574604
dst := ipvs.Destination{
575605
Address: eIP,
576606
AddressFamily: syscallINET,
577607
ConnectionFlags: ipvs.ConnectionFlagTunnel,
578-
Port: uint16(endpoint.port),
608+
Port: ePort,
579609
Weight: 1,
580610
}
581611

‎pkg/controllers/routing/bgp_policies.go

+14-3
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"strconv"
1212
"strings"
1313

14+
"github.com./ccoveille/go-safecast"
1415
gobgpapi "github.com./osrg/gobgp/v3/api"
1516
v1core "k8s.io/api/core/v1"
1617
"k8s.io/klog/v2"
@@ -135,10 +136,14 @@ func (nrc *NetworkRoutingController) addPodCidrDefinedSet() error {
135136
if cidrLen < 0 || cidrLen > cidrMax {
136137
return fmt.Errorf("the pod CIDR IP given is not a proper mask: %d", cidrLen)
137138
}
139+
uCIDRLen, err := safecast.ToUint32(cidrLen)
140+
if err != nil {
141+
return fmt.Errorf("failed to convert CIDR length to uint32: %v", err)
142+
}
138143
prefixes = append(prefixes, &gobgpapi.Prefix{
139144
IpPrefix: cidr,
140-
MaskLengthMin: uint32(cidrLen),
141-
MaskLengthMax: uint32(cidrLen),
145+
MaskLengthMin: uCIDRLen,
146+
MaskLengthMax: uCIDRLen,
142147
})
143148
}
144149
podCidrDefinedSet := &gobgpapi.DefinedSet{
@@ -318,7 +323,13 @@ func (nrc *NetworkRoutingController) addCustomImportRejectDefinedSet() error {
318323
prefix := new(gobgpapi.Prefix)
319324
prefix.IpPrefix = ipNet.String()
320325
mask, _ := ipNet.Mask.Size()
321-
prefix.MaskLengthMin = uint32(mask)
326+
327+
uIntMask, err := safecast.ToUint32(mask)
328+
if err != nil {
329+
return fmt.Errorf("failed to convert mask to uint32: %v", err)
330+
}
331+
332+
prefix.MaskLengthMin = uIntMask
322333
prefix.MaskLengthMax = uint32(ipv4MaskMinBits)
323334
prefixes = append(prefixes, prefix)
324335
}

‎pkg/controllers/routing/network_routes_controller.go

+19-3
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414

1515
"google.golang.org/protobuf/types/known/anypb"
1616

17+
"github.com./ccoveille/go-safecast"
1718
"github.com./cloudnativelabs/kube-router/v2/pkg/bgp"
1819
"github.com./cloudnativelabs/kube-router/v2/pkg/healthcheck"
1920
"github.com./cloudnativelabs/kube-router/v2/pkg/metrics"
@@ -1060,11 +1061,16 @@ func (nrc *NetworkRoutingController) startBgpServer(grpcServer bool) error {
10601061
localAddressList = append(localAddressList, addr)
10611062
}
10621063

1064+
intBGPPort, err := safecast.ToInt32(nrc.bgpPort)
1065+
if err != nil {
1066+
return fmt.Errorf("failed to convert BGP port to int32: %v", err)
1067+
}
1068+
10631069
global := &gobgpapi.Global{
10641070
Asn: nodeAsnNumber,
10651071
RouterId: nrc.routerID,
10661072
ListenAddresses: localAddressList,
1067-
ListenPort: int32(nrc.bgpPort),
1073+
ListenPort: intBGPPort,
10681074
}
10691075

10701076
if err := nrc.bgpServer.StartBgp(context.Background(), &gobgpapi.StartBgpRequest{Global: global}); err != nil {
@@ -1402,13 +1408,23 @@ func NewNetworkRoutingController(clientset kubernetes.Interface,
14021408
// Convert ints to uint32s
14031409
peerASNs := make([]uint32, 0)
14041410
for _, i := range kubeRouterConfig.PeerASNs {
1405-
peerASNs = append(peerASNs, uint32(i))
1411+
ui, err := safecast.ToUint32(i)
1412+
if err != nil {
1413+
return nil, fmt.Errorf("failed to convert Peer ASNs to uint32: %s", err)
1414+
}
1415+
1416+
peerASNs = append(peerASNs, ui)
14061417
}
14071418

14081419
// Convert uints to uint16s
14091420
peerPorts := make([]uint32, 0)
14101421
for _, i := range kubeRouterConfig.PeerPorts {
1411-
peerPorts = append(peerPorts, uint32(i))
1422+
ui, err := safecast.ToUint32(i)
1423+
if err != nil {
1424+
return nil, fmt.Errorf("failed to convert Peer Port to uint32: %s", err)
1425+
}
1426+
1427+
peerPorts = append(peerPorts, ui)
14121428
}
14131429

14141430
// PeerPasswords as cli params take precedence over password file

0 commit comments

Comments
 (0)