Skip to content

[19.03 backport] Update DNS library#40617

Merged
AkihiroSuda merged 1 commit intomoby:19.03from
SamWhited:19.03
Mar 27, 2020
Merged

[19.03 backport] Update DNS library#40617
AkihiroSuda merged 1 commit intomoby:19.03from
SamWhited:19.03

Conversation

@SamWhited
Copy link
Contributor

@SamWhited SamWhited commented Mar 3, 2020

This makes sure that we don't become vulnerable to CVE-2018-17419 or
CVE-2019-19794 in the future.

This is a cherry-pick of #40579 using the correct bump_19.03 libnetwork branch.

Signed-off-by: Sam Whited [email protected]

@SamWhited SamWhited requested a review from tianon as a code owner March 3, 2020 21:51
@thaJeztah thaJeztah added this to the 19.03.8 milestone Mar 6, 2020
@thaJeztah
Copy link
Member

thaJeztah commented Mar 6, 2020

Don't merge this one yet; looks like there's a regression; #40634 (comment)

@thaJeztah thaJeztah mentioned this pull request Mar 9, 2020
Merged
thaJeztah
thaJeztah reviewed Mar 9, 2020
View reviewed changes
@SamWhited SamWhited mentioned this pull request Mar 11, 2020
Closed
@thaJeztah thaJeztah modified the milestones: 19.03.8, 19.03.9 Mar 11, 2020
@thaJeztah thaJeztah mentioned this pull request Mar 12, 2020
Closed
@trapier
Copy link

trapier commented Mar 13, 2020

@thaJeztah: hi!

Looks like this is up to date on the action items from #40596 (comment). Should be good to go.

@thaJeztah
Copy link
Member

thaJeztah commented Mar 13, 2020

looks like there's a merge conflict; @SamWhited can you rebase and remove the temporary commit?

@SamWhited
Copy link
Contributor Author

SamWhited commented Mar 17, 2020

@thaJeztah Rebased, tests running.

thaJeztah
thaJeztah approved these changes Mar 17, 2020
View reviewed changes
Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@thaJeztah
Copy link
Member

thaJeztah commented Mar 19, 2020

could you update the commit once more to include moby/libnetwork#2541 ?

@SamWhited
Copy link
Contributor Author

SamWhited commented Mar 19, 2020

Done

thaJeztah
thaJeztah approved these changes Mar 19, 2020
View reviewed changes
Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

still LGTM

@SamWhited
Copy link
Contributor Author

SamWhited commented Mar 19, 2020 •
edited
Loading

Test failures appear to exist in bump_19.03 too.

@thaJeztah
Copy link
Member

thaJeztah commented Mar 20, 2020

Networking in CI has quite some issues recently. No idea what changed tbh

@SamWhited
Copy link
Contributor Author

SamWhited commented Mar 25, 2020

@thaJeztah can this be merged or do we need to figure out the CI flakiness first?

@euanh
Copy link
Contributor

euanh commented Mar 25, 2020

I see some evidence of network connectivity problems from the build worker in the build logs:

  1. ppc64le: failed to clone containerd, GnuTLS recv error; s390x: failed apt update, Temporary failure resolving 'cdn-fastly.deb.debian.org'
  2. s390: failed apt update Temporary failure resolving 'cdn-fastly.deb.debian.org'
  3. win_RS5: not sure, could be a Git clone failure
  4. amd64: test failure amd64.integration-cli TestDockerSwarmSuite/TestSwarmClusterRotateUnlockKey
  5. s390: failed apt update Temporary failure resolving 'cdn-fastly.deb.debian.org'
  6. win_RS5: timeout?
  7. PASS
  8. superseded by 9`
  9. amd64: error pulling an asset during swagger build error: RPC failed; curl 56 GnuTLS recv error (-54): Error in the pull function
  10. amd64: error in frozen-images curl: (56) OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 101
  11. amd64: criu build failed pulling from the network - asset was corrupted: curl -sSL https://github.com/checkpoint-restore/criu/archive/v${CRIU_VERSION}.tar.gz | tar -C /usr/src/criu/ -xz --strip-components=1 -> gzip: stdin: not in gzip format

@euanh
Copy link
Contributor

euanh commented Mar 26, 2020

@thaJeztah I think it's at least worth kicking off the build again. The last runs were a week ago and if there were networking problems for the builder they may have been resolved.

@SamWhited
Update libnetwork and DNS library
0212586 
This makes sure that we don't become vulnerable to CVE-2018-17419 or
CVE-2019-19794 in the future. While we are not currently vulnerable to
either, there is a risk that a PR could be made which uses one of the
vulnerable methods in the future, so it's worth going ahead and updating
to ensure that a simple PR that would easily pass code review doesn't
lead to a vulnerability.

Signed-off-by: Sam Whited <[email protected]>
@SamWhited
Copy link
Contributor Author

SamWhited commented Mar 27, 2020

Reran CI, it's green now.

@thaJeztah
Copy link
Member

thaJeztah commented Mar 27, 2020

@cpuguy83 @AkihiroSuda good to go?

@AkihiroSuda AkihiroSuda merged commit 1454987 into moby:19.03 Mar 27, 2020
@SamWhited SamWhited deleted the 19.03 branch March 27, 2020 17:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thaJeztah thaJeztah thaJeztah approved these changes

@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes

@tianon tianon Awaiting requested review from tianon tianon is a code owner

Assignees

No one assigned

Labels

area/networking Networking status/2-code-review

Projects

None yet

Milestone

19.03.9

Development

Successfully merging this pull request may close these issues.

5 participants

@SamWhited @thaJeztah @trapier @euanh @AkihiroSuda