Skip to content

Commit

Permalink
Upgrade github.com/mostynb/go-grpc-compression to avoid decompression…
Browse files Browse the repository at this point in the history 
… bomb DoS

mostynb/go-grpc-compression#27
  • Loading branch information
@mostynb
mostynb committed Jun 6, 2024
1 parent a1a92db commit 5087a69
Show file tree
Hide file tree
Showing 7 changed files with 25 additions and 26 deletions.
6 changes: 2 additions & 4 deletions cache/grpcproxy/grpcproxy_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -63,8 +63,7 @@ func newProxy(t *testing.T, dir string, storageMode string) *testProxy {
dialer := func(context.Context, string) (net.Conn, error) {
return listener.Dial()
}
cc, err := grpc.Dial(
"bufconn",
cc, err := grpc.NewClient("passthrough://bufnet",
grpc.WithTransportCredentials(insecure.NewCredentials()),
grpc.WithContextDialer(dialer),
)
Expand Down Expand Up @@ -223,8 +222,7 @@ func newFixture(t *testing.T, proxy cache.Proxy, storageMode string) *fixture {
return listener.Dial()
}

cc, err := grpc.Dial(
"bufconn",
cc, err := grpc.NewClient("passthrough://bufnet",
grpc.WithTransportCredentials(insecure.NewCredentials()),
grpc.WithContextDialer(dialer),
)
Expand Down
2 changes: 1 addition & 1 deletion config/proxy.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ func (c *Config) setProxy() error {
opts = append(opts, grpc.WithChainStreamInterceptor(metrics.StreamClientInterceptor()))
opts = append(opts, grpc.WithChainUnaryInterceptor(metrics.UnaryClientInterceptor()))

conn, err := grpc.Dial(c.GRPCBackend.BaseURL.Host, opts...)
conn, err := grpc.NewClient(c.GRPCBackend.BaseURL.Host, opts...)
if err != nil {
return err
}
Expand Down
20 changes: 10 additions & 10 deletions deps.bzl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -126,8 +126,8 @@ def go_dependencies():
go_repository(
name = "com_github_cncf_xds_go",
importpath = "github.com/cncf/xds/go",
sum = "h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=",
version = "v0.0.0-20231128003011-0fa0005c9caa",
sum = "h1:DBmgJDC9dTfkVyGgipamEh2BpGYxScCH1TOF1LL1cXc=",
version = "v0.0.0-20240318125728-8a4994d93e50",
)
go_repository(
name = "com_github_cpuguy83_go_md2man_v2",
Expand Down Expand Up @@ -612,8 +612,8 @@ def go_dependencies():
go_repository(
name = "com_github_mostynb_go_grpc_compression",
importpath = "github.com/mostynb/go-grpc-compression",
sum = "h1:XaDbnRvt2+1vgr0b/l0qh4mJAfIxE0bKXtz2Znl3GGI=",
version = "v1.2.2",
sum = "h1:42/BKWMy0KEJGSdWvzqIyOZ95YcR9mLPqKctH7Uo//I=",
version = "v1.2.3",
)
go_repository(
name = "com_github_mostynb_zstdpool_syncpool",
Expand All @@ -637,8 +637,8 @@ def go_dependencies():
go_repository(
name = "com_github_pierrec_lz4_v4",
importpath = "github.com/pierrec/lz4/v4",
sum = "h1:xaKrnTkyoqfh1YItXl56+6KJNVYWlEEPuAQW9xsplYQ=",
version = "v4.1.18",
sum = "h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=",
version = "v4.1.21",
)

go_repository(
Expand Down Expand Up @@ -1713,15 +1713,15 @@ def go_dependencies():
go_repository(
name = "org_golang_google_grpc",
importpath = "google.golang.org/grpc",
sum = "h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=",
version = "v1.63.2",
sum = "h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY=",
version = "v1.64.0",
)

go_repository(
name = "org_golang_google_protobuf",
importpath = "google.golang.org/protobuf",
sum = "h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=",
version = "v1.33.0",
sum = "h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=",
version = "v1.34.1",
)
go_repository(
name = "org_golang_x_arch",
Expand Down
6 changes: 3 additions & 3 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ require (
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
github.com/klauspost/compress v1.17.8
github.com/minio/minio-go/v7 v7.0.69
github.com/mostynb/go-grpc-compression v1.2.2
github.com/mostynb/go-grpc-compression v1.2.3
github.com/mostynb/zstdpool-syncpool v0.0.13
github.com/prometheus/client_golang v1.19.0
github.com/prometheus/client_model v0.6.1 // indirect
Expand All @@ -20,8 +20,8 @@ require (
golang.org/x/sync v0.7.0
golang.org/x/sys v0.19.0 // indirect
google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda
google.golang.org/grpc v1.63.2
google.golang.org/protobuf v1.33.0
google.golang.org/grpc v1.64.0
google.golang.org/protobuf v1.34.1
gopkg.in/yaml.v3 v3.0.1
)

Expand Down
12 changes: 6 additions & 6 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,8 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/mostynb/go-grpc-compression v1.2.2 h1:XaDbnRvt2+1vgr0b/l0qh4mJAfIxE0bKXtz2Znl3GGI=
github.com/mostynb/go-grpc-compression v1.2.2/go.mod h1:GOCr2KBxXcblCuczg3YdLQlcin1/NfyDA348ckuCH6w=
github.com/mostynb/go-grpc-compression v1.2.3 h1:42/BKWMy0KEJGSdWvzqIyOZ95YcR9mLPqKctH7Uo//I=
github.com/mostynb/go-grpc-compression v1.2.3/go.mod h1:AghIxF3P57umzqM9yz795+y1Vjs47Km/Y2FE6ouQ7Lg=
github.com/mostynb/zstdpool-syncpool v0.0.13 h1:AIzAvQ9hNum4Fh5jYXyfZTd2aDi1leq7grKDkVZX4+s=
github.com/mostynb/zstdpool-syncpool v0.0.13/go.mod h1:pbt8qOdq6wX5jrUsRI9UmBvAnjToEgVQC3H1pwJwktM=
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
Expand Down Expand Up @@ -183,10 +183,10 @@ google.golang.org/genproto/googleapis/bytestream v0.0.0-20240401170217-c3f982113
google.golang.org/genproto/googleapis/bytestream v0.0.0-20240401170217-c3f982113cda/go.mod h1:IN9OQUXZ0xT+26MDwZL8fJcYw+y99b0eYPA2U15Jt8o=
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda h1:LI5DOvAxUPMv/50agcLLoo+AdWc1irS9Rzz4vPuD1V4=
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
google.golang.org/grpc v1.64.0 h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY=
google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg=
google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
Expand Down
2 changes: 1 addition & 1 deletion server/grpc_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,7 @@ func grpcTestSetupInternal(t *testing.T, mangleACKeys bool) (tc grpcTestFixture)
}
}()

conn, err := grpc.Dial("bufnet",
conn, err := grpc.NewClient("passthrough://bufnet",
grpc.WithTransportCredentials(insecure.NewCredentials()),
grpc.WithContextDialer(bufDialer))
if err != nil {
Expand Down
3 changes: 2 additions & 1 deletion utils/grpcreadclient/grpcreadclient.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ func main() {
}

func dial(serverAddr string, caCertFile string, clientCertFile string, clientKeyFile string, basicAuthUser string, basicAuthPass string) (*grpc.ClientConn, error, context.Context, context.CancelFunc) {

//nolint:all
dialOpts := []grpc.DialOption{grpc.WithBlock()}

if basicAuthUser != "" {
Expand Down Expand Up @@ -154,6 +154,7 @@ func dial(serverAddr string, caCertFile string, clientCertFile string, clientKey
fmt.Println("Dialing...", serverAddr)

ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
//nolint:all
conn, err := grpc.DialContext(ctx, serverAddr, dialOpts...)
return conn, err, ctx, cancel
}
Expand Down

0 comments on commit 5087a69

Please sign in to comment.