full diff: https://github.com/golang/net/compare/ab34263943818b32f575efc978
This fixes the same CVE as go1.21.3 and go1.20.10;
- net/http: rapid stream resets can cause excessive work
A malicious HTTP/2 client which rapidly creates requests and
immediately resets them can cause excessive server resource consumption.
While the total number of requests is bounded to the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.
HTTP/2 servers now bound the number of simultaneously executing
handler goroutines to the stream concurrency limit. New requests
arriving when at the limit (which can only happen after the client
has reset an existing, in-flight request) will be queued until a
handler exits. If the request queue grows too large, the server
will terminate the connection.
This issue is also fixed in golang.org/x/net/http2 v0.17.0,
for users manually configuring HTTP/2.
The default stream concurrency limit is 250 streams (requests)
per HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.
This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
This is also tracked by CVE-2023-44487.
Dependency full diffs:
a3d24e80b04bd7...v0.17.0
https://github.com/golang/sys/compare/33da011f77ade50ff5b6a6fb4a
9a1e6d6b285809...v0.13.0
https://github.com/golang/text/compare/v0.3.3...v0.13.0https://github.com/golang/crypto/compare/c1f2f97bffc9c53fc40a1a28a5
b460094c0050d9...v0.14.0
Signed-off-by: Cory Snider <csnider@mirantis.com>
Go 1.17 requires golang.org/x/sys a76c4d0a0096537dc565908b53073460d96c8539 (May 8,
2021) or later, see https://github.com/golang/go/issues/45702. While this seems
to affect macOS only, let's update to the latest version.
full diff: d19ff857e8...63515b42dc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit d48c8b70a1)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: b64e53b001...d19ff857e8
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit f0d3e905b6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
aee5d888a8...eeed37f84f
- all: add GOOS=ios
- unix: add back IoctlCtlInfo on darwin
- windows: add SetConsoleCursorPosition
- unix: update Dockerfile to Linux 5.9 and Go 1.15.2 (adds `CAP_CHECKPOINT_RESTORE`)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: 73f35e472e...7f0af18e79
- update gotest.tools to v3
- Use unix.Ioctl{Get,Set}Termios on all unix platforms
- Make Termios type alias, remove casts
vendor: golang.org/x/sys 196b9ba8737a10c9253b04174f25881e562da5b8
full diff: ed371f2e16...196b9ba873
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: c990c680b6...6d18c012ae
execute "docker run -it {image name} /bin/sh" no response on mip64el platform;
EpollEvent struct define lack a field named PadFd;
add the field "PadFd";
execute docker run -it {image} /bin/sh for test after rebuilded.
Signed-off-by: liuxiaodong <liuxiaodong@loongson.cn>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
updates golang.org/x/sys to 90868a75fefd03942536221d7c0e2f84ec62a668, which
adds support for building on windows/arm.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We can do that now as we're no longer carrying archive/tar.
Note that latest vndr removes vendor/ subdir so we don't have to,
thus the change in hack/validate/vendor.
While at it, re-run a new vndr version to make sure everything
that should be there is.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Update golang.org/x/sys to 95c6576299259db960f6c5b9b69ea52422860fce in
order to get the unix.Utsname with byte array instead of int8/uint8
members.
This allows to use simple byte slice to string conversions instead of
using charsToString or its open-coded version.
Also see golang/go#20753 for details.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Update golang.org/x/sys to 8dbc5d05d6edcc104950cc299a1ce6641235bc86 in
order to get the Major, Minor and Mkdev functions for every unix-like
OS. Use them instead of the locally defined versions which currently use
the Linux specific device major/minor encoding.
This means that the device number should now be properly encoded on e.g.
Darwin, FreeBSD or Solaris.
Also, the SIGUNUSED constant was removed from golang.org/x/sys/unix in
https://go-review.googlesource.com/61771 as it is also removed from the
respective glibc headers.
Remove it from signal.SignalMap as well after the golang.org/x/sys
re-vendoring.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Update golang.org/x/sys to 07c182904dbd53199946ba614a412c61d3c548f5 in
order to get the newly added Windows event functions which will be used
in successive commits.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Update golang.org/x/sys to 739734461d1c916b6c72a63d7efda2b27edb369f in
order to get the Lgetxattr, Llistxattr, Lremovexattr and Lsetxattr
syscall wrappers. These will be used in a successive commit to replace
the wrappers in libcontainer/system/xattr_linux.go.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
This bumps vndr to 9909bb2b8a0b7ea464527b376dc50389c90df587
and revendors dependencies.
Includes a change that prunes go files with `+build ignore`
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* run latest vndr so as to collect more LICENSE files
* remove unused packages
* vendor github.com/philhofer/fwd with LICENSE.md (MIT)
* vendor github.com/bsphere/le_go with LICENSE (MIT)
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
