Skip to content

Commit 6fecfcd

Browse files
ausphamCopilot
auspham
and
Copilot
committed
fix: cherry-pick docker-ptf security fixes from sonic-net#26676
Cherry-pick e60cdf2 to bring Go 1.25.9, go-jose/v4, otel/sdk, aws-sdk-go-v2/s3 upgrades and gocloud-patches to 202411 branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Austin Pham (agent) <austinpham@microsoft.com>
1 parent 7fa5f82 commit 6fecfcd

3 files changed

Lines changed: 105 additions & 5 deletions

File tree

‎dockers/docker-ptf/Dockerfile.j2‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -104,13 +104,17 @@ RUN apt-get update \
104104
# to ensure they use a patched Go stdlib (GO-2026-4337: crypto/tls)
105105
{% if CONFIGURED_ARCH == "armhf" %}
106106
RUN GO_ARCH=armv6l \
107+
&& GO_SHA256=7d4f0d266d871301e08ef4ac31c56e66048688893b2848392e5c600276351ee8 \
107108
{% elif CONFIGURED_ARCH == "arm64" %}
108109
RUN GO_ARCH=arm64 \
110+
&& GO_SHA256=ec342e7389b7f489564ed5463c63b16cf8040023dabc7861256677165a8c0e2b \
109111
{% else %}
110112
RUN GO_ARCH=amd64 \
113+
&& GO_SHA256=00859d7bd6defe8bf84d9db9e57b9a4467b2887c18cd93ae7460e713db774bc1 \
111114
{% endif %}
112-
&& GO_VERSION=1.25.8 \
115+
&& GO_VERSION=1.25.9 \
113116
&& curl -L "https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" -o /tmp/go.tar.gz \
117+
&& echo "${GO_SHA256} /tmp/go.tar.gz" | sha256sum -c - \
114118
&& tar -C /usr/local -xzf /tmp/go.tar.gz \
115119
&& rm /tmp/go.tar.gz
116120

@@ -122,12 +126,14 @@ RUN GRPCURL_VERSION=v1.9.3 \
122126
&& git clone --depth 1 --branch "${GRPCURL_VERSION}" https://github.com/fullstorydev/grpcurl.git /tmp/grpcurl \
123127
&& cd /tmp/grpcurl \
124128
&& go get google.golang.org/grpc@v1.79.3 \
129+
&& go get github.com/go-jose/go-jose/v4@latest \
125130
&& go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest \
126131
&& go mod tidy \
127132
&& go build -o /usr/local/bin/grpcurl ./cmd/grpcurl \
128133
&& chmod +x /usr/local/bin/grpcurl \
129-
&& rm -rf /tmp/grpcurl
134+
&& rm -rf /tmp/grpcurl /root/go/pkg/mod /root/.cache/go-build
130135
# Security fixes: upgrade all vulnerable system packages (S360 scan remediation)
136+
# Covers CVE-2026-33416 and CVE-2026-33636 (libpng16-16) among others
131137
RUN apt-get update && apt-get upgrade -y \
132138
&& rm -rf /var/lib/apt/lists/*
133139
{% if PTF_ENV_PY_VER == "py3" %}
@@ -358,27 +364,35 @@ RUN git clone https://github.com/karimra/gnoic.git \
358364
&& git checkout 27bc5a6 \
359365
&& go get google.golang.org/grpc@v1.79.3 \
360366
&& go get github.com/go-viper/mapstructure/v2@v2.4.0 \
367+
&& go get github.com/go-jose/go-jose/v4@latest \
361368
&& go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest \
362369
&& go mod tidy \
363370
&& go build -o /usr/local/bin/gnoic . \
364371
&& cd .. \
365-
&& rm -rf gnoic
372+
&& rm -rf gnoic /root/go/pkg/mod /root/.cache/go-build
366373

367374
# Build gnmic from source with upgraded deps to address known CVEs
375+
COPY gocloud-patches/ /tmp/gocloud-patches/
368376
RUN GNMIC_VERSION=v0.43.0 \
369377
&& git clone --depth 1 --branch "${GNMIC_VERSION}" https://github.com/openconfig/gnmic.git /tmp/gnmic \
370378
&& cd /tmp/gnmic \
371379
&& go get google.golang.org/grpc@v1.79.3 \
372380
&& go get github.com/cloudflare/circl@v1.6.3 \
373381
&& go get github.com/go-git/go-git/v5@latest \
374382
&& go get github.com/nats-io/nats-server/v2@latest \
375-
&& go get go.opentelemetry.io/otel/sdk@v1.40.0 \
383+
&& go get go.opentelemetry.io/otel/sdk@latest \
376384
&& go get github.com/docker/docker@latest \
385+
&& go get github.com/go-jose/go-jose/v4@latest \
386+
&& go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@latest github.com/aws/aws-sdk-go-v2/service/s3@latest github.com/aws/aws-sdk-go-v2/feature/s3/manager@latest \
377387
&& go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest \
388+
&& go get gocloud.dev@v0.25.1-0.20220408200107-09b10f7359f7 \
378389
&& go mod tidy \
390+
&& GOCLOUD_DIR="$(go list -m -f '{{ '{{' }}.Dir{{ '}}' }}' gocloud.dev)" \
391+
&& chmod -R +w "$GOCLOUD_DIR" \
392+
&& patch --forward -d "$GOCLOUD_DIR" -p1 < /tmp/gocloud-patches/0001-fix-aws-sdk-go-v2-pointer-api-changes.patch \
379393
&& go build -o /usr/local/bin/gnmic . \
380394
&& chmod +x /usr/local/bin/gnmic \
381-
&& rm -rf /tmp/gnmic
395+
&& rm -rf /tmp/gnmic /tmp/gocloud-patches /root/go/pkg/mod /root/.cache/go-build
382396

383397
COPY \
384398
{% for deb in docker_ptf_debs.split(' ') -%}

‎dockers/docker-ptf/gocloud-patches/0001-fix-aws-sdk-go-v2-pointer-api-changes.patch‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
--- a/blob/s3blob/s3blob.go 2026-04-09 22:48:10.700372961 +0000
2+
+++ b/blob/s3blob/s3blob.go 2026-04-09 22:48:19.654602364 +0000
3+
@@ -399,7 +399,7 @@
4+
if b.useV2 {
5+
in := &s3v2.ListObjectsV2Input{
6+
Bucket: aws.String(b.name),
7+
- MaxKeys: int32(pageSize),
8+
+ MaxKeys: aws.Int32(int32(pageSize)),
9+
}
10+
if len(opts.PageToken) > 0 {
11+
in.ContinuationToken = aws.String(string(opts.PageToken))
12+
@@ -425,7 +425,7 @@
13+
page.Objects[i] = &driver.ListObject{
14+
Key: unescapeKey(aws.StringValue(obj.Key)),
15+
ModTime: *obj.LastModified,
16+
- Size: obj.Size,
17+
+ Size: aws.Int64Value(obj.Size),
18+
MD5: eTagToMD5(obj.ETag),
19+
AsFunc: func(i interface{}) bool {
20+
p, ok := i.(*typesv2.Object)
21+
@@ -576,7 +576,7 @@
22+
var nextContinuationToken *string
23+
if legacyResp.NextMarker != nil {
24+
nextContinuationToken = legacyResp.NextMarker
25+
- } else if legacyResp.IsTruncated {
26+
+ } else if aws.BoolValue(legacyResp.IsTruncated) {
27+
nextContinuationToken = aws.String(aws.StringValue(legacyResp.Contents[len(legacyResp.Contents)-1].Key))
28+
}
29+
return &s3v2.ListObjectsV2Output{
30+
@@ -706,7 +706,7 @@
31+
Metadata: md,
32+
// CreateTime not supported; left as the zero time.
33+
ModTime: aws.TimeValue(resp.LastModified),
34+
- Size: resp.ContentLength,
35+
+ Size: aws.Int64Value(resp.ContentLength),
36+
MD5: eTagToMD5(resp.ETag),
37+
ETag: aws.StringValue(resp.ETag),
38+
AsFunc: func(i interface{}) bool {
39+
@@ -803,7 +803,7 @@
40+
attrs: driver.ReaderAttributes{
41+
ContentType: aws.StringValue(resp.ContentType),
42+
ModTime: aws.TimeValue(resp.LastModified),
43+
- Size: getSize(resp.ContentLength, aws.StringValue(resp.ContentRange)),
44+
+ Size: getSize(aws.Int64Value(resp.ContentLength), aws.StringValue(resp.ContentRange)),
45+
},
46+
rawV2: resp,
47+
}, nil

‎dockers/docker-ptf/openbfdd-patches/broken-build-bookworm.patch‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
diff --git a/Logger.cpp b/Logger.cpp
2+
index f375b20..6777d14 100755
3+
--- a/Logger.cpp
4+
+++ b/Logger.cpp
5+
@@ -11,6 +11,9 @@
6+
#include <errno.h>
7+
#include <string.h>
8+
#include <unistd.h>
9+
+#include <pthread.h>
10+
+#include <time.h>
11+
+#include <ctime>
12+
13+
const size_t Logger::MaxMessageLen;
14+
15+
diff --git a/SchedulerBase.cpp b/SchedulerBase.cpp
16+
index 3eab298..554e6cb 100755
17+
--- a/SchedulerBase.cpp
18+
+++ b/SchedulerBase.cpp
19+
@@ -11,6 +11,7 @@
20+
#include <fcntl.h>
21+
#include <string.h>
22+
#include <unistd.h>
23+
+#include <pthread.h>
24+
25+
using namespace std;
26+
27+
diff --git a/utils.cpp b/utils.cpp
28+
index 79c7b68..02d1ea3 100755
29+
--- a/utils.cpp
30+
+++ b/utils.cpp
31+
@@ -13,6 +13,8 @@
32+
#include <sys/stat.h>
33+
#include <sys/param.h>
34+
#include <sys/socket.h>
35+
+#include <pthread.h>
36+
+#include <time.h>
37+
38+
using namespace std;
39+

0 commit comments

Comments
 (0)