Skip to content
This repository was archived by the owner on Apr 8, 2025. It is now read-only.

Commit 387fb2b

Browse files
garylouggaryloug
authored
Merge pull request #57 from przemeklal/static_analysis_and_hardening
fix static analysis errors and build hardened binary
2 parents 6e9ee3a + f124834 commit 387fb2b

File tree

8 files changed

+41
-39
lines changed

8 files changed

+41
-39
lines changed

Diff for: ‎build-args

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
go build -o hardened-binary -buildmode=pie -ldflags "-s -w -extldflags=-Wl,-z,now,-z,relro" userspace/userspace.go

Diff for: ‎docker/dpdk-app-centos/Dockerfile

+6-4
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@
44

55

66
# -------- Builder stage.
7-
FROM centos
8-
MAINTAINER Billy McFall <[email protected]>
7+
FROM centos:7
98

109
#
1110
# Install required packages
1211
#
12+
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
13+
14+
1315
RUN rpm --import https://mirror.go-repo.io/centos/RPM-GPG-KEY-GO-REPO && curl -s https://mirror.go-repo.io/centos/go-repo.repo | tee /etc/yum.repos.d/go-repo.repo
1416
RUN yum groupinstall -y "Development Tools"
1517
RUN yum install -y wget numactl-devel git golang make; yum clean all
@@ -20,7 +22,7 @@ RUN yum install -y wget numactl-devel git golang make; yum clean all
2022
# Download and Build APP-NetUtil
2123
#
2224
WORKDIR /root/go/src/
23-
RUN go get github.com/openshift/app-netutil 2>&1 > /tmp/UserspaceDockerBuild.log || echo "Can ignore no GO files."
25+
RUN go get github.com/openshift/app-netutil > /tmp/UserspaceDockerBuild.log 2>&1 || echo "Can ignore no GO files."
2426
WORKDIR /root/go/src/github.com/openshift/app-netutil
2527
RUN make c_sample
2628
RUN cp bin/libnetutil_api.so /lib64/libnetutil_api.so; cp bin/libnetutil_api.h /usr/include/libnetutil_api.h
@@ -31,7 +33,7 @@ RUN cp bin/libnetutil_api.so /lib64/libnetutil_api.so; cp bin/libnetutil_api.h /
3133
ENV DPDK_VER 19.08
3234
ENV DPDK_DIR /usr/src/dpdk-${DPDK_VER}
3335
WORKDIR /usr/src/
34-
RUN wget http://fast.dpdk.org/rel/dpdk-${DPDK_VER}.tar.xz
36+
RUN curl --output dpdk-${DPDK_VER}.tar.xz http://fast.dpdk.org/rel/dpdk-${DPDK_VER}.tar.xz
3537
RUN tar -xpvf dpdk-${DPDK_VER}.tar.xz
3638

3739
ENV RTE_TARGET=x86_64-native-linuxapp-gcc

Diff for: ‎docker/vpp-centos-userspace-cni/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,9 @@
55

66

77
# -------- Builder stage.
8-
FROM centos
9-
MAINTAINER Billy McFall <[email protected]>
8+
FROM centos:7
9+
10+
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
1011

1112
# Install VPP - Needed by CNI-VPP
1213
RUN curl -s https://packagecloud.io/install/repositories/fdio/release/script.rpm.sh | bash
@@ -23,7 +24,7 @@ RUN yum install -y git golang make
2324

2425
# Build the usrsp-app
2526
WORKDIR /root/go/src/
26-
RUN go get github.com/intel/userspace-cni-network-plugin 2>&1 > /tmp/UserspaceDockerBuild.log || echo "Can ignore no GO files."
27+
RUN go get github.com/intel/userspace-cni-network-plugin > /tmp/UserspaceDockerBuild.log 2>&1 || echo "Can ignore no GO files."
2728
WORKDIR /root/go/src/github.com/intel/userspace-cni-network-plugin
2829
RUN make extras
2930
RUN cp docker/usrsp-app/usrsp-app /usr/sbin/usrsp-app
@@ -61,5 +62,5 @@ COPY vppcni.sh vppcni.sh
6162
#COPY usrsp-app /usr/sbin/usrsp-app
6263

6364

64-
CMD bash -C './vppcni.sh'
65+
CMD ["bash", "-C", "./vppcni.sh"]
6566
#CMD [ "./vppcni.sh" ]

Diff for: ‎hardened-binary

30.1 MB
Binary file not shown.

Diff for: ‎scripts/.usrsp-docker-run.sh.swp

12 KB
Binary file not shown.

Diff for: ‎scripts/dpdk-docker-run.sh

+7-7
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,17 @@
1313
#
1414

1515
scriptpath=$GOPATH/src/github.com/containernetworking/cni/scripts
16-
echo $scriptpath
16+
echo "$scriptpath"
1717

18-
contid=$(docker run -d --net=none $@ /bin/sleep 10000000)
19-
pid=$(docker inspect -f '{{ .State.Pid }}' $contid)
18+
contid=$(docker run -d --net=none "$@" /bin/sleep 10000000)
19+
pid=$(docker inspect -f '{{ .State.Pid }}' "$contid")
2020
netnspath=/proc/$pid/ns/net
2121

22-
$scriptpath/exec-plugins.sh add $contid $netnspath
22+
"$scriptpath"/exec-plugins.sh add "$contid" "$netnspath"
2323

2424
function cleanup() {
25-
$scriptpath/exec-plugins.sh del $contid $netnspath
26-
docker rm -f $contid >/dev/null
25+
"$scriptpath"/exec-plugins.sh del "$contid" "$netnspath"
26+
docker rm -f "$contid" >/dev/null
2727
}
2828
trap cleanup EXIT
2929

@@ -35,7 +35,7 @@ trucContid=${contid:0:12}
3535
docker run -i -t -v /var/lib/cni/usrspcni/shared:/var/lib/cni/usrspcni/shared:rw \
3636
-v /dev/hugepages:/dev/hugepages \
3737
dpdk-app-testpmd testpmd -l 0-1 -n 4 -m 1024 --no-pci \
38-
--vdev=virtio_user0,path=/var/lib/cni/usrspcni/shared/$trucContid-eth0 \
38+
--vdev=virtio_user0,path=/var/lib/cni/usrspcni/shared/"$trucContid"-eth0 \
3939
--file-prefix=container \
4040
-- -i --txqflags=0xf00 --disable-hw-vlan --port-topology=chained
4141

Diff for: ‎scripts/usrsp-docker-run.sh

+8-8
Original file line numberDiff line numberDiff line change
@@ -17,23 +17,23 @@
1717
#
1818

1919
scriptpath=$GOPATH/src/github.com/containernetworking/cni/scripts
20-
echo $scriptpath
20+
echo "$scriptpath"
2121

22-
contid=$(docker run -d --net=none $@ /bin/sleep 10000000)
23-
pid=$(docker inspect -f '{{ .State.Pid }}' $contid)
22+
contid=$(docker run -d --net=none "$@" /bin/sleep 10000000)
23+
pid=$(docker inspect -f '{{ .State.Pid }}' "$contid")
2424
netnspath=/proc/$pid/ns/net
2525

26-
$scriptpath/exec-plugins.sh add $contid $netnspath
26+
"$scriptpath"/exec-plugins.sh add "$contid" "$netnspath"
2727

2828
function cleanup() {
29-
$scriptpath/exec-plugins.sh del $contid $netnspath
30-
docker rm -f $contid >/dev/null
29+
"$scriptpath"/exec-plugins.sh del "$contid" "$netnspath"
30+
docker rm -f "$contid" >/dev/null
3131
}
3232
trap cleanup EXIT
3333

3434
docker run \
3535
-v /var/lib/cni/usrspcni/shared:/var/lib/cni/usrspcni/shared:rw \
36-
-v /var/lib/cni/usrspcni/$contid:/var/lib/cni/usrspcni/data:rw \
36+
-v /var/lib/cni/usrspcni/"$contid":/var/lib/cni/usrspcni/data:rw \
3737
--device=/dev/hugepages:/dev/hugepages \
38-
--net=container:$contid $@
38+
--net=container:"$contid" "$@"
3939

Diff for: ‎usrspcni/usrspcni.go

+14-16
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ import (
1919
"k8s.io/client-go/kubernetes"
2020

2121
"github.com/containernetworking/cni/pkg/skel"
22-
_ "github.com/containernetworking/cni/pkg/types"
2322
"github.com/containernetworking/cni/pkg/types/current"
2423

2524
"github.com/intel/userspace-cni-network-plugin/pkg/types"
@@ -30,22 +29,21 @@ import (
3029
//
3130
type UsrSpCni interface {
3231
AddOnHost(conf *types.NetConf,
33-
args *skel.CmdArgs,
34-
kubeClient kubernetes.Interface,
35-
sharedDir string,
36-
ipResult *current.Result) error
32+
args *skel.CmdArgs,
33+
kubeClient kubernetes.Interface,
34+
sharedDir string,
35+
ipResult *current.Result) error
3736
AddOnContainer(conf *types.NetConf,
38-
args *skel.CmdArgs,
39-
kubeClient kubernetes.Interface,
40-
sharedDir string,
41-
pod *v1.Pod,
42-
ipResult *current.Result) (*v1.Pod, error)
37+
args *skel.CmdArgs,
38+
kubeClient kubernetes.Interface,
39+
sharedDir string,
40+
pod *v1.Pod,
41+
ipResult *current.Result) (*v1.Pod, error)
4342
DelFromHost(conf *types.NetConf,
44-
args *skel.CmdArgs,
45-
sharedDir string) error
43+
args *skel.CmdArgs,
44+
sharedDir string) error
4645
DelFromContainer(conf *types.NetConf,
47-
args *skel.CmdArgs,
48-
sharedDir string,
49-
pod *v1.Pod) error
46+
args *skel.CmdArgs,
47+
sharedDir string,
48+
pod *v1.Pod) error
5049
}
51-

0 commit comments

Comments
 (0)