K8S 生态周报| 深入源码剖析 Kubernetes 的漏洞

 fn := func() error {
  restClient, err := restclient.RESTClientFor(p.Config)
  if err != nil {
   return err
  }

  // TODO: consider abstracting into a client invocation or client helper
  req := restClient.Post().
   Resource("pods").
   Name(pod.Name).
   Namespace(pod.Namespace).
   SubResource("exec")
  req.VersionedParams(&corev1.PodExecOptions{
   Container: containerName,
   Command:   p.Command,
   Stdin:     p.Stdin,
   Stdout:    p.Out != nil,
   Stderr:    p.ErrOut != nil,
   TTY:       t.Raw,
  }, scheme.ParameterCodec)

  return p.Executor.Execute("POST", req.URL(), p.Config, p.In, p.Out, p.ErrOut, t.Raw, sizeQueue)
 }

func ExecLocation(
 ctx context.Context,
 getter ResourceGetter,
 connInfo client.ConnectionInfoGetter,
 name string,
 opts *api.PodExecOptions,
) (*url.URL, http.RoundTripper, error) {
 return streamLocation(ctx, getter, connInfo, name, opts, opts.Container, "exec")
}

container, err = validateContainer(container, pod)
 if err != nil {
  return nil, nil, err
 }

 nodeName := types.NodeName(pod.Spec.NodeName)
 if len(nodeName) == 0 {
  // If pod has not been assigned a host, return an empty location
  return nil, nil, errors.NewBadRequest(fmt.Sprintf("pod %s does not have a host assigned", name))
 }
 nodeInfo, err := connInfo.GetConnectionInfo(ctx, nodeName)
 if err != nil {
  return nil, nil, err
 }
 params := url.Values{}
 if err := streamParams(params, opts); err != nil {
  return nil, nil, err
 }
 loc := &url.URL{
  Scheme:   nodeInfo.Scheme,
  Host:     net.JoinHostPort(nodeInfo.Hostname, nodeInfo.Port),
  Path:     fmt.Sprintf("/%s/%s/%s/%s", path, pod.Namespace, pod.Name, container),
  RawQuery: params.Encode(),
 }
 return loc, nodeInfo.Transport, nil

func ResourceLocation(getter ResourceGetter, connection client.ConnectionInfoGetter, proxyTransport http.RoundTripper, ctx context.Context, id string) (*url.URL, http.RoundTripper, error) {
 schemeReq, name, portReq, valid := utilnet.SplitSchemeNamePort(id)
 if !valid {
  return nil, nil, errors.NewBadRequest(fmt.Sprintf("invalid node request %q", id))
 }
 info, err := connection.GetConnectionInfo(ctx, types.NodeName(name))
 if err != nil {
  return nil, nil, err
 }

+   if err := proxyutil.IsProxyableHostname(ctx, &net.Resolver{}, info.Hostname); err != nil {
+       return nil, nil, errors.NewBadRequest(err.Error())
+   }

 // We check if we want to get a default Kubelet's transport. It happens if either:
 // - no port is specified in request (Kubelet's port is default)
 // - the requested port matches the kubelet port for this node
 if portReq == "" || portReq == info.Port {
  return &url.URL{
    Scheme: info.Scheme,
    Host:   net.JoinHostPort(info.Hostname, info.Port),
   },
   info.Transport,
   nil
 }

-   if err := proxyutil.IsProxyableHostname(ctx, &net.Resolver{}, info.Hostname); err != nil {
-       return nil, nil, errors.NewBadRequest(err.Error())
-   }

 // Otherwise, return the requested scheme and port, and the proxy transport
 return &url.URL{Scheme: schemeReq, Host: net.JoinHostPort(info.Hostname, portReq)}, proxyTransport, nil
}