kubernetes: Backport fix for CVE-2021-25735 and CVE-2021-25737

Upstream-commit:
https://github.com/kubernetes/kubernetes/commit/e612ebfdff22e4bd27ad8345f7c82f074bfedf26
&
https://github.com/kubernetes/kubernetes/commit/d57f0641d60b73934ebc2cdf4b6a63182217d10c
& https://github.com/kubernetes/kubernetes/commit/901e8e07e1f031456ecd7fefce965aaa05916825

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 128 insertions, 0 deletions

diff --git a/recipes-containers/kubernetes/kubernetes/CVE-2021-25737.patch b/recipes-containers/kubernetes/kubernetes/CVE-2021-25737.patch
new file mode 100644
index 00000000..d1a97971
--- /dev/null
+++ b/recipes-containers/kubernetes/kubernetes/CVE-2021-25737.patch
@@ -0,0 +1,128 @@
+From 901e8e07e1f031456ecd7fefce965aaa05916825 Mon Sep 17 00:00:00 2001
+From: Rob Scott <robertjscott@google.com>
+Date: Fri, 9 Apr 2021 15:24:17 -0700
+Subject: [PATCH] Updating EndpointSlice validation to match Endpoints
+ validation
+
+Upstream-Status: Backport [https://github.com/kubernetes/kubernetes/commit/901e8e07e1f031456ecd7fefce965aaa05916825]
+CVE: CVE-2021-25737
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ pkg/apis/core/validation/validation.go        | 18 ++++++----
+ pkg/apis/discovery/validation/validation.go   |  2 ++
+ .../discovery/validation/validation_test.go   | 34 +++++++++++++++++--
+ 3 files changed, 45 insertions(+), 9 deletions(-)
+
+diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go
+index 3daeb139d590d..c65cdd40f9061 100644
+--- a/src/import/pkg/apis/core/validation/validation.go
++++ b/src/import/pkg/apis/core/validation/validation.go
+@@ -4014,7 +4014,7 @@ func ValidateService(service *core.Service, allowAppProtocol bool) field.ErrorLi
+                                allErrs = append(allErrs, field.Invalid(idxPath, ip, msgs[i]))
+                        }
+                } else {
+-                       allErrs = append(allErrs, validateNonSpecialIP(ip, idxPath)...)
++                       allErrs = append(allErrs, ValidateNonSpecialIP(ip, idxPath)...)
+                }
+        }
+ 
+@@ -5572,15 +5572,19 @@ func validateEndpointAddress(address *core.EndpointAddress, fldPath *field.Path)
+                        allErrs = append(allErrs, field.Invalid(fldPath.Child("nodeName"), *address.NodeName, msg))
+                }
+        }
+-       allErrs = append(allErrs, validateNonSpecialIP(address.IP, fldPath.Child("ip"))...)
++       allErrs = append(allErrs, ValidateNonSpecialIP(address.IP, fldPath.Child("ip"))...)
+        return allErrs
+ }
+ 
+-func validateNonSpecialIP(ipAddress string, fldPath *field.Path) field.ErrorList {
+-       // We disallow some IPs as endpoints or external-ips.  Specifically,
+-       // unspecified and loopback addresses are nonsensical and link-local
+-       // addresses tend to be used for node-centric purposes (e.g. metadata
+-       // service).
++// ValidateNonSpecialIP is used to validate Endpoints, EndpointSlices, and
++// external IPs. Specifically, this disallows unspecified and loopback addresses
++// are nonsensical and link-local addresses tend to be used for node-centric
++// purposes (e.g. metadata service).
++//
++// IPv6 references
++// - https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
++// - https://www.iana.org/assignments/ipv6-multicast-addresses/ipv6-multicast-addresses.xhtml
++func ValidateNonSpecialIP(ipAddress string, fldPath *field.Path) field.ErrorList {
+        allErrs := field.ErrorList{}
+        ip := net.ParseIP(ipAddress)
+        if ip == nil {
+diff --git a/pkg/apis/discovery/validation/validation.go b/pkg/apis/discovery/validation/validation.go
+index 810f2ca124d57..3aa5128359d7f 100644
+--- a/src/import/pkg/apis/discovery/validation/validation.go
++++ b/src/import/pkg/apis/discovery/validation/validation.go
+@@ -103,8 +103,10 @@ func validateEndpoints(endpoints []discovery.Endpoint, addrType discovery.Addres
+                                }
+                        case discovery.AddressTypeIPv4:
+                                allErrs = append(allErrs, validation.IsValidIPv4Address(addressPath.Index(i), address)...)
++                               allErrs = append(allErrs, apivalidation.ValidateNonSpecialIP(address, addressPath.Index(i))...)
+                        case discovery.AddressTypeIPv6:
+                                allErrs = append(allErrs, validation.IsValidIPv6Address(addressPath.Index(i), address)...)
++                               allErrs = append(allErrs, apivalidation.ValidateNonSpecialIP(address, addressPath.Index(i))...)
+                        case discovery.AddressTypeFQDN:
+                                allErrs = append(allErrs, validation.IsFullyQualifiedDomainName(addressPath.Index(i), address)...)
+                        }
+diff --git a/pkg/apis/discovery/validation/validation_test.go b/pkg/apis/discovery/validation/validation_test.go
+index 060545f93ab31..3c8a5465128a9 100644
+--- a/src/import/pkg/apis/discovery/validation/validation_test.go
++++ b/src/import/pkg/apis/discovery/validation/validation_test.go
+@@ -390,7 +390,7 @@ func TestValidateEndpointSlice(t *testing.T) {
+                        },
+                },
+                "bad-ipv4": {
+-                       expectedErrors: 2,
++                       expectedErrors: 3,
+                        endpointSlice: &discovery.EndpointSlice{
+                                ObjectMeta:  standardMeta,
+                                AddressType: discovery.AddressTypeIPv4,
+@@ -405,7 +405,7 @@ func TestValidateEndpointSlice(t *testing.T) {
+                        },
+                },
+                "bad-ipv6": {
+-                       expectedErrors: 2,
++                       expectedErrors: 4,
+                        endpointSlice: &discovery.EndpointSlice{
+                                ObjectMeta:  standardMeta,
+                                AddressType: discovery.AddressTypeIPv6,
+@@ -454,6 +454,36 @@ func TestValidateEndpointSlice(t *testing.T) {
+                        expectedErrors: 3,
+                        endpointSlice:  &discovery.EndpointSlice{},
+                },
++               "special-ipv4": {
++                       expectedErrors: 1,
++                       endpointSlice: &discovery.EndpointSlice{
++                               ObjectMeta:  standardMeta,
++                               AddressType: discovery.AddressTypeIPv4,
++                               Ports: []discovery.EndpointPort{{
++                                       Name:     utilpointer.StringPtr("http"),
++                                       Protocol: protocolPtr(api.ProtocolTCP),
++                               }},
++                               Endpoints: []discovery.Endpoint{{
++                                       Addresses: []string{"127.0.0.1"},
++                                       Hostname:  utilpointer.StringPtr("valid-123"),
++                               }},
++                       },
++               },
++               "special-ipv6": {
++                       expectedErrors: 1,
++                       endpointSlice: &discovery.EndpointSlice{
++                               ObjectMeta:  standardMeta,
++                               AddressType: discovery.AddressTypeIPv6,
++                               Ports: []discovery.EndpointPort{{
++                                       Name:     utilpointer.StringPtr("http"),
++                                       Protocol: protocolPtr(api.ProtocolTCP),
++                               }},
++                               Endpoints: []discovery.Endpoint{{
++                                       Addresses: []string{"fe80::9656:d028:8652:66b6"},
++                                       Hostname:  utilpointer.StringPtr("valid-123"),
++                               }},
++                       },
++               },
+        }
+ 
+        for name, testCase := range testCases {