new file mode 100644

@@ -0,0 +1,75 @@

+commit 0535bcef95a33855f0a722c8cd822c663fc6275e

+Author: Jordan Liggitt <liggitt@google.com>

+Date:   Mon Nov 5 23:50:35 2018 -0500

+

+    Verify backend upgraded connection

+

+diff --git a/staging/src/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go b/staging/src/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go

+index 2bc1965..01d6b85 100644

+--- a/staging/src/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go

+@@ -17,6 +17,7 @@ limitations under the License.

+ package proxy

+ 

+ import (

++	"bufio"

+ 	"bytes"

+ 	"context"

+ 	"fmt"

+@@ -270,6 +271,18 @@ func (h *UpgradeAwareHandler) tryUpgrade(w http.ResponseWriter, req *http.Reques

+ 	}

+ 	defer backendConn.Close()

+ 

++	// determine the http response code from the backend by reading from rawResponse+backendConn

++	rawResponseCode, headerBytes, err := getResponseCode(io.MultiReader(bytes.NewReader(rawResponse), backendConn))

++	if err != nil {

++		glog.V(6).Infof("Proxy connection error: %v", err)

++		h.Responder.Error(w, req, err)

++		return true

++	}

++	if len(headerBytes) > len(rawResponse) {

++		// we read beyond the bytes stored in rawResponse, update rawResponse to the full set of bytes read from the backend

++		rawResponse = headerBytes

++	}

++

+ 	// Once the connection is hijacked, the ErrorResponder will no longer work, so

+ 	// hijacking should be the last step in the upgrade.

+ 	requestHijacker, ok := w.(http.Hijacker)

+@@ -294,6 +307,17 @@ func (h *UpgradeAwareHandler) tryUpgrade(w http.ResponseWriter, req *http.Reques

+ 		}

+ 	}

+ 

++	if rawResponseCode != http.StatusSwitchingProtocols {

++		// If the backend did not upgrade the request, finish echoing the response from the backend to the client and return, closing the connection.

++		glog.V(6).Infof("Proxy upgrade error, status code %d", rawResponseCode)

++		_, err := io.Copy(requestHijackedConn, backendConn)

++		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {

++			glog.Errorf("Error proxying data from backend to client: %v", err)

++		}

++		// Indicate we handled the request

++		return true

++	}

++

+ 	// Proxy the connection.

+ 	wg := &sync.WaitGroup{}

+ 	wg.Add(2)

+@@ -345,6 +369,19 @@ func (h *UpgradeAwareHandler) DialForUpgrade(req *http.Request) (net.Conn, error

+ 	return dial(updatedReq, h.UpgradeTransport)

+ }

+ 

++// getResponseCode reads a http response from the given reader, returns the status code,

++// the bytes read from the reader, and any error encountered

++func getResponseCode(r io.Reader) (int, []byte, error) {

++	rawResponse := bytes.NewBuffer(make([]byte, 0, 256))

++	// Save the bytes read while reading the response headers into the rawResponse buffer

++	resp, err := http.ReadResponse(bufio.NewReader(io.TeeReader(r, rawResponse)), nil)

++	if err != nil {

++		return 0, nil, err

++	}

++	// return the http status code and the raw bytes consumed from the reader in the process

++	return resp.StatusCode, rawResponse.Bytes(), nil

++}

++

+ // dial dials the backend at req.URL and writes req to it.

+ func dial(req *http.Request, transport http.RoundTripper) (net.Conn, error) {

+ 	conn, err := DialURL(req.URL, transport)

@@ -1,7 +1,7 @@

 Summary:        Kubernetes cluster management

 Name:           kubernetes

 Version:        1.9.6

-Release:        1%{?dist}

+Release:        2%{?dist}

 License:        ASL 2.0

 URL:            https://github.com/kubernetes/kubernetes/archive/v%{version}.tar.gz

 Source0:        kubernetes-v%{version}.tar.gz

@@ -9,6 +9,7 @@ Source0:        kubernetes-v%{version}.tar.gz

 Source1:        https://github.com/kubernetes/contrib/archive/contrib-0.7.0.tar.gz

 %define sha1    contrib-0.7.0=47a744da3b396f07114e518226b6313ef4b2203c

 Patch0:         k8s-cascade.patch

+Patch1:         CVE-2018-1002105.patch

 Group:          Development/Tools

 Vendor:         VMware, Inc.

 Distribution:   Photon

@@ -49,6 +50,7 @@ tar xf %{SOURCE1} --no-same-owner

 sed -i -e 's|127.0.0.1:4001|127.0.0.1:2379|g' contrib-0.7.0/init/systemd/environ/apiserver

 cd %{name}-%{version}

 %patch0 -p1

+%patch1 -p1

 %build

 make

@@ -186,6 +188,8 @@ fi

 %{_bindir}/pause-amd64

 %changelog

+*   Thu Dec 20 2018 Ashwin H <ashwinh@vmware.com> 1.9.6-2

+-   Fix CVE-2018-1002105

 *   Fri May 18 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 1.9.6-1

 -   k8s v1.9.6 and Cascade Cloud Provider patch

 *   Tue Jan 30 2018 Ashok Chandrasekar <ashokc@vmware.com> 1.8.1-5