antrea

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Main branch: https://github.com/antrea-io/antrea/tree/main We also have release branches for cherry-picking patches.

Repository on GitHub, which uses git. git is distributed.

We use semantic versioning for release tagging. List of releases: https://github.com/antrea-io/antrea/releases. Documentation about our versioning policy: https://antrea.io/docs/main/versioning/.

We create a git tag for each new release. List of releases: https://github.com/antrea-io/antrea/releases. Documentation about our versioning policy: https://antrea.io/docs/main/versioning/.

https://github.com/antrea-io/antrea/tree/main/CHANGELOG

We haven't had CVEs for Antrea so far

https://antrea.io/docs/master/contributing/#filing-an-issue

We use the Github issue tracker: https://github.com/antrea-io/antrea/issues

Github issues search function: https://github.com/antrea-io/antrea/issues

https://github.com/antrea-io/antrea/security/policy

https://github.com/antrea-io/antrea/security/policy

No vulnerability report received yet for the project

Non-trivial build file in repository: https://github.com/antrea-io/antrea/blob/main/Makefile.

Non-trivial build file in repository: https://github.com/antrea-io/antrea/blob/main/Makefile.

The only required software to build the project are make and Docker (Community Edition is distributed under the Apache 2.0 license)

Go unit and integration tests: https://antrea.io/docs/master/contributing/#building-and-testing-your-change

golangci-lint to run common Go linters: https://github.com/antrea-io/antrea/blob/main/ci/README.md

https://antrea.io/docs/master/contributing/#building-and-testing-your-change

"make test-unit" to run the unit tests, or using "go test" directly

Instructions to run e2e tests: https://github.com/antrea-io/antrea/blob/main/test/e2e/README.md

Github actions for unit tests, integration tests and part of the e2e test suite: https://github.com/antrea-io/antrea/tree/main/.github/workflows

Jenkins for more advanced e2e tests (that require more time / compute resources): https://jenkins.antrea-ci.rocks/

The policy is in place and maintainers will not accept patches for new functionality without sufficient test coverage provided by the CI test suite. See https://antrea.io/docs/main/contributing/#getting-reviewers

Release notes include links to Github Pull Requests for all major changes since the last release. Pull Requests which add new functionality to the project must include test cases which will be run as part of the automated test suite.

Documented here: https://antrea.io/docs/main/contributing/#getting-reviewers. Description of the different categories of tests, with the purpose of each one, here: https://github.com/antrea-io/antrea/blob/main/ci/README.md#antrea-test-suite

Go tests are run with the "-race" flag top test for race conditions We use golangci-lint to run common Go linters: https://github.com/antrea-io/antrea/blob/main/ci/README.md (integrated as part of CI)

Linters are integrated with CI, PR cannot be merged until warnings are addressed

All warnings are enabled for linters

Several maintainers went through mandatory security training for developing secure software

Several maintainers went through mandatory security training for developing secure software

Antrea does not use cryptographic protocols and algorithms directly. However cryptographic capabilities are provided for the following:

1) Traffic between Kubernetes Nodes can be encrypted using IPsec. This is provided through Open vSwitch and strongSwan.

2) Control plane communication channels are secured using TLS. This is provided though the standard Go cryptographic libraries. If users do not provide their own certificate and private key, Antrea will ask the Kubernetes apiserver library to generate a certificate / key pair using the Go cryptographic libraries. An RSA key length of 2048 bits will be used.

While the Antrea code uses SHA1, which is vulnerable to attacks, SHA1 is not used for cryptography purposes, but is used to generate identifiers.

Antrea relies on strongSwan (https://www.strongswan.org/) and the standard Go cryptography libraries.

Antrea relies on strongSwan (https://www.strongswan.org/) and the standard Go cryptography libraries, which are FLOSS.

Antrea ships with a recent version of strongSwan, which uses IKEv2 IPsec connections by default, with the aes128-sha256-modp3072 cipher suite for IKE and the aes128-sha256 cipher suite for ESP, Note that it is possible for user to override the default configuration. The Pre-Shared Key (PKS) for the IPsec tunnels is provided by the user.

Control plane communications:

• The Kubernetes apiserver used by the Antrea Controller will by default use TLS 1.2, with a 2048-bit RSA key. The cipher suites used for TLS are the ones implemented by the Go cryptography libraries , excluding the ones with known security issues. The keylengths meet the NIST minimum requirements. Users may elect to provide their own certificate and RSA key for the Antrea Controller. No configuration parameter is provided for users to change the cipher suite used by the Antrea Controller apiserver.

• For connections from the Antrea components (Agent / Controller) to the Kubernetes apiserver instance, TLS is also used. The cluster administrator is free to configure the Kubernetes apiserver instance (kube-apiserver) as desired, and this is out-of-scope of Antrea. However, Antrea uses client-go (https://github.com/kubernetes/client-go) to connect to kube-apiserver, which requires TLS 1.2 or greater and restricts cipher suites to a secure list.

While the Antrea code uses SHA1 directly, which is vulnerable to attacks, SHA1 is not used for cryptography purposes, but is used to generate identifiers. The gosec linter (run as part of CI for every commit) flags direct uses of DES, RC4, MD5 or SHA1 in the Antrea code.

The TLS v1.2 implementation in the standard Go cryptography library does not use broken cryptographic algorithms by default. In particular cipher suites using RC4 are excluded by default. 3DES cipher suites are included.

We use a recent strongSwan version that defaults to the aes128-sha256-modp3072 cipher suite for IKE and the aes128-sha256 cipher suite for ESP. Given that both endpoints are configured by Antrea, these are the cipher suites that should be used, even if the charon daemon may include additional defaults.

See answer above for SHA1. CBC mode may be used in TLS cipher suites, but Antrea does not use SSH.

All authentication is delegated to the K8s apiserver instance.

When generating a self-signed certificate-key pair for the Antrea Controller, the K8s apiserver library invokes rsa.GenerateKey from the standard Go cryptography library (https://golang.org/pkg/crypto/rsa/#GenerateKey). The key is generated using a CSPRNG.

Antrea currently does not directly generate cryptographic key / nonces, but if we do, the gosec linter will warn if the "wrong" random generator is used (rand instead of crypto/rand).

Starting with Antrea v0.10.0, all assets are delivered securely, using a combination of the following mechanisms:

• Github release assets (https://github.com/antrea-io/antrea/releases) over HTTPS from github.com
• Dockerhub registry, which uses HTTPS
• HTTPS delivery from downloads.antrea.io (at the moment this is only used to publish OVS binaries for Windows, which can be used to run Antrea on Windows Kubernetes Nodes)

N/A

No security vulnerabilities have been reported yet for the project. We have a well-documented policy to report security issues: https://github.com/antrea-io/antrea/security/policy

See above. No security vulnerabilities have been reported yet for the project.

Enforced by code review and through the gosec tool (https://github.com/securego/gosec) which will flag suspected hard-coded credentials.

We use golangci-lint to run multiple linters as part of CI, and in particular the following ones: staticcheck (https://staticcheck.io/), go vet (https://golang.org/cmd/vet/) and gosec (https://github.com/securego/gosec). The complete list can be found here: https://github.com/antrea-io/antrea/blob/main/.golangci.yml.

We also use the LGTM code platform (from Semmle) to run CodeQL queries: https://lgtm.com/projects/g/antrea-io/antrea/?mode=list

Yes, this is the case for the tools mentioned above (LGTM, staticcheck, go vet, gosec)

Linters / static analysis tools are run before accepting any patch into the main branch. If any issue is reported, it will need to be addressed before the patch can be merged. The same tools are also run every time the main branch is updated and for every release.

Linters / static analysis tools are run before accepting any patch into the main branch.

The software is written in Go.

We are not running dynamic code analysis.