prometheus处理pprof漏洞

1. 以下步骤为构建docker镜像步骤
2. 所需个人镜像仓库（使用阿里云镜像）
3. 大部分操作为gitpod操作，可避免国内依赖安装失败

本地依赖安装

安装环境

yum install -y git 
yum install -y wget 
yum install -y go      # 版本在1.17及以上
yum install -y npm     # 版本在7及以上
yum install -y nodejs  # 版本在16及以上  官网安装地址：https://nodejs.org/zh-cn/download/package-manager
yum install -y  bzip2

开启\关闭模块支持

1、开启模块支持：
    export GO111MODULE=on          # 执行
2、关闭模块支持：
    export GO111MODULE=off

国内代理

1、七牛 CDN
    go env -w  GOPROXY=https://goproxy.cn,direct
2、阿里云
    go env -w GOPROXY=https://mirrors.aliyun.com/goproxy/,direct
3、官方
    go env -w  GOPROXY=https://goproxy.io,direct

下载go环境依赖

go mod download      # 1、服务器在国外  2、源代码中有go.mod 和 go.sum文件，所需依赖都在这2个文件中  3、go mod download 是拉取go环境所有的依赖  4、国内服务器拉取依赖和第3方库，要配置代理

说明：

1. 以上为本地国内所需依赖安装前提操作
2. 最简单方式为使用gitpod从互联网环境不需要安装依赖环境，可从github直接clone操作以下步骤

prometheus源码构建docker镜像

2.1 克隆仓库
gitpod ~ $ git clone https://github.com/prometheus/prometheus.git
Cloning into 'prometheus'...
remote: Enumerating objects: 135723, done.
remote: Counting objects: 100% (229/229), done.
remote: Compressing objects: 100% (166/166), done.
remote: Total 135723 (delta 148), reused 63 (delta 63), pack-reused 135494 (from 4)
Receiving objects: 100% (135723/135723), 253.46 MiB | 40.53 MiB/s, done.
Resolving deltas: 100% (83480/83480), done.

2.2 进入目录
gitpod ~ $ cd prometheus/

2.3 查询与pprof相关的文件
gitpod ~/prometheus (main) $ grep -r "pprof" ./*
...
./web/web.go:   "net/http/pprof"
./web/web.go:   if subpath == "/pprof" {
./web/web.go:   if !strings.HasPrefix(subpath, "/pprof/") {
./web/web.go:   subpath = strings.TrimPrefix(subpath, "/pprof/")
...

2.4 修改./web/web.go`(只修改web.go文件)`
 16 import (
 17         "bytes"
 23         "math"
 24         "net"
 25         "net/http"
 26         "net/http/pprof"   //删除/注释
 27         "net/url"
----------------------------------------------------------------------------以下内容全部注释/删除
566 func serveDebug(w http.ResponseWriter, req *http.Request) {
567         ctx := req.Context()
568         subpath := route.Param(ctx, "subpath")
569 
570         if subpath == "/pprof" {
571                 http.Redirect(w, req, req.URL.Path+"/", http.StatusMovedPermanently)
572                 return
573         }
574 
575         if !strings.HasPrefix(subpath, "/pprof/") {
576                 http.NotFound(w, req)
577                 return
578         }
579         subpath = strings.TrimPrefix(subpath, "/pprof/")
580 
581         switch subpath {
582         case "cmdline":
583                 pprof.Cmdline(w, req)
584         case "profile":
585                 pprof.Profile(w, req)
586         case "symbol":
587                 pprof.Symbol(w, req)
588         case "trace":
589                 pprof.Trace(w, req)
590         default:
591                 req.URL.Path = "/debug/pprof/" + subpath
592                 pprof.Index(w, req)
593         }
594 }

2.5 构建二进制文件
gitpod ~/prometheus (main) $ make build
cd web/ui && npm install
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
...

2.6 修改当前Dockerfile内容
原：
COPY .build/${OS}-${ARCH}/prometheus        /bin/prometheus
COPY .build/${OS}-${ARCH}/promtool          /bin/promtool
修改为：
COPY ./prometheus        /bin/prometheus
COPY ./promtool          /bin/promtool

2.7 构建镜像
gitpod ~/prometheus $ docker build -t registry.cn-hangzhou.aliyuncs.com/xx/xx:prometheus-pprof .

2.8 推送到个人仓库本地部署
gitpod ~/prometheus $ docker push registry.cn-hangzhou.aliyuncs.com/xx/xx:prometheus-pprof

alertmanager源码构建docker镜像

3.1 克隆仓库
gitpod ~ $ git clone https://github.com/prometheus/alertmanager.git
Cloning into 'alertmanager'...
remote: Enumerating objects: 29705, done.
remote: Counting objects: 100% (133/133), done.
remote: Compressing objects: 100% (106/106), done.
remote: Total 29705 (delta 107), reused 27 (delta 27), pack-reused 29572 (from 4)
Receiving objects: 100% (29705/29705), 42.68 MiB | 38.92 MiB/s, done.
Resolving deltas: 100% (16130/16130), done.

3.2 进入目录
gitpod ~ $ cd alertmanager/

3.3 查询与pprof相关的文件
gitpod ~/alertmanager (main) $ grep -r "pprof" ./*
./go.sum:github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod 
...
./ui/web.go:    _ "net/http/pprof" // Comment this line to disable pprof endpoint.

3.4 修改./ui/web.go文件
import (
        "fmt"
        "log/slog"
        "net/http"
        _ "net/http/pprof" // 删除/注释
        "path"
        
3.5 构建二进制文件
gitpod ~/alertmanager (main) $ make build
cd ui/react-app && npm install && npm run build
...

3.6 修改当前Dockerfile内容
原：
COPY .build/${OS}-${ARCH}/amtool       /bin/amtool
COPY .build/${OS}-${ARCH}/alertmanager /bin/alertmanager
修改为：
COPY ./amtool       /bin/amtool
COPY ./alertmanager /bin/alertmanager

3.7 构建镜像
gitpod ~/alertmanager (main) $ docker build -t registry.cn-hangzhou.aliyuncs.com/xx/xx:alertmanager-pprof .

3.8 推送到个人仓库本地部署
gitpod ~/alertmanager (main) $ docker push registry.cn-hangzhou.aliyuncs.com/xx/xx:alertmanager-pprof 

pushgateway源码构建docker镜像

4.1 克隆仓库
gitpod ~ $ git clone https://github.com/prometheus/pushgateway.git
Cloning into 'pushgateway'...
remote: Enumerating objects: 6348, done.
remote: Counting objects: 100% (2423/2423), done.
remote: Compressing objects: 100% (665/665), done.
remote: Total 6348 (delta 1981), reused 1761 (delta 1756), pack-reused 3925 (from 2)
Receiving objects: 100% (6348/6348), 12.61 MiB | 26.35 MiB/s, done.
Resolving deltas: 100% (3798/3798), done.

4.2 进入目录
gitpod ~ $ cd pushgateway/

4.3 查询与pprof相关的文件
gitpod ~/pushgateway (master) $ grep -r "pprof" ./*
./CHANGELOG.md:* [BUGFIX] Re-add pprof endpoints.
./main.go:      "net/http/pprof"
./main.go:      // Re-enable pprof.
./main.go:      r.Get(*routePrefix+"/debug/pprof/*pprof", handlePprof)
./main.go:      switch route.Param(r.Context(), "pprof") {
./main.go:              pprof.Cmdline(w, r)
./main.go:              pprof.Profile(w, r)
./main.go:              pprof.Symbol(w, r)
./main.go:              pprof.Index(w, r)

4.4 修改./main.go文件
16 import (
 17         "compress/gzip"
 18         "context"
 19         "fmt"
 20         "io"
 21         "log/slog"
 22         "net/http"
 23         "net/http/pprof" //删除/注释
 -----------------------------------------------------------------
 140         // Re-enable pprof.								
 141         r.Get(*routePrefix+"/debug/pprof/*pprof", handlePprof) //删除/注释
 -----------------------------------------------------------------以下内容全部注释/删除
 233 func handlePprof(w http.ResponseWriter, r *http.Request) {
 234         switch route.Param(r.Context(), "pprof") {
 235         case "/cmdline":
 236                 pprof.Cmdline(w, r)
 237         case "/profile":
 238                 pprof.Profile(w, r)
 239         case "/symbol":
 240                 pprof.Symbol(w, r)
 241         default:
 242                 pprof.Index(w, r)
 243         }
 244 }

4.5 构建二进制文件
gitpod ~/pushgateway (master) $ make build
curl -s -L https://github.com/prometheus/promu/releases/download/v0.17.0/promu-0.17.0.linux-amd64.tar.gz | tar -xvzf - -C /tmp/tmp.wAHta4la8R
...

4.6 修改当前Dockerfile内容
原：
COPY --chown=nobody:nobody .build/${OS}-${ARCH}/pushgateway /bin/pushgateway
修改为：
COPY --chown=nobody:nobody ./pushgateway /bin/pushgateway

4.7 构建镜像
gitpod ~/pushgateway (master) $ docker build -t registry.cn-hangzhou.aliyuncs.com/xx/xx:pushgateway-pprof .

4.8 推送到个人仓库本地部署
gitpod ~/pushgateway (master) $ docker push registry.cn-hangzhou.aliyuncs.com/xx/xx:pushgateway-pprof  

node_exporter源码构建docker镜像

5.1 克隆仓库
gitpod ~ $ git clone https://github.com/prometheus/node_exporter.git
Cloning into 'node_exporter'...
remote: Enumerating objects: 17203, done.
remote: Counting objects: 100% (56/56), done.
remote: Compressing objects: 100% (37/37), done.
remote: Total 17203 (delta 44), reused 19 (delta 19), pack-reused 17147 (from 5)
Receiving objects: 100% (17203/17203), 12.20 MiB | 28.86 MiB/s, done.
Resolving deltas: 100% (10741/10741), done.

5.2 进入目录
gitpod ~ $ cd node_exporter/

5.3 查询pprof相关文件
gitpod ~/node_exporter (master) $ grep -r "pprof" ./*
./node_exporter.go:     _ "net/http/pprof"

5.4 修改./node_exporter.go文件
 16 import (
 17         "fmt"
 18         "log/slog"
 19         "net/http"
 20         _ "net/http/pprof" //注释/删除
 21         "os"

5.5 构建二进制文件
gitpod ~/node_exporter (master) $ make build
>> building binaries
/workspace/go/bin/promu --config .promu.yml build --prefix /home/gitpod/node_exporter 
 >   node_exporter
go: downloading github.com/beorn7/perks v1.0.1
...

5.6 修改当前Dockerfile内容
原：
COPY .build/${OS}-${ARCH}/node_exporter /bin/node_exporter
修改为：
COPY ./node_exporter /bin/node_exporter

5.7 构建镜像
gitpod ~/node_exporter (master) $ docker build -t registry.cn-hangzhou.aliyuncs.com/xx/xx:node_exporter-pprof .

5.8 推送到个人仓库本地部署
gitpod ~/node_exporter (master) $ docker push registry.cn-hangzhou.aliyuncs.com/xx/xx:node_exporter-pprof  

验证效果