fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs

.github/workflows/codeql-analysis.yml

@@ -13,6 +13,10 @@ on:
       - '202[0-9][0-9][0-9]'
   workflow_dispatch:
 
+env:
+  BUILD_BRANCH: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.ref || github.ref_name }}
+
+
 jobs:
   analyze:
     name: Analyze
@@ -31,6 +35,20 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@v3
 
+    # Checkout sonic-mgmt-common repository which is used by sonic-gnmi
+    - name: Checkout sonic-mgmt-common repository
+      uses: actions/checkout@v3
+      with:
+        repository: sonic-net/sonic-mgmt-common
+        path: sonic-mgmt-common
+        ref: refs/heads/${{ env.BUILD_BRANCH }}
+
+    # Update go.mod to use local sonic-mgmt-common.
+    # This is the same hack used in the CI pipeline. See lgtm.yml.
+    # We should find a better way to do this.
+    - name: Update go.mod for sonic-mgmt-common
+      run: sed -i 's@replace github.com/Azure/sonic-mgmt-common => ../sonic-mgmt-common@replace github.com/Azure/sonic-mgmt-common => ./sonic-mgmt-common@g' go.mod
+
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v2.1.29

azure-pipelines.yml

@@ -47,7 +47,7 @@ stages:
     timeoutInMinutes: 60
 
     pool:
-      vmImage: ubuntu-20.04
+      vmImage: ubuntu-22.04
 
     variables:
       DIFF_COVER_CHECK_THRESHOLD: 80

gnmi_server/clientCertAuth.go

@@ -5,6 +5,7 @@ import (
 	"crypto/x509"
 	"io"
 	"net/http"
+	"strings"
 	"time"
 	"github.com/sonic-net/sonic-gnmi/common_utils"
 	"github.com/sonic-net/sonic-gnmi/swsscommon"
@@ -260,7 +261,11 @@ func PopulateAuthStructByCommonName(certCommonName string, auth *common_utils.Au
 
 	var fieldValuePairs = configDbConnector.Get_entry(serviceConfigTableName, certCommonName)
 	if fieldValuePairs.Size() > 0 {
-		if fieldValuePairs.Has_key("role") {
+		if fieldValuePairs.Has_key("role@") {
+			var role = fieldValuePairs.Get("role@")
+			auth.Roles = strings.Split(role, ",")
+		} else if fieldValuePairs.Has_key("role") {
+			// Backward compatibility for single role DB schema
 			var role = fieldValuePairs.Get("role")
 			auth.Roles = []string{role}
 		}

gnmi_server/client_subscribe.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"strings"
 	"sync"
 
 	"github.com/Workiva/go-datastructures/queue"
@@ -59,8 +60,8 @@ func (c *Client) setConnectionManager(threshold int) {
 		return
 	}
 	connectionManager = &ConnectionManager {
-		connections: make(map[string]struct{}),
-		threshold:   threshold,
+			connections: make(map[string]struct{}),
+			threshold:   threshold,
 	}
 	connectionManager.PrepareRedis()
 }
@@ -195,7 +196,11 @@ func (c *Client) Run(stream gnmipb.GNMI_SubscribeServer) (err error) {
 		c.polled = make(chan struct{}, 1)
 		c.polled <- struct{}{}
 		c.w.Add(1)
-		go dc.PollRun(c.q, c.polled, &c.w, c.subscribe)
+		if target == "APPL_DB" || strings.HasPrefix(target, "APPL_DB/") {
+			go dc.AppDBPollRun(c.q, c.polled, &c.w, c.subscribe)
+		} else {
+			go dc.PollRun(c.q, c.polled, &c.w, c.subscribe)
+		}
 	case gnmipb.SubscriptionList_ONCE:
 		c.once = make(chan struct{}, 1)
 		c.once <- struct{}{}