[CVE-2023-47108] Compatibility with go.opentelemetry.io/otel v1.20.0

[roger2hk]

What happened?

To fix CVE-2023-47108, go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc needs to be bumped to 0.46.0. However, changes in etcd are required to upgrade to go.opentelemetry.io/otel v1.20.0.

Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/provider.go:90:30: cannot use &TracerProvider{} (value of type *TracerProvider) as "go.opentelemetry.io/otel/trace".TracerProvider value in variable declaration: *TracerProvider does not implement "go.opentelemetry.io/otel/trace".TracerProvider (missing method tracerProvider)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/span.go:161:23: cannot use (*recordingSpan)(nil) (value of type *recordingSpan) as ReadWriteSpan value in variable declaration: *recordingSpan does not implement ReadWriteSpan (missing method span)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/span.go:780:20: cannot use nonRecordingSpan{} (value of type nonRecordingSpan) as "go.opentelemetry.io/otel/trace".Span value in variable declaration: nonRecordingSpan does not implement "go.opentelemetry.io/otel/trace".Span (missing method span)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/tracer.go:30:22: cannot use &tracer{} (value of type *tracer) as "go.opentelemetry.io/otel/trace".Tracer value in variable declaration: *tracer does not implement "go.opentelemetry.io/otel/trace".Tracer (missing method tracer)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/provider.go:170:10: cannot use t (variable of type *tracer) as "go.opentelemetry.io/otel/trace".Tracer value in return statement: *tracer does not implement "go.opentelemetry.io/otel/trace".Tracer (missing method tracer)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/span.go:692:9: cannot use s.tracer.provider (variable of type *TracerProvider) as "go.opentelemetry.io/otel/trace".TracerProvider value in return statement: *TracerProvider does not implement "go.opentelemetry.io/otel/trace".TracerProvider (missing method tracerProvider)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/span.go:811:74: cannot use s.tracer.provider (variable of type *TracerProvider) as "go.opentelemetry.io/otel/trace".TracerProvider value in return statement: *TracerProvider does not implement "go.opentelemetry.io/otel/trace".TracerProvider (missing method tracerProvider)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/tracer.go:47:21: impossible type assertion: p.(*recordingSpan)
	*recordingSpan does not implement "go.opentelemetry.io/otel/trace".Span (missing method span)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/tracer.go:117:10: cannot use tr.newNonRecordingSpan(sc) (value of type nonRecordingSpan) as "go.opentelemetry.io/otel/trace".Span value in return statement: nonRecordingSpan does not implement "go.opentelemetry.io/otel/trace".Span (missing method span)
Error: /home/runner/go/pkg/mod/go.opentelemetry.io/otel/sdk@v1.19.0/trace/tracer.go:119:9: cannot use tr.newRecordingSpan(psc, sc, name, samplingResult, config) (value of type *recordingSpan) as "go.opentelemetry.io/otel/trace".Span value in return statement: *recordingSpan does not implement "go.opentelemetry.io/otel/trace".Span (missing method span)
Error: /home/runner/go/pkg/mod/go.etcd.io/etcd/server/v3@v3.5.10/embed/config_tracing.go:64:4: cannot use tracesdk.NewTracerProvider(tracesdk.WithBatcher(exporter), tracesdk.WithResource(res), tracesdk.WithSampler(tracesdk.ParentBased(tracesdk.NeverSample()))) (value of type *"go.opentelemetry.io/otel/sdk/trace".TracerProvider) as "go.opentelemetry.io/otel/trace".TracerProvider value in argument to otelgrpc.WithTracerProvider: *"go.opentelemetry.io/otel/sdk/trace".TracerProvider does not implement "go.opentelemetry.io/otel/trace".TracerProvider (missing method tracerProvider)

What did you expect to happen?

I expected to bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.45.0 to 0.46.0 in other repositories, which has a dependency on etcd, without any issue.

How can we reproduce it (as minimally and precisely as possible)?

Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.45.0 to 0.46.0

Anything else we need to know?

There are breaking changes for TracerProvider.
https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.20.0

Etcd version (please run commands below)

etcd/server/go.mod

Lines 32 to 35 in 4d8eefb

	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.45.0
	go.opentelemetry.io/otel v1.19.0
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0
	go.opentelemetry.io/otel/sdk v1.19.0

[ahrtr]

Thanks for reporting this issue.

@sharathsivakumar, I noticed you are handling dependency management for this week. Could you take this as a high priority task? Thank you!

[sharathsivakumar]

@ahrtr Definetly. looking into this now!

[ahrtr]

The fix needs to be backported to 3.5 and 3.4. Please update the changelog for 3.4 and 3.5 as well afterwards, thanks.

[ahrtr]

@sharathsivakumar any update on this? Please let me know if you need any assistance or you need someone else to take over? We always need to take any CVE as high priority task. Thanks.

[sharathsivakumar]

@ahrtr On it. I was testing a few things if it broke anything in 3.5. I will be creating the PRs for the backports within the next 2 hours. Hope that's fine.

[ahrtr]

@sharathsivakumar Thanks.

[sharathsivakumar]

@ahrtr Here is the PR for backporting to 3.5 #16946
I think some tests will fail, I am keeping a tab on it and will get it fixed!

[sharathsivakumar]

@ahrtr I checked with the release-3.4 source code and looks like it does not use the go packages go.opentelemetry.io/otel v1.20.0 and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.45.0 packages. So I think 3.4 will not need a back fix. Is this correct?

[ahrtr]

So I think 3.4 will not need a back fix. Is this correct?

YES, the opentelemetry was only introduced in 3.5 (included) onwards. Thanks.

[ahrtr]

All done

• main branch: dependency: bump go.opentelemetry.io/contrib/instrumentation/google.g… #16930
• 3.5: [3.5] CVE-2023-47108: Backport go.opentelemetry.io/otel@v1.20.0 and go.open… #16946
• changelog: changelog: Update fix for CVE-2023-47108 #16953

[ahrtr]

thx both @roger2hk and @sharathsivakumar

[Includeoyasi]

Hello, I got same errors with version 1.20.0 today

[roger2hk]

Hello, I got same errors with version 1.20.0 today

The problem will go away when the v3.5.11 is released.

#16960