security: conform to gosec G114 (#1860)

(cherry picked from commit 97b4112)

cmd/controller/controller.go

@@ -49,7 +49,15 @@ func CmdMain() {
 			mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
 			mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
 		}
-		klog.Fatal(http.ListenAndServe(fmt.Sprintf("0.0.0.0:%d", config.PprofPort), mux))
+
+		// conform to Gosec G114
+		// https://github.com/securego/gosec#available-rules
+		server := &http.Server{
+			Addr:              fmt.Sprintf("0.0.0.0:%d", config.PprofPort),
+			ReadHeaderTimeout: 3 * time.Second,
+			Handler:           mux,
+		}
+		klog.Fatal(server.ListenAndServe())
 	}()
 
 	ctl := controller.NewController(config)

cmd/daemon/cniserver.go

@@ -88,7 +88,15 @@ func CmdMain() {
 		mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
 		mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
 	}
-	klog.Fatal(http.ListenAndServe(fmt.Sprintf("0.0.0.0:%d", config.PprofPort), mux))
+
+	// conform to Gosec G114
+	// https://github.com/securego/gosec#available-rules
+	server := &http.Server{
+		Addr:              fmt.Sprintf("0.0.0.0:%d", config.PprofPort),
+		ReadHeaderTimeout: 3 * time.Second,
+		Handler:           mux,
+	}
+	klog.Fatal(server.ListenAndServe())
 }
 
 func mvCNIConf() error {

cmd/ovn_monitor/ovn_monitor.go

@@ -2,6 +2,7 @@ package ovn_monitor
 
 import (
 	"net/http"
+	"time"
 
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"k8s.io/klog/v2"
@@ -28,5 +29,12 @@ func CmdMain() {
 
 	http.Handle(config.MetricsPath, promhttp.Handler())
 	klog.Infoln("Listening on", config.ListenAddress)
-	klog.Fatal(http.ListenAndServe(config.ListenAddress, nil))
+
+	// conform to Gosec G114
+	// https://github.com/securego/gosec#available-rules
+	server := &http.Server{
+		Addr:              config.ListenAddress,
+		ReadHeaderTimeout: 3 * time.Second,
+	}
+	klog.Fatal(server.ListenAndServe())
 }

cmd/pinger/pinger.go

@@ -5,6 +5,7 @@ import (
 	"github.com/kubeovn/kube-ovn/pkg/util"
 	"net/http"
 	_ "net/http/pprof" // #nosec
+	"time"
 
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"k8s.io/klog/v2"
@@ -26,7 +27,13 @@ func CmdMain() {
 	if config.Mode == "server" {
 		http.Handle("/metrics", promhttp.Handler())
 		go func() {
-			klog.Fatal(http.ListenAndServe(fmt.Sprintf("0.0.0.0:%d", config.Port), nil))
+			// conform to Gosec G114
+			// https://github.com/securego/gosec#available-rules
+			server := &http.Server{
+				Addr:              fmt.Sprintf("0.0.0.0:%d", config.Port),
+				ReadHeaderTimeout: 3 * time.Second,
+			}
+			klog.Fatal(server.ListenAndServe())
 		}()
 	}
 	e := pinger.NewExporter(config)

cmd/speaker/speaker.go

@@ -3,6 +3,7 @@ package speaker
 import (
 	"fmt"
 	"net/http"
+	"time"
 
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"k8s.io/klog/v2"
@@ -26,7 +27,14 @@ func CmdMain() {
 
 	go func() {
 		http.Handle("/metrics", promhttp.Handler())
-		klog.Fatal(http.ListenAndServe(fmt.Sprintf("0.0.0.0:%d", config.PprofPort), nil))
+
+		// conform to Gosec G114
+		// https://github.com/securego/gosec#available-rules
+		server := &http.Server{
+			Addr:              fmt.Sprintf("0.0.0.0:%d", config.PprofPort),
+			ReadHeaderTimeout: 3 * time.Second,
+		}
+		klog.Fatal(server.ListenAndServe())
 	}()
 
 	ctl.Run(stopCh)