proxy: Update prost to 0.6

[olix0r]

ID:       RUSTSEC-2020-0002
Crate:    prost
Version:  0.5.0
Date:     2020-01-16
URL:      https://rustsec.org/advisories/RUSTSEC-2020-0002
Title:    Parsing a specially crafted message can result in a stack overflow
Solution:  upgrade to >= 0.6.1
Dependency tree: 
prost 0.5.0

The proxy has dependencies on prost 0.5, as does proxy-api, and tower-grpc-build, etc.

Is it feasible to update this dependency?

[hawkw]

I'm working on this. The breaking changes in prost 0.6 shouldn't be a problem for us, but it requires updating to bytes 0.5, which then implies a lot of dependency updates. So, may take a bit.

[hawkw]

This will require updating the v0.1.xtokio-io and tokio-buf to pick up the breaking changes to bytes in 0.5, which looks like a significant chunk of work (there are a lot of breaking changes). Since we would like to update the proxy to tokio 0.2 in the near future, a better short term solution may be looking into whether the security fix in prost 0.6.1 can be backported to prost 0.5.x, and then picking up 0.6.1 when the proxy is updated to the tokio 0.2 ecosystem?

[hawkw]

Here is a patched prost 0.5.x with the security fix: https://github.com/linkerd/prost/tree/v0.5.x. We can update the proxy to patch all prost deps to use this. Since I believe Dan has stated he doesn't intend to maintain 0.5.x (https://github.com/danburkert/prost/issues/267#issuecomment-575409718) we don't have to worry about missing future patches...especially because we ought to be updated to tokio 0.2 soon and can therefore pick up the latest prost.

[olix0r]

Now that we've updated to tokio-0.2, we should ensure that we eliminate our (patched) prost 0.5 dependencies so that cargo audit is happy.

[hawkw]

The proxy itself is now using prost 0.6, in fact, now that we've switched to tonic, we can't use 0.5 even if we wanted to. There is still a dependency on 0.5, but it's for the test-support mock controllers, which still use tower-grpc. Hopefully, those should be removeable soon.