feat(node-ensure/delete-untracked/metrics) Ensure there is no extra ARP/FDB configuration when ensuring node endpoints, build OTEL metrics out of control loop

[leo-scalingo]

Related to #328

[semgrep-code-scalingo]

Semgrep identified an issue in your code:

A wrapped file-not-found error from erepo.Activate(...) may not be recognized here, so missing endpoint.TargetNetnsPath can skip erepo.Deactivate(...). An attacker who can cause stale netns paths during restore could leave orphaned endpoint network state behind.

More details about this

erepo.Activate(...) returns an error, and this code decides whether to clean up the endpoint by checking os.IsNotExist(errors.Cause(err)). That check only looks at the unwrapped cause, so a wrapped not exist error can be missed and the code will take the failed to ensure endpoint path instead of calling erepo.Deactivate(...).

A plausible abuse case is: 1) an attacker causes endpoint.TargetNetnsPath to point to a namespace path that has already been removed, 2) erepo.Activate(endpointCtx, network, endpoint, ...) returns a wrapped file-not-found error for that path, 3) this os.IsNotExist(errors.Cause(err)) check fails to recognize it, and 4) the stale endpoint is left active because erepo.Deactivate(endpointCtx, network, endpoint) is never called. In a system restoring many endpoints, repeatedly triggering this on selected endpoint.NetworkID / endpoint.TargetNetnsPath values can leave orphaned network state behind, which can keep unexpected connectivity or policy state attached to containers that should have been cleaned up.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	if os.IsNotExist(errors.Cause(err)) {
	if errors.Is(errors.Cause(err), fs.ErrNotExist) {

View step-by-step instructions

1. Replace the os.IsNotExist(...) check with the standard library errors.Is(...) check against the not-exist sentinel error.
   Change os.IsNotExist(errors.Cause(err)) to stderrors.Is(err, fs.ErrNotExist).

2. Stop unwrapping the error with errors.Cause(...) in this condition.
   errors.Is already walks wrapped errors, so it can match the original not-exist error through errors.Wrap, fmt.Errorf(... %w ...), and similar wrappers.

3. Add the standard library imports needed for the new check.
   If this file already imports github.com/pkg/errors as errors, import the standard library package with an alias such as stderrors "errors", and add io/fs for fs.ErrNotExist.

4. Keep the existing deactivate path the same, and only update the condition.
   The resulting condition should look like if stderrors.Is(err, fs.ErrNotExist) { ... }.

5. Alternatively, if this file does not import github.com/pkg/errors with the name errors, use the standard library package directly as errors.Is(err, fs.ErrNotExist).

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by os-error-is-not-exist.

_{You can view more details about this finding in the Semgrep AppSec Platform.}