String matching: match long strings #1806
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
kevsecurity
added
the
release-note/bug
kevsecurity
force-pushed
the
pr/kevsecurity/fix-prefix-for-long-strings
branch
from
a8361d4 to
2d96730
Compare
kkourt
previously requested changes
Nov 28, 2023
|
Also, I believe we need to backport this to 1.0. I've added a label. |
Prefix matching is done by looking up the provided string in the LPM TRIE string prefix map (for strings and file paths). Currently, we don't look up strings that are longer than the prefix map can hold. This is a bug, because we could still look up the beginning substring (to the max the map allows) and if it matches, then the full string would also match (if the map size permitted it). This commit detects strings that are longer than the map allows and instead of not matching, it looks up the longest beginning substring that the map allows instead. This will allow prefix matching to be used on all strings and not just the ones short enough to fit into the prefix map. Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
Postfix matching is done by reversing all the postfixes and storing them in a LPM TRIE map, and then reversing the string to match on and looking it up in the map. If the string to match is longer than the postfix max length then the string would not be matched, leading to long strings not being subject to the match logic. This commit modifies the look up to handle strings longer than the postfix max length. It fixes the length to copy to the postfix max length and supplies an offset from where to start copying. The offset is calculated as the difference between the original length and the capped length. Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
Add tests for very long (>256 chars) paths for prefix and postfix selectors. Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
kevsecurity
force-pushed
the
pr/kevsecurity/fix-prefix-for-long-strings
branch
from
2d96730 to
71604ee
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The current implementation ignore prefix and postfix matching on strings that are longer than the prefix max or postfix max (accordingly).
These patches modify the logic to handle strings that are longer than these maximums by restricting the string to the maximum permitted by the LPM TRIE maps – from the beginning for prefix and from the end for postfix.