Backports/v1.0/string match fixes #1819
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The file prefix limit was originally 256 characters. When the code was converted to use LMP TRIE maps, the limit was set to 128 characters. This commit changes the prefix limit from 128 to 256 characters. [Upstream commit: 3a6d3209] Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
Kprobe arguments of type "sock" and "skb" are valid but fail BTF validation because the function prototypes report "struct sock *" and "struct sk_buff *" types. This commit adds validation to remove warnings that these types in the policy don't match the types in the function prototypes. [Upstream commit: 6be17e98] Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
Prefix matching is done by looking up the provided string in the LPM TRIE string prefix map (for strings and file paths). Currently, we don't look up strings that are longer than the prefix map can hold. This is a bug, because we could still look up the beginning substring (to the max the map allows) and if it matches, then the full string would also match (if the map size permitted it). This commit detects strings that are longer than the map allows and instead of not matching, it looks up the longest beginning substring that the map allows instead. This will allow prefix matching to be used on all strings and not just the ones short enough to fit into the prefix map. [Upstream commit: 9a5e74dc] Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
Postfix matching is done by reversing all the postfixes and storing them in a LPM TRIE map, and then reversing the string to match on and looking it up in the map. If the string to match is longer than the postfix max length then the string would not be matched, leading to long strings not being subject to the match logic. This commit modifies the look up to handle strings longer than the postfix max length. It fixes the length to copy to the postfix max length and supplies an offset from where to start copying. The offset is calculated as the difference between the original length and the capped length. [Upstream commit: 7d2a344a] Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
Add tests for very long (>256 chars) paths for prefix and postfix selectors. [Upstream commit: cf7aceb8] Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
kevsecurity
added
the
release-note/bug
willfindlay
approved these changes
Dec 4, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Increase prefix matches to 256 characters (fix regression).
Check prefix and postfix on strings longer than the prefix and postfix maximums (bug fix).
Add mappings for sock and skb types (bug fix).
See commits.