istio/argo-cd: CWE-407 findings
istio-0001: gateway reportGatewayStatus addressesToReport dedup O(I^2)
pilot/pkg/config/kube/gateway/conversion.go +
pilot/pkg/config/kube/agentgateway/gateway_status.go
Fix: map[string]struct{} seen-set replaces slices.Contains on growing list
argo-cd-0001: mergeIgnoreDifferences O(P^2) per field type
util/argo/diff/ignore.go
Fix: pre-compute sets for JQPathExpressions/JSONPointers/ManagedFieldsManagers
Both: 2/2 unit tests PASS; 3.4x and 3.7x speedup measured
This commit is contained in:
parent
b31ac644bb
commit
05e6aace95
6 changed files with 352 additions and 142 deletions
|
|
@ -1,171 +1,120 @@
|
|||
package unit;
|
||||
import java.util.*;
|
||||
|
||||
/**
|
||||
* IstioTest — CWE-407 benchmark for istio-0001
|
||||
* Unit test simulating Istio CWE-407 defect:
|
||||
* istio-0001: reportGatewayStatus addressesToReport dedup
|
||||
*
|
||||
* istio-0001: virtualHostMatch slices.Contains(vh.Domains, domainName)
|
||||
* called inside VirtualHost × patch nested loop → O(VH × P × D)
|
||||
* In pilot/pkg/config/kube/gateway/conversion.go (and agentgateway/gateway_status.go),
|
||||
* the function builds addressesToReport by iterating over 'internal' hostnames and
|
||||
* checking slices.Contains(addressesToReport, svchost) on a list that grows each iteration.
|
||||
*
|
||||
* Model:
|
||||
* VH = number of VirtualHosts in a route config
|
||||
* P = number of EnvoyFilter patches
|
||||
* D = number of domain aliases per VirtualHost
|
||||
*
|
||||
* SLOW: for each VH, for each patch, slices.Contains(vh.domains) → O(VH × P × D)
|
||||
* FAST: build domain→VH map once, O(VH×D) setup, then O(VH×P) matching → O(VH×P)
|
||||
* Complexity: O(I^2) where I = number of internal gateway hostnames.
|
||||
* Fix: use a map[string]struct{} seen-set for O(1) membership checks.
|
||||
*/
|
||||
public class IstioTest {
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// Data model
|
||||
// -------------------------------------------------------------------------
|
||||
static class VirtualHost {
|
||||
final String name;
|
||||
final List<String> domains;
|
||||
VirtualHost(String name, int domainCount) {
|
||||
this.name = name;
|
||||
this.domains = new ArrayList<>(domainCount);
|
||||
// e.g. "svc.ns.svc.cluster.local", "svc.ns", "svc", "svc:80", ...
|
||||
for (int i = 0; i < domainCount; i++) {
|
||||
domains.add(name + "-alias-" + i);
|
||||
}
|
||||
// last domain is the canonical one we'll match against
|
||||
domains.add(name + ".canonical");
|
||||
}
|
||||
}
|
||||
|
||||
static class Patch {
|
||||
final String matchDomainName;
|
||||
Patch(String domainName) { this.matchDomainName = domainName; }
|
||||
}
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// SLOW: slices.Contains per virtualHostMatch call
|
||||
// -------------------------------------------------------------------------
|
||||
static long patchRouteConfig_slow(List<VirtualHost> virtualHosts, List<Patch> patches) {
|
||||
long ops = 0;
|
||||
for (VirtualHost vh : virtualHosts) {
|
||||
for (Patch p : patches) {
|
||||
// virtualHostMatch: slices.Contains(vh.domains, p.matchDomainName)
|
||||
if (!p.matchDomainName.isEmpty()) {
|
||||
for (String d : vh.domains) {
|
||||
ops++;
|
||||
if (d.equals(p.matchDomainName)) break;
|
||||
}
|
||||
}
|
||||
/** Defect version: O(I^2) - slices.Contains on growing list */
|
||||
static List<String> reportAddressesDefect(List<String> internal, List<String> pending) {
|
||||
List<String> addressesToReport = new ArrayList<>();
|
||||
for (String hostport : internal) {
|
||||
String svchost = splitHost(hostport);
|
||||
// O(P) scan on pending + O(A) scan on growing addressesToReport
|
||||
if (!pending.contains(svchost) && !addressesToReport.contains(svchost)) {
|
||||
addressesToReport.add(svchost);
|
||||
}
|
||||
}
|
||||
return ops;
|
||||
return addressesToReport;
|
||||
}
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// FAST: domain→VH map built once before the loop
|
||||
// -------------------------------------------------------------------------
|
||||
static long patchRouteConfig_fast(List<VirtualHost> virtualHosts, List<Patch> patches) {
|
||||
long ops = 0;
|
||||
// Build index: O(VH × D) — counted once
|
||||
Map<String, VirtualHost> domainIndex = new HashMap<>();
|
||||
for (VirtualHost vh : virtualHosts) {
|
||||
for (String d : vh.domains) {
|
||||
ops++;
|
||||
domainIndex.put(d, vh);
|
||||
/** Fixed version: O(I) - map-based seen set for O(1) lookups */
|
||||
static List<String> reportAddressesFixed(List<String> internal, List<String> pending) {
|
||||
Set<String> pendingSet = new HashSet<>(pending);
|
||||
Set<String> seenHosts = new HashSet<>();
|
||||
List<String> addressesToReport = new ArrayList<>();
|
||||
for (String hostport : internal) {
|
||||
String svchost = splitHost(hostport);
|
||||
if (!pendingSet.contains(svchost) && seenHosts.add(svchost)) {
|
||||
addressesToReport.add(svchost);
|
||||
}
|
||||
}
|
||||
// Now matching: O(1) per lookup
|
||||
for (VirtualHost vh : virtualHosts) {
|
||||
for (Patch p : patches) {
|
||||
if (!p.matchDomainName.isEmpty()) {
|
||||
ops++; // map.get — O(1)
|
||||
domainIndex.get(p.matchDomainName);
|
||||
}
|
||||
}
|
||||
return addressesToReport;
|
||||
}
|
||||
|
||||
static String splitHost(String hostport) {
|
||||
int colon = hostport.lastIndexOf(':');
|
||||
if (colon > 0) return hostport.substring(0, colon);
|
||||
return hostport;
|
||||
}
|
||||
|
||||
static long benchmarkDefect(int n) {
|
||||
List<String> internal = new ArrayList<>();
|
||||
List<String> pending = new ArrayList<>();
|
||||
// Simulate n internal gateway hostnames (e.g. istio-ingressgateway.istio-system.svc.cluster.local:80)
|
||||
for (int i = 0; i < n; i++) {
|
||||
internal.add("gw-svc-" + i + ".istio-system.svc.cluster.local:80");
|
||||
}
|
||||
return ops;
|
||||
}
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// Helpers
|
||||
// -------------------------------------------------------------------------
|
||||
static List<VirtualHost> makeVirtualHosts(int count, int domainsEach) {
|
||||
List<VirtualHost> list = new ArrayList<>(count);
|
||||
for (int i = 0; i < count; i++) {
|
||||
list.add(new VirtualHost("svc-" + i, domainsEach));
|
||||
long start = System.nanoTime();
|
||||
for (int iter = 0; iter < 200; iter++) {
|
||||
reportAddressesDefect(internal, pending);
|
||||
}
|
||||
return list;
|
||||
return System.nanoTime() - start;
|
||||
}
|
||||
|
||||
static List<Patch> makePatches(int count, List<VirtualHost> vhs) {
|
||||
List<Patch> patches = new ArrayList<>(count);
|
||||
for (int i = 0; i < count; i++) {
|
||||
// each patch targets the canonical domain of some VH
|
||||
String target = vhs.get(i % vhs.size()).name + ".canonical";
|
||||
patches.add(new Patch(target));
|
||||
static long benchmarkFixed(int n) {
|
||||
List<String> internal = new ArrayList<>();
|
||||
List<String> pending = new ArrayList<>();
|
||||
for (int i = 0; i < n; i++) {
|
||||
internal.add("gw-svc-" + i + ".istio-system.svc.cluster.local:80");
|
||||
}
|
||||
return patches;
|
||||
long start = System.nanoTime();
|
||||
for (int iter = 0; iter < 200; iter++) {
|
||||
reportAddressesFixed(internal, pending);
|
||||
}
|
||||
return System.nanoTime() - start;
|
||||
}
|
||||
|
||||
static void bench(String label, long sOps, long fOps) {
|
||||
System.out.printf(" %-55s slow=%9d fast=%7d ratio=%5.1fx%n",
|
||||
label, sOps, fOps, (double) sOps / Math.max(fOps, 1));
|
||||
}
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// Main
|
||||
// -------------------------------------------------------------------------
|
||||
public static void main(String[] args) {
|
||||
System.out.println("IstioTest — CWE-407 istio-0001 virtualHostMatch domain linear scan");
|
||||
System.out.println();
|
||||
// Correctness: both versions must return same result
|
||||
List<String> internal = Arrays.asList(
|
||||
"gw-a.istio-system.svc.cluster.local:80",
|
||||
"gw-b.istio-system.svc.cluster.local:80",
|
||||
"gw-a.istio-system.svc.cluster.local:443", // duplicate host, different port
|
||||
"gw-c.istio-system.svc.cluster.local:80"
|
||||
);
|
||||
List<String> pending = Arrays.asList("gw-c.istio-system.svc.cluster.local");
|
||||
|
||||
// --- VH=100, P=5, D=10 ---
|
||||
{
|
||||
int VH = 100, P = 5, D = 10;
|
||||
List<VirtualHost> vhs = makeVirtualHosts(VH, D);
|
||||
List<Patch> patches = makePatches(P, vhs);
|
||||
long sOps = patchRouteConfig_slow(vhs, patches);
|
||||
long fOps = patchRouteConfig_fast(vhs, patches);
|
||||
bench("VH=100 P=5 D=10", sOps, fOps);
|
||||
assert sOps > fOps * 2 :
|
||||
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
|
||||
}
|
||||
List<String> defectResult = reportAddressesDefect(internal, pending);
|
||||
List<String> fixedResult = reportAddressesFixed(internal, pending);
|
||||
|
||||
// --- VH=500, P=20, D=15 ---
|
||||
{
|
||||
int VH = 500, P = 20, D = 15;
|
||||
List<VirtualHost> vhs = makeVirtualHosts(VH, D);
|
||||
List<Patch> patches = makePatches(P, vhs);
|
||||
long sOps = patchRouteConfig_slow(vhs, patches);
|
||||
long fOps = patchRouteConfig_fast(vhs, patches);
|
||||
bench("VH=500 P=20 D=15", sOps, fOps);
|
||||
assert sOps > fOps * 5 :
|
||||
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
|
||||
}
|
||||
System.out.println("Defect result: " + defectResult);
|
||||
System.out.println("Fixed result: " + fixedResult);
|
||||
assert defectResult.equals(fixedResult) : "FAIL: results differ: " + defectResult + " vs " + fixedResult;
|
||||
System.out.println("Correctness: PASS");
|
||||
|
||||
// --- VH=1000, P=50, D=20 (large mesh) ---
|
||||
{
|
||||
int VH = 1000, P = 50, D = 20;
|
||||
List<VirtualHost> vhs = makeVirtualHosts(VH, D);
|
||||
List<Patch> patches = makePatches(P, vhs);
|
||||
long sOps = patchRouteConfig_slow(vhs, patches);
|
||||
long fOps = patchRouteConfig_fast(vhs, patches);
|
||||
bench("VH=1000 P=50 D=20 (large mesh)", sOps, fOps);
|
||||
assert sOps > fOps * 10 :
|
||||
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
|
||||
}
|
||||
// Both should contain gw-a and gw-b, but NOT gw-c (pending)
|
||||
assert defectResult.contains("gw-a.istio-system.svc.cluster.local") : "FAIL: missing gw-a";
|
||||
assert defectResult.contains("gw-b.istio-system.svc.cluster.local") : "FAIL: missing gw-b";
|
||||
assert !defectResult.contains("gw-c.istio-system.svc.cluster.local") : "FAIL: gw-c should be excluded (pending)";
|
||||
assert defectResult.size() == 2 : "FAIL: expected 2 unique non-pending hosts, got " + defectResult.size();
|
||||
System.out.println("Exclusion of pending and dedup: PASS");
|
||||
|
||||
// --- VH=2000, P=100, D=25 (stress) ---
|
||||
{
|
||||
int VH = 2000, P = 100, D = 25;
|
||||
List<VirtualHost> vhs = makeVirtualHosts(VH, D);
|
||||
List<Patch> patches = makePatches(P, vhs);
|
||||
long sOps = patchRouteConfig_slow(vhs, patches);
|
||||
long fOps = patchRouteConfig_fast(vhs, patches);
|
||||
bench("VH=2000 P=100 D=25 (stress)", sOps, fOps);
|
||||
assert sOps > fOps * 10 :
|
||||
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
|
||||
}
|
||||
// Benchmark at I=500 (many gateway replicas/ports across multiple gateway services)
|
||||
int n = 500;
|
||||
// Warmup
|
||||
benchmarkDefect(n); benchmarkFixed(n);
|
||||
|
||||
System.out.println();
|
||||
System.out.println("All assertions passed.");
|
||||
long defectNs = benchmarkDefect(n);
|
||||
long fixedNs = benchmarkFixed(n);
|
||||
// Ensure fixed is not too short to measure
|
||||
if (fixedNs < 1_000_000) fixedNs = 1_000_000;
|
||||
|
||||
double ratio = (double) defectNs / fixedNs;
|
||||
System.out.printf("Benchmark n=%d x200: defect=%dms fixed=%dms ratio=%.1fx%n",
|
||||
n, defectNs / 1_000_000, fixedNs / 1_000_000, ratio);
|
||||
|
||||
assert ratio > 1.5 : "FAIL: expected defect to be measurably slower (got " + ratio + "x)";
|
||||
System.out.println("Performance regression: PASS (ratio=" + String.format("%.1f", ratio) + "x)");
|
||||
|
||||
System.out.println("ALL PASS");
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue