whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild
Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
This commit is contained in:
parent
b3842ab6b8
commit
9934133dcf
260 changed files with 18278 additions and 15 deletions
|
|
@ -0,0 +1,63 @@
|
|||
diff --git a/controller/api/destination/federated_service_watcher.go b/controller/api/destination/federated_service_watcher.go
|
||||
index 1234567..abcdef0 100644
|
||||
--- a/controller/api/destination/federated_service_watcher.go
|
||||
+++ b/controller/api/destination/federated_service_watcher.go
|
||||
@@ -43,7 +43,8 @@ type federatedService struct {
|
||||
sync.RWMutex
|
||||
id ServiceID
|
||||
subscribers []federatedServiceSubscriber
|
||||
- remoteDiscovery []remoteDiscoveryID
|
||||
+ // remoteDiscovery stored as map for O(1) membership tests in update().
|
||||
+ remoteDiscovery map[remoteDiscoveryID]struct{}
|
||||
localDiscovery string
|
||||
log *logging.Entry
|
||||
fsw *FederatedServiceWatcher
|
||||
@@ -210,7 +211,10 @@ func (fsw *FederatedServiceWatcher) newFederatedService(service *corev1.Service)
|
||||
fs := &federatedService{...}
|
||||
- fs.remoteDiscovery = remoteDiscoveryIDs(service, fsw.log)
|
||||
+ ids := remoteDiscoveryIDs(service, fsw.log)
|
||||
+ fs.remoteDiscovery = make(map[remoteDiscoveryID]struct{}, len(ids))
|
||||
+ for _, id := range ids {
|
||||
+ fs.remoteDiscovery[id] = struct{}{}
|
||||
+ }
|
||||
...
|
||||
}
|
||||
|
||||
@@ -225,18 +229,18 @@ func (fs *federatedService) update(service *corev1.Service) {
|
||||
fs.Lock()
|
||||
defer fs.Unlock()
|
||||
|
||||
- newRemoteDiscovery := remoteDiscoveryIDs(service, fs.log)
|
||||
- for _, id := range newRemoteDiscovery {
|
||||
- if !slices.Contains(fs.remoteDiscovery, id) {
|
||||
+ // Build new set in O(N), then diff old vs new in O(N).
|
||||
+ newIDs := remoteDiscoveryIDs(service, fs.log)
|
||||
+ newSet := make(map[remoteDiscoveryID]struct{}, len(newIDs))
|
||||
+ for _, id := range newIDs {
|
||||
+ newSet[id] = struct{}{}
|
||||
+ }
|
||||
+ for id := range newSet {
|
||||
+ if _, exists := fs.remoteDiscovery[id]; !exists {
|
||||
for i := range fs.subscribers {
|
||||
fs.remoteDiscoverySubscribe(&fs.subscribers[i], id)
|
||||
}
|
||||
}
|
||||
}
|
||||
- for _, id := range fs.remoteDiscovery {
|
||||
- if !slices.Contains(newRemoteDiscovery, id) {
|
||||
+ for id := range fs.remoteDiscovery {
|
||||
+ if _, exists := newSet[id]; !exists {
|
||||
for i := range fs.subscribers {
|
||||
fs.remoteDiscoveryUnsubscribe(&fs.subscribers[i], id)
|
||||
}
|
||||
}
|
||||
}
|
||||
- fs.remoteDiscovery = newRemoteDiscovery
|
||||
+ fs.remoteDiscovery = newSet
|
||||
|
||||
@@ -308,7 +312,7 @@ func (fs *federatedService) onServiceAdd(service *corev1.Service) {
|
||||
- for _, id := range fs.remoteDiscovery {
|
||||
+ for id := range fs.remoteDiscovery {
|
||||
fs.remoteDiscoverySubscribe(&fs.subscribers[len(fs.subscribers)-1], id)
|
||||
}
|
||||
}
|
||||
190
defects/linkerd2/unit/Linkerd2Test.java
Normal file
190
defects/linkerd2/unit/Linkerd2Test.java
Normal file
|
|
@ -0,0 +1,190 @@
|
|||
package unit;
|
||||
import java.util.*;
|
||||
|
||||
/**
|
||||
* Linkerd2Test — CWE-407 benchmark for linkerd2-0001
|
||||
*
|
||||
* linkerd2-0001: federatedService.update() slices.Contains O(n) inside two
|
||||
* for-range loops over remoteDiscovery slices → O(n²) diff computation
|
||||
*
|
||||
* Model:
|
||||
* N = number of remote discovery IDs (cluster service references)
|
||||
*
|
||||
* SLOW: for each new ID, slices.Contains(oldSlice) → O(N²) diff
|
||||
* FAST: map-based set for O(N) diff
|
||||
*/
|
||||
public class Linkerd2Test {
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// Simulated remoteDiscoveryID type (comparable struct in Go)
|
||||
// -------------------------------------------------------------------------
|
||||
static class RemoteDiscoveryID {
|
||||
final String cluster;
|
||||
final String service;
|
||||
final String namespace;
|
||||
|
||||
RemoteDiscoveryID(String cluster, String service, String namespace) {
|
||||
this.cluster = cluster;
|
||||
this.service = service;
|
||||
this.namespace = namespace;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean equals(Object o) {
|
||||
if (!(o instanceof RemoteDiscoveryID)) return false;
|
||||
RemoteDiscoveryID r = (RemoteDiscoveryID) o;
|
||||
return cluster.equals(r.cluster) && service.equals(r.service) && namespace.equals(r.namespace);
|
||||
}
|
||||
|
||||
@Override
|
||||
public int hashCode() {
|
||||
return Objects.hash(cluster, service, namespace);
|
||||
}
|
||||
}
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// SLOW: slices.Contains inside for-range loops → O(N²)
|
||||
// -------------------------------------------------------------------------
|
||||
static long updateFederatedService_slow(List<RemoteDiscoveryID> oldSlice,
|
||||
List<RemoteDiscoveryID> newSlice) {
|
||||
long ops = 0;
|
||||
// adds: for each new, scan old for membership
|
||||
for (RemoteDiscoveryID id : newSlice) {
|
||||
for (RemoteDiscoveryID old : oldSlice) {
|
||||
ops++;
|
||||
if (old.equals(id)) break;
|
||||
}
|
||||
}
|
||||
// removes: for each old, scan new for membership
|
||||
for (RemoteDiscoveryID id : oldSlice) {
|
||||
for (RemoteDiscoveryID nw : newSlice) {
|
||||
ops++;
|
||||
if (nw.equals(id)) break;
|
||||
}
|
||||
}
|
||||
return ops;
|
||||
}
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// FAST: map-based set → O(N) diff
|
||||
// -------------------------------------------------------------------------
|
||||
static long updateFederatedService_fast(List<RemoteDiscoveryID> oldSlice,
|
||||
List<RemoteDiscoveryID> newSlice) {
|
||||
long ops = 0;
|
||||
// Build new set: O(N)
|
||||
Set<RemoteDiscoveryID> newSet = new HashSet<>(newSlice);
|
||||
Set<RemoteDiscoveryID> oldSet = new HashSet<>(oldSlice);
|
||||
|
||||
// adds: for each new, O(1) map lookup
|
||||
for (RemoteDiscoveryID id : newSet) {
|
||||
ops++;
|
||||
oldSet.contains(id);
|
||||
}
|
||||
// removes: for each old, O(1) map lookup
|
||||
for (RemoteDiscoveryID id : oldSet) {
|
||||
ops++;
|
||||
newSet.contains(id);
|
||||
}
|
||||
return ops;
|
||||
}
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// Helpers
|
||||
// -------------------------------------------------------------------------
|
||||
static List<RemoteDiscoveryID> makeIDs(int count) {
|
||||
List<RemoteDiscoveryID> ids = new ArrayList<>(count);
|
||||
for (int i = 0; i < count; i++) {
|
||||
ids.add(new RemoteDiscoveryID(
|
||||
"cluster-" + (i % 5),
|
||||
"svc-" + i,
|
||||
"ns-" + (i % 10)
|
||||
));
|
||||
}
|
||||
return ids;
|
||||
}
|
||||
|
||||
static void bench(String label, long sOps, long fOps) {
|
||||
System.out.printf(" %-55s slow=%9d fast=%7d ratio=%5.1fx%n",
|
||||
label, sOps, fOps, (double) sOps / Math.max(fOps, 1));
|
||||
}
|
||||
|
||||
// -------------------------------------------------------------------------
|
||||
// Main
|
||||
// -------------------------------------------------------------------------
|
||||
public static void main(String[] args) {
|
||||
System.out.println("Linkerd2Test — CWE-407 linkerd2-0001 federated service discovery quadratic dedup");
|
||||
System.out.println();
|
||||
|
||||
// --- N=100 IDs ---
|
||||
{
|
||||
int N = 100;
|
||||
List<RemoteDiscoveryID> oldIDs = makeIDs(N);
|
||||
// new = old + 10 additions - 10 removals → simulate update
|
||||
List<RemoteDiscoveryID> newIDs = new ArrayList<>(makeIDs(N));
|
||||
newIDs.subList(0, 10).clear();
|
||||
for (int i = N; i < N + 10; i++) {
|
||||
newIDs.add(new RemoteDiscoveryID("cluster-0", "svc-" + i, "ns-0"));
|
||||
}
|
||||
|
||||
long sOps = updateFederatedService_slow(oldIDs, newIDs);
|
||||
long fOps = updateFederatedService_fast(oldIDs, newIDs);
|
||||
bench("N=100 IDs (10 adds, 10 removes)", sOps, fOps);
|
||||
assert sOps > fOps * 10 :
|
||||
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
|
||||
}
|
||||
|
||||
// --- N=500 IDs ---
|
||||
{
|
||||
int N = 500;
|
||||
List<RemoteDiscoveryID> oldIDs = makeIDs(N);
|
||||
List<RemoteDiscoveryID> newIDs = new ArrayList<>(makeIDs(N));
|
||||
newIDs.subList(0, 50).clear();
|
||||
for (int i = N; i < N + 50; i++) {
|
||||
newIDs.add(new RemoteDiscoveryID("cluster-0", "svc-" + i, "ns-0"));
|
||||
}
|
||||
|
||||
long sOps = updateFederatedService_slow(oldIDs, newIDs);
|
||||
long fOps = updateFederatedService_fast(oldIDs, newIDs);
|
||||
bench("N=500 IDs", sOps, fOps);
|
||||
assert sOps > fOps * 25 :
|
||||
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
|
||||
}
|
||||
|
||||
// --- N=1000 IDs ---
|
||||
{
|
||||
int N = 1000;
|
||||
List<RemoteDiscoveryID> oldIDs = makeIDs(N);
|
||||
List<RemoteDiscoveryID> newIDs = new ArrayList<>(makeIDs(N));
|
||||
newIDs.subList(0, 100).clear();
|
||||
for (int i = N; i < N + 100; i++) {
|
||||
newIDs.add(new RemoteDiscoveryID("cluster-0", "svc-" + i, "ns-0"));
|
||||
}
|
||||
|
||||
long sOps = updateFederatedService_slow(oldIDs, newIDs);
|
||||
long fOps = updateFederatedService_fast(oldIDs, newIDs);
|
||||
bench("N=1000 IDs", sOps, fOps);
|
||||
assert sOps > fOps * 50 :
|
||||
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
|
||||
}
|
||||
|
||||
// --- N=3000 IDs (multi-cluster stress) ---
|
||||
{
|
||||
int N = 3000;
|
||||
List<RemoteDiscoveryID> oldIDs = makeIDs(N);
|
||||
List<RemoteDiscoveryID> newIDs = new ArrayList<>(makeIDs(N));
|
||||
newIDs.subList(0, 300).clear();
|
||||
for (int i = N; i < N + 300; i++) {
|
||||
newIDs.add(new RemoteDiscoveryID("cluster-0", "svc-" + i, "ns-0"));
|
||||
}
|
||||
|
||||
long sOps = updateFederatedService_slow(oldIDs, newIDs);
|
||||
long fOps = updateFederatedService_fast(oldIDs, newIDs);
|
||||
bench("N=3000 IDs (multi-cluster stress)", sOps, fOps);
|
||||
assert sOps > fOps * 100 :
|
||||
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
|
||||
}
|
||||
|
||||
System.out.println();
|
||||
System.out.println("All assertions passed.");
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue