Limit DNS matchname/matchpattern rule lengths

[joestringer]

DNS names can only be up to 255 characters in length:

https://datatracker.ietf.org/doc/html/rfc1035#section-2.3.4

Furthermore, DNS matchpattern rules that are excessively long could cause Cilium agent to take a long time to process the rules. It would make sense to impose a (configurable?) limit on these, perhaps something like 63 to begin with.

Tasks:

• Check whether matchName statements are limited to the maximum length of a DNS name
• Create a new hidden configuration flag for max dns matchpattern string length
• Extend the CiliumNetworkPolicy sanitization logic to limit the length of DNS matchname/matchpattern rules
• Extend the preflight check to validate whether any existing CNPs or CCNPs have matchpattern / matchnames that exceed the default limits. If yes, highlight the statements. Instruct the user to configure the above Cilium flag to raise the limits to match the policies they use in their environment.

[github-actions]

This issue has been automatically marked as stale because it has not
had recent activity. It will be closed if no further activity occurs.

[github-actions]

This issue has not seen any activity since it was marked stale.
Closing.

[kwakubiney]

Stale? Interested.

[joestringer]

Hi @kwakubiney , awesome that you're interested in this topic! Feel free to write up a CFP / proposal for more discussion, or create a PR with an implementation and we can discuss on the PR. If you would like more up-front design discussion then there is the https://github.com/cilium/design-cfps/ repo which has a template for considerations for an implementation, and you can start either with a PR on that repo or a Google doc (+ link it here).