Skip to content

Commit

Permalink
arg matches: raise postfix match length <5.4
Browse files Browse the repository at this point in the history
When the string and file matches relied on byte for byte matching in
BPF, postfix matches were limited to 50 chars for >=5.4 and 40 chars
<5.4. With the new hash match look ups, the >=5.4 limit was raised to
the standard 128 characters by default. For <5.4, we can now raise the
'small program' limit to 96 without exceeding the instruction count.

Signed-off-by: Kevin Sheldrake <kevin.sheldrake@isovalent.com>
  • Loading branch information
kevsecurity committed Sep 7, 2023
1 parent 941731d commit 923dd6f
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion bpf/process/string_maps.h
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ struct {
#ifdef __LARGE_BPF_PROG
#define STRING_POSTFIX_MAX_MATCH_LENGTH STRING_POSTFIX_MAX_LENGTH
#else
#define STRING_POSTFIX_MAX_MATCH_LENGTH 40
#define STRING_POSTFIX_MAX_MATCH_LENGTH 96
#endif

struct string_postfix_lpm_trie {
Expand Down

0 comments on commit 923dd6f

Please sign in to comment.