Skip to content

Commit

Permalink
String: Increase prefix size from 128 to 256 chars
Browse files Browse the repository at this point in the history
The file prefix limit was originally 256 characters. When the code was
converted to use LMP TRIE maps, the limit was set to 128 characters.

This commit changes the prefix limit from 128 to 256 characters.

Signed-off-by: Kevin Sheldrake <[email protected]>
  • Loading branch information
kevsecurity committed Nov 22, 2023
1 parent 6a4c9ef commit fa29d2a
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion bpf/process/string_maps.h
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ struct {
__uint(value_size, 512);
} string_maps_ro_zero SEC(".maps");

#define STRING_PREFIX_MAX_LENGTH 128
#define STRING_PREFIX_MAX_LENGTH 256

struct string_prefix_lpm_trie {
__u32 prefixlen;
Expand Down
2 changes: 1 addition & 1 deletion pkg/selectors/selectors.go
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ const (
stringMapsKeyIncSize = 24
StringMapsNumSubMaps = 6
MaxStringMapsSize = 6*stringMapsKeyIncSize + 1
StringPrefixMaxLength = 128
StringPrefixMaxLength = 256
StringPostfixMaxLength = 128
)

Expand Down
2 changes: 1 addition & 1 deletion pkg/sensors/tracing/selectors.go
Original file line number Diff line number Diff line change
Expand Up @@ -436,7 +436,7 @@ func populateStringPrefixFilterMap(
innerSpec := &ebpf.MapSpec{
Name: innerName,
Type: ebpf.LPMTrie,
KeySize: 4 + selectors.StringPrefixMaxLength, // NB: KernelLpmTrieStringPrefix consists of 32bit prefix and 128 byte data
KeySize: 4 + selectors.StringPrefixMaxLength, // NB: KernelLpmTrieStringPrefix consists of 32bit prefix and 256 byte data
ValueSize: uint32(1),
MaxEntries: maxEntries,
Flags: bpf.BPF_F_NO_PREALLOC,
Expand Down

0 comments on commit fa29d2a

Please sign in to comment.