Skip to content

POC: VRF-aware IP matching in the graph matcher#566

Draft
ldrozdz93 wants to merge 1 commit into
developfrom
poc/vrf-aware-ip-graph-matching
Draft

POC: VRF-aware IP matching in the graph matcher#566
ldrozdz93 wants to merge 1 commit into
developfrom
poc/vrf-aware-ip-graph-matching

Conversation

@ldrozdz93

Copy link
Copy Markdown

AFK POC

Address-only IPAddress match rule collapses same-address/different-VRF IPs
to one graph node. Add ipAddress.vrf.name as a required primary rule (paths
switched to camelCase to match stored protojson) so they stay distinct.

POC only. Proof + drift notes in controller-integrations
.session/diode-graph-vrf-proof/PROOF.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

Vulnerability Scan: Failed — diode-auth

Image: diode-auth:scan

Source Library CVE Severity Installed Fixed Title
usr/bin/hydra github.com/docker/docker CVE-2026-34040 🟠 HIGH v28.3.3+incompatible 29.3.1 Moby: Moby: Authorization bypass vulnerability
usr/bin/hydra github.com/docker/docker CVE-2026-33997 🟡 MEDIUM v28.3.3+incompatible 29.3.1 moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plu
usr/bin/hydra github.com/go-jose/go-jose/v3 CVE-2026-34986 🟠 HIGH v3.0.4 3.0.5 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-33815 🔴 CRITICAL v5.7.5 5.9.0 github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-33816 🔴 CRITICAL v5.7.5 5.9.0 github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability
usr/bin/hydra github.com/jackc/pgx/v5 CVE-2026-41889 ⚪ LOW v5.7.5 5.9.2 github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditio
usr/bin/hydra go.opentelemetry.io/otel CVE-2026-29181 🟠 HIGH v1.40.0 1.41.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service
usr/bin/hydra go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp CVE-2026-39882 🟡 MEDIUM v1.37.0 1.43.0 github.com/open-telemetry/opentelemetry-go: golang: OpenTelemetry-Go: Memory exh
usr/bin/hydra go.opentelemetry.io/otel/sdk CVE-2026-39883 🟠 HIGH v1.40.0 1.43.0 github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code exe
usr/bin/hydra golang.org/x/crypto CVE-2026-39828 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution
usr/bin/hydra golang.org/x/crypto CVE-2026-39829 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted
usr/bin/hydra golang.org/x/crypto CVE-2026-39830 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource
usr/bin/hydra golang.org/x/crypto CVE-2026-39831 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to mis
usr/bin/hydra golang.org/x/crypto CVE-2026-39832 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass du
usr/bin/hydra golang.org/x/crypto CVE-2026-39835 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via
usr/bin/hydra golang.org/x/crypto CVE-2026-42508 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts:
usr/bin/hydra golang.org/x/crypto CVE-2026-46595 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to sk
usr/bin/hydra golang.org/x/crypto CVE-2026-46597 🟠 HIGH v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted
usr/bin/hydra golang.org/x/crypto CVE-2026-39827 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via
usr/bin/hydra golang.org/x/crypto CVE-2026-39833 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass du
usr/bin/hydra golang.org/x/crypto CVE-2026-39834 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due
usr/bin/hydra golang.org/x/crypto CVE-2026-46598 🟡 MEDIUM v0.46.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of
usr/bin/hydra golang.org/x/net CVE-2026-25681 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross
usr/bin/hydra golang.org/x/net CVE-2026-27136 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via H
usr/bin/hydra golang.org/x/net CVE-2026-33814 🟠 HIGH v0.48.0 0.53.0 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service
usr/bin/hydra golang.org/x/net CVE-2026-39821 🟠 HIGH v0.48.0 0.55.0 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escala
usr/bin/hydra golang.org/x/net CVE-2026-25680 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive
usr/bin/hydra golang.org/x/net CVE-2026-42502 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via u
usr/bin/hydra golang.org/x/net CVE-2026-42506 🟡 MEDIUM v0.48.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arb
usr/bin/hydra google.golang.org/grpc GHSA-hrxh-6v49-42gf 🟠 HIGH v1.79.3 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
usr/bin/hydra stdlib CVE-2026-25679 🟠 HIGH v1.26.0 1.25.8, 1.26.1 net/url: Incorrect parsing of IPv6 host literals in net/url
usr/bin/hydra stdlib CVE-2026-27137 🟠 HIGH v1.26.0 1.26.1 crypto/x509: Incorrect enforcement of email constraints in crypto/x509
usr/bin/hydra stdlib CVE-2026-27145 🟠 HIGH v1.26.0 1.25.11, 1.26.4 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive process
usr/bin/hydra stdlib CVE-2026-32280 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certific
usr/bin/hydra stdlib CVE-2026-32281 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certifica
usr/bin/hydra stdlib CVE-2026-32283 🟠 HIGH v1.26.0 1.25.9, 1.26.2 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key up
usr/bin/hydra stdlib CVE-2026-33810 🟠 HIGH v1.26.0 1.26.2 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorr
usr/bin/hydra stdlib CVE-2026-33811 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net: golang: Go net package: Denial of Service via long CNAME response in Lookup
usr/bin/hydra stdlib CVE-2026-33814 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service
usr/bin/hydra stdlib CVE-2026-39820 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
usr/bin/hydra stdlib CVE-2026-39822 🟠 HIGH v1.26.0 1.25.12, 1.26.5, 1.27.0-rc.2 os: golang: Go os.Root: Symlink following vulnerability allows directory travers
usr/bin/hydra stdlib CVE-2026-39836 🟠 HIGH v1.26.0 1.25.10, 1.26.3 ELSA-2026-22121: golang security update (IMPORTANT)
usr/bin/hydra stdlib CVE-2026-42499 🟠 HIGH v1.26.0 1.25.10, 1.26.3 net/mail: golang: net/mail: Denial of Service via pathological email address par
usr/bin/hydra stdlib CVE-2026-42504 🟠 HIGH v1.26.0 1.25.11, 1.26.4 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
usr/bin/hydra stdlib CVE-2026-27142 🟡 MEDIUM v1.26.0 1.25.8, 1.26.1 html/template: URLs in meta content attribute actions are not escaped in html/te
usr/bin/hydra stdlib CVE-2026-32282 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
usr/bin/hydra stdlib CVE-2026-32288 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously
usr/bin/hydra stdlib CVE-2026-32289 🟡 MEDIUM v1.26.0 1.25.9, 1.26.2 html/template: golang: html/template: Cross-Site Scripting (XSS) via improper co
usr/bin/hydra stdlib CVE-2026-39823 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 html/template: golang: Go html/template: Cross-Site Scripting via improper URL e
usr/bin/hydra stdlib CVE-2026-39825 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query
usr/bin/hydra stdlib CVE-2026-39826 🟡 MEDIUM v1.26.0 1.25.10, 1.26.3 html/template: golang: html/template: Cross-site scripting due to incorrect scri
usr/bin/hydra stdlib CVE-2026-42505 🟡 MEDIUM v1.26.0 1.25.12, 1.26.5, 1.27.0-rc.2 crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client He
usr/bin/hydra stdlib CVE-2026-42507 🟡 MEDIUM v1.26.0 1.25.11, 1.26.4 net/textproto: golang: Golang net/textproto: Misleading error messages via input
usr/bin/hydra stdlib CVE-2026-27138 ⚪ LOW v1.26.0 1.26.1 crypto/x509: Panic in name constraint checking for malformed certificates in cry
usr/bin/hydra stdlib CVE-2026-27139 ⚪ LOW v1.26.0 1.25.8, 1.26.1 os: FileInfo can escape from a Root in golang os module
usr/local/bin/authmanager google.golang.org/grpc GHSA-hrxh-6v49-42gf 🟠 HIGH v1.79.3 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
usr/local/bin/diode-server google.golang.org/grpc GHSA-hrxh-6v49-42gf 🟠 HIGH v1.79.3 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Commit: 081ac39

@github-actions

Copy link
Copy Markdown

Vulnerability Scan: Failed — diode-reconciler

Image: diode-reconciler:scan

Source Library CVE Severity Installed Fixed Title
usr/local/bin/diode-server google.golang.org/grpc GHSA-hrxh-6v49-42gf 🟠 HIGH v1.79.3 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Commit: 081ac39

@github-actions

Copy link
Copy Markdown

Go test coverage

STATUS ELAPSED PACKAGE COVER PASS FAIL SKIP
🟢 PASS 1.43s github.com/netboxlabs/diode/diode-server/auth 44.7% 42 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/auth/cli 0.0% 0 0 0
🟢 PASS 1.03s github.com/netboxlabs/diode/diode-server/authutil 82.8% 5 0 0
🟢 PASS 0.20s github.com/netboxlabs/diode/diode-server/dbstore/postgres 0.0% 0 0 0
🟢 PASS 1.13s github.com/netboxlabs/diode/diode-server/entityhash 79.2% 13 0 0
🟢 PASS 1.15s github.com/netboxlabs/diode/diode-server/entitymatcher 82.8% 100 0 0
🟢 PASS 0.09s github.com/netboxlabs/diode/diode-server/errors 0.0% 0 0 0
🟢 PASS 1.18s github.com/netboxlabs/diode/diode-server/graph 52.0% 81 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/grpckeepalive 100.0% 1 0 0
🟢 PASS 1.54s github.com/netboxlabs/diode/diode-server/ingester 85.4% 66 0 0
🟢 PASS 1.16s github.com/netboxlabs/diode/diode-server/matching 94.1% 66 0 0
🟢 PASS 1.08s github.com/netboxlabs/diode/diode-server/migrator 70.4% 4 0 0
🟢 PASS 3.13s github.com/netboxlabs/diode/diode-server/netboxdiodeplugin 46.8% 23 0 0
🟢 PASS 0.18s github.com/netboxlabs/diode/diode-server/pprof 0.0% 0 0 0
🟢 PASS 5.10s github.com/netboxlabs/diode/diode-server/reconciler 74.8% 102 0 0
🟢 PASS 0.10s github.com/netboxlabs/diode/diode-server/reconciler/changeset 0.0% 0 0 0
🟢 PASS 1.06s github.com/netboxlabs/diode/diode-server/reconciler/differ 49.3% 23 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/server 85.7% 14 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/strcase 100.0% 24 0 0
🟢 PASS 1.02s github.com/netboxlabs/diode/diode-server/telemetry 26.2% 26 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/telemetry/otel 90.2% 25 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/tls 65.2% 6 0 0
🟢 PASS 1.01s github.com/netboxlabs/diode/diode-server/version 100.0% 2 0 0

Total coverage: 55.1%

@github-actions

Copy link
Copy Markdown

Vulnerability Scan: Failed — diode-ingester

Image: diode-ingester:scan

Source Library CVE Severity Installed Fixed Title
usr/local/bin/diode-server google.golang.org/grpc GHSA-hrxh-6v49-42gf 🟠 HIGH v1.79.3 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Commit: 081ac39

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR is a proof-of-concept to make IP address entity matching VRF-aware by aligning matching rule field paths with the JSON shape the graph stores and by including VRF identity in the match criteria.

Changes:

  • Update the example entity matching config to use protojson-style ipAddress.* paths and include ipAddress.vrf.name in IP identity.
  • Add a focused unit test suite that exercises Matcher.FindBestMatch against an in-memory NodeFinder to demonstrate/address VRF collisions and field-path drift.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
diode-server/examples/entity_matching_config.yaml Updates IPAddress matching rules to use ipAddress.* paths and add VRF name to prevent cross-VRF collapses.
diode-server/entitymatcher/vrf_ip_matching_test.go Adds POC tests validating how field paths and VRF affect IPAddress matching behavior.
Comments suppressed due to low confidence (2)

diode-server/examples/entity_matching_config.yaml:104

  • Requiring ipAddress.vrf.name will prevent matching (and likely increase duplicate nodes) for IP addresses that have no VRF set (global VRF). IPAddress.vrf is optional in the proto, and the codebase already constructs IPAddress entities without a VRF (e.g., reconciler/server_internal_test.go:169–172). Consider either normalizing “global VRF” to an explicit VRF value at ingestion time, or updating the matcher/config semantics so “missing on both sides” can be treated as a match for this identity field.
      - field_path: "ipAddress.vrf.name"
        match_type: exact
        weight: 1.0
        required: true
        confidence: 0.95

diode-server/entitymatcher/vrf_ip_matching_test.go:47

  • In the in-memory finder, JSON unmarshal errors are silently ignored, which can make tests pass/fail for the wrong reason if node Data is malformed. It’s safer to fail fast (return the error) so the test output clearly indicates bad fixture data.
		var m map[string]any
		if err := json.Unmarshal(n.Data, &m); err != nil {
			continue
		}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +86 to +90
# POC (VRF-aware IP matching): paths are camelCase to match the protojson the
# graph actually stores/serialises (`ipAddress`, not `ip_address`), and
# `ipAddress.vrf.name` is added so two allocations of the same address in
# different VRFs stay distinct nodes. rd is intentionally ignored; VRF name
# is sufficient identity. See .session/diode-graph-vrf-proof/PROOF.md.
Comment on lines +3 to +6
// POC + PROOF: does the diode graph matcher honour VRF when matching IP addresses?
//
// Full write-up: .session/diode-graph-vrf-proof/PROOF.md
//
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants