## Preserve Original Source Address within Istio Zhonghu Xu @hzxuzhonghu ## I stioCon ## About me Zhonghu Xu: an open source engineer from Huawei Cloud. - Github: https://github.com/hzxuzhonghu - Agenda Background 2 TCP Original Address Preserve HTTP Original Address Preserve Demo ## Content Background 2 TCP Original Address Preserve HTTP Original Address Preserve Demo ## What is the use use case of original address 1. Sticky Session: based on ip hash, traffic from same client is forwarded to the same backend 2. Security Policy: set white/black list 3. Access log & Stats 4. Specific

Lifetime Safety in C++ Gabor Horvath ## Announcing In Visual Studio 2022 version 17.7, # Address Sanitizer continue_on_error Mode Now Available • A new “checked build” for C and C++ • Diagnoses and json| |---| |CMakePresets.json| |CMake Debugger| |Problem Details Window| |Static Analysis| |Address Sanitizer (ASAN)| |All-In-One-Search| |Sticky Scroll| |Brace Pair Colorization| |Macro Expansion| |Spell mode)|0x4000041c read-write|333|if (val > 2047)|||| |---|---|---|---|---|---|---| Initializing WiFi MAC address: C8:93:46:88:71:4B SUCCESS: WiFi initialized ## Announcing ## GitHub Copilot Chat now in public

Versions 1.5 Messaging Concepts 1.6 Architecture 1.7 Using the Server 1.8 Upgrading 1.9 Address Model 1.10 Protocols and Interoperability 1.11 AMQP 1.12 MQTT 1.13 STOMP 1.14 OpenWire Bridges 1.56 Transformers 1.57 Duplicate Message Detection 1.58 Clusters 1.59 Federation 1.60 Address Federation 1.60.1 Queue Federation 1.60.2 High Availability and Failover 1.61 Graceful Server Support ActiveMQ5 feature JMSXGroupFirstForConsumer. - Clarify handshake timeout error with remote address. - Support duplicate detection for AMQP messages the same as core. #### 2.7. 0 Full release notes

Versions 1.5 Messaging Concepts 1.6 Architecture 1.7 Using the Server 1.8 Upgrading 1.9 Address 1.10 Model 1.10.1 Settings 1.10.2 Protocols and Interoperability 1.11 AMQP 1.12 Broker 1.57 Transformers 1.58 Duplicate Message Detection 1.59 Clusters 1.60 Federation 1.61 Address Federation 1.61.1 Queue Federation 1.61.2 High Availability and Failover 1.62 Connection Routers could potentially negatively impact broker stability. The management-message-attribute-size-limit address-setting controls this behavior. If you wish to restore the previous (and potentially dangerous behavior)

integrity (Windows 8.1 & Windows 10) CFG is complementary to other exploit mitigations, such as: Address Space Layout Randomization (ASLR) Data Execution Prevention (DEP) Modifying — Visual Studio Professional s/1/0/8/f/108f90d702d7ed2c2f8717cd7bf81ffc/p57_2.jpg) youtube.com/watch?v=0EsqxGgYOQU ## Address Sanitizer (ASan) # De facto standard for detecting memory safety issues It's important for basic correctness and sometimes true vulnerabilities github.com/google/sanitizers/wiki/AddressSanitizer ## Address Sanitizer (ASan) ## Detects: Use after free (dangling pointer dereference) Heap buffer overflow Stack

std::vector(16); return v[16]; } > clang -fsanitize=address main.cpp >=98481==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x000105701320 at pc 0x000102d8 READ of size 4 at 0x000105701320 being invoked These functions are relatively light, checking state stored in integers When the sanitizer is enabled, there is a (minimal) runtime cost ## RealtimeSanitizer has no runtime cost without -fsanitize=realtime \-Wfunction-effects\") __VA_ARGS__ _Pragma("clang diagnostic pop") #include <sanitizer rtsan_interface.h=""> void lock_error_mutex(std::mutex& m) { __rtsan::ScopedDisabler disable{};

Service and the Privacy Policy PROCEED > ## 2. Add your Artifactory repository To get the correct address, click on Application -> Artifactory -> Artifacts -> Set Me Up: SET ME UP > Enter your large or on a slow network, you might need to increase that value. You can also bind to an IPv6 address or specify both IPv4 and IPv6 addresses: $ gunicorn -b 0.0.0.0:9300 -b [::1]:9300 -w 4 -t 300 conans 'GLIBCXX_3.4.26' not found (required by / →hello) ``` Fortunately, this is much easier to address by just adding -static-libstdc++ compiler flag. Unlike C runtime, C++ runtime can be linked statically

Service and the Privacy Policy PROCEED > ## 2. Add your Artifactory repository To get the correct address, click on Application -> Artifactory -> Artifacts -> Set Me Up: SET ME UP > Enter your large or on a slow network, you might need to increase that value. You can also bind to an IPv6 address or specify both IPv4 and IPv6 addresses: $ gunicorn -b 0.0.0.0:9300 -b [::1]:9300 -w 4 -t 300 conans 'GLIBCXX_3.4.26' not found (required by / →hello) ``` Fortunately, this is much easier to address by just adding -static-libstdc++ compiler flag. Unlike C runtime, C++ runtime can be linked statically

Service and the Privacy Policy PROCEED > ## 2. Add your Artifactory repository To get the correct address, click on Application -> Artifactory -> Artifacts -> Set Me Up: SET ME UP > Enter your large or on a slow network, you might need to increase that value. You can also bind to an IPv6 address or specify both IPv4 and IPv6 addresses: $ gunicorn -b 0.0.0.0:9300 -b [::1]:9300 -w 4 -t 300 conans 'GLIBCXX_3.4.26' not found (required by / →hello) ``` Fortunately, this is much easier to address by just adding -static-libstdc++ compiler flag. Unlike C runtime, C++ runtime can be linked statically

Service and the Privacy Policy PROCEED > ## 2. Add your Artifactory repository To get the correct address, click on Application -> Artifactory -> Artifacts -> Set Me Up: SET ME UP > Enter your large or on a slow network, you might need to increase that value. You can also bind to an IPv6 address or specify both IPv4 and IPv6 addresses: $ gunicorn -b 0.0.0.0:9300 -b [::1]:9300 -w 4 -t 300 conans 'GLIBCXX_3.4.26' not found (required by / →hello) ``` Fortunately, this is much easier to address by just adding -static-libstdc++ compiler flag. Unlike C runtime, C++ runtime can be linked statically