FelixConfiguration BPFConntrackTimeout validation: Pattern has ReDoS risk

Expected Behavior

The regular expression used for validating time duration fields (e.g., creationGracePeriod, genericTimeout) in FelixConfiguration should be safe against Regular Expression Denial of Service (ReDoS) attacks. It should efficiently validate inputs like "10s", "1h30m", or "Auto" without causing excessive CPU consumption.

Current Behavior

The current regex pattern used in the CRD validation schema contains nested quantifiers, which creates a ReDoS vulnerability. The current pattern looks like this: ^(([0-9]*(\.[0-9]*)?(ms|s|h|m|us)+)+|Auto)$ The issue lies in the nested structure: (...(unit)+)+. The inner group (ms|s|h|m|us)+ allows matching multiple units. The outer group wraps the entire "number + unit" logic and applies another +. When an attacker provides a malicious input string (e.g., 1msmsmsmsmsmsX), the regex engine (specifically RE2 or Go's regexp) will attempt to backtrack exponentially to find a match, leading to catastrophic backtracking and high CPU usage.

Possible Solution

I suggest modifying the regex pattern to eliminate the nested quantifiers while maintaining the ability to parse compound durations (like 1h30m). Proposed Regex: ^(([0-9]*(\.[0-9]*)?(ms|s|h|m|us))+|Auto)$

Context

This issue affects the FelixConfiguration CRD validation. While Kubernetes API server requests are generally trusted, allowing a ReDoS pattern in the schema validation logic poses a risk to the API server's stability if an attacker gains the ability to submit custom resources.

Your Environment

• Calico version: After v3.31.3
• Calico dataplane (bpf, nftables, iptables, windows etc.): all
• Orchestrator version (e.g. kubernetes, openshift, etc.): kubernetes
• Operating System and version: all
• Link to your project (optional):