Cloudflare outage caused by bad software deploy

Re:Cloudflare outage caused by bad software deploy by sequoia on Tuesday July 02, 2019 @05:13PM (#20339453)

What sort of regular expression pitfalls can cause this sort of CPU utilization? I know they're possible but I am curious about specific examples of something similar to what caused Cloudflare's issue here.

[ Parent | on HN ]

Re:Cloudflare outage caused by bad software deploy by roro159 on Tuesday July 02, 2019 @05:20PM (#20339507)

DoS with regex is a thing: https://www.owasp.org/index.php/Regular_expression_Denial_of...

StackOverflow had a similar case a while back: https://stackstatus.net/post/147710624694/outage-postmortem-...

[ Parent | on HN ]

Re:Cloudflare outage caused by bad software deploy by andreareina on Tuesday July 02, 2019 @06:58PM (#20340133)

HN discussion of the StackOverflow incident: https://news.ycombinator.com/item?id=12131909

[ Parent | on HN ]

Re:Cloudflare outage caused by bad software deploy by novas0x2a on Tuesday July 02, 2019 @05:20PM (#20339503)

Some regex languages allow backtracking, and backtracking is usually the thing that causes regexes to blow up in resource cost: https://www.regular-expressions.info/catastrophic.html

[ Parent | on HN ]

Re:Cloudflare outage caused by bad software deploy by edwintorok on Tuesday July 02, 2019 @07:03PM (#20340161)

You probably want a regex engine that runs in linear time:

* Google's RE2 https://github.com/google/re2/wiki/WhyRE2

* https://github.com/laurikari/tre/

There is a good series of articles about the problem: https://swtch.com/~rsc/regexp/regexp3.html

I would strongly recommend deploying such a regular expression matcher to avoid problems like this. There are examples in the above article that you can use to test anything in your production deployment that accepts regular expressions to see how well it copes.

[ Parent | on HN ]

Re:Cloudflare outage caused by bad software deploy by novas0x2a on Tuesday July 02, 2019 @07:22PM (#20340268)

Might have been a misdirect reply (although useful), but yeah, agree, linear-time regex engines are generally a much better idea.

[ Parent | on HN ]

Re:Cloudflare outage caused by bad software deploy by RcouF1uZ4gsC on Tuesday July 02, 2019 @09:36PM (#20340877)

Part of the problem is that "regular expressions" are not really regular expressions in the Chomsky sense.

Regular languages have some very nice properties relating to how they can be evaluated. Some regular expression engines have features that pulls the expressions from being a regular language into more complexity.

[ Parent | on HN ]

Re:Cloudflare outage caused by bad software deploy by ErikCorry on Tuesday July 02, 2019 @06:53PM (#20340115)

For examples check the bugs that were duped into https://bugs.chromium.org/p/v8/issues/detail?id=430

[ Parent | on HN ]

Re:Cloudflare outage caused by bad software deploy by tyingq on Tuesday July 02, 2019 @07:54PM (#20340441)

There's also other similar things in this space, like hash table collisions that can eat CPU.

[ Parent | on HN ]