Jump to content

Recommended Posts

Posted (edited)

https://www.theregister.co.uk/2019/06/24/cloudflare_route_leak/

 

Not really much info, but the article might expand as time goes on.

 

Yeah general all round weirdness today. Also... Discord!? :twitch:

Lol yep that was how I noticed it. Discord asplode.

 

Edit: Cloudflare have declared the issue 'resolved'

Route Leak Impacting Cloudflare

Resolved - Traffic levels have returned to normal now that the route leak has been fixed. We are now marking this incident as resolved.

Jun 24, 13:02 UTC

[Source - Cloudflare Status page]

 

Except services are still down. :confused2:

Edited by Garacesh
Posted

Yesterday's 30 minute Cloudflare outage was caused by a bad regular expression. 🤔

 

Cloudflare outage caused by bad software deploy

 

Starting at 13:42 UTC today we experienced a global outage across our network that resulted in visitors to Cloudflare-proxied domains being shown 502 errors ("Bad Gateway"). The cause of this outage was deployment of a single misconfigured rule within the Cloudflare Web Application Firewall (WAF) during a routine deployment of new Cloudflare WAF Managed rules.

 

The intent of these new rules was to improve the blocking of inline JavaScript that is used in attacks. These rules were being deployed in a simulated mode where issues are identified and logged by the new rule but no customer traffic is actually blocked so that we can measure false positive rates and ensure that the new rules do not cause problems when they are deployed into full production.

 

Unfortunately, one of these rules contained a regular expression that caused CPU to spike to 100% on our machines worldwide. This 100% CPU spike caused the 502 errors that our customers saw. At its worst traffic dropped by 82%.

  • Thanks 1
Posted
Yesterday's 30 minute Cloudflare outage was caused by a bad regular expression. [emoji848]

 

 

“Oh sh**” ?!

  • 2 weeks later...
Posted
Yesterday's 30 minute Cloudflare outage was caused by a bad regular expression.

Cloudflare have posted a full post-mortem on the recent outage....

 

https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019

 

To fully understand how
[b](??:"|'|\]|\}|\\|\d|(?:nan|infinity|true|false|null|undefined|symbol|math)|\`|\-|\+)+[)]*;?((?:\s|-|~|!|{}|\|\||\+)*.*(?:.*=.*)))[/b]

caused CPU exhaustion you need to understand a little about how a standard regular expression engine works. The critical part is .*(?:.*=.*). The (?: and matching ) are a non-capturing group (i.e. the expression inside the parentheses is grouped together as a single expression).

 

For the purposes of the discussion of why this pattern causes CPU exhaustion we can safely ignore it and treat the pattern as .*.*=.*. When reduced to this, the pattern obviously looks unnecessarily complex; but what's important is any "real-world" expression (like the complex ones in our WAF rules) that ask the engine to "match anything followed by anything" can lead to catastrophic backtracking. Here’s why.

 

The blog post is an interesting read if you use regular expressions. :)

  • Thanks 1

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



×
×
  • Create New...