[Varnish] #1249: Undeterministic results in regsub/regsuball

[Varnish]

#1249: Undeterministic results in regsub/regsuball
---------------------+--------------------
 Reporter:  arthens  |       Type:  defect
   Status:  new      |   Priority:  normal
Milestone:           |  Component:  build
  Version:  3.0.3    |   Severity:  normal
 Keywords:           |
---------------------+--------------------
 First let me say that I'm not a varnish expert nor a C programmer, so bare
 with me if something I say is not 100% correct :) Plus given the nature of
 the bug I'm seeing it might be hard to produce a reliable test case.


 The problem:
 - some of our users get randomly asked to sign in even if they are already
 signed in
 - it seems to happen only on some specific pages, and mostly to staff
 users
 - I managed to verify that the problem happens in our Varnish cache,
 because it never happens when hitting the PHP stack directly
 - we have ~12 regexp rules to remove tracking cookie, but we couldn't find
 anything wrong with any of them (they are pretty simple regexp, I'll
 attach them to the ticket)


 Investigation:
 - I added some logging after each regsuball to verify which one was
 causing the problem
 - the logs suggested that there wasn't a single broken regexp, because
 sometimes it would drop all/most cookies on one regexp, sometimes on
 another
 - we still couldn't see anything wrong with the regexp (we tested it with
 other libraries, and we were never able to reproduce the problem)


 Second investigation (here it's where it gets interesting/weird)
 - I added another regsuball rule applying one of the regexp to a fixed
 string (hardcoded in my .vcl) and noticed that the result changed based on
 where this instruction would be. In other words
 {{{
 subregall("hardcoded string here", regexp, replacement)
 }}}
 would produce a different result based on where it was executed (!!!)


 To be more specific, if this instruction was the first regsuball in
 vcl_recv then the result would be correct, but if I moved it AFTER the 12
 regsuball filtering our cookies then it would produce a wrong result (not
 always, I suppose this bug is only triggered by a particular
 setup/cookies).

 Some other observations:
 - the problem doesn't actually seems to be related with cookies, that's
 just how we noticed it. The attached example simply use other 2 random
 headers
 - it seems like regsuball/regsub (or the underlying library) can get into
 a "broken state" that will cause subsequent calls to produce wrong results
 (but only in the same request, we never saw the bug persist across
 requests)
 - I only managed to reproduce the bug using long-ish strings
 - it doesn't seem to be related with the content of the string (aka not a
 special characters problem)

 Environment:
 - Ubuntu 12.04
 - Varnish 3.0.3

-- 
Ticket URL: <https://www.varnish-cache.org/trac/ticket/1249>
Varnish <https://varnish-cache.org/>
The Varnish HTTP Accelerator