[Varnish] #1249: Undeterministic results in regsub/regsuball

Varnish varnish-bugs at varnish-cache.org
Fri Jan 11 05:37:43 CET 2013

#1249: Undeterministic results in regsub/regsuball
 Reporter:  arthens  |       Type:  defect
   Status:  new      |   Priority:  normal
Milestone:           |  Component:  build
  Version:  3.0.3    |   Severity:  normal
 Keywords:           |
 First let me say that I'm not a varnish expert nor a C programmer, so bare
 with me if something I say is not 100% correct :) Plus given the nature of
 the bug I'm seeing it might be hard to produce a reliable test case.

 The problem:
 - some of our users get randomly asked to sign in even if they are already
 signed in
 - it seems to happen only on some specific pages, and mostly to staff
 - I managed to verify that the problem happens in our Varnish cache,
 because it never happens when hitting the PHP stack directly
 - we have ~12 regexp rules to remove tracking cookie, but we couldn't find
 anything wrong with any of them (they are pretty simple regexp, I'll
 attach them to the ticket)

 - I added some logging after each regsuball to verify which one was
 causing the problem
 - the logs suggested that there wasn't a single broken regexp, because
 sometimes it would drop all/most cookies on one regexp, sometimes on
 - we still couldn't see anything wrong with the regexp (we tested it with
 other libraries, and we were never able to reproduce the problem)

 Second investigation (here it's where it gets interesting/weird)
 - I added another regsuball rule applying one of the regexp to a fixed
 string (hardcoded in my .vcl) and noticed that the result changed based on
 where this instruction would be. In other words
 subregall("hardcoded string here", regexp, replacement)
 would produce a different result based on where it was executed (!!!)

 To be more specific, if this instruction was the first regsuball in
 vcl_recv then the result would be correct, but if I moved it AFTER the 12
 regsuball filtering our cookies then it would produce a wrong result (not
 always, I suppose this bug is only triggered by a particular

 Some other observations:
 - the problem doesn't actually seems to be related with cookies, that's
 just how we noticed it. The attached example simply use other 2 random
 - it seems like regsuball/regsub (or the underlying library) can get into
 a "broken state" that will cause subsequent calls to produce wrong results
 (but only in the same request, we never saw the bug persist across
 - I only managed to reproduce the bug using long-ish strings
 - it doesn't seem to be related with the content of the string (aka not a
 special characters problem)

 - Ubuntu 12.04
 - Varnish 3.0.3

Ticket URL: <https://www.varnish-cache.org/trac/ticket/1249>
Varnish <https://varnish-cache.org/>
The Varnish HTTP Accelerator

More information about the varnish-bugs mailing list