Surface Warning in HTTPRoute Status if Regex Program Size is over 1000

[arkodg]

          thanks for digging deeper into this @davidalger 

agree with the approach of setting error_level to UINT32_MAX and warn_level to 1000 for now

either in the same PR or different, lets also highlight this in the control plane as a status
using https://pkg.go.dev/regexp/syntax (len(prog.Inst) is a close approximation)

Originally posted by @arkodg in #2543 (comment)

[davidalger]

Doesn't look like this will be feasible since the builtin regexp package has different internals than RE2 does. Syntax wise they're similar, but it compiles differently and len(prog.Inst) does not come close to matching up with RE2 program sizes.

These two programs will cause Envoy to emit a warning:

regex '^/static/[a-zA-Z0-9._-]{0,200}/[a-zA-Z0-9._-]{0,200}$' RE2 program size of 2005 > max program size of 1000 set for the warn level threshold
regex '^/api/v1/object/[^/]{124}/action$' RE2 program size of 1003 > max program size of 1000 set for the warn level threshold

Running these through Go's regexp package produces much lower numbers which don't seem to correlate to the 'size' reported by Envoy's use of the RE2 lib:

regex "^/static/[a-zA-Z0-9._-]{0,200}/[a-zA-Z0-9._-]{0,200}$" has length: 813
regex "^/api/v1/object/[^/]{124}/action$" has length: 150

This is the Go program I used to proof this: https://go.dev/play/p/mzz-8gIS9CA

package main

import (
	"fmt"
	"regexp/syntax"
)

func main() {
	fmt.Println(validate("^/static/[a-zA-Z0-9._-]{0,200}/[a-zA-Z0-9._-]{0,200}$"))
	fmt.Println(validate("^/api/v1/object/[^/]{124}/action$"))
}

func validate(regex string) error {
	if re, err := syntax.Parse(regex, syntax.Perl); err != nil {
		return fmt.Errorf("regex %q is invalid: %w", regex, err)
	} else {
		re = re.Simplify()
		if prog, err := syntax.Compile(re); err != nil {
			return fmt.Errorf("regex %q is invalid: %w", regex, err)
		} else {
			return fmt.Errorf("regex %q has length: %d", regex, len(prog.Inst))
		}
	}
}

[arkodg]

thanks for testing this out @davidalger, found another go package based off re2 https://pkg.go.dev/github.com/wasilibs/go-re2#Compile, could this one be closer ?
cc @mathetake

[JayantDhakajd]

Hello everyone, I believe I understand the problem and would like to work on resolving the issue. If you could assign it to me, I’ll get started.
Thanks!

[JayantDhakajd]

Good Afternoon, @arkodg as suggested above I tested using package (https://pkg.go.dev/github.com/wasilibs/go-re2#Compile) and through this we can keep track which regex programs are having lengths more than 1000.
Here's the code and result I got during testing:

package main

import (
	"fmt"
	regexp "github.com/wasilibs/go-re2"
	"regexp/syntax"
)

func main() {
	fmt.Println(validate("^/static/[a-zA-Z0-9._-]{0,200}/[a-zA-Z0-9._-]{0,200}$"))
	fmt.Println(validate("^/api/v1/object/[^/]{124}/action$"))
}
func validate(regex string) error {
	if re, err := syntax.Parse(regex, syntax.Perl); err != nil {
		return fmt.Errorf("regex %q is invalid: %w", regex, err)
	} else {
		re = re.Simplify()
		if prog, err := regexp.Compile(re.String());err != nil {
			return fmt.Errorf("regex %q is invalid: %w", regex, err)
		} else {
			if len(prog.String())>1000 {
				return fmt.Errorf("Regex %q is too complex with length: %d",regex, len(prog.String()))
			}
			return fmt.Errorf("regex %q has length: %d", regex, len(prog.String()))
		}
	}
}

Regex "^/static/[a-zA-Z0-9._-]{0,200}/[a-zA-Z0-9._-]{0,200}$" is too complex with length: 8410
regex "^/api/v1/object/[^/]{124}/action$" has length: 527

[arkodg]

thanks for picking this up @JayantDhakajd, can you try and confirm those numbers with the o/p from envoy proxy ?
you could install Envoy Gateway https://gateway.envoyproxy.io/docs/tasks/quickstart/ + edit the routing config (https://gateway.envoyproxy.io/docs/tasks/traffic/http-routing/) to match on Regex instead of exact type

those numbers, shared by David, are from the envoy proxy pod logs

[JayantDhakajd]

Thanx @arkodg for assigning me, I'll give my best and will try to confirm the numbers.

[JayantDhakajd]

Good afternoon @arkodg ,
As discussed, I’ve been verifying output numbers from Envoy Proxy. Since I’m relatively new to Kubernetes, could you advise whether EKS, KinD, or Minikube would be the best setup for this task?
Additionally, I encountered an issue where http-routing on KinD is always returning false, and it seems charts.envoyproxy.io is currently down, which is impacting the setup.
If possible can you provide any guidance on this.
Thanks!

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.