internal/envoy: Regex "MaxProgramSize" too small

[stevesloka]

When deploying HTTPProxy resources which use Contains header matcher conditions, there's an error getting thrown by Envoy:

ERRO[0291] regex '.*Chrome.*' RE2 program size of 38 > max program size of 10. Increase configured max program size if necessary. 

I didn't think much of this error, but working on a different feature for Contour I found that at times all my routes would disappear from Envoy's config and I wasn't able to get them back. I found that removing the "header contains" Conditions from my Proxies, Envoy started working well again.

Other symptoms I've seen are a lack of xDS updates between Contour<>Envoy. At times, I was able to check Contour's RDS (e.g. contour cli rds) and I would see the proper config, however, it was not mirrored in Envoy's admin config.

At the moment, I've taken out the MaxProgramSize from being configured (https://github.com/projectcontour/contour/blob/master/internal/envoy/regex.go#L27) and am using Envoy's default of 100.

[jpeach]

see also envoyproxy/envoy#9174

[jpeach]

RE2 program sizes:

regex	size
.*foo.*'	35
foo.*[abcd]+ooo.*	43
x-envoy-(a|b|c)	15
x-envoy-(a|b|c)-[grep]{3}	28
a.*b.*c.*d.*e.*f.*g.*	109

So there's no clear relationship between regex length and program size other than that .* cost about 15.

[davecheney]

Can we use the re2 library to compute the cost of the regex so we can program the correct value in Envoy?

[jpeach]

re2 is a C++ library, so that's probably tricky. If the goal is to accept whatever the user gives us, then I'd say we should just send a very high value.

[davecheney]

I'm sorry I wasn't clear. I thought there was a version of re2 available in go, but I think I was mistaken -- go's regex library is based on re2, or something, anyway, I wasn't thinking straight.

[jpeach]

The xDS error handling behaviour is #1176

[jpeach]

On 13 Dec 2019, at 9:19 am, Dave Cheney ***@***.***> wrote: I'm sorry I wasn't clear. I thought there was a version of re2 available in go, but I think I was mistaken -- go's regex library is based on re2, or something, anyway, I wasn't thinking straight.

IIUC, Go uses RE2 syntax, but it's not the same code. The program size of the same regex can change across different versions of the C++ RE2 library, so if we could estimate the program size, we would still want to add a fudge factor. I don't see anything in the go regexp package that looks like program size.