Yeaaaaa, this isn't good.
This is what CloudBleed looks like, in the wild: https://gfycat.com/ElatedJoyousDanishswedishfarmdog
A random HTTP request's data and other data injected into an HTTP response from Cloudflare.
Sick.
Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
651–660 of 1001 posts
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#652This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…
The blog post makes it seem like the problem was in an nginx module. Looking at the docs [1] it looks like that's a C API; as far as I know writing shared libraries in golang for a C caller isn't really a thing (because the runtime needs to exist). Rust might have better luck here (I _think_ there have been attempts to get rust code loaded by not-rust code), but I haven't kept track. [1] https://www.nginx.com/resourc…
Calling Rust from C is easy.
Details: http://siciarz.net/24-days-of-rust-calling-rust-from-other-l...
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#653If you must write your HTML parser in C/C++, then you should expect buffer overruns.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#654Why do they need to add google analytics to random people's web pages?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#655Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#656Does anyone know answer to this question someone is asking there at the end? Is it related?
> could you tell us why a lot of people had to re-authenticate their Google accounts on their devices all of the sudden? It may not have been related, but Google definitely did something that had us all re-authenticate.
I too had to reauthenticate and was very worried because it was first time I had to do this, I thought something bad happened with my account and it was very suspicious.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#657Earlier quoted context omitted.
Cloudflare terminates SSL and then forwards the request to your servers as one of their services. This isn't about the CDN, but about them terminating SSL, then leaking the plaintext data back through other requests.
What are the benefits of terminating SSL early at the CDN level? It seems to me the risks associated with not having SSL still remain they're just shifted to between the CDN and the backend. Is it much more than just giving lip service to SSL and getting away with things like browser restrictions, etc.?
> It seems to me the risks associated with not having SSL still remain they're just shifted to between the CDN and the backend
Exactly, it's a really bad idea for anyone who cares about their users' privacy. It's essentially an opt-in MITM attack...one that, apparently, leaks data everywhere.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#658Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#659Earlier quoted context omitted.
jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results
Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…
[deleted]
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#660Author of Ragel here. An experienced Ragel programmer would know that when you start setting the EOF pointer you are enabling code paths that never executed before. Like, potentially buggy ones. Eek!
I'm not familiar with Ragel, but you might consider adding support for SaferCPlusPlus[1] as an output target. It should be a fairly simple modification of your existing C or C++ output generator. SaferCPlusPlus was, in part, designed for this (I mean, CloudFlare's) sort of situation - using C/C++ in internet facing applications.