Nthawi yomweyo ndidalembera a Matthew Prince ndi mutu wakuti "DNS yanga ili kuti?" ndipo adabweza yankho lalitali lodzaza zaukadaulo (werengani makalata onse apa), ndinayankha kuti:
Kuchokera: John Graham-Cumming
Tsiku: October 7, 2010, 9:14
Mutu: Re: Kodi DNS yanga ili kuti?
Kwa: Matthew Prince
Ine ndikutsimikiza inu mukumvetsa izo. Mukutsimikiza kuti simukufuna munthu wanu ku Europe? π
Ndipo anayankha:
Kuchokera: Matthew Prince
Tsiku: October 7, 2010, 9:57
Mutu: Re: Kodi DNS yanga ili kuti?
Kwa: John Graham-Cumming
Zikomo. Tinayankha aliyense amene analemba. Ndikupita ku ofesi tsopano ndipo tilemba kena kake pabulogu kapena kusindikiza positi pa bolodi lathu. Ndikuvomereza kwathunthu, kukhulupirika ndi chilichonse.
Tsopano Cloudflare ndi kampani yaikulu kwambiri, ndimagwira ntchito, ndipo tsopano ndiyenera kulemba momasuka za zolakwa zathu, zotsatira zake ndi zochita zathu.
Zochitika pa July 2
Pa Julayi 2nd tidatulutsa lamulo latsopano mu Malamulo Oyendetsedwa a WAFs chifukwa chake Zida za CPU zinali kutha pa purosesa iliyonse yopangira HTTP/HTTPS traffic pa Cloudflare network padziko lonse lapansi. Tikuwongolera nthawi zonse malamulo oyendetsedwa ndi ma WAF poyankha zovuta zatsopano ndi ziwopsezo. Mwachitsanzo, mu May, tinafulumira onjezani lamulokuteteza pachiwopsezo chachikulu cha SharePoint. Mfundo yonse ya WAF yathu ndikutha kuyika malamulo mwachangu komanso padziko lonse lapansi.
Tsoka ilo, zosintha za Lachinayi lapitali zinali ndi mawu okhazikika omwe adawononga zinthu zambiri za HTTP/HTTPS CPU pakubweza kumbuyo. Ntchito zathu za proxy, CDN, ndi WAF zinavutika chifukwa chake. Chithunzichi chikuwonetsa kuti zida za purosesa zothandizira HTTP/HTTPS zimafikira pafupifupi 100% pa maseva pamaneti athu.
Kugwiritsa ntchito CPU pamalo amodzi pazochitika
Zotsatira zake, makasitomala athu (ndi makasitomala amakasitomala athu) adakhala ndi tsamba lolakwika la 502 m'madomeni a Cloudflare. Zolakwa 502 zidapangidwa ndi ma seva akutsogolo a Cloudflare omwe akadali ndi ma cores aulere koma osatha kulumikizana ndi njira zoyendetsera HTTP/HTTPS.
Tikudziwa kuti izi zasokoneza makasitomala athu. Tili ndi manyazi kwambiri. Ndipo kulephera uku kwatilepheretsa kuchita bwino ndi zomwe zidachitikazo.
Ngati munali mmodzi wa makasitomala awa, mwina mumachita mantha, okwiya komanso okhumudwa. Komanso, sitinakhalepo ndi a chisokonezo padziko lonse. Kugwiritsa ntchito kwambiri kwa CPU kudachitika chifukwa cha lamulo limodzi la WAF lomwe silinatchulidwe momveka bwino zomwe zidapangitsa kuti anthu abwerere m'mbuyo kwambiri. Nawa mawu olakwa: (?:(?:"|'|]|}||d|(?:nan|infinity|true|false|null|undefined|symbol|math)|`|-|+)+[)]*;?((?:s|-|~|!|{}||||+)*.*(?:.*=.*)))
Ngakhale izi ndizosangalatsa pazokha (ndipo ndilankhula mwatsatanetsatane pansipa), ntchito ya Cloudflare idatsika kwa mphindi 27 osati chifukwa cha mawu oyipa nthawi zonse. Zinatitengera nthawi kuti tifotokoze ndondomeko ya zochitika zomwe zinapangitsa kuti tilephere, choncho tinachedwa kuyankha. Kumapeto kwa positi, ndikufotokozerani za kubwereranso m'mawu okhazikika ndikukuuzani zoyenera kuchita nazo.
Zomwe zachitika
Tiyeni tiyambe mwadongosolo. Nthawi zonse pano ali ku UTC.
Nthawi ya 13:42 p.m., injiniya wa gulu la firewall adasintha pang'ono malamulo ozindikira. XSS pogwiritsa ntchito njira yokha. Chifukwa chake, tikiti yopempha kusintha idapangidwa. Timayendetsa matikiti oterowo kudzera ku Jira (chithunzi pansipa).
Pambuyo pa mphindi 3, tsamba loyamba la PagerDuty lidawonekera, likunena vuto ndi WAF. Uku kunali kuyesa kopanga komwe kumayesa magwiridwe antchito a WAF (tili ndi mazana aiwo) kunja kwa Cloudflare kuwunika momwe ntchito ikuyendera. Izi zidatsatiridwa nthawi yomweyo ndi masamba a zidziwitso za mayeso ena a Cloudflare-to-mapeto akulephera, zovuta zamagalimoto padziko lonse lapansi, zolakwika 502 zofala, komanso matani a malipoti ochokera ku Points of Presence (PoP) m'mizinda padziko lonse lapansi zomwe zikuwonetsa kusowa. za CPU zothandizira.
Ndinalandira machenjezo angapo, ndinatuluka pamsonkhano, ndipo ndinali paulendo wopita ku tebulo pamene mkulu wa dipatimenti yathu yopititsa patsogolo mayankho adanena kuti tataya 80% ya magalimoto athu. Ndinathamangira kwa akatswiri athu a SRE, omwe anali akugwira ntchito kale pa vutoli. Poyamba tinkaganiza kuti ndi kuukira kosadziwika.
Mainjiniya a Cloudflare SRE amwazikana padziko lonse lapansi ndikuwunika momwe zinthu zilili nthawi yonseyi. Nthawi zambiri, zidziwitso izi zimakudziwitsani za zovuta zakumaloko zocheperako, zimatsatiridwa pazidashibodi zamkati, ndipo zimathetsedwa kangapo patsiku. Koma masamba awa ndi zidziwitso zidawonetsa chinthu chovuta kwambiri, ndipo mainjiniya a SRE adalengeza nthawi yomweyo kuchuluka kwamphamvu P0 ndikulumikizana ndi oyang'anira ndi mainjiniya amachitidwe.
Akatswiri athu a ku London anali kumvetsera nkhani mβholo yaikulu panthawiyo. Nkhaniyo inayenera kusokonezedwa, aliyense anasonkhana mβchipinda chachikulu cha misonkhano, ndipo akatswiri enanso anaitanidwa. Ili silinali vuto lomwe ma SRE amatha kuthana nawo okha. Zinali zofulumira kuphatikizira akatswiri oyenerera.
Pa 14:00 tinatsimikiza kuti vuto linali ndi WAF ndipo panalibe kuwukira. Gulu lochita masewerawa lidakoka zambiri za CPU ndipo zidawonekeratu kuti WAF ndiye adayambitsa. Wogwira ntchito wina adatsimikizira chiphunzitsochi pogwiritsa ntchito strace. Winawake adawona m'zipikazo kuti pali vuto ndi WAF. Pa 14:02 p.m., gulu lonse linabwera kwa ine pamene likufuna kugwiritsa ntchito kupha padziko lonse, makina opangidwa mu Cloudflare omwe amatseka chigawo chimodzi padziko lonse lapansi.
Pa 14:52 tinali otsimikiza kuti tamvetsetsa chifukwa chake ndikuwongolera, ndikuwongolera WAF kachiwiri.
Momwe Cloudflare imagwirira ntchito
Cloudflare ili ndi gulu la mainjiniya odzipereka kuti aziwongolera malamulo a WAFs. Amayesetsa kuwongolera ziwopsezo zodziwikiratu, kuchepetsa zonena zabodza, ndikuyankha mwachangu kuwopseza kwatsopano akamatuluka. M'masiku 60 apitawa, pakhala zopempha zosintha 476 zomwe zasinthidwa pamalamulo oyendetsedwa ndi WAF (avareji imodzi mwamaola atatu aliwonse).
Kusintha kwapadera kumeneku kuyenera kutumizidwa mumayendedwe oyerekeza, pomwe magalimoto enieni amakasitomala amadutsa mulamulo, koma palibe chomwe chatsekedwa. Timagwiritsa ntchito njirayi kuti tiyese mphamvu ya malamulo ndikuyesa zolakwika zabodza ndi zabodza. Koma ngakhale mumayendedwe oyerekeza, malamulowo ayenera kuchitidwa, ndipo pamenepa lamuloli limakhala ndi mawu okhazikika omwe amawononga kwambiri purosesa.
Monga mukuonera pa pempho losintha pamwambapa, tili ndi ndondomeko yotumizira, ndondomeko yobweza, ndi ulalo wa ndondomeko yoyendetsera mkati (SOP) yamtunduwu. SOP yosintha lamulo imalola kuti lifalitsidwe padziko lonse lapansi. Kwenikweni, ku Cloudflare, zinthu zimachitika mosiyana kwambiri, ndipo SOP imatiuza kuti tiyambe kutumiza mapulogalamuwa kuti ayesedwe ndikugwiritsa ntchito mkati kumalo amkati (PoP) (omwe ogwira ntchito athu amagwiritsa ntchito), kenako kwa makasitomala ochepa. malo akutali, kenako kwa ogula ambiri, kenako kudziko lonse lapansi.
Izi ndi momwe zimawonekera. Timagwiritsa ntchito git mkati kudzera pa BitBucket. Mainjiniya omwe akugwira ntchito pazosintha amatumiza ma code, omwe amamangidwa ku TeamCity, ndipo nyumbayo ikadutsa, owunikira amapatsidwa. Pempho kukoka litavomerezedwa, code imasonkhanitsidwa ndipo mayeso angapo amayendetsedwa (kachiwiri).
Ngati kumanga ndi kuyesa kutha bwino, pempho losintha limapangidwa ku Jira ndipo woyang'anira woyenera kapena mtsogoleri ayenera kuvomereza kusinthaku. Pambuyo pa kuvomerezedwa, kutumizidwa kumachitika kumalo otchedwa "PoP menagerie": GALU, PIG ndi Canary (galu, nkhumba ndi canary).
DOG PoP ndi Cloudflare PoP (monga mizinda yathu yonse) yomwe imagwiritsidwa ntchito ndi ogwira ntchito ku Cloudflare okha. PoP yogwiritsidwa ntchito mkati imakupatsani mwayi wopeza zovuta magalimoto a makasitomala asanayambe kulowa yankho. Chinthu chothandiza.
Ngati mayeso a GALU apambana, code imasunthira ku PIG (guinea pig). Iyi ndi Cloudflare PoP, pomwe kachulukidwe kakang'ono kamakasitomala aulere kamayenda kudzera mu code yatsopano.
Ngati zonse zili bwino, code imapita ku Canary. Tili ndi ma Canary PoP atatu kumadera osiyanasiyana padziko lapansi. Mwa iwo, kuchuluka kwa makasitomala olipidwa ndi aulere kumadutsa mu code yatsopano, ndipo iyi ndiye cheke chomaliza cha zolakwika.
Pulogalamu Yotulutsa Mapulogalamu ku Cloudflare
Ngati code ili bwino ku Canary, timayimasula. Kudutsa magawo onse - GALU, PIG, Canary, dziko lonse lapansi - zimatenga maola angapo kapena masiku, kutengera kusintha kwa code. Chifukwa cha kusiyanasiyana kwa netiweki ya Cloudflare komanso makasitomala, timayesa kachidindo tisanawatulutse padziko lonse lapansi kwa makasitomala onse. Koma WAF samatsata ndondomekoyi chifukwa ziwopsezo ziyenera kuyankhidwa mwachangu.
Zowopsa za WAF
M'zaka zingapo zapitazi, pakhala kuwonjezeka kwakukulu kwa ziwopsezo pakugwiritsa ntchito wamba. Izi ndichifukwa cha kupezeka kwakukulu kwa zida zoyesera mapulogalamu. Mwachitsanzo, ife posachedwapa analemba za fuzzing).
Munjira yophatikizira, algorithm sigwira ntchito ndi zizindikiro. Imapereka malangizo ku code yopangidwa. Kupha kumathamanga kwambiri - mutapereka deta pamwamba pa mndandanda wamakono, imangofufuza zilembo zonse zomwe zingatheke motsatizana m'mawu okhazikika.
Ma algorithm ophatikizira ndi osakira akuphatikizidwa mumkonzi wogawana nthawi ngati kusaka kwanthawi zonse. Zoonadi, izi siziri kutali ndi ntchito yokhayo ya kufufuza koteroko. Mwachitsanzo, kusinthika kwa algorithm iyi kumagwiritsidwa ntchito ngati kusaka chizindikiro patebulo mu assembler.
Zikuganiziridwa kuti owerenga amadziwa mawu okhazikika komanso chilankhulo cha pulogalamu ya pakompyuta ya IBM 7094.
Wopanga
Wopangayo amakhala ndi magawo atatu omwe akuyenda molumikizana. Gawo loyamba ndi kusefa kwa syntax, komwe kumalola kuti mawu okhazikika azitha kudutsamo. Sitepe iyi imayikanso "Β·" wogwiritsa ntchito kuti agwirizane ndi mawu okhazikika. Mu gawo lachiwiri, mawu okhazikika amasinthidwa kukhala mawonekedwe a postfix. Pa gawo lachitatu, code code imapangidwa. Magawo awiri oyamba ndi odziwikiratu, ndipo sitikhala pa iwo.
Nkhani ya Thompson sichinena za makina amtundu wa nondeterministic finite state, koma imalongosola ndondomeko ya nthawi yeniyeni bwino ndipo imapereka pulogalamu ya ALGOL-60 yomwe imapanga kachidindo ka chinenero cha msonkhano kwa IBM 7094. Kukhazikitsa ndizovuta, koma lingaliro ndilosavuta.
njira yakusaka. Imayimiridwa ndi β chithunzi chokhala ndi cholowetsa chimodzi ndi zotulutsa ziwiri.
Chithunzi 1 chikuwonetsa ntchito za gawo lachitatu lophatikizira posintha chitsanzo chokhazikika. Zilembo zitatu zoyambirira pachitsanzozi ndi a, b, c, ndipo aliyense amapanga zolowa S[i] ndi gawo la NNODE.
Umu ndi momwe mawu okhazikika angawonekere .*.*=.*, ngati mukuganiza ngati muzithunzi zochokera m'nkhani ya Thompson.
Mku. 0 pali zigawo zisanu kuyambira ku 0, ndi 3 kuzungulira komwe kumayambira ku chigawo 1, 2 ndi 3. .* m'mawu okhazikika. Ma oval 3 okhala ndi madontho amafanana ndi chizindikiro chimodzi. Chowulungika ndi chizindikiro = zimagwirizana ndi munthu weniweni =. State 4 ndi yomaliza. Ngati tifika, ndiye kuti mawu okhazikika amafanana.
Kuti algorithm iyi igwire ntchito, makina aboma ayenera kukhala m'maboma angapo nthawi imodzi. Makina osakhazikika omaliza apanga masinthidwe onse munthawi imodzi.
Isanakhale ndi nthawi yowerengera zomwe zalowetsedwa, imapita m'magawo onse awiri (1 ndi 2), monga zikuwonetsedwa mkuyu. 2.
Mku. 2 ikuwonetsa zomwe zimachitika akayang'ana koyamba x Π² x=x. x akhoza kupanga mapu mpaka pamwamba, kuchoka ku boma 1 ndi kubwerera ku chigawo 1. Kapena x akhoza kupanga mapu mpaka pansi, kuchoka ku chigawo 2 ndi kubwerera ku chigawo cha 2.
Pambuyo pofananiza woyamba x Π² x=x tikadali mu zigawo 1 ndi 2. Sitingathe kufikira gawo 3 kapena 4 chifukwa timafunikira munthu weniweni. =.
Algorithm ndiye imaganizira = Π² x=x. Monga x isanachitike, imatha kufananizidwa ndi imodzi mwa malupu awiri apamwamba kuchokera ku boma 1 kupita ku 1 kapena kuchokera ku boma 2 kupita ku 2, koma algorithm imatha kufanana ndi zenizeni. = ndi kuchoka ku boma 2 kupita ku 3 (ndipo nthawi yomweyo 4). Izi zikuwonetsedwa mkuyu. 3.
Kenako algorithm imapitilira mpaka yomaliza x Π² x=x. Kuchokera ku zigawo 1 ndi 2 kusintha komweko ndi kotheka kubwerera ku zigawo 1 ndi 2. Kuchokera ku boma 3 x akhoza kufanana ndi mfundo kumanja ndi kubwerera ku chigawo 3.
Pa nthawi imeneyi, aliyense khalidwe x=x amaganiziridwa, ndipo popeza tafika gawo la 4, mawu okhazikika amafanana ndi chingwecho. Chikhalidwe chilichonse chimakonzedwa kamodzi, kotero kuti aligorivimu ili ndi mzere muutali wa chingwe cholowetsa. Ndipo palibe kubwerera m'mbuyo.
Mwachiwonekere, atafika ku state 4 (pamene algorithm yafanana x=) mawu onse okhazikika amafananizidwa, ndipo algorithm ikhoza kutha popanda kuganizira konse x.
Algorithm iyi imadalira motsatana ndi kukula kwa chingwe cholowetsa.