Use Google RE2 as underlying regex engine

This introduces guaranteed upper bounds for memory usage and
CPU time during regex evaluation. Most importantly, it removes
the danger of catastrophic backtracking that is currrently
present in GCC's std::regex implementation.

With this commit, RE2 will be used instead of std::regex for:
* Document selection regex/glob operators
* Attribute regex search
* Evaluation of mTLS authorization rules

10 files changed, 317 insertions, 67 deletions

diff --git a/vespalib/src/tests/net/tls/policy_checking_certificate_verifier/policy_checking_certificate_verifier_test.cpp b/vespalib/src/tests/net/tls/policy_checking_certificate_verifier/policy_checking_certificate_verifier_test.cpp
index ad45c217701..a9e823bf3ab 100644
--- a/vespalib/src/tests/net/tls/policy_checking_certificate_verifier/policy_checking_certificate_verifier_test.cpp
+++ b/vespalib/src/tests/net/tls/policy_checking_certificate_verifier/policy_checking_certificate_verifier_test.cpp
@@ -1,11 +1,8 @@
 // Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
-#include <vespa/vespalib/io/fileutil.h>
 #include <vespa/vespalib/net/tls/transport_security_options.h>
-#include <vespa/vespalib/net/tls/transport_security_options_reading.h>
 #include <vespa/vespalib/net/tls/policy_checking_certificate_verifier.h>
 #include <vespa/vespalib/test/peer_policy_utils.h>
 #include <vespa/vespalib/testkit/test_kit.h>
-#include <vespa/vespalib/util/exceptions.h>
 
 using namespace vespalib;
 using namespace vespalib::net::tls;
diff --git a/vespalib/src/tests/regex/regex.cpp b/vespalib/src/tests/regex/regex.cpp
index d1b94daa7ba..7dc5a7f4aa9 100644
--- a/vespalib/src/tests/regex/regex.cpp
+++ b/vespalib/src/tests/regex/regex.cpp
@@ -1,70 +1,147 @@
 // Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 #include <vespa/vespalib/testkit/test_kit.h>
-
+#include <vespa/vespalib/regex/regex.h>
 #include <vespa/vespalib/util/regexp.h>
-#include <vespa/vespalib/util/exception.h>
-#include <regex>
+#include <string>
 
 using namespace vespalib;
 
 TEST("require that prefix detection works") {
-    EXPECT_EQUAL("", Regexp::get_prefix(""));
-    EXPECT_EQUAL("", Regexp::get_prefix("foo"));
-    EXPECT_EQUAL("foo", Regexp::get_prefix("^foo"));
-    EXPECT_EQUAL("", Regexp::get_prefix("^foo|bar"));
-    EXPECT_EQUAL("foo", Regexp::get_prefix("^foo$"));
-    EXPECT_EQUAL("foo", Regexp::get_prefix("^foo[a-z]"));
-    EXPECT_EQUAL("fo", Regexp::get_prefix("^foo{0,1}"));
-    EXPECT_EQUAL("foo", Regexp::get_prefix("^foo."));
-    EXPECT_EQUAL("fo", Regexp::get_prefix("^foo*"));
-    EXPECT_EQUAL("fo", Regexp::get_prefix("^foo?"));
-    EXPECT_EQUAL("foo", Regexp::get_prefix("^foo+"));
+    EXPECT_EQUAL("", RegexpUtil::get_prefix(""));
+    EXPECT_EQUAL("", RegexpUtil::get_prefix("foo"));
+    EXPECT_EQUAL("foo", RegexpUtil::get_prefix("^foo"));
+    EXPECT_EQUAL("", RegexpUtil::get_prefix("^foo|bar"));
+    EXPECT_EQUAL("foo", RegexpUtil::get_prefix("^foo$"));
+    EXPECT_EQUAL("foo", RegexpUtil::get_prefix("^foo[a-z]"));
+    EXPECT_EQUAL("fo", RegexpUtil::get_prefix("^foo{0,1}"));
+    EXPECT_EQUAL("foo", RegexpUtil::get_prefix("^foo."));
+    EXPECT_EQUAL("fo", RegexpUtil::get_prefix("^foo*"));
+    EXPECT_EQUAL("fo", RegexpUtil::get_prefix("^foo?"));
+    EXPECT_EQUAL("foo", RegexpUtil::get_prefix("^foo+"));
 }
 
 TEST("require that prefix detection sometimes underestimates the prefix size") {
-    EXPECT_EQUAL("", Regexp::get_prefix("^^foo"));
-    EXPECT_EQUAL("", Regexp::get_prefix("^foo(bar|baz)"));
-    EXPECT_EQUAL("fo", Regexp::get_prefix("^foo{1,2}"));
-    EXPECT_EQUAL("foo", Regexp::get_prefix("^foo\\."));
-    EXPECT_EQUAL("foo", Regexp::get_prefix("^foo(bar)"));
-    EXPECT_EQUAL("", Regexp::get_prefix("(^foo)"));
-    EXPECT_EQUAL("", Regexp::get_prefix("^(foo)"));
-    EXPECT_EQUAL("foo", Regexp::get_prefix("^foo[a]"));
-    EXPECT_EQUAL("", Regexp::get_prefix("^foo|^foobar"));
+    EXPECT_EQUAL("", RegexpUtil::get_prefix("^^foo"));
+    EXPECT_EQUAL("", RegexpUtil::get_prefix("^foo(bar|baz)"));
+    EXPECT_EQUAL("fo", RegexpUtil::get_prefix("^foo{1,2}"));
+    EXPECT_EQUAL("foo", RegexpUtil::get_prefix("^foo\\."));
+    EXPECT_EQUAL("foo", RegexpUtil::get_prefix("^foo(bar)"));
+    EXPECT_EQUAL("", RegexpUtil::get_prefix("(^foo)"));
+    EXPECT_EQUAL("", RegexpUtil::get_prefix("^(foo)"));
+    EXPECT_EQUAL("foo", RegexpUtil::get_prefix("^foo[a]"));
+    EXPECT_EQUAL("", RegexpUtil::get_prefix("^foo|^foobar"));
 }
 
-const vespalib::string special("^|()[]{}.*?+\\$");
+const std::string special("^|()[]{}.*?+\\$");
 
 struct ExprFixture {
-    std::vector<vespalib::string> expressions;
+    std::vector<std::string> expressions;
     ExprFixture() {
         expressions.push_back(special);
         for (char c: special) {
-            expressions.push_back(vespalib::string(&c, 1));
+            expressions.emplace_back(std::string(&c, 1));
         }
-        expressions.push_back("abc");
-        expressions.push_back("[:digit:]");
+        expressions.emplace_back("abc");
+        expressions.emplace_back("[:digit:]");
     }
 };
 
 TEST_F("require that regexp can be made from suffix string", ExprFixture()) {
-    for (vespalib::string str: f1.expressions) {
-        std::regex re(std::string(Regexp::make_from_suffix(str)));
-        EXPECT_TRUE(std::regex_search(std::string(str), re));
-        EXPECT_FALSE(std::regex_search(std::string(str + "foo"), re));
-        EXPECT_TRUE(std::regex_search(std::string("foo" + str), re));
-        EXPECT_FALSE(std::regex_search(std::string("foo" + str + "bar"), re));
+    for (const auto& str: f1.expressions) {
+        auto re = Regex::from_pattern(std::string(RegexpUtil::make_from_suffix(str)));
+        ASSERT_TRUE(re.parsed_ok());
+
+        EXPECT_TRUE(re.partial_match(str));
+        EXPECT_FALSE(re.partial_match(str + "foo"));
+        EXPECT_TRUE(re.partial_match("foo" + str));
+        EXPECT_FALSE(re.partial_match("foo" + str + "bar"));
     }
 }
 
 TEST_F("require that regexp can be made from substring string", ExprFixture()) {
-    for (vespalib::string str: f1.expressions) {
-        std::regex re(std::string(Regexp::make_from_substring(str)));
-        EXPECT_TRUE(std::regex_search(std::string(str), re));
-        EXPECT_TRUE(std::regex_search(std::string(str + "foo"), re));
-        EXPECT_TRUE(std::regex_search(std::string("foo" + str), re));
-        EXPECT_TRUE(std::regex_search(std::string("foo" + str + "bar"), re));
+    for (const auto& str: f1.expressions) {
+        auto re = Regex::from_pattern(std::string(RegexpUtil::make_from_substring(str)));
+        ASSERT_TRUE(re.parsed_ok());
+
+        EXPECT_TRUE(re.partial_match(str));
+        EXPECT_TRUE(re.partial_match(str + "foo"));
+        EXPECT_TRUE(re.partial_match("foo" + str));
+        EXPECT_TRUE(re.partial_match("foo" + str + "bar"));
     }
 }
 
+TEST("full_match requires expression to match entire input string") {
+    std::string pattern = "[Aa][Bb][Cc]";
+    auto re = Regex::from_pattern(pattern);
+    ASSERT_TRUE(re.parsed_ok());
+
+    EXPECT_TRUE(re.full_match("abc"));
+    EXPECT_TRUE(re.full_match("ABC"));
+    EXPECT_FALSE(re.full_match("abcd"));
+    EXPECT_FALSE(re.full_match("aabc"));
+    EXPECT_FALSE(re.full_match("aabcc"));
+
+    EXPECT_TRUE(Regex::full_match("abc", pattern));
+    EXPECT_TRUE(Regex::full_match("ABC", pattern));
+    EXPECT_FALSE(Regex::full_match("abcd", pattern));
+    EXPECT_FALSE(Regex::full_match("aabc", pattern));
+    EXPECT_FALSE(Regex::full_match("aabcc", pattern));
+}
+
+TEST("partial_match requires expression to match substring of input string") {
+    std::string pattern = "[Aa][Bb][Cc]";
+    auto re = Regex::from_pattern(pattern);
+    ASSERT_TRUE(re.parsed_ok());
+
+    EXPECT_TRUE(re.partial_match("abc"));
+    EXPECT_TRUE(re.partial_match("ABC"));
+    EXPECT_TRUE(re.partial_match("abcd"));
+    EXPECT_TRUE(re.partial_match("aabc"));
+    EXPECT_TRUE(re.partial_match("aabcc"));
+    EXPECT_FALSE(re.partial_match("abd"));
+
+    EXPECT_TRUE(Regex::partial_match("abc", pattern));
+    EXPECT_TRUE(Regex::partial_match("ABC", pattern));
+    EXPECT_TRUE(Regex::partial_match("abcd", pattern));
+    EXPECT_TRUE(Regex::partial_match("aabc", pattern));
+    EXPECT_TRUE(Regex::partial_match("aabcc", pattern));
+    EXPECT_FALSE(Regex::partial_match("abd", pattern));
+}
+
+TEST("partial_match can be explicitly anchored") {
+    EXPECT_TRUE(Regex::partial_match("abcc", "^abc"));
+    EXPECT_FALSE(Regex::partial_match("aabc", "^abc"));
+    EXPECT_TRUE(Regex::partial_match("aabc", "abc$"));
+    EXPECT_FALSE(Regex::partial_match("abcc", "abc$"));
+    EXPECT_TRUE(Regex::partial_match("abc", "^abc$"));
+    EXPECT_FALSE(Regex::partial_match("aabc", "^abc$"));
+    EXPECT_FALSE(Regex::partial_match("abcc", "^abc$"));
+}
+
+TEST("Regex instance returns parsed_ok() == false upon parse failure") {
+    auto re = Regex::from_pattern("[a-z"); // Unterminated set
+    EXPECT_FALSE(re.parsed_ok());
+}
+
+TEST("Regex that has failed parsing immediately returns false for matches") {
+    auto re = Regex::from_pattern("[a-z");
+    EXPECT_FALSE(re.parsed_ok());
+    EXPECT_FALSE(re.partial_match("a"));
+    EXPECT_FALSE(re.full_match("b"));
+}
+
+TEST("can create case-insensitive regex matcher") {
+    auto re = Regex::from_pattern("hello", Regex::Options::IgnoreCase);
+    ASSERT_TRUE(re.parsed_ok());
+    EXPECT_TRUE(re.partial_match("HelLo world"));
+    EXPECT_TRUE(re.full_match("HELLO"));
+}
+
+TEST("regex is case sensitive by default") {
+    auto re = Regex::from_pattern("hello");
+    ASSERT_TRUE(re.parsed_ok());
+    EXPECT_FALSE(re.partial_match("HelLo world"));
+    EXPECT_FALSE(re.full_match("HELLO"));
+}
+
 TEST_MAIN() { TEST_RUN_ALL(); }
diff --git a/vespalib/src/vespa/vespalib/CMakeLists.txt b/vespalib/src/vespa/vespalib/CMakeLists.txt
index 95f6a407914..4a753a66394 100644
--- a/vespalib/src/vespa/vespalib/CMakeLists.txt
+++ b/vespalib/src/vespa/vespalib/CMakeLists.txt
@@ -16,6 +16,7 @@ vespa_add_library(vespalib
     $<TARGET_OBJECTS:vespalib_vespalib_net_tls_impl>
     $<TARGET_OBJECTS:vespalib_vespalib_objects>
     $<TARGET_OBJECTS:vespalib_vespalib_portal>
+    $<TARGET_OBJECTS:vespalib_vespalib_regex>
     $<TARGET_OBJECTS:vespalib_vespalib_stllike>
     $<TARGET_OBJECTS:vespalib_vespalib_test>
     $<TARGET_OBJECTS:vespalib_vespalib_testkit>
@@ -30,3 +31,5 @@ vespa_add_library(vespalib
 )
 
 vespa_add_target_package_dependency(vespalib OpenSSL)
+vespa_add_target_package_dependency(vespalib RE2)
+
diff --git a/vespalib/src/vespa/vespalib/net/tls/peer_policies.cpp b/vespalib/src/vespa/vespalib/net/tls/peer_policies.cpp
index 8d2fb04d853..27a11b3f0f1 100644
--- a/vespalib/src/vespa/vespalib/net/tls/peer_policies.cpp
+++ b/vespalib/src/vespa/vespalib/net/tls/peer_policies.cpp
@@ -1,28 +1,34 @@
 // Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 
 #include "peer_policies.h"
+#include <vespa/vespalib/regex/regex.h>
 #include <iostream>
-#include <regex>
 
 namespace vespalib::net::tls {
 
 namespace {
 
-// Note: this is for basix regexp only, _not_ extended regexp
-bool is_basic_regex_special_char(char c) noexcept {
+bool is_regex_special_char(char c) noexcept {
     switch (c) {
-        case '^':
-        case '$':
-        case '.':
-        case '[':
-        case '\\':
-            return true;
-        default:
-            return false;
+    case '^':
+    case '$':
+    case '|':
+    case '{':
+    case '}':
+    case '(':
+    case ')':
+    case '[':
+    case ']':
+    case '\\':
+    case '+':
+    case '.':
+        return true;
+    default:
+        return false;
     }
 }
 
-std::string glob_to_basic_regex(vespalib::stringref glob) {
+std::string dot_separated_glob_to_regex(vespalib::stringref glob) {
     std::string ret = "^";
     ret.reserve(glob.size() + 2);
     for (auto c : glob) {
@@ -34,7 +40,7 @@ std::string glob_to_basic_regex(vespalib::stringref glob) {
             // Same applies for single chars; they should only match _within_ a dot boundary.
             ret += "[^.]";
         } else {
-            if (is_basic_regex_special_char(c)) {
+            if (is_regex_special_char(c)) {
                 ret += '\\';
             }
             ret += c;
@@ -45,16 +51,16 @@ std::string glob_to_basic_regex(vespalib::stringref glob) {
 }
 
 class RegexHostMatchPattern : public HostGlobPattern {
-    std::regex _pattern_as_regex;
+    Regex _pattern_as_regex;
 public:
     explicit RegexHostMatchPattern(vespalib::stringref glob_pattern)
-        : _pattern_as_regex(glob_to_basic_regex(glob_pattern), std::regex_constants::basic)
+        : _pattern_as_regex(Regex::from_pattern(dot_separated_glob_to_regex(glob_pattern)))
     {
     }
     ~RegexHostMatchPattern() override = default;
 
-    bool matches(vespalib::stringref str) const override {
-        return std::regex_match(str.begin(), str.end(), _pattern_as_regex);
+    [[nodiscard]] bool matches(vespalib::stringref str) const override {
+        return _pattern_as_regex.full_match(std::string_view(str.data(), str.size()));
     }
 };
 
diff --git a/vespalib/src/vespa/vespalib/net/tls/peer_policies.h b/vespalib/src/vespa/vespalib/net/tls/peer_policies.h
index c558708de8f..9d34b62415f 100644
--- a/vespalib/src/vespa/vespalib/net/tls/peer_policies.h
+++ b/vespalib/src/vespa/vespalib/net/tls/peer_policies.h
@@ -10,7 +10,7 @@ namespace vespalib::net::tls {
 
 struct HostGlobPattern {
     virtual ~HostGlobPattern() = default;
-    virtual bool matches(vespalib::stringref str) const = 0;
+    [[nodiscard]] virtual bool matches(vespalib::stringref str) const = 0;
 
     static std::shared_ptr<const HostGlobPattern> create_from_glob(vespalib::stringref pattern);
 };
@@ -36,7 +36,7 @@ public:
                 && (_original_pattern == rhs._original_pattern));
     }
 
-    bool matches(vespalib::stringref str) const {
+    [[nodiscard]] bool matches(vespalib::stringref str) const {
         return (_match_pattern && _match_pattern->matches(str));
     }
 
@@ -89,7 +89,7 @@ public:
     bool operator==(const AuthorizedPeers& rhs) const {
         return (_peer_policies == rhs._peer_policies);
     }
-    bool allows_all_authenticated() const noexcept {
+    [[nodiscard]] bool allows_all_authenticated() const noexcept {
         return _allow_all_if_empty;
     }
     const std::vector<PeerPolicy>& peer_policies() const noexcept { return _peer_policies; }
diff --git a/vespalib/src/vespa/vespalib/regex/CMakeLists.txt b/vespalib/src/vespa/vespalib/regex/CMakeLists.txt
new file mode 100644
index 00000000000..1034dbf6086
--- /dev/null
+++ b/vespalib/src/vespa/vespalib/regex/CMakeLists.txt
@@ -0,0 +1,10 @@
+# Copyright Verizon Media. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+vespa_add_library(vespalib_vespalib_regex OBJECT
+    SOURCES
+    regex.cpp
+    DEPENDS
+)
+
+find_package(RE2 REQUIRED)
+# TODO can this be PRIVATE since we don't expose it transitively?
+target_include_directories(vespalib_vespalib_regex PUBLIC ${RE2_INCLUDE_DIR})
diff --git a/vespalib/src/vespa/vespalib/regex/regex.cpp b/vespalib/src/vespa/vespalib/regex/regex.cpp
new file mode 100644
index 00000000000..81677f1b9dd
--- /dev/null
+++ b/vespalib/src/vespa/vespalib/regex/regex.cpp
@@ -0,0 +1,88 @@
+// Copyright Verizon Media. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+
+#include "regex.h"
+#include <re2/re2.h>
+#include <cassert>
+#include <cstdint>
+
+namespace vespalib {
+
+using re2::StringPiece;
+
+// All RE2 instances use a Quiet option to prevent the library from
+// complaining to stderr if pattern compilation fails.
+
+Regex::Regex(std::shared_ptr<const Impl> impl)
+    : _impl(std::move(impl))
+{}
+
+Regex::Regex(const Regex&) = default;
+Regex& Regex::operator=(const Regex&) = default;
+Regex::Regex(Regex&&) noexcept = default;
+Regex& Regex::operator=(Regex&&) noexcept = default;
+
+Regex::~Regex() = default;
+
+class Regex::Impl {
+    RE2 _regex;
+public:
+    Impl(std::string_view pattern, const re2::RE2::Options& opts)
+        : _regex(StringPiece(pattern.data(), pattern.size()), opts)
+    {}
+
+    bool parsed_ok() const noexcept {
+        return _regex.ok();
+    }
+
+    bool partial_match(std::string_view input) const noexcept {
+        assert(input.size() <= INT32_MAX);
+        if (!_regex.ok()) {
+            return false;
+        }
+        return RE2::PartialMatch(StringPiece(input.data(), input.size()), _regex);
+    }
+
+    bool full_match(std::string_view input) const noexcept {
+        assert(input.size() <= INT32_MAX);
+        if (!_regex.ok()) {
+            return false;
+        }
+        return RE2::FullMatch(StringPiece(input.data(), input.size()), _regex);
+    }
+};
+
+Regex Regex::from_pattern(std::string_view pattern, uint32_t opt_mask) {
+    assert(pattern.size() <= INT32_MAX); // StringPiece limitation
+    RE2::Options opts;
+    opts.set_log_errors(false);
+    if ((opt_mask & Options::IgnoreCase) != 0) {
+        opts.set_case_sensitive(false);
+    }
+    return Regex(std::make_shared<Impl>(pattern, opts));
+}
+
+bool Regex::parsed_ok() const noexcept {
+    return _impl->parsed_ok();
+}
+
+bool Regex::partial_match(std::string_view input) const noexcept {
+    return _impl->partial_match(input);
+}
+
+bool Regex::full_match(std::string_view input) const noexcept {
+    return _impl->full_match(input);
+}
+
+bool Regex::partial_match(std::string_view input, std::string_view pattern) noexcept {
+    assert(pattern.size() <= INT32_MAX);
+    Impl impl(pattern, RE2::Quiet);
+    return impl.partial_match(input);
+}
+
+bool Regex::full_match(std::string_view input, std::string_view pattern) noexcept {
+    assert(pattern.size() <= INT32_MAX);
+    Impl impl(pattern, RE2::Quiet);
+    return impl.full_match(input);
+}
+
+}
diff --git a/vespalib/src/vespa/vespalib/regex/regex.h b/vespalib/src/vespa/vespalib/regex/regex.h
new file mode 100644
index 00000000000..4382d057252
--- /dev/null
+++ b/vespalib/src/vespa/vespalib/regex/regex.h
@@ -0,0 +1,69 @@
+// Copyright Verizon Media. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+#pragma once
+
+#include <memory>
+#include <string>
+#include <string_view>
+
+namespace vespalib {
+
+/**
+ * A simple Regex library wrapper which provides for both just-in-time
+ * pattern evaluation as well as pattern precompilation and reuse.
+ *
+ * Robustness and input safety:
+ * The underlying regex engine implementation must ensure that pattern
+ * parsing and input processing is safe to be run on _untrusted_ inputs.
+ * This means the underlying implementation shall provide upper bounds
+ * on both memory and CPU time and may never crash or corrupt the process.
+ *
+ * We currently use Google RE2 under the hood to achieve this.
+ *
+ * Note: due to underlying RE2 limitations, string lengths may
+ * not be longer than INT_MAX.
+ *
+ * Thread safety:
+ * A Regex object is safe to be used from multiple threads.
+ *
+ * Exception safety:
+ * Exceptions shall never be thrown from the regex code itself, neither
+ * at parse time nor at match time (ancillary exceptions _could_ be thrown
+ * from memory allocation failures etc, but we assume that the caller
+ * is running vespamalloc which terminates the process instead, making
+ * the whole thing effectively noexcept).
+ *
+ * If the provided regular expression pattern is malformed, parsing
+ * fails silently; all match functions will return false immediately.
+ */
+class Regex {
+    class Impl;
+    std::shared_ptr<const Impl> _impl; // shared_ptr to allow for cheap copying.
+
+    explicit Regex(std::shared_ptr<const Impl> impl);
+public:
+    // TODO consider using type-safe parameter instead.
+    enum Options {
+        None       = 0,
+        IgnoreCase = 1
+    };
+
+    ~Regex();
+    Regex(const Regex&);
+    Regex& operator=(const Regex&);
+    Regex(Regex&&) noexcept;
+    Regex& operator=(Regex&&) noexcept;
+
+    [[nodiscard]] bool parsed_ok() const noexcept;
+
+    [[nodiscard]] bool partial_match(std::string_view input) const noexcept;
+    [[nodiscard]] bool full_match(std::string_view input) const noexcept;
+
+    static Regex from_pattern(std::string_view pattern, uint32_t opt_flags = Options::None);
+
+    // Utility matchers for non-precompiled expressions.
+    [[nodiscard]] static bool partial_match(std::string_view input, std::string_view pattern) noexcept;
+    [[nodiscard]] static bool full_match(std::string_view input, std::string_view pattern) noexcept;
+};
+
+}
+
diff --git a/vespalib/src/vespa/vespalib/util/regexp.cpp b/vespalib/src/vespa/vespalib/util/regexp.cpp
index b3cad06382e..0d0c7b69b12 100644
--- a/vespalib/src/vespa/vespalib/util/regexp.cpp
+++ b/vespalib/src/vespa/vespalib/util/regexp.cpp
@@ -41,7 +41,7 @@ vespalib::string escape(vespalib::stringref str) {
 } // namespace vespalib::<unnamed>
 
 vespalib::string
-Regexp::get_prefix(vespalib::stringref re)
+RegexpUtil::get_prefix(vespalib::stringref re)
 {
     vespalib::string prefix;
     if ((re.size() > 0) && (re.data()[0] == '^') && !has_option(re)) {
@@ -58,13 +58,13 @@ Regexp::get_prefix(vespalib::stringref re)
 }
 
 vespalib::string
-Regexp::make_from_suffix(vespalib::stringref suffix)
+RegexpUtil::make_from_suffix(vespalib::stringref suffix)
 {
     return escape(suffix) + "$";
 }
 
 vespalib::string
-Regexp::make_from_substring(vespalib::stringref substring)
+RegexpUtil::make_from_substring(vespalib::stringref substring)
 {
     return escape(substring);
 }
diff --git a/vespalib/src/vespa/vespalib/util/regexp.h b/vespalib/src/vespa/vespalib/util/regexp.h
index 9897b488aff..74a69fee361 100644
--- a/vespalib/src/vespa/vespalib/util/regexp.h
+++ b/vespalib/src/vespa/vespalib/util/regexp.h
@@ -8,7 +8,7 @@ namespace vespalib {
 /**
  * Utility class inspecting and generating regular expression strings.
  **/
-class Regexp
+class RegexpUtil
 {
 public:
     /**