<div class="gmail_quote">* Sorry about the early incomplete version of this email. I sent it unfinished by mistake *</div><div class="gmail_quote"><br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"></blockquote></blockquote>
As we are moving more logic from varnishd into VCL, I believe some rethinking with how we deal with the default_vcl logic might be in order. This to make it easier to make the easy VCL changes and keep the default logic around still.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<blockquote></blockquote></blockquote></blockquote>A common vcl error I have observed is where you want to match on something to perform an action, and then stop further processing on this request so further rules won't match on the url. E.g.:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<blockquote><blockquote></blockquote></blockquote></blockquote></blockquote>sub vcl_fetch {</div><div class="gmail_quote"> if (req.url ~ "\.(gif|jpg|css") {</div><div class="gmail_quote"> # Cache our static resources "forever"</div>
<div class="gmail_quote"> set beresp.ttl = 180d;</div><div class="gmail_quote"> return (deliver);</div><div class="gmail_quote"> }</div><div class="gmail_quote">}<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><blockquote><blockquote>
</blockquote></blockquote></blockquote></blockquote>This will ofc bypass any set-cookie checks performed by the default vcl_fetch logic. Also the explicit return(deliver) prevents any further application level rules that may be applied later, which is convenient. But the problem comes if for some reason one of these static resources should actually return a set-cookie header.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<blockquote><blockquote></blockquote></blockquote></blockquote></blockquote>If we had restructured the default vcl logic bits into vcl subroutines of their own, this would be much easier to do safe. Given that we have a default_vcl_fetch routine that contains exactly what vcl_fetch contains today, the above example could become:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><blockquote><blockquote>
</blockquote></blockquote></blockquote></blockquote></div><div class="gmail_quote"><div class="gmail_quote">sub vcl_fetch {</div><div class="gmail_quote"> if (req.url ~ "\.(gif|jpg|css") {</div><div class="gmail_quote">
# Cache our static resources "forever"</div><div class="gmail_quote"> set beresp.ttl = 180d;</div><div class="gmail_quote"> call default_vcl_fetch; # Will not return</div><div class="gmail_quote">
}</div><div class="gmail_quote">}</div><div class="gmail_quote"><br></div><div class="gmail_quote">The default vcl_fetch routine would simply become:</div><div class="gmail_quote"><br></div><div class="gmail_quote">sub vcl_fetch {</div>
<div class="gmail_quote"> call default_vcl_fetch;</div><div class="gmail_quote">}</div><div class="gmail_quote"><br></div><div class="gmail_quote"><br></div><div class="gmail_quote">To take it a little further, I also think that some of the default logic could do with a way to modify it, without having to copy all and redoing it. If e.g. the default_vcl_recv looked like this:</div>
<div class="gmail_quote"><br></div><div class="gmail_quote">sub default_vcl_recv {</div><div class="gmail_quote"> call default_vcl_recv_xff; # Handle X-Forwarded-For header creation</div><div class="gmail_quote"> call default_vcl_recv_check_method; # Pass on non-recognized http methods</div>
<div class="gmail_quote"> call default_vcl_recv_check_pass; # Pass on anything but GET and HEAD</div><div class="gmail_quote"> call default_vcl_recv_check_auth; # Pass on auth and cookie headers present</div><div> return (lookup);</div>
<div>}</div><div><br></div><div>We could then change part of the logic only by overriding only one of the functions. So if I had a need to do the X-Forwarded-For headers differently for my site, I could redefine only that function. E.g.:</div>
<div><br></div><div>sub default_vcl_recv_xff {</div><div> if (client.ip ~ acl_fw) {</div><div> set req.http.X-Forwarded-For = req.http.X-Orig-IP;</div><div> exit; # Exit from current subroutine (only allowed from non-callback subs, could be implemented by a goto in libvcl)</div>
<div> }</div><div> # Default vcl would take over here doing the normal XFF handling</div><div>}</div><div><br></div><div>Martin</div></div><div><br></div>-- <br>Martin Blix Grydeland<br>Varnish Software AS<br><br>