# Upgrading to Varnish 6.1

A configuration for Varnish 6.0.x will run for version 6.1 without changes. There has been a subtle change in the interpretation of the VCL variable `beresp.keep` under specific circumstances, as discussed below. Other than that, the changes in 6.1 are new features, described in the following.

## varnishd parameters

We have added the max_vcl parameter to set a threshold for the number of loaded VCL programs, since it is a common error to let previous VCL instances accumulate without discarding them. The remnants of undiscarded VCLs take the form of files in the working directory of the management process. Over time, too many of these may take up significant storage space, and administrative operations such as `vcl.list` may become noticeably slow, or even time out, when Varnish has to iterate over many files.

The default threshold in max_vcl is 100, and VCL labels are not counted against the total. The max_vcl_handling parameter controls what happens when you reach the limit. By default you just get a warning from the VCL compiler, but you can set it to refuse to load more VCLs, or to ignore the threshold.

Added the backend_local_error_holddown and backend_remote_error_holddown parameters. These define delays for new attempts to connect to backends when certain classes of errors have been encountered, for which immediate re-connect attempts are likely to be counter-productive. See the parameter documentation for details.

## Changes to VCL

### VCL variables

#### `req.ttl`, `req.grace` and keep

`req.grace` had been previously removed, but was now reintroduced, since there are use cases that cannot be solved without it. Similarly, `req.ttl` used to be deprecated and is now fully supported again.

`req.ttl` and `req.grace` limit the ttl and grace times that are permitted for the current request. If `req.ttl` is set, then cache objects are considered fresh (and may be cache hits) only if their remaining ttl is less than or equal to `req.ttl`. Likewise, `req.grace` sets an upper bound on the time an object has spent in grace to be considered eligible for grace mode (which is to deliver this object and fetch a fresh copy in the background).

A common application is to set shorter TTLs when the backend is known to be healthy, so that responses are fresher when all is well. But if the backend is unhealthy, then use cached responses with longer TTLs to relieve load on the troubled backend:

    sub vcl_recv {
          # ...
          if (std.healthy(req.backend_hint)) {
                  # Get responses no older than 70s for healthy backends
                  set req.ttl = 60s;
                  set req.grace = 10s;
          }

          # If the backend is unhealthy, then permit cached responses
          # that are older than 70s.
    }

The evaluation of the `beresp.keep` timer has changed a bit. `keep` sets a lifetime in the cache in addition to TTL for objects that can be validated by a 304 “Not Modified” response from the backend to a conditional request (with `If-None-Match` or `If-Modified-Since`). If an expired object is also out of grace time, then `vcl_hit` will no longer be called, so it is impossible to deliver the “keep” object in this case.

Note that the headers `If-None-Match` and `If-Modified-Since`, together with the 304 behavior, are handled automatically by Varnish. If you, for some reason, need to explicitly disable this for a backend request, then you need do this by removing the headers in `vcl_backend_fetch`.

The documentation in Grace mode and keep has been expanded to discuss these matters in greater depth, look there for more details.

#### `beresp.filters` and support for backend response processing with VMODs

The `beresp.filters` variable is readable and writable in `vcl_backend_response`. This is a space-separated list of modules that we call VFPs, for “Varnish fetch processors”, that may be applied to a backend response body as it is being fetched. In default Varnish, the list may include values such as `gzip`, `gunzip`, and `esi`, depending on how you have set the `beresp.do_*` variables.

This addition makes it possible for VMODs to define VFPs to filter or manipulate backend response bodies, which can be added by changing the list in `beresp.filters`. VFPs are applied in the order given in `beresp.filters`, and you may have to ensure that a VFP is positioned correctly in the list, for example if it can only apply to uncompressed response bodies.

This is a new capability, and at the time of release we only know of test VFPs implemented in VMODs. Over time we hope that an “ecology” of VFP code will develop that will enrich the features available to Varnish deployments.

#### `obj.hits`

Has been fixed to return the correct value in `vcl_hit` (it had been 0 in `vcl_hit`).

### Other changes to VCL

- The `Host` header in client requests is mandatory for HTTP/1.1, as proscribed by the HTTP standard. If it is missing, then `builtin.vcl` causes a synthetic 400 “Bad request” response to be returned.

- You can now provide a string argument to `return(fail("Foo!"))`, which can be used in `vcl_init` to emit an error message if the VCL load fails due to the return.

- Additional `import` statements of an already imported vmod are now ignored.

## VMODs

Added the BOOL fnmatch(STRING pattern, STRING subject, BOOL pathname, BOOL noescape, BOOL period) function to VMOD std - Varnish Standard Module, which you can use for shell-style wildcard matching. Wildcard patterns may be a good fit for matching URLs, to match against a pattern like `/foo/*/bar/*`. The patterns can be built at runtime, if you need to do that, since they don’t need the pre-compile step at VCL load time that is required for regular expressions. And if you are simply more comfortable with the wildcard syntax than with regular expressions, you now have the option.

VMOD unix - Utilities for Unix domain sockets is now supported for SunOS and descendants. This entails changing the privilege set of the child process while the VMOD is loaded, see the documentation.

## Other changes

- `varnishd(1)`:

  - Some VCL compile-time error messages have been improved, for example when a symbol is not found or arguments to VMOD calls are missing.

  - Varnish now won’t rewrite the `Content-Length` header when responding to any HEAD request, making it possible to cache responses to HEAD requests independently from the GET responses (previously a HEAD request had to be a pass to avoid this rewriting).

  - If you have set `.proxy_header=1` (to use the PROXYv1 protocol) for a backend addressed as a Unix domain socket (with a `.path` setting for the socket file), and have also defined a probe for the backend, then the address family `UNKNOWN` is sent in the proxy header for the probe request. If you have set `.proxy_header=2` (for PROXYv2) for a UDS backend with a probe, then `PROXY LOCAL` is sent for the probe request.

- `varnishlog(1)` and `vsl(7)`:

  - The contents of `FetchError` log entries have been improved to give better human-readable diagnostics for certain classes of backend fetch failures.

    In particular, http connection (HTC) errors are now reported symbolically in addition to the previous numerical value.

  - Log entries under the new `SessError` tag now give more diagnostic information about session accept failures (failure to accept a client connection). These must be viewed in raw grouping, since accept failures are not part of any request/response transaction.

  - When a backend is unhealthy, `Backend_health` now reports some diagnostic information in addition to the HTTP response and timing information.

  - The backend name logged for `Backend_health` is just the backend name without the VCL prefix (as appears otherwise for backend naming).

  - Added the log entry tag `Filters`, which gives a list of the filters applied to a response body (see `beresp.filters` discussed above).

- `varnishadm(1)` and `varnish-cli(7)`

  - For a number of CLI commands, you can now use the `-j` argument to get a JSON response, which may help in automation. These include:

    - `ping -j`

    - `backend.list -j`

    - `help -j`

    A JSON response in the CLI always includes a timestamp (epoch time in seconds with millisecond precision), indicating the time at which the response was generated.

  - The `backend.list` command now lists both directors and backends, with their health status. The command now has a `-v` option for verbose output, in which detailed health states for each backend/director are displayed.

- `varnishstat(1)` and `varnish-counters(7)`:

  - We have added a number of counters to the `VBE.*` group to help better diagnose error conditions with backends:

    - `VBE.*.unhealthy`: the number of fetches that were not attempted because the backend was unhealthy

    - `.busy`: number of fetches that were not attempted because the `.max_connections` limit was reached

    - `.fail`: number of failed attempts to open a connection to the backend. Detailed reasons for the failures are given in the `.fail_*` counters (shown at DIAG level), and in the log entry `FetchError`. `.fail` is the sum of the values in the `.fail_*` counters.

    - `.fail_eaccess`, `.fail_eaddrnotavail`, `.fail_econnrefused`, `.fail_enetunreach` and `.fail_etimedout`: these are the number of attempted connections to the backend that failed with the given value of `errno(3)`.

    - `.fail_other`: number of connections to the backend that failed for reasons other than those given by the other `.fail_*` counters. For such cases, details on the failure can be extracted from the varnish log as described above for `FetchError`.

    - `.helddown`: the number of connections not attempted because the backend was in the period set by one of the parameters backend_local_error_holddown or backend_remote_error_holddown

  - Similarly, we have added a series of counters for better diagnostics of session accept failures (failure to accept a connection from a client). As before, the `sess_fail` counter gives the total number of accept failures, and it is now augmented with the `sess_fail_*` counters. `sess_fail` is the sum of the values in `sess_fail_*`.

    - `sess_fail_econnaborted`, `sess_fail_eintr`, `sess_fail_emfile`, `sess_fail_ebadf` and `sess_fail_enomem`: the number of accept failures with the indicated value of `errno(3)`. The varnish-counters man page, and the “long descriptions” shown by `varnishstat`, give possible reasons why each of these may happen, and what might be done to counter the problem.

    - `sess_fail_other`: number of accept failures for reasons other than those given by the other `sess_fail_*` counters. More details may appear in the `SessError` entry of the log (varnish-counters shows a `varnishlog` invocation that may help).

  - In curses mode, the information in the header lines (uptimes and cache hit rates) is always reported, even if you have defined a filter that leaves them out of the stats table.

  - Ban statistics are now reported more accurately (they had been subject to inconsistencies due to race conditions).

- `varnishtest(1)` and `vtc(7)`:

  - `varnishtest` and the `vtc` test script language now support testing for haproxy as well as Varnish. The `haproxy` directive in a test can be used to define, configure, start and stop a haproxy instance, and you can also script messages to send on the haproxy CLI connection, and define expectations for the responses. See the `haproxy` section in VTC for details.

  - Related to haproxy support, you can now define a `syslog` instance in test scripts. This defines a syslog server, and allows you to test expectations for syslog output from a haproxy instance.

  - Added the `-keepalive` argument for client and server scripts to be used with the `-repeat` directive, which causes all test iterations to run on the same connection, rather than open a new connection each time. This makes the test run faster and use fewer ephemeral ports.

  - Added the `-need-bytes` argument for the `process` command, see VTC.

- `varnishhist(1)`:

  - The `-P min:max` command-line parameters are now optional, see varnishhist.

- For all of the utilities that access the Varnish log – `varnishlog(1)`, `varnishncsa(1)`, `varnishtop(1)` and `varnishhist(1)` – it was already possible to set multiple `-I` and `-X` command-line arguments. It is now properly documented that you can use multiple include and exclude filters that apply regular expressions to selected log records.

- Changes for developers:

  - As mentioned above, VMODs can now implement VFPs that can be added to backend response processing by changing `beresp.filters`. The interface for VFPs is defined in `cache_filters.h`, and the debug VMOD included in the distribution shows an example of a VFP for rot13.

  - The Varnish API soname version (for libvarnishapi.so) has been bumped to 2.0.0.

  - The VRT version has been bumped to 8.0. See `vrt.h` for details on the changes since 7.0.

  - Space required by varnish for maintaining the `PRIV_TASK` and `PRIV_TOP` parameters is now taken from the appropriate workspace rather than from the heap as before. For a failing allocation, a VCL failure is triggered.

    The net effect of this change is that in cases of a workspace shortage, the almost unavoidable failure will happen earlier. The amount of workspace required is slightly increased and scales with the number of vmods per `PRIV_TASK` and `PRIV_TOP` parameter.

    The VCL compiler (VCC) guarantees that if a vmod function is called with a `PRIV_*` argument, that argument value is set.

    There is no change with respect to the API the `PRIV_*` vmod function arguments provide.

  - `VRT_priv_task()`, the function implementing the allocation of the `PRIV_TASK` and `PRIV_TOP` parameters as described above, is now more likely to return `NULL` for allocation failures for the same reason.

    Notice that explicit use of this function from within VMODs is considered experimental as this interface may change.

  - We have improved support for the `STRANDS` data type, which you may find easier to use than the varargs-based `STRING_LIST`. See `vrt.h` for details. VMOD blob - Utilities for the VCL blob type, encoding and decoding has been refactored to use `STRANDS`, so you can look there for an example.

  - We have fixed a bug that had limited the precision available for the `INT` data type, so you now get the full 64 bits.

  - Portions of what had previously been declared in `cache_director.h` have been moved into `vrt.h`, constituting the public API for directors. The remainder in `cache_director.h` is not public, and should not be used by a VMOD intended for VRT ABI compatibility.

  - The director API in `vrt.h` differs from the previous interface. Writing a Director has been updated accordingly. In short, the most important changes include:

    - `struct director_methods` is replaced by `struct vdi_methods`

    - signatures of various callbacks have changed

    - `VRT_AddDirector()` and `VRT_DelDirector()` are to be used for initialization and destruction.

    - `vdi_methods` callbacks are not to be called from vmods any more

    - `VRT_Healthy()` replaces calls to the `healthy` function

    - The admin health is not to be manipulated by vmods any more

    - director private state destruction is recommended to be implemented via a `destroy` callback.

  - Python 3 is now preferred in builds, and will likely be required in future versions.

  - We believe builds are now reproducible, and intend to keep them that way.

eof