I have reworked the varnish ACL code, but am not done testing.
There's a patch here:
http://phk.freebsd.dk/patch/varnish_acl.patch
If any of you feel like beating it up, feel free to.
The changes are:
* Do DNS lookups at compile time instead of child load time. This
makes restarts (much) faster (for long ACLS) and reports the
DNS errors where & when they are needed.
* Support IPv6 filtering.
The ACL rules still have the same syntax, but the sematics have
expanded to handle IPv6 also:
acl foo {
"foohost"; // Match, if the address is one of the
// ipv4 or ipv6 addresses of "foohost"
! "foohost"; // Fail, if...
"192.168.1.7" / 24; // Use mask for comparison: The '7' is
// ignored
"www.freebsd.org" / 24; // This will give compile error, because
// the "www.freebsd.org" has both ipv4
// and ipv6 addresses, and using the same
// mask for both kinds do not make sense.
( ... ); // Ignore this rule if DNS lookup fails.
( ! "idiot.net" ); // If we can resolve "idiot.net", then
// return Failure to match, if we see them.
}
Please notice that DNS lookup happens *only* on VCL compilation, if a
DNS record changes you need to recompile (ie: vcl.load or vcl.inline)
your VCL code again, it is not enough to just switch vcl (vcl.use).
(This is the same as with backend DNS lookups)
--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
[EMAIL PROTECTED] | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.
_______________________________________________
varnish-misc mailing list
[email protected]
http://projects.linpro.no/mailman/listinfo/varnish-misc
