Vinyl Cache Project

2026-03-16 · except

sub vcl_recv {
        unset req.http.Chaotic;
        unset req.http.Evil;
        if (req.http.Wicked ~ "(?i)^wicked$") {
                unset req.http.Wicked;
        }
        ...

import re2;

sub vcl_init {
        new deny = re2.set(anchor=start, case_sensitive=false);
        deny.add("chaotic:");
        deny.add("Evil:");
        deny.add("Wicked: wicked$");
}

sub vcl_recv {
        deny.hdr_filter(req, false);   # "false" makes this filter a denylist
        ...

new deny = re2.set(case_sensitive=false);
deny.add("^chaotic:");
deny.add("^Evil:");
deny.add("^Wicked: wicked$");

import re2;

sub vcl_init {
        new allow = re2.set(anchor=start, case_sensitive=false);
        allow.add("Host:");
        allow.add("If-(Modified-Since|None-Match):");
        allow.add("Non-Standard-Header:");
}

sub vcl_recv {
        allow.hdr_filter(req, true);   # "true" makes this filter an allowlist
        ...

sub vcl_init {
        new allow_recv = re2.set(anchor=start, case_sensitive=false);
        allow_recv.add("Host:");
        allow_recv.add("If-(Modified-Since|None-Match):");
        allow_recv.add("Non-Standard-Header:");

        new allow_backend_fetch = re2.set(anchor=start, case_sensitive=false);
        allow_backend_fetch.add("Host:");
        allow_backend_fetch.add("If-(Modified-Since|None-Match):");
}

sub vcl_recv {
        allow_recv.hdr_filter(req);
        ...
}

sub vcl_backend_fetch {
        allow_backend_fetch.hdr_filter(bereq);
        ...
}

allow.add("Host:");

allow.add("X-Forwarded-(Host|Proto):");

allow.add("Accept");

allow.add("Content-Type: \w+/\w+(; charset=\w+)?$");

sub vcl_init {
        new deny_beresp = re2.set(anchor=start, case_sensitive=false);
        deny_beresp.add("Some-debug-header-send-by-backends: ");
}

sub vcl_backend_response {
        deny_beresp.hdr_filter(beresp, false);   # false makes this filter a denylist
}

# for a quick overview, just dump the content of the VSL buffer:
vinyllog -d -g request -c -i Reqheader \
  -q 'RespStatus >= 200 and RespStatus <=399' \
  -w /tmp/reqheader

# for more data let vinyllog run for longer, for example for one day:
timeout 1d vinyllog -g request -c -i Reqheader \
  -q 'RespStatus >= 200 and RespStatus <=399' \
  -w /tmp/reqheader

# you may also add a filter to only trusted IP-adresses not sending malicious headers:
timeout 1d vinyllog -g request -c -i Reqheader \
  -q 'RespStatus >= 200 and RespStatus <=399 and ReqStart ~"^10\.72\."' \
  -w /tmp/reqheader

vinyllog -r /tmp/reqheader | awk '$2 == "ReqHeader" {print tolower($3)}' |
  head -10000 | sort | uniq -c | sort -n

...
    109 authorization:
    118 priority:
    146 content-length:
    168 sec-fetch-dest:
    168 sec-fetch-site:
    195 content-type:
    219 sec-fetch-mode:
    224 cookie:
    257 referer:
    312 accept-language:
    394 connection:
    423 accept:
    490 user-agent:
    555 host:
    555 via:
    600 accept-encoding:

sub vsv18 {
  if (req.url == "*" && req.method == "OPTIONS") {
    return;
  }
  # NB: we do not allow connect by default (see vcl_req_method)
  if (req.url !~ "^/" && req.method != "CONNECT") {
    return (synth(400));
  }
}

sub vcl_recv {
  call vsv18;
}

VCL language and other literals as ``literal``

placeholders and emphasis as *emphasis*

no `interpreted text` except where it actually *is* that

exception: Links to manpages outside vinyl as `man(section)`::

use code blocks for::

        Examples and

        other code

:ref:`reference name`

.. _vinyld(1):

.. _ref-vinyld-opt_T:

.. role:: ref(emphasis)

`References are tricky`_

=====
Title
=====

--------
Subtitle
--------

Section
=======

Subsection
----------

Subsubsection
~~~~~~~~~~~~~

.. <xxx>::

:date: 2026-03-13

Title
-----
.. rubric:: 2026-03-13
   :class: date

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

.. dropdown::

    Dropdown content

.. dropdown:: Dropdown title

    Dropdown content

.. dropdown:: Open dropdown
    :open:

    Dropdown content

.. tab-set::

    .. tab-item:: Label1

        Content 1

    .. tab-item:: Label2

        Content 2

:bdg:`plain badge`

:bdg-primary:`primary`, :bdg-primary-line:`primary-line`

:bdg-secondary:`secondary`, :bdg-secondary-line:`secondary-line`

:bdg-success:`success`, :bdg-success-line:`success-line`

:bdg-info:`info`, :bdg-info-line:`info-line`

:bdg-warning:`warning`, :bdg-warning-line:`warning-line`

:bdg-danger:`danger`, :bdg-danger-line:`danger-line`

:bdg-light:`light`, :bdg-light-line:`light-line`

:bdg-dark:`dark`, :bdg-dark-line:`dark-line`

.. card:: Card Title

    Header
    ^^^
    Card content
    +++
    Footer

CC-BY 4.0 [Rhubarbe](https://rhubarbe.design)

CC-BY 4.0 Rhubarbe.design

sed -e 's:github.com/varnish:code.vinyl-cache.org/vinyl-:; s:varnish:vinyl:'

#!/bin/bash

## call this from a varnish-cache git directory

set -eux
top=$(git rev-parse --show-toplevel)
cd "${top}"

# determine the new origin and use it
origin=origin
newurl=$(git remote get-url "${origin}" | sed -e 's:github.com\([\:/]\)varnishcache:code.vinyl-cache.org\1vinyl-cache:;s:varnish:vinyl:')
git remote set-url "${origin}" "${newurl}"
git fetch

# rename main to master
git checkout -b main master
git branch -u origin/main main
git branch -d master
if [[ "${top}" == *varnish* ]] ; then
      new="${top/varnish/vinyl}"
      mv "${top}" "${new}"
      echo NOW CALL: cd "${new}"
fi

	client side backend	side
request	`req` (e.g. `vcl_recv`)	`bereq` (e.g. `vcl_backend_fetch`)
response	`resp` (e.g. `vcl_deliver`)	`beresp` (e.g. `vcl_backend_response`)

Varnish version	Supported VCL versions
4.0	4.0
4.1	4.0
5.0	4.0
5.1	4.0
5.2	4.0
6.0 LTS	4.0, 4.1
6.1	4.0, 4.1
6.2	4.0, 4.1
6.3	4.0, 4.1
6.4	4.0, 4.1
6.5	4.0, 4.1
6.6	4.0, 4.1
7.0	4.0, 4.1
7.1	4.0, 4.1
7.2	4.0, 4.1
7.3	4.0, 4.1
7.4	4.0, 4.1
7.5	4.0, 4.1
7.6	4.0, 4.1
7.7	4.0, 4.1
8.0	4.0, 4.1

Members	Size of G.B
1…15	3
16…31	4
32…63	5
etc.

old	new
https://github.com/varnishcache/varnish-cache	https://code.vinyl-cache.org/vinyl-cache/vinyl-cache
https://github.com/varnishcache/homepage	https://code.vinyl-cache.org/vinyl-cache/homepage
https://github.com/varnishcache/pkg-varnish-cache	https://code.vinyl-cache.org/vinyl-cache/pkg-vinyl-cache
https://github.com/varnishcache/varnish-devicedetect	https://code.vinyl-cache.org/vinyl-cache/vinyl-devicedetect
https://github.com/varnishcache/libvmod-example	https://code.vinyl-cache.org/vinyl-cache/libvmod-example
https://github.com/varnishcache/fuzzdata	https://code.vinyl-cache.org/vinyl-cache/fuzzdata
https://github.com/varnishcache/vc-commit-event	https://code.vinyl-cache.org/vinyl-cache/vc-commit-event
https://github.com/varnishcache/pkg-debian	https://code.vinyl-cache.org/vinyl-cache/pkg-debian
https://github.com/varnishcache/varnish-release-rpm	https://code.vinyl-cache.org/vinyl-cache/vinyl-release-rpm

Vinyl Cache Project

Filter request- or response-headers with VMOD re2 sets

Filter request- or response-headers with VMOD re2 sets¶

Why filter headers at all?¶

Denylist with plain vcl¶

Denylist with vmod_re2 and hdr_filter¶

Allowlists with vmod_re2 and hdr_filter¶

Filter in backend_fetch¶

Patterns in detail¶

Response header filtering¶

Response header filtering example¶

Which headers should I put on my allowlist without breaking stuff?¶

Documentation / Further Reading¶

Contributing¶

VSV00018 Varnish Cache absolute form parsing deficiency

VSV00018 Varnish Cache absolute form parsing deficiency¶

Versions affected¶

Versions not affected¶

Mitigation¶

Acknowledgements and credits¶

Vinyl Cache 9.0.0

Vinyl Cache 9.0.0¶

Writing Documentation

Writing Documentation¶

Inline Markup¶

References are tricky¶

Document Structure¶

Admonitions¶

Additional Considerations for the Website¶

Treat the website like a blog¶

Linking on the homepage¶

Title¶

Sphinx differences¶

Sphinx design¶

Dropdowns¶

Tabs¶

Badges¶

Cards¶

Migrating from old versions

Migrating from old versions¶

Upgrading should be easy¶

Versions¶

We have a lot of documentation¶

No silent changes¶

Versions of the VCL language¶

The Vinyl Cache Project has a New Identity

The Vinyl Cache Project has a New Identity¶

Winners of the Logo and Mascot Contets¶

First price: Rhubarbe¶

Second price: Pauline Gericke¶

Governance

Governance¶

Governing board¶

Policies¶

Behavior / Code of conduct¶

Maintainer Roles¶

The Vinyl Developer Day¶

Bugs, pull requests, feature requests¶

The commit bit¶

Bylaws of The Vinyl Cache Project (1.00)

Bylaws of The Vinyl Cache Project (1.00)¶

Background information for non-Danes¶

The Bylaws¶

Formalia¶

The General Assembly¶

The Governing Board¶

The Members¶

Changing Bylaws and dissolution¶

Miscellaneous¶

Transitional Clauses¶

Revision log¶

Vinyl Cache has left github

Vinyl Cache has left github¶

… what you need to do¶

About the new forge¶

Location mapping old/new¶

Changing your git settings¶

What is happening after the forge migration¶

Mini-Retro: What we did¶

What went wrong¶

First price: Rhubarbe ¶

Second price: Pauline Gericke ¶