Custom VFP stats reveal/hide as VCL instances go warm/cold.

src/tests/stats.vtc

+# looks like -*- vcl -*-
+
+varnishtest "statistics"
+
+server s1 -repeat 10 {
+	rxreq
+	txresp -body {Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure.}
+} -start
+
+client c1 -repeat 10 {
+	txreq
+	rxresp
+	expect resp.status == 200
+	expect resp.http.Content-Encoding == <undef>
+	expect resp.body == {Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure.}
+}
+
+# Debug param vclrel causes VCLs to be released without delay. This
+# makes it possible to check the effects of temperature changes (stats
+# are hidden and revealed as VCLs go cold and warm).
+varnish v1 -arg "-p debug=+vclrel" -vcl+backend {
+	import ${vmod_ece};
+	import blob;
+
+	sub vcl_init {
+		ece.set_key("foo", blob.decode(BASE64,
+		                           encoded="hFMf3cvJSW5lQIfQlskk8g=="));
+	}
+
+	sub vcl_backend_response {
+		set bereq.http.X-ECE-Key-ID = "foo";
+		set beresp.filters = "ece_encrypt ece_decrypt";
+		set beresp.uncacheable = true;
+	}
+} -start
+
+client c1 -run
+
+varnish v1 -vsc ECE.*
+
+varnish v1 -expect ECE.vfp.ece_encrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_encrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_encrypt.out > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_decrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.out > 0
+
+varnish v1 -vcl+backend {
+	import ${vmod_ece};
+
+	sub vcl_init {
+		new my_encrypt = ece.encrypter("my_encrypt");
+		my_encrypt.create_stats();
+		new my_decrypt = ece.decrypter("my_decrypt");
+		my_decrypt.create_stats();
+	}
+
+	sub vcl_backend_response {
+		set bereq.http.X-ECE-Key-ID = "foo";
+		set beresp.filters = "my_encrypt my_decrypt";
+		set beresp.uncacheable = true;
+	}
+}
+
+varnish v1 -cliok "vcl.discard vcl1"
+varnish v1 -cliok "vcl.list"
+
+varnish v1 -vsc ECE.*
+varnish v1 -expect ECE.vfp.ece_encrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_encrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_encrypt.out > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_decrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.out > 0
+
+server s1 -wait
+server s1 -start
+client c1 -run
+
+varnish v1 -vsc ECE.*
+varnish v1 -expect ECE.vfp.ece_encrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_encrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_encrypt.out > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_decrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.out > 0
+varnish v1 -expect ECE.vfp.vcl2.my_encrypt.ops == 10
+varnish v1 -expect ECE.vfp.vcl2.my_encrypt.in > 0
+varnish v1 -expect ECE.vfp.vcl2.my_encrypt.out > 0
+varnish v1 -expect ECE.vfp.vcl2.my_decrypt.ops == 10
+varnish v1 -expect ECE.vfp.vcl2.my_decrypt.in > 0
+varnish v1 -expect ECE.vfp.vcl2.my_decrypt.out > 0
+
+varnish v1 -vcl+backend {}
+
+varnish v1 -cliok "vcl.state vcl2 cold"
+
+# With vcl2 in the cold state, stats for vcl2.* do not appear.
+# This has to be checked manually in the log.
+varnish v1 -vsc ECE.vfp.vcl2.*
+varnish v1 -expect ECE.vfp.ece_encrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_encrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_encrypt.out > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_decrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.out > 0
+
+varnish v1 -cliok "vcl.state vcl2 warm"
+
+# With vcl2 back in the warm state, stats for vcl2.* appear again.
+varnish v1 -expect ECE.vfp.ece_encrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_encrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_encrypt.out > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.ops == 10
+varnish v1 -expect ECE.vfp.ece_decrypt.in > 0
+varnish v1 -expect ECE.vfp.ece_decrypt.out > 0
+varnish v1 -expect ECE.vfp.vcl2.my_encrypt.ops == 10
+varnish v1 -expect ECE.vfp.vcl2.my_encrypt.in > 0
+varnish v1 -expect ECE.vfp.vcl2.my_encrypt.out > 0
+varnish v1 -expect ECE.vfp.vcl2.my_decrypt.ops == 10
+varnish v1 -expect ECE.vfp.vcl2.my_decrypt.in > 0
+varnish v1 -expect ECE.vfp.vcl2.my_decrypt.out > 0
+
+varnish v1 -cliok "vcl.state vcl2 cold"
+varnish v1 -cliok "vcl.discard vcl2"
+varnish v1 -cliok "vcl.list"
+
+# After the last VCL instance using ece has been discarded, there are
+# no stats left.
+varnish v1 -vsc ECE.*

src/vmod_ece.c

@@ -160,7 +160,26 @@ VPFX(event)(VRT_CTX, struct vmod_priv *priv, enum vcl_event_e e)
 		}
 		return (0);
 	case VCL_EVENT_WARM:
+		VSLIST_FOREACH(vfpe, vfph, list) {
+			CHECK_OBJ_NOTNULL(vfpe, CUSTOM_VFP_MAGIC);
+			if (vfpe->vfp != NULL && vfpe->vfp->priv1 != NULL) {
+				CAST_OBJ(cfg, TRUST_ME(vfpe->vfp->priv1),
+					 VFP_CFG_MAGIC);
+				if (cfg->vsc_seg != NULL)
+					VRT_VSC_Reveal(cfg->vsc_seg);
+			}
+		}
+		return (0);
 	case VCL_EVENT_COLD:
+		VSLIST_FOREACH(vfpe, vfph, list) {
+			CHECK_OBJ_NOTNULL(vfpe, CUSTOM_VFP_MAGIC);
+			if (vfpe->vfp != NULL && vfpe->vfp->priv1 != NULL) {
+				CAST_OBJ(cfg, TRUST_ME(vfpe->vfp->priv1),
+					 VFP_CFG_MAGIC);
+				if (cfg->vsc_seg != NULL)
+					VRT_VSC_Hide(cfg->vsc_seg);
+			}
+		}
 		return (0);
 	default:
 		WRONG("illegal event enum");