#- # Copyright (c) 2018 UPLEX Nils Goroll Systemoptimierung # All rights reserved # # Author: Geoffrey Simmons # # See LICENSE # $Module selector 3 Varnish Module for matching strings associated with backends, regexen and other data $ABI vrt $Synopsis manual SYNOPSIS ======== :: import selector; # Set creation new = selector.set([BOOL case_sensitive]) VOID .add(STRING [, STRING string] [, STRING regex] [, BACKEND backend] [, INT integer]) VOID .create_stats() # Matching BOOL .match(STRING) BOOL .hasprefix(STRING) # Match properties INT .nmatches() BOOL .matched(INT) INT .which([ENUM select]) # Retrieving objects after match STRING .element([INT n] [, ENUM select]) STRING .string([INT n] [, ENUM select]) INT .integer([INT n] [, ENUM select]) BACKEND .backend([INT n] [, ENUM select]) BOOL .re_match(STRING [, INT n] [, ENUM select]) STRING .sub(STRING text, STRING rewrite [, BOOL all] [, INT n] [, ENUM select]) # VMOD version STRING selector.version() DESCRIPTION =========== .. _VMOD re2: https://code.uplex.de/uplex-varnish/libvmod-re2 Varnish Module (VMOD) for matching strings against sets of fixed strings, and optionally associating the matched string with a backend, another string, an integer, or a regular expression. The VMOD is intended to support a variety of use cases that are typical for VCL deployments, such as: * Determining the backend based on the Host header or the prefix of the URL. * Rewriting the URL or a header. * Generating redirect responses, based on a header or the URL. Operations such as these are commonly implemented in native VCL with an ``if-elsif-elsif`` sequence of string comparisons or regex matches. As the number of matches increases, such a sequence becomes cumbersome and scales poorly -- the time needed to execute the sequence increases with the number of matches to be performed. With the VMOD, the strings to be matched are declared in a tabular form in ``vcl_init``, and the operation is executed in a few lines. For example:: import selector; sub vcl_init { # Requests for URLs with these prefixes will be sent to the # associated backend. new url_prefix = selector.set(); url_prefix.add("/foo/", backend=foo_backend); url_prefix.add("/bar/", backend=bar_backend); url_prefix.add("/baz/", backend=baz_backend); # For requests with these Host headers, generate a redirect # response, using the associated string to construct the # Location header, and the integer to set the response code. new redirect = selector.set(); redirect.add("www.foo.com", string="/foo", integer=301); redirect.add("www.bar.com", string="/bar", integer=302); redirect.add("www.baz.com", string="/baz", integer=303); redirect.add("www.quux.com", string="/quux", integer=307); # Requests for these URLs are rewritten by altering the # query string, using the associated regex for a # substitution operation, each of which removes a # parameter. new rewrite = selector.set(); rewrite.add("/alpha/beta", regex="(\?.*)\bfoo=[^&]+&?(.*)$"); rewrite.add("/delta/gamma", regex="(\?.*)\bbar=[^&]+&?(.*)$"); rewrite.add("/epsilon/zeta", regex="(\?.*)\bbaz=[^&]+&?(.*)$"); } sub vcl_recv { # .match() returns true if the Host header exactly matches # one of the strings in the set. if (redirect.match(req.http.Host)) { # .string() returns the string added to the set above with # the 'string' parameter, for the string that was # matched. We use it to construct a Location header, which # will be retrieved in vcl_synth below to construct the # redirect response. # # .integer() returns the integer added to the set with the # 'integer' parameter, for the string that was matched. We # use it as the argument of synth() to set the response # status (one of the redirect status codes). set req.http.Location = "http://other.com" + redirect.string() + req.url; return (synth(redirect.integer())); } # If the URL matches the rewrite set, change the query string by # applying a substitution using the associated regex (removing a # query parameter). if (rewrite.match(req.req.url)) { set req.url = rewrite.sub(req.url, "\1\2"); } } sub vcl_synth { # We come here when Host matched the redirect set in vcl_recv # above. Set the Location response header from the request header # set in vcl_recv. if (req.http.Location && resp.status >= 301 && resp.status <= 307) { set resp.http.Location = req.http.Location; return (deliver); } } sub vcl_backend_fetch { # The .hasprefix() method returns true if the URL has a prefix # in the set. if (url_prefix.hasprefix(bereq.url)) { # .backend() returns the backend associated with the # string in the set that was matched as a prefix. set bereq.backend = url_prefix.backend(); } } Matches with the ``.match()`` and ``.hasprefix()`` methods scale well as the number of strings in the set increases. The time needed for ``.match()`` is proportional to the length of the string to be matched; for ``.hasprefix()``, it is proportional to the length of the longest string in the set that forms a prefix of the string to be matched. In both cases, the time for execution is independent of the number of strings in the set, and is predictable and fast for large sets of strings. In the case of non-matches, the search for a match stops as soon as it encounters a character in the string such that no string in the set can match. Thus if a set contains the strings ``foo``, ``bar`` and ``baz``, then the search stops after the first character if it is neither of ``f`` or ``b``. When new strings are added to a set (with new ``.add()`` statements in ``vcl_init``), the VCL code that executes the various operations (rewrites, backend assignment and so forth) can remain unchanged. So the VMOD can contribute to better code maintainability. Matches with ``.match()`` and ``.hasprefix()`` are fixed string matches; characters such as wildcards and regex metacharacters are matched literally, and have no special meaning. Regex operations such as matching or substitution can be performed after set matches, using the regex saved with the ``regex`` parameter. But if you need to match against sets of patterns, consider using the set interface of `VMOD re2`_, which provides techniques similar to the present VMOD. Selecting matched elements of a set ----------------------------------- The ``.match()`` operation is an exact, fixed string match, and hence always matches exactly one string in the set if it succeeds. With ``.hasprefix()``, more than one string in the set may be matched, if the set includes strings that are prefixes of other strings in the same set:: sub vcl_init { new myset = selector.set(); myset.add("/foo/"); # element 1 myset.add("/foo/bar/"); # element 2 myset.add("/foo/bar/baz/"); # element 3 } sub vcl_recv { # With .hasprefix(), a URL such as /foo/bar/baz/quux matches all # 3 elements in the set. if (myset.hasprefix(req.url)) { # ... } } Just calling ``.hasprefix()`` may be sufficient if all that matters is whether a string has any prefix that appears in the set. But for some uses it may be necessary to identify one matching element of the set; this is done in particular for the ``.element()``, ``.backend()``, ``.string()``, ``.integer()``, ``.re_match()`` and ``.sub()`` methods, which retrieve data associated with a specific set element. For such cases, the method parameters ``INT n`` and ``ENUM select`` are used to choose a matched element. As indicated in the example, elements of a set are implicitly numbered in the order in which they were added to the set using the ``.add()`` method, starting from 1. In all of the following, the ``n`` and ``select`` parameters for a method call are evaluated as follows: * If ``n`` >= 1, then the ``n``-th element of the set is chosen, and the ``select`` parameter has no effect. A method with ``n`` >= 1 can be called in any context, and does not depend on prior match operations. * If ``n`` is greater than the number of elements in the set, the method fails, with an error message written to the Varnish log. See `ERRORS`_ below for details about method failure. * If ``n`` <= 0, then the ``select`` parameter is used to choose an element based on the most recent ``.match()`` or ``.hasprefix()`` call for the same set object in the same task scope; that is, the most recent call in the same client or backend context. Thus a method call in one of the ``vcl_backend_*`` subroutines refers back to the most recent ``.match()`` or ``.hasprefix()`` invocation in the same backend context. ``n`` is 0 by default, so it can be left out of the method call for this purpose. * If ``n`` <= 0 and neither of ``.match()`` or ``.hasprefix()`` has been called for the same set object in the same task scope, or if the most recent call resulted in a failed match, then the method fails. * When ``n`` <= 0 after a successful ``.match()`` call, then for any value of ``select``, the element chosen is the one that matched. * When ``n`` <= 0 after a successful ``.hasprefix()`` call, then the value of ``select`` determines the element chosen, as follows: * ``UNIQUE`` (default): if exactly one element of the set matched, choose that element. The method fails in this case if more than one element matched. Since the defaults for ``n`` and ``select`` are 0 and ``UNIQUE``, ``select=UNIQUE`` is in effect if both parameters are left out of the method call. * ``EXACT``: if one of the elements in the set matched exactly (even if other prefixes in the set matched as well), choose that element. The method fails if there was no exact match. Thus if a prefix match for ``/foo/bar`` is run against a set containing ``/foo`` and ``/foo/bar``, the latter element is chosen with ``select=EXACT``. * ``FIRST``: choose the first element in the set that matched (in the order in which they were added with ``.add()``). * ``LAST``: choose the last element in the set that matched. * ``SHORTEST``: choose the shortest element in the set that matched. * ``LONGEST``: choose the longest element in the set that matched. So for sets of strings with common prefixes, a strategy for selecting the matched element after a prefix match can be implemented by ordering the strings added to the set, by choosing only an exact match or the longest match, and so on:: # In this example, we set the backend for a fetch based on the most # specific matching prefix of the URL, i.e. the longest prefix in # the URL that appears in the set. sub vcl_init { new myset = selector.set(); myset.add("/foo/", backend=foo_backend); myset.add("/foo/bar/", backend=bar_backend); myset.add("/foo/bar/baz/", backend=baz_backend); } sub vcl_backend_fetch { if (myset.hasprefix(bereq.url)) { set bereq.backend = myset.backend(select=LONGEST); } } # This sets baz_backend for /foo/bar/baz/quux # bar_backend for /foo/bar/quux # foo_backend for /foo/quux $Object set(BOOL case_sensitive=1) Create a set object. When ``case_sensitive`` is ``false``, matches using the ``.match()`` and ``.hasprefix()`` methods are case-insensitive. By default, ``case_sensitive`` is ``true``. Example:: sub vcl_init { new myset = selector.set(); # ... # For case-insensitive matching. new caseless = selector.set(case_sensitive=false); # ... } $Method VOID .add(STRING, [STRING string], [STRING regex], [BACKEND backend], [INT integer]) Add the given string to the set. As indicated above, elements added to the set are implicitly numbered in the order in which they are added with ``.add()``, starting with 1. If values are set for the optional parameters ``string``, ``regex``, ``backend`` or ``integer``, then those values are associated with this element, and can be retrieved with the ``.string()``, ``.backend()``, ``.integer()``, ``.re_match()`` or ``.sub()`` methods, as described below. A regular expression in the ``regex`` parameter is compiled at VCL load time. If the compile fails, then the VCL load fails with an error message. Regular expressions are evaluated exactly as native regexen in VCL. ``.add()`` fails and invokes VCL failure (see `ERRORS`_) under the following conditions: * ``.add()`` is called any subroutine besides ``vcl_init``. * The string to be added is NULL. * The same string is added to the same set more than once. * A regular expression in the ``regex`` parameter fails to compile. Example:: sub vcl_init { new myset = selector.set(); myset.add("www.foo.com"); myset.add("www.bar.com", string="/bar"); myset.add("www.baz.com", string="/baz", backend=baz_backend); myset.add("www.quux.com", string="/quux", backend=quux_backend, regex="^/quux/([^/]+)/"); } $Method VOID .create_stats(PRIV_VCL) Creates statistics counters for this object that are displayed by tools such as ``varnishstat(1)``. See `STATISTICS`_ below for details. It should be called in ``vcl_init`` after all strings have been added to the set. No statistics are created for a set object if ``.create_stats()`` is not invoked. Unlike the matching operations, the time needed for this method increases as the number of strings in the set increases, since it traverses the entire internal data structure. For large sets, the time needed for a VCL load can become noticeably longer. If that is a problem, consider using this method during development and testing, and removing it for production deployments (since the stats values are always the same for sets with the same strings). ``.create_stats()`` fails and invokes VCL failure if it is called in any VCL subroutine besides ``vcl_init``. Example:: sub vcl_init { new myset = selector.set(); myset.add("foo"); myset.add("bar"); myset.add("baz"); myset.create_stats(); } $Method BOOL .match(STRING) Returns ``true`` if the given STRING exactly matches one of the strings in the set. The match is case insensitive if and only if the parameter ``case_sensitive`` was set to ``false`` in the set constructor (matches are case sensitive by default). ``.match()`` fails and returns ``false`` under the following conditions: * The string to be matched is NULL (such as an unset header). * No strings were added to the set. * There is insufficient workspace for internal operations. Example:: if (myset.match(req.http.Host)) { call do_on_match; } $Method BOOL .hasprefix(STRING) Returns ``true`` if the STRING to be matched has a prefix that is in the set. The match is case insensitive if ``case_sensitive`` was set to ``false`` in the constructor. ``.hasprefix()`` fails and returns ``false`` under the same conditions given for ``.match()`` above. Example:: if (myset.hasprefix(req.url)) { call do_if_prefix_matched; } $Method INT .nmatches() Returns the number of elements that were matched by the most recent successful invocation of ``.match()`` or ``.hasprefix()`` for the same set object in the same task scope (that is, in the same client or backend context). ``.nmatches()`` returns 0 after either of ``.match()`` or ``.hasprefix()`` returned ``false``, and it returns 1 after ``.match()`` returned ``true``. After a successful ``.hasprefix()`` call, it returns the number of strings in the set that are prefixes of the string that was matched. ``.nmatches()`` returns 0 and writes an error message to the log if there was no prior invocation of ``.match()`` or ``.hasprefix()`` in the same task scope. Example:: # For a use case that requires a unique prefix match, use # .nmatches() to ensure that there was exactly one match, and fail # fast with VCL failure otherwise. if (myset.hasprefix(bereq.url)) { if (myset.nmatches() != 1) { std.log(bereq.url + " matched > 1 prefix in the set"); return (fail); } set bereq.backend = myset.backend(select=UNIQUE); } $Method BOOL .matched(INT) After a successful ``.match()`` or ``.hasprefix()`` call for the same set object in the same task scope, return ``true`` if the element indicated by the INT parameter was matched. The numbering corresponds to the order of ``.add()`` invocations in ``vcl_init`` (starting from 1). ``.matched()`` always returns ``false`` if the most recent ``.match()`` or ``.hasprefix()`` call returned ``false``. ``.matched()`` fails and returns ``false`` if: * The parameter is out of range -- it is less than 1 or greater than the number of elements in the set. * There was no prior invocation of ``.match()`` or ``.hasprefix()`` in the same task scope. Example:: if (myset.match(req.http.Host)) { if (myset.matched(1)) { call do_if_the_first_element_matched; } } $Method INT .which(ENUM {UNIQUE, EXACT, FIRST, LAST, SHORTEST, LONGEST} select=UNIQUE) After a successful ``.match()`` or ``.hasprefix()`` call for the same set object in the same task scope, return the index of the matching element indicated by ``select``. The numbering corresponds to the order of ``.add()`` calls in ``vcl_init``. Return 0 if the most recent ``.match()`` or ``.hasprefix()`` call returned ``false``. If more than one element matched after calling ``.hasprefix()``, the index is chosen with the ``select`` parameter, according to the rules given above. By default, ``select`` is ``UNIQUE``. ``.which()`` fails and returns 0 if: * The choice of ``select`` indicates failure, as documented above; that is, if ``select`` is ``UNIQUE`` or ``EXACT``, but there was no unique or exact match, respectively. * There was no prior invocation of ``.match()`` or ``.hasprefix()`` in the same task scope. Example:: if (myset.hasprefix(req.url)) { if (myset.which(select=SHORTEST) > 1) { call do_if_the_shortest_match_was_not_the_first_element; } } $Method STRING .element(INT n=0, ENUM {UNIQUE, EXACT, FIRST, LAST, SHORTEST, LONGEST} select=UNIQUE) Returns the element of the set indicated by the ``n`` and ``select`` parameters as described above. Thus if ``n`` >= 1, the ``n``-th element of the set is returned; otherwise the matched element indicated by ``select`` is returned after calling ``.match()`` or ``.hasprefix()``. The string returned is the same as it was added to the set; even if a prior match was case insensitive, and the matched string differs in case, the string with the case as added to the set is returned. ``.element()`` fails and returns NULL if the rules for ``n`` and ``select`` indicate failure; that is: * ``n`` is out of range (greater than the number of elements in the set) * ``n`` < 1 and ``select`` fails for ``UNIQUE`` or ``EXACT`` * ``n`` < 1 and there was no prior invocation of ``.match()`` or ``.hasprefix()``. Example:: if (myset.hasprefix(req.url)) { # Construct a redirect response for another host, using the # matching prefix in the request URL as the new URL path. set resp.http.Location = "http://other.com" + myset.element(); } $Method BACKEND .backend(INT n=0, ENUM {UNIQUE, EXACT, FIRST, LAST, SHORTEST, LONGEST} select=UNIQUE) Returns the backend associated with the element of the set indicated by ``n`` and ``select``, according to the rules given above; that is, it returns the backend that was set via the ``backend`` parameter in ``.add()``. ``.backend()`` fails and returns NULL if: * The rules for ``n`` and ``select`` indicate failure. * No backend was set with the ``backend`` parameter in the ``.add()`` call corresponding to the selected element. Example:: if (myset.hasprefix(bereq.url)) { # Set the backend associated with the string in the set that # forms the longest prefix of the URL set bereq.backend = myset.backend(select=LONGEST); } $Method STRING .string(INT n=0, ENUM {UNIQUE, EXACT, FIRST, LAST, SHORTEST, LONGEST} select=UNIQUE) Returns the string set by the ``string`` parameter for the element of the set indicated by ``n`` and ``select``, according to the rules given above. ``.string()`` fails and returns NULL if: * The rules for ``n`` and ``select`` indicate failure. * No string was set with the ``string`` parameter in ``.add()``. Example:: # Rewrite the URL if it matches one of the strings in the set. if (myset.match(req.url)) { set req.url = myset.string(); } $Method INT .integer(INT n=0, ENUM {UNIQUE, EXACT, FIRST, LAST, SHORTEST, LONGEST} select=UNIQUE) Returns the integer set by the ``integer`` parameter for the element of the set indicated by ``n`` and ``select``, according to the rules given above. ``.integer()`` invokes VCL failure (see `ERRORS`_) if: * The rules for ``n`` and ``select`` indicate failure. * No integer was set with the ``integer`` parameter in ``.add()``. Note that VCL failure for ``.integer()`` differs from the failure mode for other methods that retrieve data associated with the selected set element, such as ``.string()`` and ``.backend()``. Since there is no distinguished "error value" for an INT, the VMOD does not return one that can be detected in VCL, so that processing could continue without failure. So you may want to check more carefully in VCL for possible errors that may cause ``.integer()`` to fail; for example, by checking whether ``.nmatches() == 1`` before calling ``.integer()`` with ``select=UNIQUE`` or ``select=EXACT``, if the previous match operation was ``.hasprefix()`` and the set contains overlapping prefixes. Example:: # Send a synthetic response if the URL has a prefix in the set, # using the response code set in .add(). if (myset.hasprefix(req.url)) { # Check .nmatches() to ensure that select=UNIQUE can be used # without risk of VCL failure. if (myset.nmatches() == 1) { return( synth(myset.integer(select=UNIQUE)) ); } } $Method BOOL .re_match(STRING subject, INT n=0, ENUM {UNIQUE, EXACT, FIRST, LAST, SHORTEST, LONGEST} select=UNIQUE) Using the regular expression set by the ``regex`` parameter for the element of the set indicated by ``n`` and ``select``, return the result of matching the regex against ``subject``. The regex match is the same operation performed for the native VCL ``~`` operator, see vcl(7). In other words, this method can be used to perform a second match with the saved regular expression, after matching a fixed string against the set. The regex match is subject to the same conditions imposed for matching in native VCL; in particular, it may be limited by the varnishd parameters ``pcre_match_limit`` and ``pcre_match_limit_recursion`` (see varnishd(1)). ``.re_match()`` fails and returns ``false`` if: * The rules for ``n`` and ``select`` indicate failure. * No regular expression was set with the ``regex`` parameter in ``.add()``. * The regex match fails, for any of the reasons that cause a native match to fail. Example:: # If the Host header exactly matches a string in the set, perform a # regex match against the URL. if (myset.match(req.http.Host)) { if (myset.re_match(req.url)) { call do_if_the_URL_matches_the_regex_for_Host; } } $Method STRING .sub(STRING str, STRING sub, BOOL all=0, INT n=0, ENUM {UNIQUE, EXACT, FIRST, LAST, SHORTEST, LONGEST} select=UNIQUE) Using the regular expression set by the ``regex`` parameter for the element of the set indicated by ``n`` and ``select``, return the result of a substitution using ``str`` and ``sub``. If ``all`` is ``false``, then return the result of replacing the first portion of ``str`` that matches the regex with ``sub``. ``sub`` may contain backreferences ``\0`` through ``\9``, to include captured substrings from ``str`` in the substitution. This is the same operation performed by the native VCL function ``regsub(str, regex, sub)`` (see vcl(7)). By default, ``all`` is false. If ``all`` is ``true``, return the result of replacing each non-overlapping portion of ``str`` that matches the regex with ``sub`` (possibly with backreferences). This is the same operation as native VCL's ``regsuball(str, regex, sub)``. ``.sub()`` fails and returns NULL if: * The rules for ``n`` and ``select`` indicate failure. * No regular expression was set with the ``regex`` parameter in ``.add()``. * The substitution fails for any of the reasons that cause native ``regsub()`` or ``regsuball()`` to fail. Example:: # In this example we match the URL prefix, and if a match is found, # rewrite the URL by exchanging path components as indicated. sub vcl_init { new rewrite = selector.set(); rewrite.add("/foo/", regex="^(/foo)/([^/]+)/([^/]+)/"); rewrite.add("/foo/bar/", regex="^(/foo/bar)/([^/]+)/([^/]+)/"); rewrite.add("/foo/bar/baz/", regex="^(/foo/bar/baz)/([^/]+)/([^/]+)/"); } if (rewrite.hasprefix(req.url)) { set req.url = rewrite.sub(req.url, "\1/\3/\2/", select=LAST); } # /foo/1/2/* is rewritten as /foo/2/1/* # /foo/bar/1/2/* is rewritten as /foo/bar/2/1/* # /foo/bar/baz/1/2/* is rewritten as /foo/bar/baz/2/1/* $Method STRING .debug() Intentionally not documented. $Function STRING version() Return the version string for this VMOD. Example:: std.log("Using VMOD selector version: " + selector.version()); STATISTICS ========== When ``.create_stats()`` is invoked for a set object, statistics are created that can be viewed with a tool like varnishstat(1). *NOTE*: except for ``elements``, the stats refer to properties of a set object's internal data structure, and hence depend on the internal implementation. The implementation may be changed in any new version of the VMOD, and hence the stats may change. If you install a new version, check the new version of the present document to see if there are new or different statistics. The stats have the following naming schema:: SELECTOR..