vmod_debug: use $Restrict where relevant and add tests

bin/varnishtest/tests/v00043.vtc

@@ -98,10 +98,7 @@ varnish v1 -cliok "param.set debug +syncvsl" -vcl+backend {
 	}
 
 	sub vcl_backend_fetch {
-		if (bereq.url == "/fail") {
-			# dynamic priv not checked at compile time
-			o2.test_priv_top("only works on client side");
-		}
+
 	}
 
 	sub vcl_backend_response {
@@ -126,8 +123,3 @@ client c1 {
 
 varnish v1 -expect client_req == 2
 
-client c2 {
-	txreq -url /fail
-	rxresp
-	expect resp.status == 503
-} -run

bin/varnishtest/tests/v00051.vtc

@@ -538,3 +538,30 @@ logexpect l1 -v v1 -g raw {
 
 varnish v1 -cliok "vcl.discard vcl10"
 logexpect l1 -wait
+
+#######################################################################
+# Fail vcl - debug.client_ip function restricted to client and backend
+
+varnish v1 -errvcl {Not available in subroutine 'vcl_init'} {
+	import debug;
+
+	sub vcl_init {
+		debug.client_ip();
+    }
+}
+
+#######################################################################
+# Fail vcl - obj.test_priv_top method restricted to client
+
+varnish v1 -errvcl {Not available in subroutine 'vcl_backend_response'} {
+	import debug;
+
+	sub vcl_init {
+		new test_obj = debug.obj("bar");
+	}
+
+	sub vcl_backend_response {
+		set beresp.http.foo = test_obj.test_priv_top();
+	}
+}
+

vmod/vmod_debug.vcc

@@ -123,6 +123,8 @@ $Method STRING .test_priv_top(STRING s="")
 
 Test per-object priv_top via VRT_priv_top()
 
+$Restrict client
+
 $Function VOID rot104()
 
 Try to register the rot52 filter again. This should always fail
@@ -285,6 +287,8 @@ $Function VOID catflap(ENUM {miss, first, last} type)
 
 Test the HSH_Lookup catflap
 
+$Restrict client
+
 $Function BYTES stk()
 
 Return an approximation of the amount of stack used.
@@ -294,6 +298,8 @@ should now only be used for diagnostic purposes.
 
 0B is returned if no sensible value can be determined.
 
+$Restrict client
+
 $Function VOID vcl_prevent_cold(PRIV_VCL)
 
 Prevent VCL from going cold.
@@ -316,6 +322,8 @@ Set the client socket' send buffer size to *sndbuf*. The previous, desired
 and actual values appear in the logs. Not currently implemented for backend
 transactions.
 
+$Restrict client backend
+
 $Function VOID store_ip(IP)
 
 Store an IP address to be later found by ``debug.get_ip()`` in the same
@@ -336,10 +344,14 @@ $Function STRING client_ip()
 
 Get the stringified client ip from the session attr
 
+$Restrict client backend
+
 $Function STRING client_port()
 
 Get the stringified client port from the session attr
 
+$Restrict client backend
+
 $Function VOID fail_task_fini()
 
 fail any task fini before ok_task_fini() is called