Varnish Enterprise 6.0.18r5 is a feature and bug fix release.
With this release, the kv,
ratelimit,
otel,
cwt and
nodes
VMODs become standard Varnish Enterprise features. They were previously
distributed as separately licensed feature add-ons and are now available
to all Varnish Enterprise users.
The release also introduces a new experimental payload data allocator,
purpose-built for MSE4, which can be enabled by setting the
yalloc_enable parameter. It aims at better memory density and faster
reclaim of memory for large allocations, and is disabled by default.
As the allocator is experimental, its parameter names may change in a
future release. The parameter must be set on the varnishd command
line:
varnishd -s mse4,/etc/varnish/mse4.conf -p yalloc_enable=on ...
Beyond that, the release brings runtime configuration of MSE4, configurable read-ahead for the Slicer, partial chain client certificate verification for TLS, a set of HTTP/1 protocol hardening fixes, and a number of stability and correctness fixes. All users are encouraged to upgrade.
New mse4.param.show and mse4.param.set CLI commands allow
displaying and changing MSE4 configuration settings at runtime,
without editing the MSE4 configuration file. Environment parameters
are addressed by name, book and store parameters with a
book.<id>. or store.<id>. prefix. Some settings require a
restart of the cache process to take effect.
varnishadm mse4.param.show changed
varnishadm mse4.param.show book.book1.banjournal_size
varnishadm mse4.param.set memcache_chunksize 5M
varnishadm mse4.param.set store.store1.aio_requests 5
The Slicer’s segment read-ahead during delivery is now configurable
through the new slicer_read_ahead parameter and the
slicer.read_ahead() VCL function. Higher values let more segment
fetches proceed while earlier segments are transmitting, at the cost
of more concurrent backend connections when delivering uncached
content.
import slicer;
sub vcl_recv {
if (req.url ~ "^/videos/") {
slicer.read_ahead(8);
}
}
TLS client certificate verification now supports partial chains: with
client-verify-partial-chain = true, any certificate in the client CA
file acts as a trust anchor, so a single intermediate CA can be
trusted without trusting its root or sibling intermediates.
varnishlog-json gained several options: -w and -a for writing to
a file with log rotation support, -F for reporting the final state
of requests and responses, and -K for structured key/value output of
VCL logs.
A set of HTTP/1 protocol hardening fixes from Varnish Cache, refusing
invalid or ambiguous message framing such as Transfer-Encoding on
HTTP/1.0 messages, repeated Transfer-Encoding header fields, and
disagreeing repeated Content-Length header fields. (VS issue #3414)
vmod_slicer: a transient segment fetch failure no longer invalidates
the segment meta object and all previously cached segments; only the
in-flight delivery fails. (VS issue #3352)
Range requests are now honored only for the GET method, as mandated
by RFC 9110.
With tls_ocsp_auto enabled, committing a certificate could issue a
duplicate fetch to the OCSP responder, and in certain cases crash the
cache process on an assertion.
Fixed a race in vmod_stat reference counting that could crash the
cache process, and a case where vmod_http kept recycling its
connection pool ten times per second while idle, degrading
performance on busy servers.
Note that memory_target no longer accepts a byte value larger than
the system’s physical memory. If your configuration sets such a value,
varnishd will refuse to start after the upgrade. We recommend setting
memory_target as a percentage instead.
See the changelog for the complete list of changes.