varnish / varnish-modules

Collection of Varnish Cache modules (vmods) by Varnish Software
Other
182 stars 86 forks source link

New vmod_uuid #76

Closed infintesimal closed 7 years ago

infintesimal commented 7 years ago

This vmod allows for generating a random uuid from within vcl. It's useful for handling uuid format session identifying cookies that either need to be intercepted and rewritten to an req.http.X-header or for cookieless inbound requests where we'd like to serve the response body from cache but make sure an appropriate uuid format session cookie is sent to the client and not leaking hte cookie that was cached.

infintesimal commented 7 years ago

one quick comment: this vmod does rely on uuid and uuid-dev packages. I tweaked configure to fail if that package was not available. On my ubuntu system, it's sudo apt-get install uuid uuid-dev I know this is counter to the notes, I suppose I could have implemented by own random 16 bytes, but it seemed overkill. Would love to get your feedback.

infintesimal commented 7 years ago

Hi all, So now I propagated the updated configure.ac and other sources correctly. It's barfing, as expected, on no uuid/uuid.h headers and lib. Can you update the Travis build environment to do an sudo apt-get install uuid uuid-dev

That should fix the build fails.

Thanks, Steve

dridi commented 7 years ago

Hello Steve,

Thank you for a much appreciated contribution, however, as described in the README this is a collection of self-contained modules that don't rely on external libraries besides those Varnish already links to.

Dridi

jstangroome commented 7 years ago

@infintesimal you mentioned you could have implemented your own random 16 bytes instead of referencing the uuid library and I believe making this change would allow this to be re-considered.

However, be aware that UUIDs are not purely random, most use the current time, the network interface's MAC address, and other seeds in the value. Only UUID v4 is based purely on a random-number generator but even then certain bit positions are used to indicate that it is this particular variant of UUID. See RFC 4122 for more.

Also, it would probably be prudent to avoid a name collision with the existing UUID vmod and/or expose a compatible API.