[Varnish] #280: VCL fault with restart logic if backend returns 403

[Varnish]

#280: VCL fault with restart logic if backend returns 403
----------------------+-----------------------------------------------------
 Reporter:  marlier   |       Owner:  phk  
     Type:  defect    |      Status:  new  
 Priority:  normal    |   Milestone:       
Component:  varnishd  |     Version:  trunk
 Severity:  normal    |    Keywords:       
----------------------+-----------------------------------------------------
 Issue description:
 With restart logic enabled, "403: Forbidden" responses are not handled
 correctly.  It appears that they loop forever (sending requests to the
 backend, or backends), until they cause this fault:

 {{{
 Child (25712) died signal=6
 Child (25712) Panic message: Missing errorhandling code in cnt_lookup(),
 cache_center.c line 558:
   Condition((p) != 0) not true.  thread = (cache-worker)sp = 0x857546c {
   fd = 9, id = 9, xid = 1541762087,
   client = 127.0.0.1:35186,
   step = STP_LOOKUP,
   err_code = 403, err_reason = (null),
   ws = 0x85754b4 { overflow
     id = "sess",
     {s,f,r,e} = {0x8575934,,+8168,(nil),+8192},
   },
     worker = 0x6f2970e0 {
     },
     vcl = {
       srcname = {
         "/etc/varnish/restarts.vcl",
         "Default",
       },
     },
   backend = 0x855fc98 {
     vcl_name = "tea",
   },
 },


 Child cleanup complete
 }}}


 Steps to reproduce:
 This issue is consistently reproducible.

 * Configure varnish with a backend that includes forbidden URLs.
 * Add logic to vcl_fetch that will cause a restart if the returned object
 has a response code other than 200
 * Request the forbidden URL via varnish (eg, with wget)


 Workaround:
 There is a simple workaround to this issue.  Instead of enabling restart
 logic with this:
 {{{
 sub vcl_fetch {
     if (obj.status != 200) {
         restart;
     }
 }
 }}}

 use this:
 {{{
 sub vcl_fetch {
     if (obj.status != 200 && obj.status != 403) {
         restart;
     }
 }
 }}}

 Attached VCL file is broken, and includes the workaround commented out.

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/280>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator