Operators

Conditionals

Note that there are no loops or iterators of any kind in VCL.

Variables

if (req.url == "/mistyped_url.html") {
    set req.url = "/correct_url.html";
    unset req.http.cookie;
}

There are obvious limitations to what can be done, for instance it makes no sense to unset req.url; - a request must have some kind of URL to be valid, and likewise trying to manipulate a backend response when there is none (yet) makes no sense. The VCL compiler will detect such errors.

Variables have types. Most of them a STRINGS, and anything in VCL can be turned into a STRING, but some variables have types like DURATION, IP etc.

When setting a such variables, the right hand side of the equal sign must have the correct variables type, you cannot assign a STRING to a variable of type NUMBER, even if the string is "42".

Explicit conversion functions are available in vmod_std(3).

For the complete album of VCL variables see: vcl-var(7).

Strings

Booleans

String types will evaluate to false if they are unset. This allows checks of the type if (req.http.opthdr) {} to test if a header exists, even if it is empty, whereas if (req.http.opthdr == "") {} does not distinguish if the header does not exist or if it is empty.

Backend types will evaluate to false if they don't have a backend assigned; integer types will evaluate to false if their value is zero; duration types will evaluate to false if their value is equal or less than zero.

Time

The keyword now returns a notion of the current time, which is kept consistent during VCL subroutine invocations, so during the execution of a VCL state subroutine (vcl_* {}), including all user-defined subroutines being called, now always returns the same value.

Durations

In string context they return a string with their value rounded to 3 decimal places and excluding the unit, e.g. 1.500.

Integers

Real numbers

Regular Expressions

To send flags to the PCRE engine, such as to do case insensitive matching, add the flag within parens following a question mark, like this:

# If host is NOT example dot com..
if (req.http.host !~ "(?i)example\.com$") {
    ...
}

Include statement

include "foo.vcl";

Optionally, the include keyword can take a +glob flag to include all files matching a glob pattern:

include +glob "example.org/*.vcl";

Import statement

Example:

import std;
sub vcl_recv {
    std.log("foo");
}

Comments

Example:

sub vcl_recv {
    // Single line of out-commented VCL.
    # Another way of commenting out a single line.
    /*
        Multi-line block of commented-out VCL.
    */
}

Backends and health probes

Access Control List (ACL)

acl localnetwork {
    "localhost";    # myself
    "192.0.2.0"/24; # and everyone on the local network
    ! "192.0.2.23"; # except for the dial-in router
}

If an ACL entry specifies a host name which Varnish is unable to resolve, it will match any address it is compared to. Consequently, if it is preceded by a negation mark, it will reject any address it is compared to, which may not be what you intended. If the entry is enclosed in parentheses, however, it will simply be ignored if the host name cannot be resolved.

To match an IP address against an ACL, simply use the match operator:

if (client.ip ~ localnetwork) {
    return (pipe);
}

ACLs have feature flags which can be set or cleared for each ACL individually:

acl foo -pedantic +log {
    "firewall.example.com" / 24;
}

VCL objects

sub vcl_init {
    new b = directors.round_robin()
    b.add_backend(node1);
}

This is only available in vcl_init.

Subroutines

sub pipe_if_local {
    if (client.ip ~ localnetwork) {
        return (pipe);
    }
}

Subroutines in VCL do not take arguments, nor do they return values. The built in subroutines all have names beginning with vcl_, which is reserved.

To call a subroutine, use the call keyword followed by the subroutine's name:

sub vcl_recv {
    call pipe_if_local;
}

Return statements

The <action> specifies how execution should proceed. The context defines which actions are available.

It is possible to exit a subroutine that is not part of the built-in ones using a simple return statement without specifying an action. It exits the subroutine without transitioning to a different state:

sub filter_cookies {
    if (!req.http.cookie) {
        return;
    }
    # complex cookie filtering
}

Multiple subroutines

The built-in VCL distributed with Varnish will be implicitly concatenated when the VCL is compiled.

Functions

ban(STRING)

hash_data(input)

synthetic(STRING)

regsub(str, regex, sub)

regsuball(str, regex, sub)

For converting or casting VCL values between data types use the functions available in the std VMOD.