.. _phk_barriers:

============================
Security barriers in Varnish
============================

Security is a very important design driver in Varnish, more likely than not,
if you find yourself thinking "Why did he do _that_ ? the answer has to
do with security.

The Varnish security model is based on some very crude but easy to understand
barriers between the various components::

                .-->- provides ->---------------------------------------.
                |                                          |            |
       (ADMIN)--+-->- runs ----->---.                      |            |
                |                   |                      |            |
                |-->- cli_req -->---|                      v            v
                '--<- cli_resp -<---|                     VCL        MODULE
                                    |                      |            |
       (OPER)                       |                      |reads       |
         |                          |                      |            |
         |runs                      |                      |            |
         |      .-<- create -<-.    |    .->- fork ->-.    v            |
         v      |->- check -->-|-- MGR --|            |-- VCC <- loads -|
        VSM     |-<- write --<-'    |    '-<- wait -<-'    |            |
       TOOLS    |                   |                      |            |
         ^      |     .-------------'                      |            |
         |      |     |                                    |writes      |
         |reads |     |->- fork ----->-.                   |            |
         |      |     |->- cli_req -->-|                   |            |
        VSM ----'     |-<- cli_resp -<-|                   v            |
         |            '-<- wait -----<-|                VCL.SO          |
         |                             |                   |            |
         |                             |                   |            |
         |---->----- inherit --->------|--<-- loads -------'            |
         |---->-----  reads ---->------|                                |
         '----<----- writes ----<------|--<-- loads --------------------'
                                       |
                                       |
                                       |
           .--->-- http_req --->--.    |    .-->-- http_req --->--.
  (ANON) --|                      |-- CLD --|                     |-- (BACKEND)
           '---<-- http_resp --<--'         '--<-- http_resp --<--'

(ASCII-ART   tforms we care about
---------------------------

We care about these platforms because our users use them and
because they deliver a lot of bang for the buck with Varnish.

These platforms are in our "tinderbox" tests, we use them ourselves
and they pass all regression tests all the time. 
Platform specific bug reports gets acted on.

*FreeBSD*

*Linux*

Obviously you can forget about running Varnish on your
`WRT54G <http://en.wikipedia.org/wiki/Linksys_WRT54G_series>`_
but if you have a real computer, you can expect Varnish to work
"ok or better" on any distro that has a package available.

B - Platforms we try not to break
---------------------------------

We try not to break these platforms, because they basically work,
possibly with some footnotes or minor limitations, and they have
an active userbase.

We may or may not test on these platforms on a regular basis,
or we may rely on contributors to alert us to problems.
Platform specific bug reports without patches will likely live a quiet life.

*Mac OS/X*

*Solaris*.

Yes, we'd like to bump Solaris to tier-A but I have to say that the
uncertainty about the future for OpenSolaris, and lack of time to
care and feed the somewhat altmodishe socket-API on Solaris, does
keep the enthusiasm bounded.

NetBSD, AIX and HP-UX are conceivably candidates for this level, but
so far I have not heard much, if any, user interest.

C - Platforms we tolerate
-------------------------

We tolerate any other platform, as long as the burden of doing
so is proportional to the benefit to the Varnish community.

Do not file bug reports specific to these platforms without attaching
a patch that solves the problem, we will just close it.

For now, anything else goes here, certainly the N900 and the WRT54G.

I'm afraid I have to put OpenBSD here for now, it is seriously
behind on socket APIs and working around those issues is just not
worth the effort.

If people send us a small non-intrusive patches that makes Varnish
run on these platforms, we'll take it.

If they send us patches that reorganizes everything, hurts code
readability, quality or just generally do not satisfy our taste,
they get told that thanks, but no thanks.

Is that it ?  Abandon all hope etc. ?
-------------------------------------

These tiers are not static, if for some reason Varnish suddenly
becomes a mandatory accessory to some technically sensible platform,
(zOS anyone ?) that platform will get upgraded.  If the pessimists
are right about Oracles intentions, Solaris may get demoted.


Until next time,

Poul-Henning, 2010-08-03
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ./usr/share/doc/varnish-doc/html/_sources/phk/gzip.txt                                              0000644 0000000 0000000 00000013121 11652771702 021676  0                                                                                                    ustar   root                        