HSH: Limit the number of ban checks before vary matching

Refs: #4236

bin/varnishd/cache/cache_hash.c

@@ -371,6 +371,7 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 	const uint8_t *vary;
 	intmax_t boc_progress;
 	unsigned xid = 0;
+	unsigned ban_checks;
 	float dttl = 0.0;
 
 	AN(ocp);
@@ -420,6 +421,7 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 	busy_found = 0;
 	exp_oc = NULL;
 	exp_t_origin = 0.0;
+	ban_checks = 0;
 	VTAILQ_FOREACH(oc, &oh->objcs, hsh_list) {
 		/* Must be at least our own ref + the objcore we examine */
 		assert(oh->refcnt > 1);
@@ -451,7 +453,8 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 		if (oc->ttl <= 0.)
 			continue;
 
-		if (BAN_CheckObject(wrk, oc, req)) {
+		if (ban_checks++ < cache_param->ban_variant_checks
+		    && BAN_CheckObject(wrk, oc, req)) {
 			oc->flags |= OC_F_DYING;
 			EXP_Remove(oc, NULL);
 			continue;
@@ -466,6 +469,13 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 			}
 		}
 
+		if (ban_checks >= cache_param->ban_variant_checks
+		    && BAN_CheckObject(wrk, oc, req)) {
+			oc->flags |= OC_F_DYING;
+			EXP_Remove(oc, NULL);
+			continue;
+		}
+
 		if (req->vcf != NULL) {
 			vr = req->vcf->func(req, &oc, &exp_oc, 0);
 			if (vr == VCF_CONTINUE)

bin/varnishtest/tests/c00133.vtc

@@ -0,0 +1,41 @@
+varnishtest "test ban + vary behavior"
+
+server s0 {
+	rxreq
+	txresp -hdr "vary: version" -body "Variant A"
+	rxreq
+	txresp -hdr "vary: version" -body "Variant B"
+	rxreq
+	txresp -hdr "vary: version" -body "New variant A"
+	rxreq
+	txresp -hdr "vary: version" -body "New variant B"
+} -start
+
+varnish v1 -arg "-p ban_variant_checks=0" -vcl+backend {} -start
+
+client c1 {
+	txreq -hdr "version: a"
+	rxresp
+	expect resp.body == "Variant A"
+} -run
+
+client c2 {
+	txreq -hdr "version: b"
+	rxresp
+	expect resp.body == "Variant B"
+} -run
+
+varnish v1 -cliok "ban req.http.version == a"
+
+# Should this remove a single variant from cache
+client c3 {
+	txreq -hdr "version: a"
+	rxresp
+	expect resp.body == "New variant A"
+} -run
+
+client c4 {
+	txreq -hdr "version: b"
+	rxresp
+	expect resp.body == "Variant B"
+} -run