Client supplied Fastly-FF header breaks some of the files.vcl behavior

[calebbrown]

There is a bug in terraform/file-hosting/vcl/files.vcl that allows someone to:

• hide their file download activity from the logging
• expose removed header fields (fortunately nothing too sensitive)
• bypass SNI checks

Reproduction

$ curl -A "python-requests/2.34.2-logged" -v -o /dev/null https://files.pythonhosted.org/packages/ac/c3/e2a2b89f2d3e2179abd6d00ebd70bff6273f37fb3e0cc209f48b39d00cbf/requests-2.34.2.tar.gz
$ curl -H "Fastly-FF: 1" -A "python-requests/2.34.2-not-logged" -v -o /dev/null https://files.pythonhosted.org/packages/ac/c3/e2a2b89f2d3e2179abd6d00ebd70bff6273f37fb3e0cc209f48b39d00cbf/requests-2.34.2.tar.gz

The first curl shows normal behaviour.

The second curl will show the headers delivered from the storage backend.

Furthermore, running the following GCP BigQuery will show the second curl command never hits linehaul (after a propagation delay):

SELECT details.installer.name, details.installer.version, details.installer.subcommand, COUNT(*)
FROM `bigquery-public-data.pypi.file_downloads`
WHERE project='requests' AND
      file.filename = 'requests-2.34.2.tar.gz' AND
      TIMESTAMP_TRUNC(timestamp, DAY) >= TIMESTAMP("2026-09-03") AND
      details.installer.name = 'requests'
GROUP BY details.installer.name, details.installer.version, details.installer.subcommand
LIMIT 1000

The fix for this is to use fastly.ff.visits_this_service rather than the Fastly-FF header.