Varnish Cache with PHP Captcha for Anti-Site-Scrap

Question

I've got Varnish cache working with PHP Captcha but I don't
understand yet how I can set the trigger limits.

After the limit of so many requests per hour (or minute)
the captcha input is sent.

I have it working but would like to be understand how I can alter the req/s limit.

Here is the code from:
http://drcarter.info/2010/04/how-fighting-against-scraping-using-varnish-vcl-inline-c-memcached/

What is this code saying to me?

if (rc == MEMCACHED_SUCCESS) {
uint64_t intval;
rc= memcached_increment(memc, key, strlen(key), (uint64_t)1, &intval);

if (rc != MEMCACHED_SUCCESS)
  rc= memcached_set(memc, key, strlen(key), "1", 1, (time_t)60, (uint32_t)0);
else
  if (intval>30) {
    VRT_SetHdr(sp, HDR_REQ, "\013X-Scraping:", "1", vrt_magic_string_end);
    syslog(LOG_INFO, "Scraping detected from %s",VRT_IP_string(sp, VRT_r_client_ip(sp)));
    if (intval<300)
      rc= memcached_set(memc, key, strlen(key), "500", 3, (time_t)3600, (uint32_t)0);
  }

Your advise would be greatly appreciated.

Thanks!

Answer 1

excuse me to have not commenting my code :)

So with the comment, I think you will understand.

if (rc == MEMCACHED_SUCCESS) {
//if connected to memcache
uint64_t intval;
//trying to increment the "ip address" key (+1)
rc= memcached_increment(memc, key, strlen(key), (uint64_t)1, &intval);

if (rc != MEMCACHED_SUCCESS)
  //if increment fail, then it is the first time that we see this address
  //init the value at 1 for 60 seconds
  rc= memcached_set(memc, key, strlen(key), "1", 1, (time_t)60, (uint32_t)0);
else
  //if increment success, then verifying the value, if more than 30 (30 reqs/minute)
  //blacklist the ipaddress (setting the value arbitrary at 500 for 1 hour)
  if (intval>30) {
    VRT_SetHdr(sp, HDR_REQ, "\013X-Scraping:", "1", vrt_magic_string_end);
    syslog(LOG_INFO, "Scraping detected from %s",VRT_IP_string(sp, VRT_r_client_ip(sp)));
    if (intval<300)
      rc= memcached_set(memc, key, strlen(key), "500", 3, (time_t)3600, (uint32_t)0);
  }

Answer 2

The code works with this flow:

try to increment the key identifying the client and return the value in intval
if it fails set the key with an expiration of 60 seconds
else
  if the number of call (intval) is less than 30
    it set an header X-Scraping (which will be use later to deny access: this part is not in the part of the code you have pasted)

so if you want to alter res/s you can play on either the > 30 test or changing the key expiry to something else than 60.