{"action":"created","issue":{"url":"https://api.github.com/repos/varnish/libvmod-shield/issues/3","labels_url":"https://api.github.com/repos/varnish/libvmod-shield/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/varnish/libvmod-shield/issues/3/comments","events_url":"https://api.github.com/repos/varnish/libvmod-shield/issues/3/events","html_url":"https://github.com/varnish/libvmod-shield/issues/3","id":97930085,"number":3,"title":"Use syntax","user":{"login":"blindpet","id":8589960,"avatar_url":"https://avatars.githubusercontent.com/u/8589960?v=3","gravatar_id":"","url":"https://api.github.com/users/blindpet","html_url":"https://github.com/blindpet","followers_url":"https://api.github.com/users/blindpet/followers","following_url":"https://api.github.com/users/blindpet/following{/other_user}","gists_url":"https://api.github.com/users/blindpet/gists{/gist_id}","starred_url":"https://api.github.com/users/blindpet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blindpet/subscriptions","organizations_url":"https://api.github.com/users/blindpet/orgs","repos_url":"https://api.github.com/users/blindpet/repos","events_url":"https://api.github.com/users/blindpet/events{/privacy}","received_events_url":"https://api.github.com/users/blindpet/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-29T13:02:01Z","updated_at":"2015-07-29T13:48:04Z","closed_at":null,"body":"I am testing this now with varnish 3 and 4, is it really this simple to implement. It seems too easy as if I'm missing something.\r\n\r\n```import shield;\r\n\r\nsub vcl_recv {\r\n        if (req.url ~ \"i-am-an-attacker\") {\r\n                shield.conn_reset();\r\n        }\r\n}```"},"comment":{"url":"https://api.github.com/repos/varnish/libvmod-shield/issues/comments/125958172","html_url":"https://github.com/varnish/libvmod-shield/issues/3#issuecomment-125958172","issue_url":"https://api.github.com/repos/varnish/libvmod-shield/issues/3","id":125958172,"user":{"login":"aondio","id":6757531,"avatar_url":"https://avatars.githubusercontent.com/u/6757531?v=3","gravatar_id":"","url":"https://api.github.com/users/aondio","html_url":"https://github.com/aondio","followers_url":"https://api.github.com/users/aondio/followers","following_url":"https://api.github.com/users/aondio/following{/other_user}","gists_url":"https://api.github.com/users/aondio/gists{/gist_id}","starred_url":"https://api.github.com/users/aondio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aondio/subscriptions","organizations_url":"https://api.github.com/users/aondio/orgs","repos_url":"https://api.github.com/users/aondio/repos","events_url":"https://api.github.com/users/aondio/events{/privacy}","received_events_url":"https://api.github.com/users/aondio/received_events","type":"User","site_admin":false},"created_at":"2015-07-29T13:48:04Z","updated_at":"2015-07-29T13:48:04Z","body":"Hi,\r\nthat syntax is enough to close the connection and reset the TCP, but before closing a connection you need to know which kind of requests are part of a ddos attack.\r\nThere is some more documentation here and you might want to consider using vmod_throttle : ttps://github.com/nand2/libvmod-throttle (it has not be ported to V4 yet.)\r\n\r\nThere is also a old, but still gold blog post about ddos attacks: https://www.varnish-software.com/blog/withstanding-ddos-attacks-varnish-and-cots-hardware"}}