The ultimate solution for anti-theft chain technology (Squid+cookie)

Anti-theft chain technology status:
1. Confirm the Request source page by identifying Referer
2, Apache,squid and so on can be referer to identify
3. Content displayed through ActiveX does not provide Referer headers to the server (for example, Flash,windowsmedia video
such as
4. The RTSP protocol of streaming media does not provide referer Header to the server.
5, through the server-side program code implementation
Anti-theft chain application Status:
1, the image, HTML, etc. can be implemented anti-theft chain
2. Unable to Flash,windowsmedia video
(MMS,RTSP) implement anti-theft chain
3, the server-side program code implementation of the anti-theft chain can not be accelerated by CDN
For Flash,windowsmedia Video
This high-occupancy service can not implement the anti-theft chain, a reliance on such content as a profit point of the site is very headache, I through a number of research and testing to implement the use of cookie technology anti-theft chain solution, the perfect solution to the Flash,windowsmedia video
Anti-theft chain.
First found that although the ActiveX plugin does not pass referer, it faithfully passes the cookie. Then embed a piece of code in the <script> document.cookie= "cache=vod;domain=domain.com;path=/"; </script>
This code uses JavaScript to set a Cookie:cache=vod
The existence of this cookie and the operation of verifying its value are then judged by various ACLs.
Squid:
Create a script/usr/local/squid/libexec/squid_cookie.pl
———–
#!/usr/bin/perl-w
# This script simply verifies the existence of the cache cookie and does not have a strict checksum value.
# This is the cookie to check for.
$COOKIE = "cache=";
# Disable Output buffering
$|=1;
# cookie matches?
while (<STDIN>) {
Chop
$cookie =$_;
if ($cookie =~/$COOKIE/i) {
print "ok\n";
} else {print "err\n";}
}
———–
Then add in squid.conf:
External_acl_type download children=15%{cookie}/usr/local/squid/libexec/squid_cookie.pl
ACL DL external Download
Then select the type of file you want to use for the anti-theft chain:
ACL filetype url_regex-i \.wmv
ACL filetype url_regex-i \.wma
ACL filetype url_regex-i \.asf
ACL filetype url_regex-i \.asx
ACL filetype url_regex-i \.avi
ACL filetype url_regex-i \.mp3
ACL filetype url_regex-i \.smi
ACL filetype url_regex-i \.rm
ACL filetype url_regex-i \.ram
ACL filetype url_regex-i \.rmvb
ACL filetype url_regex-i \.swf
ACL filetype url_regex-i \.mpg
ACL filetype url_regex-i \.mpeg
ACL filetype url_regex-i \.mov
ACL filetype url_regex-i \.zip
ACL filetype url_regex-i \.mid
If only to prohibit users to visit, it is not interesting, to let hotlinking to help us promote our website, especially found hotlinking more time, this time, you can let any hotlinking of the site to help us free ~ ~ ~ that is to redirect the hotlinking URL to our website promotion page ~ ~
Build script:/usr/local/squid/libexec/squid_redir.pl
————————–
#!/usr/bin/perl-t-W
#
# rredir.pl
#
# Description:direct all request to files who is in a local dir to
# this Directory
#
Use File::basename;
Use Uri::url;
# flush after every print
$| = 1;
# Process lines of the form ' URL Ip-address/fqdn ident method '
# See release n****s of Squids 1.1 for details
while (<>) {
$r 302=0;
($url, $addr, $fqdn, $ident, $method) = m\s*) (\s*)/(\s*) (\s*) (\s*):;
$url = URL $url;
$host = LC ($url->host);
if ($host!~/\./) {
Next
}
if ($host =~/vod\.domain\.com/) {
$url->path ("/ad.wmv");
$r 302=1;
}
} Continue {
if ($r 302) {
print "302url\n";
} else {
Print "$url $addr/$fqdn $ident $method \ n";
}
}
————————–
Then add in squid.conf:
redirect_program/usr/local/squid/libexec/squid_redir.pl
Redirect_children 5
ACL Superurl url_regex-i ^http://vod\.domain\.com/tom\.wmv$
Redirector_access Deny Superurl
redirector_access Allow filetype!dl
Redirector_access Deny All
Set Superurl because we advertise our own site's video
is not to do anti-theft chain, so as to play the role of propaganda. It's done now! The site's traffic has increased dramatically ~~~PV is three times times the original, oh,yeah~
WMS Video
MMS protocol is not clear text, can not implement the anti-theft chain, but the RTSP protocol is basically a variant of the HTTP protocol, can be BIGIP and so on Layer 7 processing data on the device to implement the cookie verification. But WMS Video
Anti-theft chain to prohibit the MMS protocol, because the MMS protocol is not plaintext, can not be recognized cookies. However, it can be identified on the HTTP,RTSP, and WMS V9 supports HTTP,RTSP. Below is the anti-theft chain irule for BIGIP:
————————–
if (Http_uri Matches_regex "vod.domain.com") {
if (Http_cookie ("Cache") = = = "VOD") {
Use Pool VOD-RTSP
}
else {
Discard
}
}
else {
Use Pool VOD-RTSP
}
————————–
Other systems can refer to the above rules.
The use of the anti-theft chain of cookies for most systems can be easily implemented, cookies are generally used to pass authentication information, I believe there will be no non-delivery status.

The ultimate solution for anti-theft chain technology (Squid+cookie)