Browse Source

feat(zone.xml): allow to rate limit 'accept' in rich rules

The current rich_rule macro is supporting to set if the connection
should be accepted or rejected or dropped but doesn't support setting
rate limiting in the 'accept' case. Add code for that.

Signed-off-by: Arnaud Patard <apatard@hupstream.com>
tags/v1.2.0
Arnaud Patard 3 years ago
parent
commit
a2f4f3b36e
2 changed files with 4 additions and 4 deletions
  1. +1
    -1
      firewalld/files/zone.xml
  2. +3
    -3
      test/integration/default/controls/zones_spec.rb

+ 1
- 1
firewalld/files/zone.xml View File

<audit>{%- if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{%- endif %}</audit> <audit>{%- if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{%- endif %}</audit>
{%- endif %} {%- endif %}
{%- if 'accept' in rule %} {%- if 'accept' in rule %}
<accept/>
<accept>{%- if rule.accept is mapping and 'limit' in rule.accept %} <limit value="{{ rule.accept.limit }}"/>{%- endif %}</accept>
{%- endif %} {%- endif %}
{%- if 'reject' in rule %} {%- if 'reject' in rule %}
<reject{%- if 'type' in rule.reject %} type="{{ rule.reject.type }}"{%- endif %} /> <reject{%- if 'type' in rule.reject %} type="{{ rule.reject.type }}"{%- endif %} />

+ 3
- 3
test/integration/default/controls/zones_spec.rb View File

<source-port port="4444" protocol="tcp" /> <source-port port="4444" protocol="tcp" />
<rule family="ipv4"> <rule family="ipv4">
<source address="8.8.8.8/24" /> <source address="8.8.8.8/24" />
<accept/>
<accept></accept>
</rule> </rule>
<rule family="ipv4"> <rule family="ipv4">
<source ipset="fail2ban-ssh" /> <source ipset="fail2ban-ssh" />
<rule> <rule>
<source ipset="fail2ban-ssh" /> <source ipset="fail2ban-ssh" />
<service name="ssh" /> <service name="ssh" />
<accept/>
<accept></accept>
</rule> </rule>
<rule> <rule>
<source ipset="other-ipset" /> <source ipset="other-ipset" />
<service name="ssh" /> <service name="ssh" />
<accept/>
<accept></accept>
</rule> </rule>
</zone> </zone>
ZONE_XML ZONE_XML

Loading…
Cancel
Save