The current rich_rule macro is supporting to set if the connection should be accepted or rejected or dropped but doesn't support setting rate limiting in the 'accept' case. Add code for that. Signed-off-by: Arnaud Patard <apatard@hupstream.com>tags/v1.2.0
<audit>{%- if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{%- endif %}</audit> | <audit>{%- if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{%- endif %}</audit> | ||||
{%- endif %} | {%- endif %} | ||||
{%- if 'accept' in rule %} | {%- if 'accept' in rule %} | ||||
<accept/> | |||||
<accept>{%- if rule.accept is mapping and 'limit' in rule.accept %} <limit value="{{ rule.accept.limit }}"/>{%- endif %}</accept> | |||||
{%- endif %} | {%- endif %} | ||||
{%- if 'reject' in rule %} | {%- if 'reject' in rule %} | ||||
<reject{%- if 'type' in rule.reject %} type="{{ rule.reject.type }}"{%- endif %} /> | <reject{%- if 'type' in rule.reject %} type="{{ rule.reject.type }}"{%- endif %} /> |
<source-port port="4444" protocol="tcp" /> | <source-port port="4444" protocol="tcp" /> | ||||
<rule family="ipv4"> | <rule family="ipv4"> | ||||
<source address="8.8.8.8/24" /> | <source address="8.8.8.8/24" /> | ||||
<accept/> | |||||
<accept></accept> | |||||
</rule> | </rule> | ||||
<rule family="ipv4"> | <rule family="ipv4"> | ||||
<source ipset="fail2ban-ssh" /> | <source ipset="fail2ban-ssh" /> | ||||
<rule> | <rule> | ||||
<source ipset="fail2ban-ssh" /> | <source ipset="fail2ban-ssh" /> | ||||
<service name="ssh" /> | <service name="ssh" /> | ||||
<accept/> | |||||
<accept></accept> | |||||
</rule> | </rule> | ||||
<rule> | <rule> | ||||
<source ipset="other-ipset" /> | <source ipset="other-ipset" /> | ||||
<service name="ssh" /> | <service name="ssh" /> | ||||
<accept/> | |||||
<accept></accept> | |||||
</rule> | </rule> | ||||
</zone> | </zone> | ||||
ZONE_XML | ZONE_XML |