saltstack-formulas/firewalld-formula
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(zone.xml): allow to rate limit 'accept' in rich rules

Browse Source 
The current rich_rule macro is supporting to set if the connection
should be accepted or rejected or dropped but doesn't support setting
rate limiting in the 'accept' case. Add code for that.

Signed-off-by: Arnaud Patard <apatard@hupstream.com>
This commit is contained in:
Arnaud Patard 2021-01-13 14:59:29 +01:00
parent 4d797fc01e
commit a2f4f3b36e
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
firewalld/files/zone.xml
View File

@ -60,7 +60,7 @@
<audit>{%- if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{%- endif %}</audit> <audit>{%- if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{%- endif %}</audit>
{%- endif %} {%- endif %}
{%- if 'accept' in rule %} {%- if 'accept' in rule %}
<accept/> <accept>{%- if rule.accept is mapping and 'limit' in rule.accept %} <limit value="{{ rule.accept.limit }}"/>{%- endif %}</accept>
{%- endif %} {%- endif %}
{%- if 'reject' in rule %} {%- if 'reject' in rule %}
<reject{%- if 'type' in rule.reject %} type="{{ rule.reject.type }}"{%- endif %} /> <reject{%- if 'type' in rule.reject %} type="{{ rule.reject.type }}"{%- endif %} />

6
test/integration/default/controls/zones_spec.rb
View File

@ -31,7 +31,7 @@ control 'zones/public.xml configuration' do
<source-port port="4444" protocol="tcp" /> <source-port port="4444" protocol="tcp" />
<rule family="ipv4"> <rule family="ipv4">
<source address="8.8.8.8/24" /> <source address="8.8.8.8/24" />
<accept/> <accept></accept>
</rule> </rule>
<rule family="ipv4"> <rule family="ipv4">
<source ipset="fail2ban-ssh" /> <source ipset="fail2ban-ssh" />
@ -59,12 +59,12 @@ control 'zones/rich_public.xml configuration' do
<rule> <rule>
<source ipset="fail2ban-ssh" /> <source ipset="fail2ban-ssh" />
<service name="ssh" /> <service name="ssh" />
<accept/> <accept></accept>
</rule> </rule>
<rule> <rule>
<source ipset="other-ipset" /> <source ipset="other-ipset" />
<service name="ssh" /> <service name="ssh" />
<accept/> <accept></accept>
</rule> </rule>
</zone> </zone>
ZONE_XML ZONE_XML