Projet

Général

Profil

Révision b10c6216

IDb10c62165276b133767ca89024cbf866c89226a2
Parent 92461926
Enfant 902ceaac

Ajouté par Nacho Barrientos il y a plus de 4 ans

Set a customisable rate limit to the logging rules

Voir les différences:

manifests/inet_filter.pp
1 1 
# manage basic chains in table inet filter
2 2 
class nftables::inet_filter inherits nftables {
3 3 

  		




  4
  
  
    
  $_log_prefix_discard = sprintf($nftables::log_prefix, { 'chain' => '%<chain>s', 'comment' => 'Rejected: ' })


  		




  
  4
  
    
  $_reject_rule = epp('nftables/reject_rule.epp',


  		




  
  5
  
    
    {


  		




  
  6
  
    
      'log_prefix' => sprintf($nftables::log_prefix, { 'chain' => '%<chain>s', 'comment' => 'Rejected: ' }),


  		




  
  7
  
    
      'log_limit'  => $nftables::log_limit


  		




  
  8
  
    
    }


  		




  
  9
  
    
  )


  		




  5
  10
  
    

  		




  6
  11
  
    
  nftables::config{


  		




  7
  12
  
    
    'inet-filter':


  		




  ......




  41
  46
  
    
      content => 'jump global';


  		




  42
  47
  
    
    'INPUT-log_discarded':


  		




  43
  48
  
    
      order   => '97',


  		




  44
  
  
    
      content => "log prefix \"${sprintf($_log_prefix_discard, { 'chain' => 'INPUT' })}\" flags all counter";


  		




  
  49
  
    
      content => sprintf($_reject_rule, { 'chain' => 'INPUT' }),


  		




  45
  50
  
    
  }


  		




  46
  51
  
    
  if $nftables::reject_with {


  		




  47
  52
  
    
    nftables::rule{


  		




  ......




  77
  82
  
    
      content => 'jump global';


  		




  78
  83
  
    
    'OUTPUT-log_discarded':


  		




  79
  84
  
    
      order   => '97',


  		




  80
  
  
    
      content => "log prefix \"${sprintf($_log_prefix_discard, { 'chain' => 'OUTPUT' })}\" flags all counter";


  		




  
  85
  
    
      content => sprintf($_reject_rule, { 'chain' => 'OUTPUT' }),


  		




  81
  86
  
    
  }


  		




  82
  87
  
    
  if $nftables::reject_with {


  		




  83
  88
  
    
    nftables::rule{


  		




  ......




  110
  115
  
    
      content => 'jump global';


  		




  111
  116
  
    
    'FORWARD-log_discarded':


  		




  112
  117
  
    
      order   => '97',


  		




  113
  
  
    
      content => "log prefix \"${sprintf($_log_prefix_discard, { 'chain' => 'FORWARD' })}\" flags all counter";


  		




  
  118
  
    
      content => sprintf($_reject_rule, { 'chain' => 'FORWARD' }),


  		




  114
  119
  
    
  }


  		




  115
  120
  
    
  if $nftables::reject_with {


  		




  116
  121
  
    
    nftables::rule{


  		












  

    
      manifests/init.pp
    
  





  38
  38
  
    
#    * chain: Will be replaced by the name of the chain.


  		




  39
  39
  
    
#    * comment: Allows chains to add extra comments.


  		




  40
  40
  
    
#


  		




  
  41
  
    
# @param log_limit


  		




  
  42
  
    
#  String with the content of a limit statement to be applied


  		




  
  43
  
    
#  to the rules that log discarded traffic. Set to false to


  		




  
  44
  
    
#  disable rate limiting.


  		




  
  45
  
    
#


  		




  41
  46
  
    
# @param reject_with


  		




  42
  47
  
    
#   How to discard packets not matching any rule. If `false`, the


  		




  43
  48
  
    
#   fate of the packet will be defined by the chain policy (normally


  		




  ......




  65
  70
  
    
  Boolean $in_out_conntrack      = true,


  		




  66
  71
  
    
  Hash $rules                    = {},


  		




  67
  72
  
    
  String $log_prefix             = '[nftables] %<chain>s %<comment>s',


  		




  
  73
  
    
  Variant[Boolean[false], String]


  		




  
  74
  
    
    $log_limit                   = '3/minute burst 5 packets',


  		




  68
  75
  
    
  Variant[Boolean[false], Pattern[


  		




  69
  76
  
    
    /icmp(v6|x)? type .+|tcp reset/]]


  		




  70
  77
  
    
    $reject_with                 = 'icmpx type port-unreachable',


  		












  

    
      spec/classes/inet_filter_spec.rb
    
  





  111
  111
  
    
        it {


  		




  112
  112
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(


  		




  113
  113
  
    
            target:  'nftables-inet-filter-chain-INPUT',


  		




  114
  
  
    
            content: %r{^  log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},


  		




  
  114
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},


  		




  115
  115
  
    
            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',


  		




  116
  116
  
    
          )


  		




  117
  117
  
    
        }


  		




  ......




  234
  234
  
    
        it {


  		




  235
  235
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(


  		




  236
  236
  
    
            target:  'nftables-inet-filter-chain-OUTPUT',


  		




  237
  
  
    
            content: %r{^  log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},


  		




  
  237
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},


  		




  238
  238
  
    
            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',


  		




  239
  239
  
    
          )


  		




  240
  240
  
    
        }


  		




  ......




  370
  370
  
    
        it {


  		




  371
  371
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(


  		




  372
  372
  
    
            target:  'nftables-inet-filter-chain-FORWARD',


  		




  373
  
  
    
            content: %r{^  log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},


  		




  
  373
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},


  		




  374
  374
  
    
            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',


  		




  375
  375
  
    
          )


  		




  376
  376
  
    
        }


  		




  ......




  420
  420
  
    
        it {


  		




  421
  421
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(


  		




  422
  422
  
    
            target:  'nftables-inet-filter-chain-INPUT',


  		




  423
  
  
    
            content: %r{^  log prefix \"test " flags all counter$},


  		




  
  423
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},


  		




  424
  424
  
    
            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',


  		




  425
  425
  
    
          )


  		




  426
  426
  
    
        }


  		




  427
  427
  
    
        it {


  		




  428
  428
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(


  		




  429
  429
  
    
            target:  'nftables-inet-filter-chain-OUTPUT',


  		




  430
  
  
    
            content: %r{^  log prefix \"test " flags all counter$},


  		




  
  430
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},


  		




  431
  431
  
    
            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',


  		




  432
  432
  
    
          )


  		




  433
  433
  
    
        }


  		




  434
  434
  
    
        it {


  		




  435
  435
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(


  		




  436
  436
  
    
            target:  'nftables-inet-filter-chain-FORWARD',


  		




  437
  
  
    
            content: %r{^  log prefix \"test " flags all counter$},


  		




  
  437
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},


  		




  438
  438
  
    
            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',


  		




  439
  439
  
    
          )


  		




  440
  440
  
    
        }


  		




  ......




  446
  446
  
    
        it {


  		




  447
  447
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(


  		




  448
  448
  
    
            target:  'nftables-inet-filter-chain-INPUT',


  		




  449
  
  
    
            content: %r{^  log prefix \" bar \[INPUT\] " flags all counter$},


  		




  
  449
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \" bar \[INPUT\] " flags all counter$},


  		




  
  450
  
    
            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',


  		




  
  451
  
    
          )


  		




  
  452
  
    
        }


  		




  
  453
  
    
        it {


  		




  
  454
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(


  		




  
  455
  
    
            target:  'nftables-inet-filter-chain-OUTPUT',


  		




  
  456
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \" bar \[OUTPUT\] " flags all counter$},


  		




  
  457
  
    
            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',


  		




  
  458
  
    
          )


  		




  
  459
  
    
        }


  		




  
  460
  
    
        it {


  		




  
  461
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(


  		




  
  462
  
    
            target:  'nftables-inet-filter-chain-FORWARD',


  		




  
  463
  
    
            content: %r{^  limit rate 3/minute burst 5 packets log prefix \" bar \[FORWARD\] " flags all counter$},


  		




  
  464
  
    
            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',


  		




  
  465
  
    
          )


  		




  
  466
  
    
        }


  		




  
  467
  
    
      end


  		




  
  468
  
    

  		




  
  469
  
    
      context 'no log limit' do


  		




  
  470
  
    
        let(:params) do


  		




  
  471
  
    
          {


  		




  
  472
  
    
            'log_limit' => false,


  		




  
  473
  
    
          }


  		




  
  474
  
    
        end


  		




  
  475
  
    

  		




  
  476
  
    
        it {


  		




  
  477
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(


  		




  
  478
  
    
            target:  'nftables-inet-filter-chain-INPUT',


  		




  
  479
  
    
            content: %r{^  log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},


  		




  
  480
  
    
            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',


  		




  
  481
  
    
          )


  		




  
  482
  
    
        }


  		




  
  483
  
    
        it {


  		




  
  484
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(


  		




  
  485
  
    
            target:  'nftables-inet-filter-chain-OUTPUT',


  		




  
  486
  
    
            content: %r{^  log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},


  		




  
  487
  
    
            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',


  		




  
  488
  
    
          )


  		




  
  489
  
    
        }


  		




  
  490
  
    
        it {


  		




  
  491
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(


  		




  
  492
  
    
            target:  'nftables-inet-filter-chain-FORWARD',


  		




  
  493
  
    
            content: %r{^  log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},


  		




  
  494
  
    
            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',


  		




  
  495
  
    
          )


  		




  
  496
  
    
        }


  		




  
  497
  
    
      end


  		




  
  498
  
    

  		




  
  499
  
    
      context 'custom log limit' do


  		




  
  500
  
    
        let(:params) do


  		




  
  501
  
    
          {


  		




  
  502
  
    
            'log_limit' => '5/minute',


  		




  
  503
  
    
          }


  		




  
  504
  
    
        end


  		




  
  505
  
    

  		




  
  506
  
    
        it {


  		




  
  507
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(


  		




  
  508
  
    
            target:  'nftables-inet-filter-chain-INPUT',


  		




  
  509
  
    
            content: %r{^  limit rate 5/minute log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},


  		




  450
  510
  
    
            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b',


  		




  451
  511
  
    
          )


  		




  452
  512
  
    
        }


  		




  453
  513
  
    
        it {


  		




  454
  514
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(


  		




  455
  515
  
    
            target:  'nftables-inet-filter-chain-OUTPUT',


  		




  456
  
  
    
            content: %r{^  log prefix \" bar \[OUTPUT\] " flags all counter$},


  		




  
  516
  
    
            content: %r{^  limit rate 5/minute log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},


  		




  457
  517
  
    
            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b',


  		




  458
  518
  
    
          )


  		




  459
  519
  
    
        }


  		




  460
  520
  
    
        it {


  		




  461
  521
  
    
          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(


  		




  462
  522
  
    
            target:  'nftables-inet-filter-chain-FORWARD',


  		




  463
  
  
    
            content: %r{^  log prefix \" bar \[FORWARD\] " flags all counter$},


  		




  
  523
  
    
            content: %r{^  limit rate 5/minute log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},


  		




  464
  524
  
    
            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b',


  		




  465
  525
  
    
          )


  		




  466
  526
  
    
        }


  		












  

    
      templates/reject_rule.epp
    
  





  
  1
  
    
<% if $log_limit { -%>


  		




  
  2
  
    
limit rate <%= $log_limit %> log prefix "<%= $log_prefix %>" flags all counter


  		




  
  3
  
    
<% } else { -%>


  		




  
  4
  
    
log prefix "<%= $log_prefix %>" flags all counter


  		




  
  5
  
    
<% } -%>


  		












Formats disponibles :  Unified diff