webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 03:33:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Add rate limiting for LOG messages.

Browse Source 
Fixes #10488.
This commit is contained in:
Michael Tremer
2014-03-04 12:36:52 +01:00
parent 824dc93601
commit 3bb4bb3fa1
1 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
config/firewall/rules.pl
View File

@@ -70,6 +70,8 @@ my $netsettings = "${General::swroot}/ethernet/settings";
&General::readhasharray($configgrp, \%customgrp); &General::readhasharray($configgrp, \%customgrp);
&General::get_aliases(\%aliases); &General::get_aliases(\%aliases);
my @log_limit_options = &make_log_limit_options();
# MAIN # MAIN
&main(); &main();
@@ -305,7 +307,7 @@ sub buildrules {
} }
if ($LOG) { if ($LOG) {
run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options -j LOG --log-prefix 'DNAT '"); run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options @log_limit_options -j LOG --log-prefix 'DNAT '");
} }
run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options -j DNAT --to-destination $dnat_address"); run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options -j DNAT --to-destination $dnat_address");
@@ -317,7 +319,7 @@ sub buildrules {
push(@nat_options, @destination_options); push(@nat_options, @destination_options);
if ($LOG) { if ($LOG) {
run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j LOG --log-prefix 'SNAT '"); run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @log_limit_options -j LOG --log-prefix 'SNAT '");
} }
run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j SNAT --to-source $nat_address"); run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j SNAT --to-source $nat_address");
} }
@@ -328,7 +330,7 @@ sub buildrules {
# Insert firewall rule. # Insert firewall rule.
if ($LOG && !$NAT) { if ($LOG && !$NAT) {
run("$IPTABLES -A $chain @options -j LOG"); run("$IPTABLES -A $chain @options @log_limit_options -j LOG");
} }
run("$IPTABLES -A $chain @options -j $target"); run("$IPTABLES -A $chain @options -j $target");
} }
@@ -764,3 +766,18 @@ sub add_dnat_mangle_rules {
run("$IPTABLES -t mangle -A $CHAIN_MANGLE_NAT_DESTINATION_FIX @mangle_options"); run("$IPTABLES -t mangle -A $CHAIN_MANGLE_NAT_DESTINATION_FIX @mangle_options");
} }
} }
sub make_log_limit_options {
my @options = ("-m", "limit");
# Maybe we should get this from the configuration.
my $limit = 10;
# We limit log messages to $limit messages per minute.
push(@options, ("--limit", "$limit/min"));
# And we allow bursts of 2x $limit.
push(@options, ("--limit-burst", $limit * 2));
return @options;
}