From: Peter Palfrader <peter@palfrader.org>
Date: Tue, 10 Aug 2010 15:35:10 +0000 (+0200)
Subject: tidy up http related ferm rules
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=8dadeaed8aa9d6c79a7502badb684873b746428f;p=mirror%2Fdsa-puppet.git

tidy up http related ferm rules
---

diff --git a/modules/apache2/manifests/init.pp b/modules/apache2/manifests/init.pp
index 5734650e8..fb88994c6 100644
--- a/modules/apache2/manifests/init.pp
+++ b/modules/apache2/manifests/init.pp
@@ -140,27 +140,52 @@ class apache2 {
     @ferm::rule { "dsa-http-limit":
         prio            => "20",
         description     => "limit HTTP DOS",
-        rule            => "chain 'http_limit' { mod limit limit-burst 60 limit 15/minute jump ACCEPT; jump DROP; }"
+        chain           => 'http_limit',
+        rule            => '
+                            mod limit limit-burst 60 limit 15/minute jump ACCEPT;
+                            jump DROP;
+                           '
     }
     @ferm::rule { "dsa-http-soso":
         prio            => "21",
         description     => "slow yahoo spider",
-        rule            => "chain 'limit_sosospider' { mod connlimit connlimit-above 2 connlimit-mask 21 jump DROP; jump http_limit; }"
+        chain           => 'limit_sosospider',
+        rule            => '
+                            mod connlimit connlimit-above 2 connlimit-mask 21 jump DROP;
+                            jump http_limit;
+                           '
     }
     @ferm::rule { "dsa-http-yahoo":
         prio            => "21",
         description     => "slow yahoo spider",
-        rule            => "chain 'limit_yahoo' { mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP; jump http_limit; }"
+        chain           => 'limit_yahoo',
+        rule            => '
+                            mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP;
+                            jump http_limit;
+                           '
     }
     @ferm::rule { "dsa-http-bing":
         prio            => "21",
         description     => "slow bing spider",
-        rule            => "chain 'limit_bing' { mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP; jump http_limit; }"
+        chain           => 'limit_bing',
+        rule            => '
+                            mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP;
+                            jump http_limit;
+                           '
     }
     @ferm::rule { "dsa-http-rules":
         prio            => "22",
         description     => "http subchain",
-        rule            => "chain 'http' { saddr ( 74.6.22.182 74.6.18.240 ) jump limit_yahoo; saddr 124.115.0.0/21 jump limit_sosospider; saddr (65.52.0.0/14 207.46.0.0/16) jump limit_bing; mod recent name HTTPDOS update seconds 1800 jump log_or_drop; mod hashlimit hashlimit-name HTTPDOS hashlimit-mode srcip hashlimit-burst 600 hashlimit 30/minute jump ACCEPT; mod recent name HTTPDOS set jump log_or_drop; }"
+        chain           => 'http',
+        rule            => '
+                            saddr ( 74.6.22.182 74.6.18.240 ) jump limit_yahoo;
+                            saddr 124.115.0.0/21 jump limit_sosospider;
+                            saddr (65.52.0.0/14 207.46.0.0/16) jump limit_bing;
+
+                            mod recent name HTTPDOS update seconds 1800 jump log_or_drop;
+                            mod hashlimit hashlimit-name HTTPDOS hashlimit-mode srcip hashlimit-burst 600 hashlimit 30/minute jump ACCEPT;
+                            mod recent name HTTPDOS set jump log_or_drop;
+                           '
     }
     case $hostname {
         sibelius,stabile: {