on master help sign in
[fix] indentation of filtron's rules (json)

Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>

commit6ff20cef7385d6827042f00d295f51bbc213afab authorMarkus Heiser <markus.heiser@darmarit.de> dateThu 18 Jun 2020, 18:31 (6 years ago) parentdda4a46
2 files changed+200−207
docs/admin/filtron.rst+85−94 utils/templates/etc/filtron/rules.json+115−113
docs/admin/filtron.rst+85−94
@@ -57,100 +57,91 @@ of:
5757
5858.. code:: json
5959
60− [
61− { "name": "search request",
62− "filters": [
63− "Param:q",
64− "Path=^(/|/search)$"
65− ],
66− "interval": "<time-interval-in-sec (int)>",
67− "limit": "<max-request-number-in-interval (int)>",
68− "subrules": [
69− {
70− "name": "roboagent limit",
71− "interval": "<time-interval-in-sec (int)>",
72− "limit": "<max-request-number-in-interval (int)>",
73− "filters": [
74− "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client)"
75− ],
76− "actions": [
77− { "name": "log"},
78− { "name": "block",
79− "params": {
80− "message": "Rate limit exceeded"
81− }
82− }
83− ]
84− },
85− {
86− "name": "botlimit",
87− "limit": 0,
88− "stop": true,
89− "filters": [
90− "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
91− ],
92− "actions": [
93− { "name": "log"},
94− { "name": "block",
95− "params": {
96− "message": "Rate limit exceeded"
97− }
98− }
99− ]
100− },
101− {
102− "name": "IP limit",
103− "interval": "<time-interval-in-sec (int)>",
104− "limit": "<max-request-number-in-interval (int)>",
105− "stop": true,
106− "aggregations": [
107− "Header:X-Forwarded-For"
108− ],
109− "actions": [
110− { "name": "log"},
111− { "name": "block",
112− "params": {
113− "message": "Rate limit exceeded"
114− }
115− }
116− ]
117− },
118− {
119− "name": "rss/json limit",
120− "interval": "<time-interval-in-sec (int)>",
121− "limit": "<max-request-number-in-interval (int)>",
122− "stop": true,
123− "filters": [
124− "Param:format=(csv|json|rss)"
125− ],
126− "actions": [
127− { "name": "log"},
128− { "name": "block",
129− "params": {
130− "message": "Rate limit exceeded"
131− }
132− }
133− ]
134− },
135− {
136− "name": "useragent limit",
137− "interval": "<time-interval-in-sec (int)>",
138− "limit": "<max-request-number-in-interval (int)>",
139− "aggregations": [
140− "Header:User-Agent"
141− ],
142− "actions": [
143− { "name": "log"},
144− { "name": "block",
145− "params": {
146− "message": "Rate limit exceeded"
147− }
148− }
149− ]
150− }
151− ]
152− }
153− ]
60+ [
61+ {
62+ "name": "search request",
63+ "filters": [
64+ "Param:q",
65+ "Path=^(/|/search)$"
66+ ],
67+ "interval": "<time-interval-in-sec (int)>"
68+ "limit": "<max-request-number-in-interval (int)>",
69+ "subrules": [
70+ {
71+ "name": "missing Accept-Language",
72+ "filters": ["!Header:Accept-Language"],
73+ "limit": "<max-request-number-in-interval (int)>",
74+ "stop": true,
75+ "actions": [
76+ {"name":"log"},
77+ {"name": "block",
78+ "params": {"message": "Rate limit exceeded"}}
79+ ]
80+ },
81+ {
82+ "name": "suspiciously Connection=close header",
83+ "filters": ["Header:Connection=close"],
84+ "limit": "<max-request-number-in-interval (int)>",
85+ "stop": true,
86+ "actions": [
87+ {"name":"log"},
88+ {"name": "block",
89+ "params": {"message": "Rate limit exceeded"}}
90+ ]
91+ },
92+ {
93+ "name": "IP limit",
94+ "interval": "<time-interval-in-sec (int)>"
95+ "limit": "<max-request-number-in-interval (int)>",
96+ "stop": true,
97+ "aggregations": [
98+ "Header:X-Forwarded-For"
99+ ],
100+ "actions": [
101+ { "name": "log"},
102+ { "name": "block",
103+ "params": {
104+ "message": "Rate limit exceeded"
105+ }
106+ }
107+ ]
108+ },
109+ {
110+ "name": "rss/json limit",
111+ "filters": [
112+ "Param:format=(csv|json|rss)"
113+ ],
114+ "interval": "<time-interval-in-sec (int)>"
115+ "limit": "<max-request-number-in-interval (int)>",
116+ "stop": true,
117+ "actions": [
118+ { "name": "log"},
119+ { "name": "block",
120+ "params": {
121+ "message": "Rate limit exceeded"
122+ }
123+ }
124+ ]
125+ },
126+ {
127+ "name": "useragent limit",
128+ "interval": "<time-interval-in-sec (int)>"
129+ "limit": "<max-request-number-in-interval (int)>",
130+ "aggregations": [
131+ "Header:User-Agent"
132+ ],
133+ "actions": [
134+ { "name": "log"},
135+ { "name": "block",
136+ "params": {
137+ "message": "Rate limit exceeded"
138+ }
139+ }
140+ ]
141+ }
142+ ]
143+ }
144+ ]
154145
155146
156147.. _filtron route request:
utils/templates/etc/filtron/rules.json+115−113
@@ -1,127 +1,129 @@
11[
22 {
3− "name": "roboagent limit",
4− "filters": [
5− "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client|Ruby|UniversalFeedParser)"
6− ],
7− "limit": 0,
8− "stop": true,
9− "actions": [
10− { "name": "log"},
11− { "name": "block",
3+ "name": "roboagent limit",
4+ "filters": [
5+ "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client|Ruby|UniversalFeedParser)"
6+ ],
7+ "limit": 0,
8+ "stop": true,
9+ "actions": [
10+ { "name": "log"},
11+ { "name": "block",
1212 "params": {
13− "message": "Rate limit exceeded"
13+ "message": "Rate limit exceeded"
1414 }
15− }
16− ]
15+ }
16+ ]
1717 },
1818 {
19− "name": "botlimit",
20− "filters": [
21− "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
22− ],
23− "limit": 0,
24− "stop": true,
25− "actions": [
26− { "name": "log"},
27− { "name": "block",
19+ "name": "botlimit",
20+ "filters": [
21+ "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
22+ ],
23+ "limit": 0,
24+ "stop": true,
25+ "actions": [
26+ { "name": "log"},
27+ { "name": "block",
2828 "params": {
29− "message": "Rate limit exceeded"
29+ "message": "Rate limit exceeded"
3030 }
31− }
32− ]
31+ }
32+ ]
3333 },
34− { "name": "suspiciously frequent IP",
35− "filters": [],
36− "interval": 600,
37− "limit": 30,
38− "aggregations": [
39− "Header:X-Forwarded-For"
34+ {
35+ "name": "suspiciously frequent IP",
36+ "filters": [],
37+ "interval": 600,
38+ "limit": 30,
39+ "aggregations": [
40+ "Header:X-Forwarded-For"
4041 ],
41− "actions":[
42− {"name":"log"}
42+ "actions":[
43+ {"name":"log"}
4344 ]
4445 },
45− { "name": "search request",
46− "filters": [
47− "Param:q",
48− "Path=^(/|/search)$"
49− ],
50− "interval": 61,
51− "limit": 999,
52− "subrules": [
53− {
54− "name": "missing Accept-Language",
55− "filters": ["!Header:Accept-Language"],
56− "limit": 0,
57− "stop": true,
58− "actions": [
59− {"name":"log"},
60− {"name": "block",
61− "params": {"message": "Rate limit exceeded"}}
62− ]
63− },
64− {
65− "name": "suspiciously Connection=close header",
66− "filters": ["Header:Connection=close"],
67− "limit": 0,
68− "stop": true,
69− "actions": [
70− {"name":"log"},
71− {"name": "block",
72− "params": {"message": "Rate limit exceeded"}}
73− ]
74− },
75− {
76− "name": "IP limit",
77− "interval": 61,
78− "limit": 9,
79− "stop": true,
80− "aggregations": [
81− "Header:X-Forwarded-For"
82− ],
83− "actions": [
84− { "name": "log"},
85− { "name": "block",
86− "params": {
87− "message": "Rate limit exceeded"
88− }
89− }
90− ]
91− },
92− {
93− "name": "rss/json limit",
94− "filters": [
95− "Param:format=(csv|json|rss)"
96− ],
97− "interval": 121,
98− "limit": 2,
99− "stop": true,
100− "actions": [
101− { "name": "log"},
102− { "name": "block",
103− "params": {
104− "message": "Rate limit exceeded"
105− }
106− }
107− ]
108− },
109− {
110− "name": "useragent limit",
111− "interval": 61,
112− "limit": 199,
113− "aggregations": [
114− "Header:User-Agent"
115− ],
116− "actions": [
117− { "name": "log"},
118− { "name": "block",
119− "params": {
120− "message": "Rate limit exceeded"
121− }
122− }
123− ]
124− }
125− ]
46+ {
47+ "name": "search request",
48+ "filters": [
49+ "Param:q",
50+ "Path=^(/|/search)$"
51+ ],
52+ "interval": 61,
53+ "limit": 999,
54+ "subrules": [
55+ {
56+ "name": "missing Accept-Language",
57+ "filters": ["!Header:Accept-Language"],
58+ "limit": 0,
59+ "stop": true,
60+ "actions": [
61+ {"name":"log"},
62+ {"name": "block",
63+ "params": {"message": "Rate limit exceeded"}}
64+ ]
65+ },
66+ {
67+ "name": "suspiciously Connection=close header",
68+ "filters": ["Header:Connection=close"],
69+ "limit": 0,
70+ "stop": true,
71+ "actions": [
72+ {"name":"log"},
73+ {"name": "block",
74+ "params": {"message": "Rate limit exceeded"}}
75+ ]
76+ },
77+ {
78+ "name": "IP limit",
79+ "interval": 61,
80+ "limit": 9,
81+ "stop": true,
82+ "aggregations": [
83+ "Header:X-Forwarded-For"
84+ ],
85+ "actions": [
86+ { "name": "log"},
87+ { "name": "block",
88+ "params": {
89+ "message": "Rate limit exceeded"
90+ }
91+ }
92+ ]
93+ },
94+ {
95+ "name": "rss/json limit",
96+ "filters": [
97+ "Param:format=(csv|json|rss)"
98+ ],
99+ "interval": 121,
100+ "limit": 2,
101+ "stop": true,
102+ "actions": [
103+ { "name": "log"},
104+ { "name": "block",
105+ "params": {
106+ "message": "Rate limit exceeded"
107+ }
108+ }
109+ ]
110+ },
111+ {
112+ "name": "useragent limit",
113+ "interval": 61,
114+ "limit": 199,
115+ "aggregations": [
116+ "Header:User-Agent"
117+ ],
118+ "actions": [
119+ { "name": "log"},
120+ { "name": "block",
121+ "params": {
122+ "message": "Rate limit exceeded"
123+ }
124+ }
125+ ]
126+ }
127+ ]
126128 }
127129]