From 82b911248650f1b8da03ec04ef4a9121f8e107e5 Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Sun, 20 Jan 2013 16:45:26 -0200 Subject: Extlookup for firewall_ssl_ratelimit --- manifests/subsystems/firewall.pp | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) (limited to 'manifests/subsystems/firewall.pp') diff --git a/manifests/subsystems/firewall.pp b/manifests/subsystems/firewall.pp index a43662f..130e638 100644 --- a/manifests/subsystems/firewall.pp +++ b/manifests/subsystems/firewall.pp @@ -2,16 +2,6 @@ class firewall { class { 'shorewall': } - # SSL computational DoS mitigation - # See http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html - $firewall_ssl_ratelimit = $firewall_ssl_ratelimit ? { - '' => $firewall_global_ssl_ratelimit ? { - '' => '-', - default => $firewall_global_ssl_ratelimit, - }, - default => $firewall_ssl_ratelimit, - } - $rfc1918 = $shorewall_local_net ? { true => true, false => false, @@ -120,13 +110,15 @@ class firewall { order => 102, } + # SSL computational DoS mitigation + # See http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html shorewall::rule { 'https': action => 'HTTPS/ACCEPT', source => 'net', destination => '$FW', proto => '-', destinationport => '-', - ratelimit => "$firewall_ssl_ratelimit", + ratelimit => extlookup("firewall_ssl_ratelimit", '-'), order => 103, } -- cgit v1.2.3