/etc/filtron/rules.json: normalize rules from docs & tooling box

Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>

1 files changed, 100 insertions, 102 deletions

diff --git a/utils/templates/etc/filtron/rules.json b/utils/templates/etc/filtron/rules.json
index f333306e1..1c7005ae5 100644
--- a/utils/templates/etc/filtron/rules.json
+++ b/utils/templates/etc/filtron/rules.json
@@ -1,107 +1,105 @@
-[{
-  "name":"search request",
-  "filters":[
-    "Param:q",
-    "Path=^(/|/search)$"
-  ],
-  "interval":120,
-  "limit":19,
-  "actions":[
-    {
-      "name":"block",
-      "params":{
-        "message":"common rate limit exceeded"
-      }
-    }
-  ],
-  "subrules":[
-    {
-      "name":"roboagent limit",
-      "interval":60,
-      "limit":3,
-      "filters":[
-        "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client|Ruby)"
-      ],
-      "actions":[
-        {"name":"log"},
-        {
-          "name":"block",
-          "params":{
-            "message":"rate limit exceeded"
+[
+  { "name": "suspiciously frequent IP",
+    "filters": [],
+    "interval": 600,
+    "limit": 30,
+    "aggregations": [
+      "Header:X-Forwarded-For"
+    ],
+    "actions":[
+      {"name":"log"}
+    ]
+  },
+  { "name": "search request",
+    "filters": [
+      "Param:q",
+      "Path=^(/|/search)$"
+    ],
+    "interval": 61,
+    "limit": 999,
+    "subrules": [
+      {
+        "name": "roboagent limit",
+        "interval": 61,
+        "limit": 1,
+        "filters": [
+          "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client)"
+        ],
+        "actions": [
+          { "name": "log"},
+          { "name": "block",
+            "params": {
+              "message": "Rate limit exceeded"
+            }
           }
-        }
-      ]
-    },
-    {
-      "name":"botlimit",
-      "interval":60,
-      "limit":0,
-      "stop":true,
-      "filters":[
-        "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
-      ],
-      "actions":[
-        {"name":"log"},
-        {
-          "name":"block",
-          "params":{
-            "message":"rate limit exceeded"
+        ]
+      },
+      {
+        "name": "botlimit",
+        "limit": 0,
+        "stop": true,
+        "filters": [
+          "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
+        ],
+        "actions": [
+          { "name": "log"},
+          { "name": "block",
+            "params": {
+              "message": "Rate limit exceeded"
+            }
           }
-        }
-      ]
-    },
-    {
-      "name":"IP limit",
-      "interval":60,
-      "limit":13,
-      "stop":true,
-      "aggregations":[
-        "Header:X-Forwarded-For"
-      ],
-      "actions":[
-        {"name":"log"},
-        {
-          "name":"block",
-          "params":{
-            "message":"rate limit exceeded"
+        ]
+      },
+      {
+        "name": "IP limit",
+        "interval": 61,
+        "limit": 9,
+        "stop": true,
+        "aggregations": [
+          "Header:X-Forwarded-For"
+        ],
+        "actions": [
+          { "name": "log"},
+          { "name": "block",
+            "params": {
+              "message": "Rate limit exceeded"
+            }
           }
-        }
-      ]
-    },
-    {
-      "name":"rss/json limit",
-      "interval":60,
-      "limit":13,
-      "stop":true,
-      "filters":[
-        "Param:format=(csv|json|rss)"
-      ],
-      "actions":[
-        {"name":"log"},
-        {
-          "name":"block",
-          "params":{
-            "message":"rate limit exceeded"
+        ]
+      },
+      {
+        "name": "rss/json limit",
+        "interval": 121,
+        "limit": 2,
+        "stop": true,
+        "filters": [
+          "Param:format=(csv|json|rss)"
+        ],
+        "actions": [
+          { "name": "log"},
+          { "name": "block",
+            "params": {
+              "message": "Rate limit exceeded"
+            }
           }
-        }
-      ]
-    },
-    {
-      "name":"useragent limit",
-      "interval":60,
-      "limit":13,
-      "aggregations":[
-        "Header:User-Agent"
-      ],
-      "actions":[
-        {"name":"log"},
-        {
-          "name":"block",
-          "params":{
-            "message":"rate limit exceeded"
+        ]
+      },
+      {
+        "name": "useragent limit",
+        "interval": 61,
+        "limit": 199,
+        "aggregations": [
+          "Header:User-Agent"
+        ],
+        "actions": [
+          { "name": "log"},
+          { "name": "block",
+            "params": {
+              "message": "Rate limit exceeded"
+            }
           }
-        }
-      ]
-    }
-  ]
-}]
+        ]
+      }
+    ]
+  }
+]