From 2f40f61f83afb34f0c4b95019a53050a504ce43a Mon Sep 17 00:00:00 2001
From: Markus Heiser <markus.heiser@darmarit.de>
Date: Tue, 4 Feb 2020 17:59:58 +0100
Subject: /etc/filtron/rules.json: normalize rules from docs & tooling box

Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
---
 docs/admin/filtron.rst | 192 +++++++++++++++++++++++++------------------------
 1 file changed, 98 insertions(+), 94 deletions(-)

(limited to 'docs/admin')

diff --git a/docs/admin/filtron.rst b/docs/admin/filtron.rst
index 205269973..2bc663411 100644
--- a/docs/admin/filtron.rst
+++ b/docs/admin/filtron.rst
@@ -39,6 +39,10 @@ an installation and the maintenance of, use our script :ref:`filtron.sh`.
 Sample configuration of filtron
 ===============================
 
+.. sidebar:: Tooling box
+
+   - :origin:`/etc/filtron/rules.json <utils/templates/etc/filtron/rules.json>`
+
 An example configuration can be find below. This configuration limits the access
 of:
 
@@ -50,100 +54,100 @@ of:
 
 .. code:: json
 
-   [{
-      "name":"search request",
-      "filters":[
-         "Param:q",
-         "Path=^(/|/search)$"
-      ],
-      "interval":"<time-interval-in-sec (int)>",
-      "limit":"<max-request-number-in-interval (int)>",
-      "subrules":[
-         {
-            "name":"roboagent limit",
-            "interval":"<time-interval-in-sec (int)>",
-            "limit":"<max-request-number-in-interval (int)>",
-            "filters":[
-               "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client)"
-            ],
-            "actions":[
-               {
-                  "name":"block",
-                  "params":{
-                     "message":"Rate limit exceeded"
-                  }
-               }
-            ]
-         },
-         {
-            "name":"botlimit",
-            "limit":0,
-            "stop":true,
-            "filters":[
-               "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
-            ],
-            "actions":[
-               {
-                  "name":"block",
-                  "params":{
-                     "message":"Rate limit exceeded"
-                  }
-               }
-            ]
-         },
-         {
-            "name":"IP limit",
-            "interval":"<time-interval-in-sec (int)>",
-            "limit":"<max-request-number-in-interval (int)>",
-            "stop":true,
-            "aggregations":[
-               "Header:X-Forwarded-For"
-            ],
-            "actions":[
-               {
-                  "name":"block",
-                  "params":{
-                     "message":"Rate limit exceeded"
-                  }
-               }
-            ]
-         },
-         {
-            "name":"rss/json limit",
-            "interval":"<time-interval-in-sec (int)>",
-            "limit":"<max-request-number-in-interval (int)>",
-            "stop":true,
-            "filters":[
-               "Param:format=(csv|json|rss)"
-            ],
-            "actions":[
-               {
-                  "name":"block",
-                  "params":{
-                     "message":"Rate limit exceeded"
-                  }
-               }
-            ]
-         },
-         {
-            "name":"useragent limit",
-            "interval":"<time-interval-in-sec (int)>",
-            "limit":"<max-request-number-in-interval (int)>",
-            "aggregations":[
-               "Header:User-Agent"
-            ],
-            "actions":[
-               {
-                  "name":"block",
-                  "params":{
-                     "message":"Rate limit exceeded"
-                  }
-               }
-            ]
-         }
-      ]
-   }]
-
+   [
+     { "name": "search request",
+       "filters": [
+	 "Param:q",
+	 "Path=^(/|/search)$"
+       ],
+       "interval": "<time-interval-in-sec (int)>",
+       "limit": "<max-request-number-in-interval (int)>",
+       "subrules": [
+	 {
+	   "name": "roboagent limit",
+	   "interval": "<time-interval-in-sec (int)>",
+	   "limit": "<max-request-number-in-interval (int)>",
+	   "filters": [
+	     "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client)"
+	   ],
+	   "actions": [
+	     { "name": "log"},
+	     { "name": "block",
+	       "params": {
+		 "message": "Rate limit exceeded"
+	       }
+	     }
+	   ]
+	 },
+	 {
+	   "name": "botlimit",
+	   "limit": 0,
+	   "stop": true,
+	   "filters": [
+	     "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
+	   ],
+	   "actions": [
+	     { "name": "log"},
+	     { "name": "block",
+	       "params": {
+		 "message": "Rate limit exceeded"
+	       }
+	     }
+	   ]
+	 },
+	 {
+	   "name": "IP limit",
+	   "interval": "<time-interval-in-sec (int)>",
+	   "limit": "<max-request-number-in-interval (int)>",
+	   "stop": true,
+	   "aggregations": [
+	     "Header:X-Forwarded-For"
+	   ],
+	   "actions": [
+	     { "name": "log"},
+	     { "name": "block",
+	       "params": {
+		 "message": "Rate limit exceeded"
+	       }
+	     }
+	   ]
+	 },
+	 {
+	   "name": "rss/json limit",
+	   "interval": "<time-interval-in-sec (int)>",
+	   "limit": "<max-request-number-in-interval (int)>",
+	   "stop": true,
+	   "filters": [
+	     "Param:format=(csv|json|rss)"
+	   ],
+	   "actions": [
+	     { "name": "log"},
+	     { "name": "block",
+	       "params": {
+		 "message": "Rate limit exceeded"
+	       }
+	     }
+	   ]
+	 },
+	 {
+	   "name": "useragent limit",
+	   "interval": "<time-interval-in-sec (int)>",
+	   "limit": "<max-request-number-in-interval (int)>",
+	   "aggregations": [
+	     "Header:User-Agent"
+	   ],
+	   "actions": [
+	     { "name": "log"},
+	     { "name": "block",
+	       "params": {
+		 "message": "Rate limit exceeded"
+	       }
+	     }
+	   ]
+	 }
+       ]
+     }
+   ]
 
 
 Route request through filtron
-- 
cgit v1.2.3