From: Tom Hughes <tom@compton.nu>
Date: Sun, 5 Mar 2023 20:33:41 +0000 (+0000)
Subject: Expire rate limit sets
X-Git-Url: https://git.openstreetmap.org./chef.git/commitdiff_plain/abd375c5775dc07eb912a839ddf8bdbfaead285f

Expire rate limit sets
---

diff --git a/cookbooks/networking/resources/firewall_rule.rb b/cookbooks/networking/resources/firewall_rule.rb
index 218a6b5f4..75d73dc11 100644
--- a/cookbooks/networking/resources/firewall_rule.rb
+++ b/cookbooks/networking/resources/firewall_rule.rb
@@ -148,7 +148,7 @@ action_class do
 
       node.default[:networking][:firewall][:sets] << set
 
-      rule << "add @#{set} { #{ip} saddr limit rate #{rate}/second burst #{burst} packets }"
+      rule << "update @#{set} { #{ip} saddr limit rate #{rate}/second burst #{burst} packets }"
     end
 
     rule << case action
diff --git a/cookbooks/networking/templates/default/nftables.conf.erb b/cookbooks/networking/templates/default/nftables.conf.erb
index 94c383525..325e7740a 100644
--- a/cookbooks/networking/templates/default/nftables.conf.erb
+++ b/cookbooks/networking/templates/default/nftables.conf.erb
@@ -25,25 +25,23 @@ table inet filter {
   set ip-blacklist {
     type ipv4_addr
     flags dynamic
-    size 0
   }
 
   set ip6-blacklist {
     type ipv6_addr
     flags dynamic
-    size 0
   }
 
   set ratelimit-icmp-echo-ip {
     type ipv4_addr
     flags dynamic
-    size 0
+    timeout 120s
   }
 
   set ratelimit-icmp-echo-ip6 {
     type ipv6_addr
     flags dynamic
-    size 0
+    timeout 120s
   }
 
 <%- node[:networking][:firewall][:sets].each do |set| %>
@@ -54,7 +52,7 @@ table inet filter {
     type ipv6_addr
 <%- end %>
     flags dynamic
-    size 0
+    timeout 120s
   }
 
 <%- end %>
@@ -82,11 +80,11 @@ table inet filter {
     ct state { established, related } accept
 
     icmp type { destination-unreachable } accept
-    icmp type { echo-request } add @ratelimit-icmp-echo-ip { ip saddr limit rate 1/second } accept
+    icmp type { echo-request } update @ratelimit-icmp-echo-ip { ip saddr limit rate 1/second } accept
     icmp type { echo-request } drop
 
     icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert } accept
-    icmpv6 type { echo-request } add @ratelimit-icmp-echo-ip6 { ip6 saddr limit rate 1/second } accept
+    icmpv6 type { echo-request } update @ratelimit-icmp-echo-ip6 { ip6 saddr limit rate 1/second } accept
     icmpv6 type { echo-request } drop
 
     meta l4proto { icmp, icmpv6 } jump log-and-drop