File: firewall/http.sh

#!/usr/bin/env bash
#=============================================================================
# Sentinela ? Intelligent Linux Security Framework
# firewall/http.sh ? Reglas específicas para HTTP
#=============================================================================
#
# Puerto 80
# - Rate limit: HTTP_RATE_LIMIT conexiones/minuto
# - Connlimit: HTTP_CONNLIMIT conexiones simultáneas por IP
# - TRUSTED ipset bypassea límites
#=============================================================================

http_firewall_rules() {
    log_info "Configurando reglas HTTP (puerto ${PORT_HTTP})..."

    # HTTP con rate limit
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_HTTP}" \
        -m conntrack --ctstate NEW \
        -m hashlimit --hashlimit-name SENTINELA_HTTP \
        --hashlimit-mode srcip \
        --hashlimit-srcmask 32 \
        --hashlimit-upto "${HTTP_RATE_LIMIT}"/minute \
        --hashlimit-burst "${HTTP_RATE_LIMIT}" \
        -j ACCEPT

    # HTTP connlimit
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_HTTP}" \
        -m connlimit --connlimit-above "${HTTP_CONNLIMIT}" \
        --connlimit-mask 32 \
        -j LOG --log-prefix "SENTINELA:HTTP_CONNLIMIT: " --log-uid

    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_HTTP}" \
        -m connlimit --connlimit-above "${HTTP_CONNLIMIT}" \
        --connlimit-mask 32 \
        -j DROP

    # HTTP accept
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_HTTP}" -j ACCEPT

    log_info "Reglas HTTP aplicadas (rate ${HTTP_RATE_LIMIT}/min, connlimit ${HTTP_CONNLIMIT})"
}