File: firewall/https.sh

#!/usr/bin/env bash
#=============================================================================
# Sentinela ? Intelligent Linux Security Framework
# firewall/https.sh ? Reglas específicas para HTTPS
#=============================================================================
#
# Puerto 443
# - Rate limit: HTTPS_RATE_LIMIT conexiones/minuto
# - Connlimit: HTTPS_CONNLIMIT conexiones simultáneas por IP
#=============================================================================

https_firewall_rules() {
    log_info "Configurando reglas HTTPS (puerto ${PORT_HTTPS})..."

    # HTTPS con rate limit
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_HTTPS}" \
        -m conntrack --ctstate NEW \
        -m hashlimit --hashlimit-name SENTINELA_HTTPS \
        --hashlimit-mode srcip \
        --hashlimit-srcmask 32 \
        --hashlimit-upto "${HTTPS_RATE_LIMIT}"/minute \
        --hashlimit-burst "${HTTPS_RATE_LIMIT}" \
        -j ACCEPT

    # HTTPS connlimit
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_HTTPS}" \
        -m connlimit --connlimit-above "${HTTPS_CONNLIMIT}" \
        --connlimit-mask 32 \
        -j LOG --log-prefix "SENTINELA:HTTPS_CONNLIMIT: " --log-uid

    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_HTTPS}" \
        -m connlimit --connlimit-above "${HTTPS_CONNLIMIT}" \
        --connlimit-mask 32 \
        -j DROP

    # HTTPS accept
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_HTTPS}" -j ACCEPT

    log_info "Reglas HTTPS aplicadas (rate ${HTTPS_RATE_LIMIT}/min, connlimit ${HTTPS_CONNLIMIT})"
}