# TODO: contribute to https://github.com/jhh/firewalld-cookbook/blob/master/providers/rich_rule.rb
# hitcound, rttl and all other options not covered
execute 'log-ssh-bruteforce' do
  command 'firewall-cmd --direct --add-rule ipv4 filter INPUT 0 \
          -p tcp -m tcp --dport 22 -m recent --update --seconds 10 \
          --hitcount 2 --rttl --name SSH --rsource -m comment --comment \
          \"SSH Brute-force Log\" -j LOG --log-prefix \"SSH_brute_force\"'
  not_if  'test -f /tmp/log-ssh-bruteforce.run'
end
file '/tmp/log-ssh-bruteforce.run' do
  action :create
  content ''
end

execute 'drop-ssh-bruteforce' do
  command 'firewall-cmd --direct --add-rule ipv4 filter INPUT 1 \
          -p tcp -m tcp --dport 22 -m recent --update --seconds 10 \
          --hitcount 2 --rttl --name SSH --rsource -m comment --comment \
          \"SSH Brute-force Drop\" -j DROP'
  not_if  'test -f /tmp/drop-ssh-bruteforce.run'
end
file '/tmp/drop-ssh-bruteforce.run' do
  action :create
  content ''
end

execute 'accept-ssh-bruteforce' do
  command 'firewall-cmd --direct --add-rule ipv4 filter INPUT 2 \
          -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set \
          --name SSH --rsource -m comment --comment \
          \"SSH Brute-force Accept\" -j ACCEPT'
  not_if  'test -f /tmp/accept-ssh-bruteforce.run'
end
file '/tmp/accept-ssh-bruteforce.run' do
  action :create
  content ''
end
