Postfwd2 - limiting hosts in the same subnet with different rate limits
I have the below set of rules (in reality list is longer but showcasing this to explain this problem I am facing)
id=Rule_0000 ; client_address=192.168.128.180; action=rate(client_address/10/60/REJECT)#Rate limit if sender IP is 192.168.128.180
id=Rule_0002 ; client_address=172.16.93.36; action=rate(client_address/200/60/REJECT)#Rate limit if sender IP is 172.16.93.36
id=Rule_0020 ; client_address=192.168.128.0/24; action=rate(client_address/100/60/REJECT)#Rate limit if sender IP is part of subnet 192.168.128.0/24
id=Rule_0019 ; client_address=172.16.93.0/24; action=rate(client_address/100/60/REJECT)#Rate limit if sender IP is part of subnet 172.16.93.0/24
id=Rule_0021 ; client_address=172.16.254.0/22; action=rate(client_address/100/60/REJECT)#Rate limit if sender IP is part of subnet 172.16.224.0/22
id=Rule_0023 ; client_address=192.168.0.0/16; action=rate(client_address/7/60/REJECT) #Rate limit if sender IP is part of subnet 192.168.0.0/16
id=Rule_0025 ; client_address=0.0.0.0/0; action=rate(client_address/5/60/REJECT) #Rate limit All remaining IPs not falling under any subnets specified above
--Each rule is meant to define how many emails per seconds will the respective client_address be allowed to send.--
Initially I have defined a full host IP
Secondly I defined rules that limit senders if they happen to be from larger subnets.
Finally anyone else not making part of the previous defined hosts or subbnets will be rate limited here.
--Explaining the syntax--
Rule_0000 defines that client_address 192.168.128.180 can only send up to 10 email every 60seconds. Exceeding this limit returns a REJECT until it expires.
So far, testing the first 3 rules respectively works just fine, ##however## the problem starts when I start incuding subnets in subsequent rules which happen to also contain IPs specified in previous rules.
The IP specified in Rule_0000 would also be found in Rule_0020 and Rule_0025.
When testing, on sending ten emails from 192.168.128.180 not all of them get delivered, I check the postfwd2 dumpcache and it shows the below.
%rate_cache -> %client_address=192.168.128.180 -> @list -> 'Rule_0000+10_60,Rule_0020+100_60,Rule_0023+7_60,Rule_0025+5_60'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0000+10_60 -> @action -> 'REJECT'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0000+10_60 -> @count -> '6'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0000+10_60 -> @maxcount -> '10'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0000+10_60 -> @rule -> 'Rule_0000'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0000+10_60 -> @time -> '1548345771.81308'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0000+10_60 -> @ttl -> '60'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0000+10_60 -> @type -> 'rate'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0000+10_60 -> @until -> '1548345831.81308'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0020+100_60 -> @action -> 'REJECT'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0020+100_60 -> @count -> '6'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0020+100_60 -> @maxcount -> '100'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0020+100_60 -> @rule -> 'Rule_0020'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0020+100_60 -> @time -> '1548345771.81308'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0020+100_60 -> @ttl -> '60'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0020+100_60 -> @type -> 'rate'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0020+100_60 -> @until -> '1548345831.81308'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0023+7_60 -> @action -> 'REJECT'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0023+7_60 -> @count -> '6'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0023+7_60 -> @maxcount -> '7'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0023+7_60 -> @rule -> 'Rule_0023'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0023+7_60 -> @time -> '1548345771.81308'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0023+7_60 -> @ttl -> '60'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0023+7_60 -> @type -> 'rate'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0023+7_60 -> @until -> '1548345831.81308'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0025+5_60 -> @action -> 'REJECT'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0025+5_60 -> @count -> '5'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0025+5_60 -> @maxcount -> '5'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0025+5_60 -> @rule -> 'Rule_0025'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0025+5_60 -> @time -> '1548345771.81308'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0025+5_60 -> @ttl -> '60'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0025+5_60 -> @type -> 'rate'
%rate_cache -> %client_address=192.168.128.180 -> %Rule_0025+5_60 -> @until -> '1548345831.81308'
My understanding is that postfwd will go from Top to Down and see which rules matches first. Upon matching it should not go through the other rules.
The problem I'm seeing here is that postfwd does match the first rule and increases the count accordingly however it doesn't stop there and keeps looking for a match in the rules that follow it. As you can see in the dumb the count for all rules reach up to 6 but stops to 5 on the last one. This may explain why only 5 emails got delivered.
-- I need help understanding if maybe my expectation of the top to down matching of rules is incorrect. Does it still check the other rules?
-- If it is indeed working fine, would you recommend achieving this in a different approach?
