<def-group>
  <definition class="compliance" id="configure_firewalld_rate_limiting" version="1">
    {{{ oval_metadata("Create a direct firewall rule to protect against DoS attacks by rate limiting incoming connections.") }}}
    <criteria operator="AND">
      <criterion comment="check if the file /etc/firewalld/direct.xml contains correct rule" test_ref="test_firewalld_rate_limiting"/>
    </criteria>
  </definition>

  <ind:xmlfilecontent_test check="at least one" check_existence="all_exist" comment="firewalld rate limiting incoming connections"
  id="test_firewalld_rate_limiting" version="1">
    <ind:object object_ref="object_firewalld_rate_limiting"/>
    <ind:state state_ref="state_firewalld_rate_limiting" />
  </ind:xmlfilecontent_test>

  <ind:xmlfilecontent_object id="object_firewalld_rate_limiting" version="1">
    <ind:filepath>/etc/firewalld/direct.xml</ind:filepath>
    <ind:xpath>/direct/rule[@chain="INPUT_direct" and @priority="0" and @table="filter" and @ipv="ipv4"]/text()</ind:xpath>
  </ind:xmlfilecontent_object>

  <ind:xmlfilecontent_state id="state_firewalld_rate_limiting" version="1">
    <ind:value_of datatype="string" entity_check="at least one">-p tcp -m limit --limit 25/minute --limit-burst 100 -j INPUT_ZONES</ind:value_of>
  </ind:xmlfilecontent_state>
</def-group>
