<def-group>
  <definition class="compliance" id="susefirewall2_ddos_protection" version="1">
    {{{ oval_metadata("Verify \"SuSEfirewall2\" is configured to protect the SUSE operating system against or limit the effects of DoS attacks.", rule_title=rule_title) }}}
    <criteria operator="AND">
      <extend_definition comment="SuSEfirewall2 is installed" definition_ref="package_SuSEfirewall2_installed" />
      <extend_definition comment="SuSEfirewall2 is enabled" definition_ref="service_SuSEfirewall2_enabled" />
      <criterion comment="DoS protection is configured" test_ref="test_susefirewall2_ddos_protection" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" comment="DoS protection is configured" id="test_susefirewall2_ddos_protection" version="1">
    <ind:object object_ref="object_susefirewall2_ddos_protection" />
    <ind:state state_ref="state_susefirewall2_ddos_protection_hitcount" />
    <ind:state state_ref="state_susefirewall2_ddos_protection_blockseconds" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_susefirewall2_ddos_protection" version="1">
      <ind:filepath operation="equals">/etc/sysconfig/SuSEfirewall2</ind:filepath>
    <ind:pattern operation="pattern match">^\s*(?:export\s+)?FW_SERVICES_ACCEPT_EXT=(?:"([^"]+)"|'([^']+)')\s*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_susefirewall2_ddos_protection_hitcount" version="1">
      <ind:subexpression operation="pattern match">(^| )0/0,tcp,22,,([^ $]+,)?hitcount=\d+(,|$)</ind:subexpression>
  </ind:textfilecontent54_state>

  <ind:textfilecontent54_state id="state_susefirewall2_ddos_protection_blockseconds" version="1">
      <ind:subexpression operation="pattern match">(^| )0/0,tcp,22,,([^ $]+,)?blockseconds=\d+(,|$)</ind:subexpression>
  </ind:textfilecontent54_state>

</def-group>
