From a2f4f3b36e3295311128673f33f90c93de24288d Mon Sep 17 00:00:00 2001
From: Arnaud Patard <apatard@hupstream.com>
Date: Wed, 13 Jan 2021 14:59:29 +0100
Subject: [PATCH] feat(zone.xml): allow to rate limit 'accept' in rich rules

The current rich_rule macro is supporting to set if the connection
should be accepted or rejected or dropped but doesn't support setting
rate limiting in the 'accept' case. Add code for that.

Signed-off-by: Arnaud Patard <apatard@hupstream.com>
---
 firewalld/files/zone.xml                        | 2 +-
 test/integration/default/controls/zones_spec.rb | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/firewalld/files/zone.xml b/firewalld/files/zone.xml
index c730b1c..8a58e6a 100644
--- a/firewalld/files/zone.xml
+++ b/firewalld/files/zone.xml
@@ -60,7 +60,7 @@
     <audit>{%- if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{%- endif %}</audit>
   {%- endif %}
   {%- if 'accept' in rule %}
-    <accept/>
+    <accept>{%- if rule.accept is mapping and 'limit' in rule.accept %} <limit value="{{ rule.accept.limit }}"/>{%- endif %}</accept>
   {%- endif %}
   {%- if 'reject' in rule %}
     <reject{%- if 'type' in rule.reject %} type="{{ rule.reject.type }}"{%- endif %} />
diff --git a/test/integration/default/controls/zones_spec.rb b/test/integration/default/controls/zones_spec.rb
index 82382ba..eee6953 100644
--- a/test/integration/default/controls/zones_spec.rb
+++ b/test/integration/default/controls/zones_spec.rb
@@ -31,7 +31,7 @@ control 'zones/public.xml configuration' do
           <source-port port="4444" protocol="tcp" />
           <rule family="ipv4">
             <source address="8.8.8.8/24" />
-            <accept/>
+            <accept></accept>
           </rule>
           <rule family="ipv4">
             <source ipset="fail2ban-ssh" />
@@ -59,12 +59,12 @@ control 'zones/rich_public.xml configuration' do
           <rule>
             <source ipset="fail2ban-ssh" />
             <service name="ssh" />
-            <accept/>
+            <accept></accept>
           </rule>
           <rule>
             <source ipset="other-ipset" />
             <service name="ssh" />
-            <accept/>
+            <accept></accept>
           </rule>
         </zone>
       ZONE_XML