<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.", rule_title=rule_title) }}}
    <criteria comment="ssh is configured correctly" operator="AND">
      <criteria comment="the configuration is correct if it exists" operator="AND">
        <criterion comment="Check the MACs in /etc/ssh/ssh_config if any"
          test_ref="test_{{{ rule_id }}}" />
        <criterion comment="Check the MACs in /etc/ssh/ssh_config.d if any"
          test_ref="test_{{{ rule_id }}}_config_dir" />
      </criteria>
      <criterion comment="the configuration exists" test_ref="test_MACs_present_{{{ rule_id }}}" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="any_exist"
    comment="tests the value of MACs setting in the /etc/ssh/ssh_config file"
    id="test_{{{ rule_id }}}" version="1">
    <ind:object object_ref="obj_{{{ rule_id }}}" />
    <ind:state state_ref="state_{{{ rule_id }}}" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
    <ind:filepath>/etc/ssh/ssh_config</ind:filepath>
    <ind:pattern operation="pattern match">^[ \t]*(?i)MACs(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="any_exist"
    comment="tests the value of MACs setting in the /etc/ssh/ssh_config.d file"
    id="test_{{{ rule_id }}}_config_dir" version="1">
    <ind:object object_ref="obj_{{{ rule_id }}}_config_dir" />
    <ind:state state_ref="state_{{{ rule_id }}}" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_config_dir" version="1">
    <ind:path>/etc/ssh/ssh_config.d</ind:path>
    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[ \t]*(?i)MACs(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_{{{ rule_id }}}" version="1">
    <ind:subexpression operation="equals" datatype="string" var_ref="ssh_approved_macs" var_check="at least one" />
  </ind:textfilecontent54_state>


  <ind:textfilecontent54_object comment="All confs collection" id="obj_collection_obj_{{{ rule_id }}}" version="1">
    <set>
      <object_reference>obj_{{{ rule_id }}}</object_reference>
      <object_reference>obj_{{{ rule_id }}}_config_dir</object_reference>
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_MACs_present_{{{ rule_id }}}" version="1"
                              check="all" check_existence="at_least_one_exists"
                              comment="Verify that the value of MACs is present">
    <ind:object object_ref="obj_collection_obj_{{{ rule_id }}}" />
  </ind:textfilecontent54_test>

  <external_variable comment="SSH Approved MACs by FIPS" datatype="string" id="ssh_approved_macs" version="1" />

</def-group>
