{{% set nftables_family_names = ['bridge', 'arp', 'inet'] %}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Make sure that there is permanent nftables configuration file used
    to save and re-apply rules on reboot") }}}
    <criteria operator="AND">
      <criterion test_ref="test_{{{ rule_id }}}_file"
                 comment="Check the existence of top level nftables configuration file" />
{{% for family in nftables_family_names %}}
      <criterion test_ref="test_{{{ rule_id }}}_include_{{{ family }}}"
                 comment="Check the contents of configuration file for {{{ family }}} family"/>
{{% endfor %}}
    </criteria>
  </definition>
  <ind:textfilecontent54_test id="test_{{{ rule_id }}}_file"
  comment="Check top level configuration file is named as expected"
  check="all" check_existence="all_exist" version="1">
    <ind:object object_ref="object_{{{ rule_id }}}_file" />
  </ind:textfilecontent54_test>
{{% for family in nftables_family_names %}}
  <ind:textfilecontent54_test id="test_{{{ rule_id }}}_include_{{{ family }}}"
  comment="Check top level configuration file includes expected {{{ family }}} family clauses"
  check="at least one" version="1">
    <ind:object object_ref="object_{{{ rule_id }}}_file" />
    <ind:state state_ref="state_{{{ rule_id }}}_{{{ family }}}_contents" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_state id="state_{{{ rule_id }}}_{{{ family }}}_contents" version="1">
    <ind:subexpression datatype="string" operation="pattern match" var_check="at least one"
                       var_ref="var_{{{ rule_id }}}_required_{{{ family }}}_files"/>
  </ind:textfilecontent54_state>

  <local_variable id="var_{{{ rule_id }}}_required_{{{ family }}}_files" version="1"
                  comment="Pattern to match all required families files" datatype="string">
    <literal_component>/etc/nftables/{{{ family }}}-filter</literal_component>
  </local_variable>
{{% endfor %}}
  <ind:textfilecontent54_object id="object_{{{ rule_id }}}_file" version="1">
    <ind:filepath operation="equals" var_ref="var_nftables_master_config_file"/>
    <ind:pattern operation="pattern match">^[\s]*include[\s]+\"([^\s]+)"$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>
  <external_variable comment="file path" datatype="string"
                     id="var_nftables_master_config_file" version="1"/>
  <local_variable id="var_{{{ rule_id }}}_families_config_paths" datatype="string" version="1"
    comment="File paths of all needed families part of the permanent configuration">
    <object_component item_field="subexpression" object_ref="object_{{{ rule_id }}}_file" />
  </local_variable>
</def-group>
