<def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
        {{{ oval_metadata("Rsyslogd must authenticate remote system its sending logs to.") }}}
        <criteria operator="AND">
            <criteria operator="OR">
                <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
                <criterion comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript"
                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" />
                <criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d"
                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
                <criterion comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript"
                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" />
            </criteria>
        </criteria>
    </definition>

{{% set legacy_regex = "^\\$ActionSendStreamDriverAuthMode x509/name$" %}}
{{% set rainer_script_regex = "^\\s*action\\(.*(?i)\\btype\\b(?-i)=\"omfwd\".*(?i)\\bStreamDriverAuthMode\\b(?-i)=\"x509/name\".*\\)\\s*$" %}}

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
                                id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" version="1">

        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode"
                                    comment="Check if  $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
                                    version="1">
        <ind:filepath>/etc/rsyslog.conf</ind:filepath>
        <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript"
                                id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" version="1">

        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer"
                                    comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript"
                                    version="1">
        <ind:filepath>/etc/rsyslog.conf</ind:filepath>
        <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
                                id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" version="1">
        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir"
                                    comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.d"
                                    version="1">
        <ind:path>/etc/rsyslog.d</ind:path>
        <ind:filename operation="pattern match">^.*conf$</ind:filename>
        <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript"
                                id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" version="1">
        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer"
                                    comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript"
                                    version="1">
        <ind:path>/etc/rsyslog.d</ind:path>
        <ind:filename operation="pattern match">^.*conf$</ind:filename>
        <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

</def-group>
