
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Ensure 'RekeyLimit' is configured with the correct value in /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/*.conf") }}}
    <criteria comment="RekeyLimit is correctly configured for ssh client" operator="AND">
      <criterion comment="check that RekeyLimit is not configured in /etc/ssh/ssh_config" test_ref="test_ssh_client_rekey_limit_main_config" negate="true" />
      <criterion comment="check correct RekeyLimit configuration in /etc/ssh/ssh_config.d/*.conf" test_ref="test_ssh_client_rekey_limit_include_configs" />
    </criteria>
  </definition>

  <local_variable id="ssh_client_line_regex" datatype="string" comment="The regex of the directive" version="1">
    <concat>
      <literal_component>^[\s]*RekeyLimit[\s]+</literal_component>
      <variable_component var_ref="var_ssh_client_rekey_limit_size"/>
      <literal_component>[\s]+</literal_component>
      <variable_component var_ref="var_ssh_client_rekey_limit_time"/>
      <literal_component>[\s]*$</literal_component>
    </concat>
  </local_variable>

  <external_variable comment="Size component of the rekey limit" datatype="string" id="var_ssh_client_rekey_limit_size" version="1" />
  <external_variable comment="Time component of the rekey limit" datatype="string" id="var_ssh_client_rekey_limit_time" version="1" />


  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in /etc/ssh/ssh_config file" id="test_ssh_client_rekey_limit_main_config" version="1">
     <ind:object object_ref="obj_ssh_client_rekey_limit_main_config"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_ssh_client_rekey_limit_main_config" version="1">
     <ind:filepath>/etc/ssh/ssh_config</ind:filepath>
     <ind:pattern operation="pattern match">^[\s]*RekeyLimit.*$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in /etc/ssh/ssh_config.d/*.conf" id="test_ssh_client_rekey_limit_include_configs" version="1">
     <ind:object object_ref="obj_ssh_client_rekey_limit_include_configs"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_ssh_client_rekey_limit_include_configs" version="1">
     <ind:filepath operation="pattern match">^/etc/ssh/ssh_config\.d/.*\.conf$</ind:filepath>
     <ind:pattern var_ref="ssh_client_line_regex" operation="pattern match"></ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
