<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="2">
    {{{ oval_metadata("The password hashing algorithm should be set correctly in /etc/login.defs.") }}}
    <criteria operator="AND">
      <criterion test_ref="test_set_password_hashing_algorithm_logindefs"/>
    </criteria>
  </definition>

  <ind:variable_test id="test_set_password_hashing_algorithm_logindefs" version="1"
    check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs">
    <ind:object object_ref="object_set_password_hashing_algorithm_logindefs"/>
    <ind:state state_ref="state_set_password_hashing_algorithm_logindefs"/>
  </ind:variable_test>

  <ind:textfilecontent54_object id="object_last_encrypt_method_from_etc_login_defs" version="1">
    <!-- Read whole /etc/login.defs as single line so we can retrieve last ENCRYPT_METHOD directive occurrence -->
    <ind:behaviors singleline="true"/>
    <ind:filepath>/etc/login.defs</ind:filepath>
    <!-- Retrieve last (uncommented) occurrence of ENCRYPT_METHOD directive -->
    <ind:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- Capture the actual ENCRYPT_METHOD string value from the previously retrieved last instance -->
  <local_variable id="variable_last_encrypt_method_instance_value" version="1"
    datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs">
    <regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
      <object_component item_field="subexpression" object_ref="object_last_encrypt_method_from_etc_login_defs"/>
    </regex_capture>
  </local_variable>

  <!-- Construct OVAL object from this local variable so we can use it in variable test above -->
  <ind:variable_object id="object_set_password_hashing_algorithm_logindefs" version="1">
    <ind:var_ref>variable_last_encrypt_method_instance_value</ind:var_ref>
  </ind:variable_object>

  <!-- Define corresponding variable state (the requirement) for the variable object -->
  <!-- The check should PASS if retrieved last ENCRYPT_METHOD value is equal to the requirement -->
  <ind:variable_state id="state_set_password_hashing_algorithm_logindefs" version="1">
    <ind:value operation="pattern match" datatype="string" var_ref="var_password_hashing_algorithm_regex"/>
  </ind:variable_state>

  <local_variable datatype="string" id="var_password_hashing_algorithm_regex" version="1" comment="Limit regex">
    <concat>
      <literal_component>^</literal_component>
       <variable_component var_ref="var_password_hashing_algorithm"/>
      <literal_component>$</literal_component>
    </concat>
  </local_variable>

  <external_variable id="var_password_hashing_algorithm" version="1"
    datatype="string" comment="hashing algorithm for /etc/login.defs"/>
</def-group>
