{{#
Generates the :code:`<affected>` tag for OVAL check using correct product platforms.

:param products: Name of products
:type products: str
#}}
{{%- macro oval_affected(products) %}}
<affected family="unix">
{{{ prodtype_to_platform(products)|indent(2) }}}
</affected>
{{%- endmacro %}}

{{#
  Constants.
#}}
{{%- set suffix_id_default_not_overriden = "_default_not_overriden" -%}}

{{#
  High level macro which checks if a particular combination of parameter and value in a configuration file is set.

:param path: Path to the configuration file to be checked.
:type path: str
:param prefix_regex: Regular expression to be used in the beginning of the OVAL text file content check.
:type prefix_regex: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param separator_regex: Regular expression to be used as the separator of parameter and value in a configuration file. If spaces are allowed, this should be included in the regular expression.
:type separator_regex: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: boolean
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: boolean
:param missing_config_file_fail: If set, the check will fail if the configuration is not existent in the system.
:type missing_config_file_fail: boolean
:param section: If set, the parameter will be checked only within the given section defined by [section].
:type section: str
:param quotes: If non-empty, one level of matching quotes is considered when checking the value. See comment of oval_line_in_file_state for more info.
:type quotes: str

#}}
{{%- macro oval_check_config_file(path='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', value='', missing_parameter_pass=false, application='', multi_value=false, missing_config_file_fail=false, section='', quotes='') -%}}
{{%- if application == '' -%}}
	{{%- set application = "The respective application or service" -%}}
{{%- endif -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Ensure '" + parameter + "' is configured with value '" + value | replace("(?i)", "") | replace("(?-i)", "") + (" in section '" + section if section else "") + "' in " + path) }}}
    {{%- if missing_config_file_fail %}}
    <criteria comment="{{{ application }}} is configured correctly and configuration file exists"
    operator="AND">
    {{%- endif %}}
    {{%- if application == "sshd" %}}
{{#-
    This condition is here to avoid regression in sshd configuration rules.
    The OVAL checks for sshd configuration test if the package is installed
    and if it is required or not by the profile. When rule applicability is
    done for these rules, it can be removed.
#}}
    <criteria comment="{{{ application }}} is configured correctly or is not installed"
    operator="OR">
        {{{- application_not_required_or_requirement_unset() }}}
        {{{- application_required_or_requirement_unset() }}}
    {{%- endif %}}
    <criteria comment="{{{ application }}} is configured correctly"
    operator="OR">
        {{{- oval_line_in_file_criterion(path, parameter) }}}
        {{%- if missing_parameter_pass %}}
        {{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass) }}}
        {{%- endif %}}
    </criteria>
    {{%- if application == "sshd" %}}
    </criteria> {{# close criteria left open in application_required_or_requirement_unset #}}
    </criteria>
    {{%- endif %}}
    {{%- if missing_config_file_fail %}}
        {{{- oval_config_file_exists_criterion(path) }}}
    </criteria>
    {{%- endif %}}
  </definition>
  {{{ oval_line_in_file_test(path, parameter) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, false, multi_value) }}}
  {{{ oval_line_in_file_state(value, multi_value, quotes) }}}
  {{%- if missing_parameter_pass %}}
  {{{ oval_line_in_file_test(path, parameter, missing_parameter_pass) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, missing_parameter_pass, multi_value) }}}
  {{%- endif %}}
  {{%- if missing_config_file_fail %}}
  {{{ oval_config_file_exists_test(path) }}}
  {{{ oval_config_file_exists_object(path) }}}
  {{%- endif %}}

</def-group>
{{%- endmacro %}}

{{#
  Macro to define the criterion of the OVAL check (Criterion definition).

:param oval_line_in_file_criterion: Path to the configuration file to be checked.
:type oval_line_in_file_criterion: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param id_stem: The first suffix of tests, objects etc. that ensures uniqueness of the particular OVAL entity ID. Defaults to the rule ID.
:type id_stem: str

#}}
{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false, comment='', id_stem='') -%}}
{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- set prefix_text = "Check the" -%}}
{{%- if missing_parameter_pass %}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{%- set prefix_text = prefix_text + " absence of" -%}}
{{%- endif %}}
{{%- if not comment -%}}
{{%- set comment = prefix_text ~ " " ~ parameter ~ " in " ~ path -%}}
{{%- endif -%}}
<criterion comment="{{{ comment }}}"
  test_ref="test_{{{ id_stem }}}{{{ suffix_id }}}" />
{{%- endmacro %}}

{{#
  Macro to define the OVAL test to be constructed (Test definition).

:param path: Path to the configuration file to be checked.
:type path: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param id_stem: The first suffix of tests, objects etc. that ensures uniqueness of the particular OVAL entity ID. Defaults to the rule ID.
:type id_stem: str

#}}
{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false, id_stem='') -%}}
{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- if missing_parameter_pass %}}
{{%- set check_existence = "none_exist" -%}}
{{%- set prefix_text = "absence" -%}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{%- else %}}
{{%- set check_existence = "all_exist" -%}}
{{%- set prefix_text = "value" -%}}
{{%- endif %}}
<ind:textfilecontent54_test check="all" check_existence="{{{ check_existence }}}"
  comment="tests the {{{ prefix_text }}} of {{{ parameter }}} setting in the {{{ path }}} file"
  id="test_{{{ id_stem }}}{{{ suffix_id }}}" version="1">
  <ind:object object_ref="obj_{{{ id_stem }}}{{{ suffix_id }}}" />
  {{%- if not missing_parameter_pass %}}
  <ind:state state_ref="state_{{{ id_stem }}}{{{ suffix_id }}}" />
  {{%- endif %}}
</ind:textfilecontent54_test>
{{%- endmacro %}}

{{#
  Macro to check if a parameter in a configuration file is set (Object definition).

:param path_or_filepath: Either `filepath` to the configuration file to be checked, or if `filename_regex` is specified, path to the directory where filenames are matched against it.
:type path_or_filepath: str
:param section: If set, the parameter will be checked only within the given section defined by [section].
:type section: str
:param prefix_regex: Regular expression to be used in the beginning of the OVAL text file content check.
:type prefix_regex: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param separator_regex: Regular expression to be used as the separator of parameter and value in a configuration file. If spaces are allowed, this should be included in the regular expression.
:type separator_regex: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: str
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param filename_regex: If specified, the first argument is interpreted as `path`, and this will serve as `filename` regex.
:type filename_regex: str
:param id_stem: The first suffix of tests, objects etc. that ensures uniqueness of the particular OVAL entity ID. Defaults to the rule ID.
:type id_stem: str

#}}
{{%- macro oval_line_in_file_object(path_or_filepath='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filename_regex='', id_stem='') -%}}
{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- if multi_value -%}}
{{%- set group_regex = "([^#]*).*$" -%}}
{{%- else -%}}
{{%- set group_regex = "(.+?)[ \\t]*(?:$|#)" -%}}
{{%- endif -%}}
{{%- if section %}}
{{%- set common_regex = "^\s*\["+section+"\].*(?:\\n\s*[^[\s].*)*\\n"+prefix_regex+parameter+separator_regex -%}}
{{%- if missing_parameter_pass %}}
{{#
  There is no need for having a regular expression with a capture
  group "(\S*)" when checking if the parameter is not present in
  the configuration file.
#}}
{{%- set regex = common_regex -%}}
{{%- else %}}
{{%- set regex = common_regex+group_regex -%}}
{{%- endif %}}
{{%- else %}}
{{%- if missing_parameter_pass %}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{#
  There is no need for having a regular expression with a capture
  group "(.*)" when checking if the parameter is not present in
  the configuration file.
#}}
{{%- set regex = prefix_regex+parameter+separator_regex -%}}
{{%- else %}}
{{%- set regex = prefix_regex+parameter+separator_regex+group_regex -%}}
{{%- endif %}}
{{%- endif %}}
<ind:textfilecontent54_object id="obj_{{{ id_stem }}}{{{ suffix_id }}}" version="1">
{{%- if filename_regex %}}
  <ind:path>{{{ path_or_filepath }}}</ind:path>
  <ind:filename operation="pattern match">{{{ filename_regex }}}</ind:filename>
{{%- else %}}
  <ind:filepath>{{{ path_or_filepath }}}</ind:filepath>
{{%- endif %}}
  <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
  <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
{{%- endmacro %}}

{{#
  Macro to check if a expected value can be found in the extracted information of an OVAL object (State definition).

:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param quotes: If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.  For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
:type quotes: str
:param id_stem: The first suffix of tests, objects etc. that ensures uniqueness of the particular OVAL entity ID. Defaults to the rule ID.
:type id_stem: str

#}}
{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='', id_stem='') -%}}
{{%- set id_stem = id_stem or rule_id -%}}
{{%- set regex = value -%}}
{{%- if quotes != "" %}}
{{%- if "\\1" in value > 0 %}}
{{{ raise("The regex for matching '%s' already references capturing groups, which doesn't go well with quoting that adds a capturing group to the beginning." % value) }}}
{{%- endif %}}
{{%- set regex =  "((?:%s)?)%s\\1" % ("|".join(quotes), regex) -%}}
{{%- endif %}}
{{%- if multi_value %}}
{{%- set regex = "^.*\\b"+regex+"\\b.*$" -%}}
{{%- else %}}
{{%- set regex = "^"+regex+"$" -%}}
{{%- endif %}}
<ind:textfilecontent54_state id="state_{{{ id_stem }}}" version="1">
  <ind:subexpression datatype="string" operation="pattern match">{{{ regex }}}</ind:subexpression>
</ind:textfilecontent54_state>
{{%- endmacro %}}

{{%- macro oval_line_in_directory_criterion(path='', parameter='', missing_parameter_pass=false) -%}}
{{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass, id_stem=rule_id ~ "_config_dir") -}}}
{{%- endmacro %}}

{{%- macro oval_line_in_directory_test(path='', parameter='', missing_parameter_pass=false) -%}}
{{{ oval_line_in_file_test(path, parameter, missing_parameter_pass, id_stem=rule_id ~ "_config_dir") }}}
{{%- endmacro %}}

{{%- macro oval_line_in_directory_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false) -%}}
{{{- oval_line_in_file_object(path_or_filepath=path, section=section, prefix_regex=prefix_regex, parameter=parameter, separator_regex=separator_regex, missing_parameter_pass=missing_parameter_pass, multi_value=multi_value, filename_regex=".*\.conf$", id_stem=rule_id ~ "_config_dir") -}}}
{{%- endmacro %}}

{{%- macro oval_line_in_directory_state(value='', multi_value='', quotes='') -%}}
{{{- oval_line_in_file_state(value, multi_value, quotes, id_stem=rule_id ~ "_config_dir") -}}}
{{%- endmacro %}}

{{#
  Macro to define the OVAL criterion to check if the configuration file exists (Criterion definition).

:param path: Path to the configuration file to be checked.
:type path: str

#}}
{{%- macro oval_config_file_exists_criterion(path='') -%}}
	<criterion comment="test if configuration file {{{ path }}} exists for {{{ rule_id }}}" test_ref="test_{{{ rule_id }}}_config_file_exists" />
{{%- endmacro %}}

{{#
  Macro to define the OVAL test to check if the configuration file exists (Test definition).

:param path: Path to the configuration file to be checked.
:type path: str

#}}
{{%- macro oval_config_file_exists_test(path='') -%}}
  <unix:file_test id="test_{{{ rule_id }}}_config_file_exists" check="all" check_existence="all_exist" comment="The configuration file {{{ path }}} exists for {{{ rule_id }}}" version="1">
    <unix:object object_ref="obj_{{{ rule_id }}}_config_file" />
  </unix:file_test>
{{%- endmacro %}}

{{#
  Macro to define the OVAL criterion that requires a file not to exist.
  The id of the test name will be test_<id>.

:param filepath: Path to the file to be checked.
:type filepath: str

#}}
{{%- macro oval_file_absent_criterion(filepath) -%}}
  <criterion comment="Pass if there are no files matching pattern '{{{ filepath }}}' exist in the system" test_ref="test_{{{ rule_id }}}_file_{{{ filepath|escape_id }}}_absent" />
{{%- endmacro %}}

{{#
  Macro to define the OVAL test to check if the configuration file exists (Test definition).

:param filepath_regex: Regex to the filepath to be checked, will be prefixed by ^.
:type filepath_regex: str

#}}
{{%- macro oval_file_absent(filepath_regex) -%}}
  <unix:file_test check="all" check_existence="none_exist" id="test_{{{ rule_id }}}_file_{{{ filepath_regex|escape_id }}}_absent"
  comment="Check if {{{ filepath_regex }}} does not exist" version="1">
    <unix:object object_ref="object_{{{ rule_id }}}_file_{{{ filepath_regex|escape_id }}}_absent" />
  </unix:file_test>
  <unix:file_object id="object_{{{ rule_id }}}_file_{{{ filepath_regex|escape_id }}}_absent" version="1">
    <unix:filepath operation="pattern match">^{{{ filepath_regex }}}</unix:filepath>
  </unix:file_object>
{{%- endmacro %}}

{{#
  Macro to define the OVAL object to check if the configuration file exists (Object definition).

:param filepath_regex: Regex to the filepath to be checked, will be prefixed by ^.
:type filepath_regex: str

#}}
{{%- macro oval_config_file_exists_object(filepath_regex='') -%}}
  <unix:file_object id="obj_{{{ rule_id }}}_config_file" comment="The configuration file {{{ filepath_regex }}} for {{{ rule_id }}}" version="1">
    <unix:filepath operation="pattern match">^{{{ filepath_regex }}}</unix:filepath>
  </unix:file_object>
{{%- endmacro %}}

{{#
  Macro to define the OVAL test to check if there is a line in file with a pair of argument=value (Criterion definition).

:param filepath: Path to the file to be checked.
:type filepath: str
:param name: Argument name
:type name: str
:param value: Argument value (Optional)
:type value: str
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param negate: Whether to negate this criterion or not
:type negate: bool

#}}
{{%- macro oval_argument_value_in_line_criterion(filepath, name, value='', application='', negate=False) -%}}
{{%- if value -%}}
{{%- set name_value = name+"="+value -%}}
{{%- else -%}}
{{%- set name_value = name -%}}
{{%- endif -%}}
  <criterion comment="Check if argument {{{ name_value }}}{{% if application %}} for {{{ application }}}{{% endif %}} is {{% if negate %}}not {{% endif %}}present in {{{ filepath }}}"
  test_ref="test_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" {{% if negate %}}negate="true" {{% endif %}}/>
{{%- endmacro -%}}

{{#
  Macro to define the OVAL test to check if there is a line in file with a pair of argument=value (Test definition).

:param filepath: Path to the configuration file to be checked. The operation is "pattern match"
:type filepath: str
:param name: Argument name
:type name: str
:param value: Argument value (Optional)
:type value: str
:param line_prefix: The starting part of the line with the list of arguments, default is empty
:type line_prefix: str
:param line_suffix: The ending part of the line with the list of arguments, default is empty
:type line_suffix: str
:param is_regex: Defines whether the given name or value is a regex
:type is_regex: bool

#}}
{{%- macro oval_argument_value_in_line_test(filepath, name, value, line_prefix='', line_suffix='', is_regex=False) -%}}
{{%- if value -%}}
  {{%- set name_value = name+"="+value -%}}
{{%- else -%}}
  {{%- set name_value = name -%}}
{{%- endif -%}}
{{%- if is_regex -%}}
  {{%- set processed_name_value = name_value -%}}
{{%- else -%}}
  {{%- set processed_name_value = name_value|escape_regex -%}}
{{%- endif -%}}
  <ind:textfilecontent54_test id="test_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}"
  comment="Check if argument {{{ name_value }}} is present{{% if line_prefix %}} in the line starting with '{{{ line_prefix }}}'{{% endif %}} in {{{ filepath }}}"
  check="all" check_existence="all_exist" version="1">
    <ind:object object_ref="object_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" />
    <ind:state state_ref="state_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" version="1">
    <ind:filepath operation="pattern match">^{{{ filepath }}}</ind:filepath>
    <ind:pattern operation="pattern match">^{{{ line_prefix|escape_regex }}}(.*){{{ line_suffix|escape_regex }}}$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_state id="state_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" version="1">
    <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?{{{ processed_name_value }}}(?:\s.*)?$</ind:subexpression>
  </ind:textfilecontent54_state>
{{%- endmacro -%}}

{{#
  High level macro to define the OVAL test to check if there is a line in file with a pair of argument=value.

:param filepath: Path to the configuration file to be checked.
:type filepath: str
:param name: Argument name
:type name: str
:param value: Argument value
:type name: str
:param line_prefix: The starting part of the line with the list of arguments, default is empty
:type line_prefix: str
:param line_suffix: The ending part of the line with the list of arguments, default is empty
:type line_suffix: str

#}}
{{%- macro oval_argument_value_in_line(filepath, name, value, line_prefix='', line_suffix='') -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="2">
    {{{ oval_metadata("Ensure argument " + name + "=" + value + " is present"+ (" in the line starting with '" + line_prefix + "'" if line_prefix else "") + " in file(s) '" + filepath + "'") }}}
    <criteria operator="AND">
      {{{- oval_argument_value_in_line_criterion(filepath, name, value, application) }}}
    </criteria>
  </definition>
  {{{- oval_argument_value_in_line_test(filepath, name, value, line_prefix, line_suffix) }}}
</def-group>
{{%- endmacro -%}}

{{#
  High level macro to check if a particular combination of parameter and value in the ssh daemon configuration file is set.
  A case insensitive comparison is used in the prefix because sshd_config has case-insensitive parameters (but case-sensitive values).

:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration file doesn't exist in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_sshd_config(parameter='', value='', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/ssh/sshd_config", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]+', value=value, missing_parameter_pass=missing_parameter_pass, application="sshd", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail) }}}
{{%- endmacro %}}

{{#
  High level macro to check if a particular shell variable is set.

:param path: Path to the file.
:type path: str
:param parameter: The shell variable name.
:type parameter: str
:param value: The variable value WITHOUT QUOTES.
:type value: str
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type value: application
:param no_quotes: If set, the check will require that the RHS of the assignment is the literal value, without quotes. If no_quotes is false, then one level of single or double quotes won't be regarded as part of the value by the check.
:type no_quotes: bool
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration file doesn't exist in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_check_shell_file(path, parameter='', value='', application='', no_quotes=false, missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{% if no_quotes -%}}
  {{%- set quotes = "" -%}}
{{%- else -%}}
  {{%- set quotes = "\"'" -%}}
{{%- endif -%}}
{{% if "$" in value %}}
  {{% set value = '%s' % value.replace("$", "\\$") %}}
{{% endif %}}
{{{ oval_check_config_file(path, prefix_regex="^[ \\t]*", parameter=parameter, separator_regex='=', value=value, missing_parameter_pass=missing_parameter_pass, application=application, multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, quotes=quotes) }}}
{{%- endmacro %}}

{{#
  High level macro to check if a particular combination of parameter and value in the Audit daemon configuration file is set.

:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type missing_parameter_pass: bool
:param missing_config_file_fail: If set, the check will fail if the configuration file doesn't exist in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_auditd_config(parameter='', value='', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/audit/auditd.conf", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]*=[ \\t]*', value="(?i)"+value+"(?-i)", missing_parameter_pass=missing_parameter_pass, application="auditd", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail) }}}
{{%- endmacro %}}

{{#
  High level macro to set a parameter in /etc/systemd/coredump.conf.

:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration is not existent in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_coredump_config_set(parameter='', value='', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/systemd/coredump.conf", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]*=[ \\t]*', value="(?i)"+value+"(?-i)", missing_parameter_pass=missing_parameter_pass, application="systemd-coredump", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, section="Coredump") }}}
{{%- endmacro %}}

{{#
  High level macro to check if a particular combination of parameter and value in the grub configuration file is set.

:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type parameter: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param  missing_config_file_fail: If set, the check will fail if the configuration is not existent in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_grub_config(parameter='', value='', missing_parameter_pass=false, multi_value=true, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/default/grub", prefix_regex="^[ \\t]*", parameter=parameter, separator_regex='=', value=value, missing_parameter_pass=missing_parameter_pass, application="grub", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail) }}}
{{%- endmacro %}}

{{#
  To be removed macro. Prevents regression on sshd configuration rules.
#}}
{{%- macro application_not_required_or_requirement_unset() -%}}
      <criteria comment="sshd is not installed" operator="AND">
        <extend_definition comment="sshd is not required or requirement is unset"
        definition_ref="sshd_not_required_or_unset" />
        {{% if product in ['opensuse', 'sle12', 'sle15'] %}}
        <extend_definition comment="rpm package openssh removed"
        definition_ref="package_openssh_removed" />
        {{% else %}}
        <extend_definition comment="rpm package openssh-server removed"
        definition_ref="package_openssh-server_removed" />
        {{% endif %}}
      </criteria>
{{%- endmacro %}}
{{#
  To be removed macro. Prevents regression on sshd configuration rules.
#}}
{{%- macro application_required_or_requirement_unset() -%}}
      <criteria comment="sshd is installed and configured" operator="AND">
        <extend_definition comment="sshd is required or requirement is unset"
        definition_ref="sshd_required_or_unset" />
        {{% if product in ['opensuse', 'sle12', 'sle15'] %}}
        <extend_definition comment="rpm package openssh installed"
        definition_ref="package_openssh_installed" />
        {{% else %}}
        <extend_definition comment="rpm package openssh-server installed"
        definition_ref="package_openssh-server_installed" />
        {{% endif %}}
      {{# Note that a criteria was left open #}}
{{%- endmacro %}}

{{#
  High level macro which checks configuration in an INI file.

:param path: Path to the configuration file to be checked.
:type path: str
:param section: The parameter will be checked only within the given section defined by [section].
:type section: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration is not existent in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_check_ini_file(path='', section='', parameter='', value='', missing_parameter_pass=false, application='', multi_value=false, missing_config_file_fail=true) %}}
{{{ oval_check_config_file(path=path, prefix_regex="^\s*", parameter=parameter, value=value, separator_regex="[ \\t]*=[ \\t]*", missing_parameter_pass=missing_parameter_pass, application=application, multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, section=section) }}}
{{%- endmacro %}}

{{#
  Creates OVAL tests with given test_id which checks if package
  is not installed.

:param package: Name of the package to be removed
:type package: str
:param test_id: Suffix of the Ids in test, obj, and state elements
:type test_id: str
#}}
{{%- macro oval_test_package_removed(package='', test_id='') -%}}
{{% if pkg_system == "rpm" %}}
  <linux:rpminfo_test check="all" check_existence="none_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is removed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
  </linux:rpminfo_test>
  <linux:rpminfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:rpminfo_object>
{{% elif pkg_system == "dpkg" %}}
  <linux:dpkginfo_test check="all" check_existence="none_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is removed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
  </linux:dpkginfo_test>
  <linux:dpkginfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:dpkginfo_object>
{{% endif %}}
{{%- endmacro -%}}

{{#
  Creates OVAL tests with given test_id which checks if package
  is installed. Optionally, it can check if a package of a given version (EVR)
  or newer version is present.

:param package: Name of the package to be installed
:type package: str
:param evr: Optional, version or newer version to check
:type evr: str
:param test_id: Suffix of the Ids in test, obj, and state elements
:type test_id: str

#}}
{{%- macro oval_test_package_installed(package='', evr='', test_id='') -%}}
{{% if pkg_system == "rpm" %}}
  <linux:rpminfo_test check="all" check_existence="all_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is installed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
    {{% if evr %}}
      <linux:state state_ref="ste_{{{ test_id }}}" />
    {{% endif %}}
  </linux:rpminfo_test>
  <linux:rpminfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:rpminfo_object>
  {{% if evr %}}
    <linux:rpminfo_state id="ste_{{{ test_id }}}" version="1">
      <linux:evr datatype="evr_string" operation="greater than or equal">{{{ evr }}}</linux:evr>
    </linux:rpminfo_state>
  {{% endif %}}
{{% elif pkg_system == "dpkg" %}}
  <linux:dpkginfo_test check="all" check_existence="all_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is installed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
    {{% if evr %}}
      <linux:state state_ref="ste_{{{ test_id }}}" />
    {{% endif %}}
  </linux:dpkginfo_test>
  <linux:dpkginfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:dpkginfo_object>
  {{% if evr %}}
    <linux:dpkginfo_state id="ste_{{{ test_id }}}" version="1">
      <linux:evr datatype="evr_string" operation="greater than or equal">{{{ evr }}}</linux:evr>
    </linux:dpkginfo_state>
  {{% endif %}}
{{% endif %}}
{{%- endmacro -%}}

{{#
  Macro which generates OVAL test for OpenShift Container Platform
  runtime process configuration.

:param command: command that executes the OpenShift process
:type command: str
:param option: command line option of the command
:type option: str
:param value: value of the option
:type value: str
:param option_id: used to build the OVAL test ID. The OVAL test ID is test_ocp_runtime_<option_id>.
:type option_id: str

#}}
{{%- macro oval_ocp_service_runtime_config(command='', option='', value='', option_id='') -%}}
  <unix:process58_test check="all" comment="ocp process runtime parameter {{{ option }}} set to {{{ value }}}" id="test_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:object object_ref="object_ocp_runtime_{{{ option_id }}}" />
    <unix:state state_ref="state_ocp_runtime_{{{ option_id }}}" />
  </unix:process58_test>
  <unix:process58_object id="object_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:command_line operation="pattern match">^{{{ command }}}.*$</unix:command_line>
    <unix:pid datatype="int" operation="greater than">0</unix:pid>
  </unix:process58_object>
  <unix:process58_state id="state_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:command_line operation="pattern match">^.*[\s]+{{{ option }}}=.*({{{ value }}}).*([\s]+.*$|$)</unix:command_line>
  </unix:process58_state>
{{%- endmacro -%}}

{{#
  Macro which generates OVAL definition, test and object that check for contents
  of the file.

:param filepath: filepath of the file to check
:type filepath: str
:param filepath_id: Used like test_whole_file_contents_$filepath_id
:param contents: contents that should be in the file
:type contents: str

#}}
{{%- macro oval_file_contents(filepath='', filepath_id='', contents='') -%}}
  <def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
      {{{ oval_metadata("Inspect the contents of " + filepath) }}}
      <criteria>
          <criterion comment="Check contents of file" test_ref="{{{ rule_id }}}_test_whole_file_contents_{{{ filepath_id }}}" />
      </criteria>
    </definition>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
    comment="Tests if contents of {{{ filepath }}} is exactly what is defined in rule description"
    id="{{{ rule_id }}}_test_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:object object_ref="{{{ rule_id }}}_object_whole_file_contents_{{{ filepath_id }}}" />
      <ind:state state_ref="{{{ rule_id }}}_state_whole_file_contents_{{{ filepath_id }}}" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="{{{ rule_id }}}_object_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:behaviors singleline="true" multiline="false" />
      <ind:filepath>{{{ filepath }}}</ind:filepath>
      <ind:pattern operation="pattern match">^.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_state id="{{{ rule_id }}}_state_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:text operation="equals">{{{ contents }}}
</ind:text>
    </ind:textfilecontent54_state>

  </def-group>
{{%- endmacro %}}

{{#
  Macro which generates the OVAL metadata section

:param description: The text to place in the description section
:type description: str
:param title: Optional, the associated rule title is used by default
:type title: str
:param affected_platforms: Optional, list of unix platform strings (e.g. "Fedora") to put under the affected element. Uses the oval_affected macro by default under the hood.
:type affected_platforms: str

#}}
{{%- macro oval_metadata(description, title="", affected_platforms=None) -%}}
    <metadata>
{{%- if title %}}
        <title>{{{ title }}}</title>
{{%- else %}}
        <title>{{{ rule_title }}}</title>
{{%- endif -%}}
{{%- if affected_platforms %}}
            <affected family="unix">
{{%- for platform in affected_platforms %}}
                <platform>{{{ platform }}}</platform>
{{%- endfor %}}
            </affected>
{{%- else %}}
        {{{ oval_affected(products) | indent -}}}
{{%- endif %}}
        <description>{{{ description }}}{{{ caller() if caller else '' }}}</description>
    </metadata>
{{%- endmacro %}}

{{#
    Create a full OVAL check for dconf ini file.

:param path: Path to the file
:type path: str
:param prefix_regex: Defaults to ^\s*. What can prefix the parameter.
:type prefix_regex: str
:param parameter: What parameter to be set.
:type parameter: str
:param separator_regex: Defaults to [ \\t]*=[ \\t]*. What is the separator between the parameter and value.
:type separator_regex: str
:param value: What value to be set
:type value: str
:param application: What application this applies to
:type application: str
:param quotes:  If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.  For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
:type value: str
:param lock_path: Path to lock file
:type lock_path: str

#}}
{{%- macro oval_check_dconf_ini_file(path='', prefix_regex='^\s*', parameter='', separator_regex='[ \\t]*=[ \\t]*', value='', application='', section='', quotes='', lock_path='') -%}}
{{%- if application == '' -%}}
	{{%- set application = "The respective application or service" -%}}
{{%- endif -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Ensure '" + parameter + "' is configured with value '" + value | replace("(?i)", "") | replace("(?-i)", "") + (" in section '" + section if section else "") + "' in " + path) }}}
    <criteria comment="{{{ application }}} is configured correctly"
    operator="AND">
        {{{- oval_line_in_file_criterion(path, parameter) }}}
      <criterion comment="Prevent user from modifying {{{ parameter }}}"
      test_ref="test_prevent_user_{{{ parameter }}}" />
    </criteria>
  </definition>
  {{{ oval_line_in_file_test(path, parameter) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, false, false, filename_regex='^.*$') }}}
  {{{ oval_line_in_file_state(value, false, quotes) }}}

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Prevent user from modifying {{{ parameter }}}"
  id="test_prevent_user_{{{ parameter }}}" version="1">
    <ind:object object_ref="obj_prevent_user_{{{ parameter }}}" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_prevent_user_{{{ parameter }}}"
  version="1">
    <ind:path>{{{ lock_path }}}</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^/{{{ section }}}/{{{ parameter }}}$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
{{%- endmacro %}}

{{#
    Create a full OVAL check for an sshd parameter and value.

:param parameter: Parameter to check
:type parameter: str
:param value: Value to check
:type value: str
:param missing_parameter_pass: If true, the check will pass if the parameter missing.
:type missing_parameter_pass: bool
:param config_is_distributed: Is the param in /etc/sshd_config.d vs just /etc/ssh/sshd_config
:type config_is_distributed: bool

#}}
{{%- macro sshd_oval_check(parameter, value, missing_parameter_pass, config_is_distributed) -%}}
{{%- set sshd_config_path = "/etc/ssh/sshd_config" %}}
{{%- set sshd_config_dir = "/etc/ssh/sshd_config.d" -%}}
{{%- set description = "Ensure '" ~ parameter ~ "' is configured with value '" ~ value ~ "' in " ~ sshd_config_path %}}
{{%- if config_is_distributed == "true" %}}
{{%- set description = description  ~ " or in " ~ sshd_config_dir -%}}
{{%- endif %}}
{{%- set case_insensitivity_kwargs = dict(prefix_regex="^[ \\t]*(?i)", separator_regex = "(?-i)[ \\t]+") -%}}

<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
   {{{ oval_metadata(description) }}}
   <criteria comment="sshd is configured correctly or is not installed" operator="OR">
     <criteria comment="sshd is not installed" operator="AND">
        <extend_definition comment="sshd is not required or requirement is unset"
          definition_ref="sshd_not_required_or_unset" />
        <extend_definition comment="rpm package openssh-server removed"
          definition_ref="package_openssh-server_removed" />
     </criteria>
     <criteria comment="sshd is installed and configured" operator="AND">
        <extend_definition comment="sshd is required or requirement is unset"
          definition_ref="sshd_required_or_unset" />
        <extend_definition comment="rpm package openssh-server installed"
          definition_ref="package_openssh-server_installed" />
        <criteria comment="sshd is configured correctly" operator="OR">
          {{{- oval_line_in_file_criterion(sshd_config_path, parameter) | indent(8) }}}
          {{%- if missing_parameter_pass %}}
          <criteria comment="sshd is not configured incorrectly" operator="AND">
          {{{- oval_line_in_file_criterion(sshd_config_path, parameter, missing_parameter_pass) | indent(10)}}}
          {{%- if config_is_distributed == "true" %}}
          {{{- oval_line_in_directory_criterion(sshd_config_dir, parameter, missing_parameter_pass) | indent(10) }}}
          {{%- endif %}}
          </criteria>
          {{%- endif %}}
          {{%- if config_is_distributed == "true" %}}
          {{{- oval_line_in_directory_criterion(sshd_config_dir, parameter) | indent(8) }}}
          {{%- endif %}}
        </criteria>
      </criteria>
    </criteria>
  </definition>
  {{{ oval_line_in_file_test(sshd_config_path, parameter) | indent (2) }}}
  {{{ oval_line_in_file_object(sshd_config_path, parameter=parameter, ** case_insensitivity_kwargs)| indent (2) }}}
  {{{ oval_line_in_file_state(value) | indent (2) }}}

  {{%- if missing_parameter_pass %}}
  {{{ oval_line_in_file_test(sshd_config_path, parameter, missing_parameter_pass) | indent(2) }}}
  {{{ oval_line_in_file_object(sshd_config_path, parameter=parameter, missing_parameter_pass=missing_parameter_pass, ** case_insensitivity_kwargs) | indent(2) }}}
  {{%- endif %}}

  {{%- if config_is_distributed == "true" %}}
  {{{ oval_line_in_directory_test(sshd_config_dir, parameter) | indent (2) }}}
  {{{ oval_line_in_directory_object(sshd_config_dir, parameter=parameter, ** case_insensitivity_kwargs) | indent (2) }}}
  {{{ oval_line_in_directory_state(value) | indent (2) }}}

  {{%- if missing_parameter_pass %}}
  {{{ oval_line_in_directory_test(sshd_config_dir, parameter, missing_parameter_pass) | indent(2) }}}
  {{{ oval_line_in_directory_object(sshd_config_dir, parameter=parameter, missing_parameter_pass=missing_parameter_pass, ** case_insensitivity_kwargs) | indent(2) }}}
  {{%- endif %}}
  {{%- endif %}}
</def-group>
{{%- endmacro %}}

{{#
  User list in form of regex that are excluded when checking user home directory permissions and ownerships.
#}}
{{%- if product in ["rhel7", "ol7"] %}}
  {{%- set user_list="(nobody|nfsnobody)" %}}
{{%- else %}}
  {{%- set user_list="nobody" %}}
{{%- endif %}}


{{%- macro partition_exists_criterion(path) %}}
{{%- set escaped_path = path | escape_id %}}
      <criterion comment="The path {{{ path }}} is a partition's mount point" test_ref="test_partition_{{{ escaped_path  }}}_exists" />
{{%- endmacro %}}

{{%- macro partition_exists_test_object(path) %}}
{{%- set escaped_path = path | escape_id %}}
  <linux:partition_test check="all" check_existence="all_exist"
      comment="Partition {{{ path }}} exists"
      id="test_partition_{{{ escaped_path }}}_exists"
  version="1">
    <linux:object object_ref="object_partition_{{{ escaped_path }}}_exists" />
  </linux:partition_test>

  <linux:partition_object id="object_partition_{{{ escaped_path }}}_exists" version="1">
    <linux:mount_point>{{{ path }}}</linux:mount_point>
  </linux:partition_object>
{{%- endmacro %}}
