{{%- set PATH = "/etc/crypto-policies/back-ends/openssh.config" -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Limit the Ciphers to those which are FIPS-approved.") }}}
    <criteria operator="AND" comment="Test conditions - presence of the file plus.">
      <criterion comment="Check that {{{ PATH }}} contains FIPS-approved SSHD Ciphers" test_ref="test_{{{ rule_id }}}" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all"
  comment="test the value of Ciphers setting in the {{{ PATH }}} file"
  id="test_{{{ rule_id }}}" version="1">
    <ind:object object_ref="obj_{{{ rule_id }}}" />
    <ind:state state_ref="ste_{{{ rule_id }}}" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
    <ind:filepath>{{{ PATH }}}</ind:filepath>
    <ind:pattern operation="pattern match">^Ciphers.*$</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="ste_{{{ rule_id }}}" version="1">
    <ind:text var_ref="sshd_ciphers_crypto" operation="equals"></ind:text>
  </ind:textfilecontent54_state>

  <local_variable id="sshd_ciphers_crypto" datatype="string" comment="The regex of the directive" version="1">
    <concat>
      <literal_component>Ciphers </literal_component>
      <variable_component var_ref="sshd_approved_ciphers"/>
    </concat>
  </local_variable>

  <external_variable comment="SSH Approved Ciphers by FIPS" datatype="string" id="sshd_approved_ciphers" version="1" />
</def-group>
