{{%- set PATH = "/etc/crypto-policies/back-ends/opensshserver.config" -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Limit the Ciphers to those which are FIPS-approved.", rule_title=rule_title) }}}
    <criteria operator="AND" comment="Test conditions - presence of the file plus.">
      <criterion comment="Check that {{{ PATH }}} contains FIPS-approved SSHD Ciphers" test_ref="test_{{{ rule_id }}}" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all"
  comment="test the value of Ciphers setting in the {{{ PATH }}} file"
  id="test_{{{ rule_id }}}" version="1">
    <ind:object object_ref="obj_{{{ rule_id }}}" />
    <ind:state state_ref="ste_{{{ rule_id }}}" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
    <ind:filepath>{{{ PATH }}}</ind:filepath>
    {{%- if product in ["ol8", "rhel8"] -%}}
    <ind:pattern operation="pattern match">^(?!#).*-oCiphers=([^\s']+).*$</ind:pattern>
    {{%- else -%}}
    <ind:pattern operation="pattern match">^(?!#).*Ciphers\s+([^\s']+).*$</ind:pattern>
    {{%- endif -%}}
    <ind:instance operation="greater than or equal" datatype="int">-1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="ste_{{{ rule_id }}}" version="1">
    <ind:subexpression var_ref="sshd_approved_ciphers" operation="equals" />
  </ind:textfilecontent54_state>

  <external_variable comment="SSH Approved Ciphers by FIPS" datatype="string" id="sshd_approved_ciphers" version="1" />
</def-group>
