<def-group>
  <definition class="compliance" id="rsyslog_remote_tls" version="1">
    {{{ oval_metadata("Check that all needed TLS-related options are present", rule_title=rule_title) }}}
    <criteria comment="Check that rsyslog is configured to use TLS for remote logging" operator="AND">
      <criterion comment="Check that all needed TLS-related options are present" test_ref="test_rsyslog_remote_tls" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_rsyslog_remote_tls"
    comment="tests the omfwd action configuration"
    check_existence="at_least_one_exists" check="all" version="1">
    <ind:object object_ref="obj_rsyslog_remote_tls" />
    <ind:state state_ref="state_rsyslog_remote_tls" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_rsyslog_remote_tls" version="1">
    <ind:behaviors singleline="true" />
    <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
    <ind:pattern operation="pattern match">^\s*action\((?i)type(?-i)="omfwd"(.+?)\)</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_rsyslog_remote_tls" comment="value of omfwd action" version="1">
    <ind:subexpression datatype="string" operation="pattern match">(?=[\S\s]*\s(?i)protocol(?-i)="tcp")(?=[\S\s]*\s(?i)Target(?-i)="[^"]+?")(?=[\S\s]*\s(?i)port(?-i)="6514")(?=[\S\s]*\s(?i)StreamDriver(?-i)="gtls")(?=[\S\s]*\s(?i)StreamDriverMode(?-i)="1")(?=[\S\s]*\s(?i)StreamDriverAuthMode(?-i)="x509/name")(?=[\S\s]*\s(?i)StreamDriver\.CheckExtendedKeyPurpose(?-i)="on")</ind:subexpression>
  </ind:textfilecontent54_state>
</def-group>
