{{%- set parameter = "RekeyLimit" %}}
{{%- set sshd_config_path = "/etc/ssh/sshd_config" %}}
{{%- set sshd_config_dir = "/etc/ssh/sshd_config.d" -%}}
{{%- set description = "Ensure " ~ parameter ~ " is configured with the appropriate value in " ~ sshd_config_path %}}
{{%- if sshd_distributed_config == "true" %}}
{{%- set description = description  ~ " or in " ~ sshd_config_dir -%}}
{{%- endif %}}

<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
  {{{ oval_metadata(description, rule_title=rule_title) }}}
  <criteria comment="sshd is configured correctly or is not installed" operator="OR">
    {{{- application_not_required_or_requirement_unset() }}}
    {{{- application_required_or_requirement_unset() }}}
      <criteria comment="sshd is configured correctly" operator="OR">
        {{%- if sshd_distributed_config == "true" %}}
        {{{- oval_line_in_directory_criterion(sshd_config_dir, parameter, rule_id=rule_id) | indent(8) }}}
        <!-- Configuration in directory has precedence -->
        <criteria comment="sshd is configured correctly in main file">
          {{{- oval_line_in_file_criterion(sshd_config_path, parameter, rule_id=rule_id) }}}
          <criterion test_ref="test_sshd_rekey_limit_config_dir_absent"
            comment="{{{ parameter }}} is not defined in the directory" />
        </criteria>
        {{%- else %}}
        {{{- oval_line_in_file_criterion(sshd_config_path, parameter, rule_id=rule_id) }}}
        {{%- endif %}}
      </criteria>
    </criteria><!-- macro application_required_or_requirement_unset() leaves an open criteria element-->
  </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of {{{ parameter }}} setting in the file" id="test_sshd_rekey_limit" version="1">
     <ind:object object_ref="obj_sshd_rekey_limit"/>
     <ind:state state_ref="state_sshd_rekey_limit"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_sshd_rekey_limit" version="1">
     <ind:filepath>{{{ sshd_config_path }}}</ind:filepath>
     <ind:pattern operation="pattern match">^[\s]*{{{ parameter }}}[\s]+(.*)$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  {{%- if sshd_distributed_config == "true" %}}
  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of {{{ parameter }}} setting in SSHD config directory" id="test_sshd_rekey_limit_config_dir" version="1">
     <ind:object object_ref="obj_sshd_rekey_limit_config_dir"/>
     <ind:state state_ref="state_sshd_rekey_limit"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1"
      comment="tests that {{{ parameter }}} is not set in SSHD config directory"
      id="test_sshd_rekey_limit_config_dir_absent">
     <ind:object object_ref="obj_sshd_rekey_limit_config_dir"/>
  </ind:textfilecontent54_test>


  <ind:textfilecontent54_object id="obj_sshd_rekey_limit_config_dir" version="1">
     <ind:path>{{{ sshd_config_dir}}}</ind:path>
     <ind:filename operation="pattern match">.*\.conf$</ind:filename>
     <ind:pattern operation="pattern match">^[\s]*{{{ parameter }}}[\s]+(.*)$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>
  {{%- endif %}}

  <ind:textfilecontent54_state id="state_sshd_rekey_limit" version="1">
     <ind:subexpression operation="pattern match" var_ref="sshd_line_regex" />
  </ind:textfilecontent54_state>

  <local_variable id="sshd_line_regex" datatype="string" comment="The regex of the directive" version="1">
    <concat>
      <literal_component>^</literal_component>
      <variable_component var_ref="var_rekey_limit_size"/>
      <literal_component>[\s]+</literal_component>
      <variable_component var_ref="var_rekey_limit_time"/>
      <literal_component>[\s]*$</literal_component>
    </concat>
  </local_variable>

  <external_variable comment="Size component of the rekey limit" datatype="string" id="var_rekey_limit_size" version="1" />
  <external_variable comment="Time component of the rekey limit" datatype="string" id="var_rekey_limit_time" version="1" />
</def-group>