<def-group>
  <definition class="compliance" id="configure_crypto_policy" version="1">
    {{{ oval_metadata("Ensure crypto policy is correctly configured in /etc/crypto-policies/config, and the policy is current.", rule_title=rule_title) }}}
    <criteria operator="AND">
{{% if product == "sle15" %}}
      <criterion comment="package crypto-policies-scripts is installed"
      test_ref="test_package_crypto-policies-scripts_installed" />
{{% endif %}}
      <criterion comment="check for crypto policy correctly configured in /etc/crypto-policy/config"
      test_ref="test_configure_crypto_policy" />
      <criterion comment="check for crypto policy correctly configured in /etc/crypto-policy/state/current"
      test_ref="test_configure_crypto_policy_current" />
      <criterion comment="Check if update-crypto-policies has been run after config update" test_ref="test_crypto_policies_updated" />
      <criterion comment="Check if /etc/crypto-policies/back-ends/nss.config exists" test_ref="test_crypto_policy_nss_config" />
    </criteria>
  </definition>

{{% if product == "sle15" %}}
  {{{ oval_test_package_installed(package="crypto-policies-scripts", test_id="test_package_crypto-policies-scripts_installed") }}}
{{% endif %}}

  <unix:file_object id="crypto_policies_current_file" comment="crypto-policies current state" version="1">
    <unix:filepath>/etc/crypto-policies/state/current</unix:filepath>
  </unix:file_object>

  <unix:file_object id="crypto_policies_config_file" comment="crypto-policies config state" version="1">
    <unix:filepath datatype="string">/etc/crypto-policies/config</unix:filepath>
  </unix:file_object>

  <local_variable id="variable_crypto_policies_current_file_timestamp" version="1" comment="Age of /etc/crypto-policies/state/current" datatype="int">
    <object_component object_ref="crypto_policies_current_file" item_field="m_time"/>
  </local_variable>

  <local_variable id="variable_crypto_policies_config_file_timestamp" version="1" comment="Age of /etc/crypto-policies/config" datatype="int">
    <object_component object_ref="crypto_policies_config_file" item_field="m_time"/>
  </local_variable>

  <ind:variable_test check="all" check_existence="all_exist" id="test_crypto_policies_updated" version="1" comment="Check if update-crypto-policies has been run">
    <ind:object object_ref="object_crypto_policies_config_file_modified_time" />
    <ind:state state_ref="state_crypto_current_file_newer_than_config_file" />
  </ind:variable_test>

  <ind:variable_object comment="Crypto policy current file timestamp"
id="object_crypto_policies_config_file_modified_time" version="1">
     <ind:var_ref>variable_crypto_policies_config_file_timestamp</ind:var_ref>
   </ind:variable_object>

  <ind:variable_state id="state_crypto_current_file_newer_than_config_file" version="1">
    <ind:value datatype="int" operation="less than or equal" var_check="all"
    var_ref="variable_crypto_policies_current_file_timestamp" />
  </ind:variable_state>

  <ind:textfilecontent54_test id="test_configure_crypto_policy"
  comment="check for crypto policy correctly configured in /etc/crypto-policies/config"
  check="all" check_existence="only_one_exists" version="1">
    <ind:object object_ref="object_configure_crypto_policy" />
    <ind:state state_ref="state_configure_crypto_policy" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_configure_crypto_policy" version="1">
    <ind:filepath>/etc/crypto-policies/config</ind:filepath>
    <ind:pattern operation="pattern match">^(?!#)(\S+)$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_configure_crypto_policy" version="1">
    <ind:subexpression operation="equals" var_check="all"
    var_ref="var_system_crypto_policy" />
  </ind:textfilecontent54_state>

    <ind:textfilecontent54_test id="test_configure_crypto_policy_current"
  comment="check for crypto policy correctly configured in /etc/crypto-policies/state/current"
  check="all" check_existence="only_one_exists" version="1">
    <ind:object object_ref="object_configure_crypto_policy_current" />
    <ind:state state_ref="state_configure_crypto_policy_current" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_configure_crypto_policy_current" version="1">
    <ind:filepath>/etc/crypto-policies/state/current</ind:filepath>
    <ind:pattern operation="pattern match">^(?!#)(\S+)$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_configure_crypto_policy_current" version="1">
    <ind:subexpression operation="equals" var_check="all"
    var_ref="var_system_crypto_policy" />
  </ind:textfilecontent54_state>

  <unix:file_test check="all" check_existence="all_exist" comment="Check if /etc/crypto-policies/back-ends/nss.config exists" id="test_crypto_policy_nss_config" version="1">
    <unix:object object_ref="object_crypto_policy_nss_config" />
  </unix:file_test>
  <unix:file_object id="object_crypto_policy_nss_config" version="1">
    <unix:filepath>/etc/crypto-policies/back-ends/nss.config</unix:filepath>
  </unix:file_object>

  <external_variable comment="defined crypto policy" datatype="string" id="var_system_crypto_policy" version="1" />

</def-group>
