<def-group>
  <definition class="compliance" id="tftp_uses_secure_mode_systemd" version="1">
    {{{ oval_metadata("The TFTP daemon should use secure mode.", rule_title=rule_title) }}}
    <criteria comment="package tftp-server removed or tftp.service configured correctly" operator="OR">
      <!-- If tftp-server is not installed -->
      <extend_definition comment="rpm package tftp-server removed" definition_ref="package_tftp-server_removed"/>
      <!-- Otherwise validate drop-ins or original -->
      <criteria operator="OR" comment="Validate drop-ins if they exist, else validate original file">
        <!-- Case: drop-ins exist -->
        <criterion comment="Drop-in secure mode" test_ref="file_tftp_service_dropin_exists"/>
        <!-- Case: no drop-ins -->
        <criteria operator="AND" comment="No drop-ins, validate original file">
          <criterion comment="No drop-in files exist" test_ref="file_tftp_service_dropin_notexists"/>
          <criterion comment="Original secure mode" test_ref="test_tftp_uses_secure_mode_systemd_original"/>
        </criteria>

      </criteria>
    </criteria>
  </definition>

  <!-- Test if no drop-in exists -->
  <ind:textfilecontent54_test id="file_tftp_service_dropin_notexists" check="all" check_existence="none_exist" version="1"
    comment="No drop-in configuration files exist">
    <ind:object object_ref="object_tftp_service_dropin"/>
  </ind:textfilecontent54_test>

  <!-- Test if drop-in exists -->
  <ind:textfilecontent54_test id="file_tftp_service_dropin_exists" check="all" version="1"
    comment="drop-in configuration files exist">
    <ind:object object_ref="object_tftp_service_dropin"/>
    <ind:state state_ref="state_tftp_service_dropin_exists"/>
  </ind:textfilecontent54_test>

  <!-- Object to match drop-in files -->
  <ind:textfilecontent54_object id="object_tftp_service_dropin" version="1">
    <ind:path>/etc/systemd/system/tftp.service.d</ind:path>
    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^\s*ExecStart=\s*(?:.*\n)*?(\s*ExecStart=.+)$</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_tftp_service_dropin_exists" version="1">
    <ind:subexpression datatype="string" operation="pattern match">\s*ExecStart\s*=\s*\S+\s+-s\s+\S+.*</ind:subexpression>
  </ind:textfilecontent54_state>

  <!-- Validate content of original unit file -->
  <ind:textfilecontent54_test id="test_tftp_uses_secure_mode_systemd_original" check="all" version="1"
    comment="Ensure original unit ExecStart uses secure mode">
    <ind:object object_ref="object_tftp_uses_secure_mode_systemd_original"/>
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_tftp_uses_secure_mode_systemd_original" version="1">
    <ind:filepath>/usr/lib/systemd/system/tftp.service</ind:filepath>
    <ind:pattern operation="pattern match">^\s*ExecStart\s*=\s*/\S+\s+-s\s+(/\S+).*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
