path: root/pym/kernelcheck/kernelcheck.py

#!/usr/bin/env python
# kernel-check -- Kernel security information
# Copyright 2009-2009 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2

from portage.output import bold, colorize, darkgreen, green, teal, blue#TODO
from _emerge.stdout_spinner import stdout_spinner
from _emerge.userquery import userquery

import getopt
import portage
import sys
import textwrap
import os

import lib.kernellib as lib

info = portage.output.EOutput().einfo
warn = portage.output.EOutput().ewarn
error = portage.output.EOutput().eerror
color = portage.output.colorize
spin = stdout_spinner()
term = portage.output.get_term_size()

def main(argv):
    'Main function'

    try:
        opts, args = getopt.getopt(argv, 'dhnr:s:v',
        ['debug', 'help', 'nocolor', 'report=', 'show=', 'verbose'])
    except getopt.GetoptError:
        usage()
        return

    for opt, arg in opts:
        if opt in ('-d', '--debug'):
            lib.DEBUG = True
        elif opt in ('-h', '--help'):
            usage()
            return
        elif opt in ('-n', '--nocolor'):
            portage.output.nocolor()
        elif opt in ('-r', '--report'):
            error('--report not yet implemented')
            return
        elif opt in ('-s', '--show'):
            print_bug(arg)
            return
        elif opt in ('-v', '--verbose'):
            lib.VERBOSE = True

    """
    These are the packages that would be merged, in order:

    Calculating dependencies... done!

    Total: 0 packages, Size of downloads: 0 kB

    Nothing to merge; would you like to auto-clean packages? [Yes/No] n
    """
    print ''
    print darkgreen('These are the specifications of your kernel:')
    print ''

    uname = os.uname()
    if uname[0] != 'Linux':
        error('This tool currently only works for Linux kernels.')
        error('Apparantly you are using "%s".' % uname[0])
        return

    info(bold('Information:'))
    
    kernel = lib.extract_version(uname[2])
    if kernel is None:
        error('No kernel information found!')
        return
    kernel.version = '2.6.30'
    
    print '      %s : %s' % (darkgreen('kernel source '), kernel.source)
    print '      %s : %s - %s' % (darkgreen('kernel version'), kernel.version,
                                  kernel.revision)

    kernel.genpatch = lib.get_genpatch(lib.PORTDIR, kernel)

    if kernel.genpatch is not None:# TODO
    
        print '      %s : %s' % (darkgreen('kernel patches'), 
                                 '%s %s (%s)' % ('genpatch',
                                 kernel.genpatch.version,
                                 repr(kernel.genpatch)))
    elif kernel.source == 'gentoo':
        warn('No genpatch information found!') 

    arch = portage.settings['ARCH']
    if arch:
        print '      %s : %s' % (darkgreen('architecture  '), arch)
    else:
        error('No architecture found!')
        return
    
    minaddr = str()
    try:
        minaddr = open('/proc/sys/vm/mmap_min_addr').read().strip()
    except:
        minaddr = '?'
        
    modules = str()
    try:
        for line in open('/proc/modules').readlines():
            modules += '%s ' % line.split(' ')[0]
    except:
        modules = '?'
    
    print ''
    info(bold('Configuration:'))
    print '      %s : %s' % (darkgreen('mmap_min_addr '), minaddr) 
    print '      %s : %s' % (darkgreen('loaded modules'), modules)
    
    print '\nDetermining vulnerabilities... done!' #TODO #spin
    print ''

    """
    supported = list()
    for item in lib.SUPPORTED:
        best = (lib.all_version(item))
        if best and best is not None:
            for i in best:
                if item == 'gentoo':
                    i.genpatch = lib.get_genpatch(lib.read_genpatch_file(
                                                  lib.DIR['out']), i)
                supported.append(i)
    """

    kernel_eval = lib.eval_cve_files(lib.DIR['out'], kernel, arch, None)
    if not kernel_eval:
        error('No kernel vulnerability files found!')
        return

    print_summary(kernel_eval.affected)


    #TODO move to kernellib
    low = int()
    medium = int()
    high = int()
    cvss_score = float()
    cve_amount = int()

    for item in kernel_eval.affected:
        for cve in item.cves:
            if cve.severity == 'Low':
                low += 1
            if cve.severity == 'Medium':
                medium += 1
            if cve.severity == 'High':
                high += 1
        if len(kernel_eval.affected) is not 0:
            for cve in item.cves:
                cve_amount += 1
                cvss_score += float(cve.score)

    cvss_score = cvss_score / cve_amount

    severity_eval = str()

    if high is not 0:
        severity_eval += '%s high' % high
    if medium is not 0:
        if high is not 0:
            severity_eval += ', '
        severity_eval += '%s medium' % medium
    if low is not 0:
        if high is not 0 or medium is not 0:
            severity_eval += ', '
        severity_eval += '%s low' % low

    print 'Total: %s vulnerabilities (%s), Average CVSS score: %.1f'   \
          % (len(kernel_eval.affected), severity_eval, cvss_score)

    print ''

    prompt = "Would you like to upgrade your kernel?"
    if userquery(prompt, None) == 'No':
        print''
        print'Quitting.'
        print ''
        return

    else:
        print 'Not implemented yet ;)'

    #print bold('Would you like to upgrade to the latest version? [%s/%s]' % (
          #color('GOOD', 'Yes'), color('BAD','No'))) #TODO read

    print ''

    """
    info('%s vulnerabilities read.' %
         color('GOOD', str(kernel_eval.read)))
    info('%s apply to this architecture.' %
         color('GOOD', str(kernel_eval.arch)))
    info('%s do not affect this kernel.' %
         color('GOOD', str(len(kernel_eval.unaffected))))

    if (len(kernel_eval.affected) is 0):
        info('Your kernel is not affected by any known vulnerabilites!')
        return


    error('%s affect this kernel: ' %
        color('BAD', str(len(kernel_eval.affected))))

    info('You have the following choices: ')
    print ''

    info('[1] Recommended')
    info('Keep your current kernel: %s' % color('BRACKET',
         'sys-kernel/%s-sources-%s-%s' % (
         kernel.source, kernel.version, kernel.revision)))
    print ''

    choice = 1
    for item in supported:
        supported_eval = lib.eval_cve_files(lib.DIR['out'], item, arch)

        if not supported_eval or kernel == item:
            continue

        else:
            comparison = lib.compare_evaluation(kernel_eval, supported_eval)

            if comparison is not None:
                choice += 1;
                score = 0
                for fix in comparison.fixed:
                    for cve in fix.cves:
                        score += float(cve.score)

                for new in comparison.new:
                    for cve in new.cves:
                        score -= float(cve.score)

                info('[%s] Recommended: (Score %s)' % (str(choice), score))
                info('Upgrade to this kernel: %s' % color('BRACKET',
                     'sys-kernel/%s-sources-%s-%s' % (
                     item.source, item.version, item.revision)))
                info('which fixes %s of %s vulnerabilities and introduces %s' \
                     ' new' % (color('GOOD', str(len(comparison.fixed))),
                      color('BAD', str(len(kernel_eval.affected))),
                      color('BAD', str(len(comparison.new)))))
                print ''


    print_information()
    print_beta()

    """


def print_summary(vullist):
    'Prints the vulnerability summary'

    for item in vullist:

        whiteboard = str()
        for interval in item.affected:
            whiteboard += '[' + str(interval) + '] '

        if item.cves:

            for cve in item.cves:
                severity = 'BAD'
                if cve.severity == 'Low':
                   severity = 'GOOD'
                elif cve.severity == 'Medium':
                    severity = 'WARN'
                
                cve_text = str()
                cve_area = str()
                
                if 'AV:L' in cve.vector or 'AV:A' in cve.vector:
                    cve_area += color('WARN', 'local')
                else:
                    cve_area += color('BAD', 'network')

                #no access
                #no authentification
                
                if 'C:P' in cve.vector or 'C:C' in cve.vector:
                    cve_text += ' -confidentiality'
                    
                if 'I:P' in cve.vector or 'I:C' in cve.vector:
                    cve_text += ' -integrity'
                    
                if 'A:P' in cve.vector or 'A:C' in cve.vector:
                    cve_text += ' -availability'
                    
                if ('C:P' in cve.vector or 'C:C' in cve.vector)               \
                and ('I:P' in cve.vector or 'I:C' in cve.vector)              \
                and ('A:P' in cve.vector or 'A:C' in cve.vector):
                    cve_text = ' -security'
                
                first_text = textwrap.wrap(cve.desc, term[1] - 44)[0]
                print '[%s %26s] %s CVSS="%s %s%s"' % (darkgreen('bugid'),
                      color('GOOD', item.bugid),
                      darkgreen(cve.cve),
                      color(severity, cve.score),
                      cve_area,
                      blue(cve_text)
                      #(AV:L/AC:L/Au:N/C:N/I:N/A:P)
                      #teal('%s...' % first_text)
                      )

    print ''


def print_bug(bugid):
    'Prints information about a particular bugid'

    if 'cve' in bugid.lower():
        print_cve(bugid.upper())
        return

    whiteboard = str()
    cves = str()
    vul = lib.read_cve_file(lib.DIR['out'], bugid)

    if vul is None:
        error('Could not find bugid: %s' % bugid)
        return

    for i, interval in enumerate(vul.affected):
        if i is not 0:
            whiteboard += ' ' * 14
        whiteboard +=  '[' + str(interval) + ']\n'

    info('Bugid    : %s - %s'  % (vul.bugid, vul.status.capitalize()))
    info('Reported : %s - %s' % (vul.reporter, vul.reported[:-5]))
    info('Affected : %s' % whiteboard[:-1])
    #TODO arch = str()

    for cve in vul.cves:
        print ''
        print_cve(cve.cve)


def print_cve(cveid):
    'Prints information about a cve'

    cve = lib.Cve('cveid')

    vul = lib.find_cve(cveid, lib.DIR['out'])
    if vul is None:
        error('Could not find cve: %s' % cveid)
        return
    else:
        for item in vul.cves:
            if item.cve == cveid:
                cve = item

    info('Cve      : %s - %s - Bugid %s' % (cve.cve, cve.published, vul.bugid))
    info('Severity : %s %s - %s' % (cve.severity, cve.score, cve.vector))
    #TODO print cve.refs

    for i, string in enumerate(textwrap.wrap('"%s"' % cve.desc ,
                                             (term[1] - 15))):
        if i is 0:
            info('Desc     : %s' % string)
        else:
            print ' ' * 15 + string

    return


def print_beta():
    'Prints a beta warning message'

    print('')
    error('%s You are using an early version of kernel-check.' %
          color('BAD', 'IMPORTANT'))
    error('Please note that this tool might not operate as expected.')


def print_information():
    'Prints an information message'

    info('To print more information about a vulnerability try:')
    info('   $ %s -s [bugid|cve]' % sys.argv[0])


def usage():
    'Prints the usage screen'

    print 'Usage: %s [OPTION]...' % sys.argv[0][:-3]
    print 'Kernel security information %s\r\n' % lib.VERSION
    print '  -d, --debug             display debugging information'
    print '  -h, --help              display help information'
    print '  -n, --nocolor           disable colors'
    print '  -r, --report [file]     create a security report'
    print '  -s, --show [bugid|cve]  display information about a bug or cve'
    print '  -v, --verbose           display additional information'


if __name__ == '__main__':
    main(sys.argv[1:])