path: root/pym/kernelcheck/kernelcheck.py

#!/usr/bin/env python
# kernel-check -- Kernel security information
# Copyright 2009-2009 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2

from portage.output import blue, bold, colorize, EOutput, darkgreen #FIXME
#from _emerge.stdout_spinner import stdout_spinner #TODO
from _emerge.userquery import userquery

import getopt
import portage
import sys
import textwrap
import os

import lib.kernellib as lib

info = EOutput().einfo #FIXME
warn = EOutput().ewarn
error = EOutput().eerror
spin = stdout_spinner()
term = portage.output.get_term_size()

def main(argv):
    'Main function'

    try:
        opts, args = getopt.getopt(argv, 'dhnr:s:v',
        ['debug', 'help', 'nocolor', 'report=', 'show=', 'verbose'])
    except getopt.GetoptError:
        usage()
        return

    for opt, arg in opts:
        if opt in ('-d', '--debug'):
            lib.DEBUG = True
        elif opt in ('-h', '--help'):
            usage()
            return
        elif opt in ('-n', '--nocolor'):
            portage.output.nocolor()
        elif opt in ('-r', '--report'):
            error('--report not yet implemented')
            return
        elif opt in ('-s', '--show'):
            print_bug(arg)
            return
        elif opt in ('-v', '--verbose'):
            lib.VERBOSE = True

    information = dict()
    configuration = dict()

    print ''
    print darkgreen('These are the specifications of your kernel:')
    print ''

    uname = os.uname()
    if uname[0] != 'Linux':
        error('This tool currently only works for Linux kernels.')
        error('Apparantly you are using "%s".' % uname[0]) #TODO
        return

    kernel = lib.extract_version(uname[2])
    if kernel is None:
        error('No kernel information found!')
        return

    information['Kernel source'] = kernel.source
    information['Kernel version'] = '%s-%s' % (kernel.version, kernel.revision)

    kernel.genpatch = lib.get_genpatch(lib.PORTDIR, kernel)

    if kernel.genpatch is not None: #FIXME
        information['Kernel patches'] = '%s %s (%s)' % ('genpatch',
                                         kernel.genpatch.version,
                                         repr(kernel.genpatch))

    elif kernel.source == 'gentoo':
        warn('No genpatch information found!') #FIXME

    arch = portage.settings['ARCH']
    if arch:
        information['Architecture'] =  arch
    else:
        error('No architecture found!') #FIXME
        return

    info(bold('Information:'))
    print_items(information)

    min_addr = str() #TODO move to kernellib
    try:
        min_addr = open('/proc/sys/vm/mmap_min_addr').read().strip()
    except:
        min_addr = '?'

    configuration['Mmap_min_addr'] = min_addr

    modules = str() #TODO move to kernellib
    try:
        for line in open('/proc/modules').readlines():
            modules += '%s ' % line.split(' ')[0]
    except:
        modules = '?'

    configuration['Loaded modules'] = modules

    print ''
    info(bold('Configuration:'))
    print_items(configuration)

    print '\nDetermining vulnerabilities... done!' #TODO #spin
    print ''

    kernel_eval = lib.eval_cve_files(lib.DIR['out'], kernel, arch, None)
    if not kernel_eval:
        error('No kernel vulnerability files found!')
        return

    print_summary(kernel_eval.affected)

    low = int()     #TODO move to kernellib
    medium = int()
    high = int()
    cvss_score = float()
    cve_amount = int()

    for item in kernel_eval.affected:
        for cve in item.cves:
            if cve.severity == 'Low':
                low += 1
            if cve.severity == 'Medium':
                medium += 1
            if cve.severity == 'High':
                high += 1
        if len(kernel_eval.affected) is not 0:
            for cve in item.cves:
                cve_amount += 1
                cvss_score += float(cve.score)

    cvss_score = cvss_score / cve_amount

    severity_eval = str()

    if high is not 0:
        severity_eval += '%s high' % high
    if medium is not 0:
        if high is not 0:
            severity_eval += ', '
        severity_eval += '%s medium' % medium
    if low is not 0:
        if high is not 0 or medium is not 0:
            severity_eval += ', '
        severity_eval += '%s low' % low

    print 'Total: %s vulnerabilities (%s), Average CVSS score: %.1f'  % (
          len(kernel_eval.affected), severity_eval, cvss_score)

    print ''

    prompt = "Would you like to upgrade your kernel?"
    if userquery(prompt, None) == 'No':
        print''
        print'Quitting.'
        print ''

    else:
        print 'Not implemented yet ;)'

def print_items(category):
    'Indents and prints items'

    for item in category.keys():
        for i, string in enumerate(textwrap.wrap('%s' % category[item],
                                             (term[1] - 23))):
            if i is 0:
                print '      %s%s : %s' % (darkgreen(item),
                                           ' ' * (14 - len(item)), string)
            else:
                print '%s%s' % (' ' * 23, string)


def print_summary(vullist):
    'Prints the vulnerability summary'

    for item in vullist:

        whiteboard = str()
        for interval in item.affected:
            whiteboard += '[' + str(interval) + '] '

        if item.cves:

            for cve in item.cves:
                severity = 'BAD'
                if cve.severity == 'Low':
                   severity = 'GOOD'
                elif cve.severity == 'Medium':
                    severity = 'WARN'

                cve_text = str()
                cve_area = str()

                if 'AV:L' in cve.vector:
                    cve_area += colorize('WARN', 'local')

                if 'AV:A' in cve.vector or 'AV:N' in cve.vector:
                    cve_area += colorize('BAD', 'network')

                if 'C:P' in cve.vector or 'C:C' in cve.vector:
                    cve_text += ' -confidentiality'

                if 'I:P' in cve.vector or 'I:C' in cve.vector:
                    cve_text += ' -integrity'

                if 'A:P' in cve.vector or 'A:C' in cve.vector:
                    cve_text += ' -availability'

                if ('C:P' in cve.vector or 'C:C' in cve.vector)               \
                and ('I:P' in cve.vector or 'I:C' in cve.vector)              \
                and ('A:P' in cve.vector or 'A:C' in cve.vector):
                    cve_text = ' -complete'

                first_text = textwrap.wrap(cve.desc, term[1] - 44)[0]
                print '[%s %26s] %s CVSS="%s %s%s"' % (darkgreen('bugid'),
                      colorize('GOOD', item.bugid), darkgreen(cve.cve),
                      colorize(severity, cve.score), cve_area, blue(cve_text))

    print ''


def print_bug(bugid):
    'Prints information about a particular bugid'

    if 'cve' in bugid.lower():
        print_cve(bugid.upper())
        return

    whiteboard = str()
    cves = str()
    vul = lib.read_cve_file(lib.DIR['out'], bugid)

    if vul is None:
        error('Could not find bugid: %s' % bugid)
        return

    for i, interval in enumerate(vul.affected):
        if i is not 0:
            whiteboard += ' ' * 14
        whiteboard +=  '[' + str(interval) + ']\n'

    info('Bugid    : %s - %s'  % (vul.bugid, vul.status.capitalize()))
    info('Reported : %s - %s' % (vul.reporter, vul.reported[:-5]))
    info('Affected : %s' % whiteboard[:-1])
    #TODO arch = str()

    for cve in vul.cves:
        print ''
        print_cve(cve.cve)


def print_cve(cveid):
    'Prints information about a cve'

    cve = lib.Cve('cveid')

    vul = lib.find_cve(cveid, lib.DIR['out'])
    if vul is None:
        error('Could not find cve: %s' % cveid)
        return
    else:
        for item in vul.cves:
            if item.cve == cveid:
                cve = item

    info('Cve      : %s - %s - Bugid %s' % (cve.cve, cve.published, vul.bugid))
    info('Severity : %s %s - %s' % (cve.severity, cve.score, cve.vector))
    #TODO print cve.refs

    for i, string in enumerate(textwrap.wrap('"%s"' % cve.desc ,
                                             (term[1] - 15))):
        if i is 0:
            info('Desc     : %s' % string)
        else:
            print ' ' * 15 + string

    return


def print_beta():
    'Prints a beta warning message'

    print('')
    error('%s You are using an early version of kernel-check.' %
          colorize('BAD', 'IMPORTANT'))
    error('Please note that this tool might not operate as expected.')


def print_information():
    'Prints an information message'

    info('To print more information about a vulnerability try:')
    info('   $ %s -s [bugid|cve]' % sys.argv[0])


def usage():
    'Prints the usage screen'

    print 'Usage: %s [OPTION]...' % sys.argv[0][:-3]
    print 'Kernel security information %s\r\n' % lib.VERSION
    print '  -d, --debug             display debugging information'
    print '  -h, --help              display help information'
    print '  -n, --nocolor           disable colors'
    print '  -r, --report [file]     create a security report'
    print '  -s, --show [bugid|cve]  display information about a bug or cve'
    print '  -v, --verbose           display additional information'


if __name__ == '__main__':
    main(sys.argv[1:])