#!/bin/bash
# Copyright Atomicorp 2022
# All Rights reserved

VERSION=0.3



###########################
# Logging
###########################
LOG_FILE="/var/ossec/logs/atomicorp-api.log"



###########################
#functions
###########################
function log_event () {
        MSG=$1
        echo "`date "+%b %d %H:%M:%S"` `hostname` atomicorp-api: ${MSG}" >> ${LOG_FILE}
}

function detect_dist () {
	#log_event "detect_dist: start"
	if [ -f /etc/redhat-release ]; then
		RELEASE=/etc/redhat-release
	elif [ -f /etc/os-release ]; then
		RELEASE=/etc/os-release
	elif [ -f /etc/openvz-release ]; then
		RELEASE=/etc/openvz-release
	elif [ -f /etc/SuSE-release ]; then
		RELEASE=/etc/SuSE-release
	elif [ -f /etc/os-release ]; then
		RELEASE=/etc/os-release
	elif [ -f /etc/lsb-release ]; then
		RELEASE=/etc/lsb-release
	elif [ -f /etc/debian_version ]; then
		RELEASE=/etc/debian_version
	elif [ -f /etc/openvz-release ]; then
		RELEASE=/etc/openvz-release
	elif [ -f /etc/virtuozzo-release ]; then
		RELEASE=/etc/virtuozzo-release
	elif [[ $OSTYPE == "aix"* ]]; then
		PKG=aix
	else
		echo "Error: unable to identify operating system"
		exit 1
	fi

	if [[ $OSTYPE == "aix"* ]]; then
		PKG=aix
	elif egrep -q "(release 5)" $RELEASE ; then
		DIST="el5"
		DIR=centos/5
		PKG=rpm
	elif egrep -q "(release 6|release 2012)" $RELEASE ; then
		DIST="el6"
		DIR=centos/6
		PKG=rpm
	elif egrep -q "(release 7|release 2014)" $RELEASE ; then
		DIST="el7"
		DIR=centos/7
		PKG=rpm
	elif egrep -q "(release 8)" $RELEASE ; then
		DIST="el8"
		DIR=centos/8
		PKG=rpm
	elif egrep -q "Red Hat Enterprise Linux.* 7" $RELEASE ; then
		DIST="el7"
		DIR=redhat/7
		PKG=rpm
	elif egrep -q "Red Hat Enterprise Linux.* 8" $RELEASE ; then
		DIST="el8"
		DIR=redhat/8
		PKG=rpm
	elif egrep -q "(Amazon Linux 2)" $RELEASE; then
		DIST="amazon"
		DIR=amazon/2
		PKG=rpm
	elif egrep -q "(Amazon Linux AMI|Amazon)" $RELEASE ; then
		DIST="el6"
		DIR=centos/6
		PKG=rpm
	elif egrep -q "wheezy" $RELEASE ; then
		DIST="debian"
		DIR="wheezy"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "jessie" $RELEASE ; then
		DIST="debian"
		DIR="jessie"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "stretch" $RELEASE ; then
		DIST="debian"
		DIR="stretch"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "lucid" $RELEASE ; then
		DIST="debian"
		DIR="lucid"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "precise" $RELEASE ; then
		DIST="debian"
		DIR="precise"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "Raring Ringtail" $RELEASE ; then
		DIST="debian"
		DIR="raring"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "Trusty Tahr" $RELEASE ; then
		DIST="ubuntu"
		DIR="trusty"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "Xenial" $RELEASE ; then
		DIST="ubuntu"
		DIR="xenial"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "Bionic" $RELEASE ; then
		DIST="ubuntu"
		DIR="bionic"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "Focal Fossa" $RELEASE; then
		DIST="ubuntu"
		DIR="focal"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "buster" $RELEASE ; then
		DIST="debian"
		DIR="buster"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "bullseye" $RELEASE ; then
		DIST="debian"
		DIR="bullseye"
		PKG=deb
		ARCH=$(dpkg --print-architecture)
	elif egrep -q "openSUSE Leap" $RELEASE; then
		DIST="suse15"
		DIR="opensuse/15.1"
		PKG=zypper

	else
		echo "Error: Unable to determine distribution type. Please send the contents of $RELEASE to support@atomicorp.com"
		exit 1
	fi

	#log_event "detect_dist: DIST:($DIST) DIR:($DIR) PKG:($PKG)"


}

function install_package () {
	log_event "install: ${PACKAGE} install_package start"
	if [[ $PKG == "rpm" ]]; then
		yum -y install ${PACKAGE}
		if [ $? -eq 0 ]; then
			log_event "install: ${PACKAGE} install_package:success"
		else
			log_event "install: ${PACKAGE} install_package:failure"
			return 1
		fi
		
	elif [[ $PKG == "deb" ]]; then
		# Update data
		apt -y update
		if [ $? -ne 0 ]; then
			log_event "install: ${PACKAGE} install_package:apt update failed"
			return 1
		fi

		# Install
		DEBIAN_FRONTEND=noninteractive  apt install -o  Dpkg::Options::="--force-confmiss" -y ${PACKAGE}
		if [ $? -eq 0 ]; then
			log_event "install: ${PACKAGE} install_package:success"
		else
			log_event "install: ${PACKAGE} install_package:failure"
			return 1
		fi
	else
		echo "ERROR: $DIST Not supported"
		exit 1
	fi 
}

function update_package() {
	if [[ $PKG == "rpm" ]]; then
		yum -y upgrade ${PACKAGE}
		RETVAL=$?
	elif [[ $PKG == "deb" ]]; then
		apt update
		DEBIAN_FRONTEND=noninteractive  apt upgrade -o  Dpkg::Options::="--force-confmiss" -y ${PACKAGE}
		RETVAL=$?
	else
		echo "ERROR: $DIST Not supported"
		exit 1
	fi

	if [ $RETVAL -eq 0 ]; then
		log_event "upgrade: ${PACKAGE} upgrade_package:success"
	else
		log_event "upgrade: ${PACKAGE} upgrade_package:failure"
	fi
}

function update_clamav_signatures() {
	if [ ! -d /var/lib/clamav ]; then
		mkdir -p /var/lib/clamav
	fi

	/usr/bin/freshclam 
	RETVAL=$?
	if [ $RETVAL -eq 0 ]; then
		log_event "upgrade: clamav signature update: success"
	else
		log_event "upgrade: clamav signature update: failure"
	fi

}
function init_clamav() {
	echo "DEBUG0: running init_clamav" >> /tmp/debug
	if [[ $PKG == "rpm" ]]; then
		# EPEL version
		if [ -f /etc/clamd.d/scan.conf ]; then
			cp /var/ossec/modules/clamav/template/clamd.conf.template /etc/clamd.d/scan.conf
			EPEL=1
			sed -i "s/^LogFile/#LogFile/g" /etc/clamd.d/scan.conf
			sed -i "s/^PidFile/#PidFile/g" /etc/clamd.d/scan.conf
			# This only needs the TCP settings for the default to work
		elif [ -f /etc/clamd.conf ]; then
			cp /var/ossec/modules/clamav/template/clamd.conf.template /etc/clamd.conf
			cp -f /var/ossec/modules/clamav/template/freshclam.conf.template /etc/freshclam.conf
		fi

		update_clamav_signatures
		# TODO: real-time 
		# /var/ossec/modules/clamav/clam-module.sh

		if [[ $EPEL -eq 1 ]]; then
			systemctl enable clamd@scan
			systemctl start clamd@scan
		else
			systemctl enable clamav-daemon
			systemctl start clamav-daemon
		fi
		
	elif [[ $PKG == "deb" ]]; then
		cp -f /var/ossec/modules/clamav/template/clamd.conf.template /etc/clamav/clamd.conf
		cp -f /var/ossec/modules/clamav/template/freshclam.conf.template /etc/freshclam.conf 
		if  ! systemctl is-active --quiet  clamav-freshclam ; then
			update_clamav_signatures
		fi

		systemctl enable clamav-daemon 
		systemctl start clamav-daemon 

	else
		log_event "init_clamav: platform not supported "
		exit 1
	fi
}


function show_help() {
	echo
	echo "Atomicorp-API Version: ${VERSION}"
	echo
	echo "Actions"
	echo "  install  - install module"
	echo "  upgrade  - upgrade module"
	echo "  init     - initialize module"
	echo
}

function install_clamav() {
	# This isnt super important since  awp-agent has a Requires on clam now
	if [[ $PKG == "rpm" ]]; then
		if [[ "$DIST" != "amazon" ]]; then
			install_package epel-release  
			if [[ ${PIPESTATUS[0]} -ne 0 ]]; then
				exit 1
			fi
			
		fi
		install_package "clamav clamd clamav-update"
		if [[ ${PIPESTATUS[0]} -ne 0 ]]; then
			exit 1
		fi
		
	elif [[ $PKG == "deb" ]]; then
		install_package clamav-daemon
	else
		log_event "install: ${PACKAGE} platform not supported ($PKG)"
		exit 1
	fi

}


function init_module () {
	MODULE=$1

	if [[ "${MODULE}" == "auditd" ]]; then
		echo
		# TODO: restart OSSEC?
	fi

	if [[ "${MODULE}" == "clamav" ]]; then
		log_event "init: ${MODULE} start"
		init_clamav
		log_event "init: ${MODULE} end"
	fi
}


#############
# Main
#############
detect_dist

# Command line variables
ACTION=$1
shift
shift
ARGS="$@"

if [[ "$ARGS" == "install"* ]]; then

	PACKAGE=$(echo $ARGS | awk -F: '{print $2}' |awk '{print $1}')

	#Allowed package list
	if [[ ${PACKAGE} =~ auditd* ]]; then
		log_event "install: ${PACKAGE} start"
		install_package auditd
	fi

	if [[ ${PACKAGE} =~ clamav ]]; then
		log_event "install: ${PACKAGE} start"
		install_clamav
	fi
elif [[  "$ARGS" == "init"* ]]; then

	PACKAGE=$(echo $ARGS | awk -F: '{print $2}' |awk '{print $1}')
	MODULE=$(echo $ARGS | awk -F: '{print $2}' |awk '{print $1}')
	init_module ${MODULE} 

elif [[  "$ARGS" == "upgrade"* ]]; then
	PACKAGE=$(echo $ARGS | awk -F: '{print $2}' |awk '{print $1}')

	if [[ ${PACKAGE} =~ ossec-hids* ]]; then
                log_event "upgrade: ${PACKAGE} start"
                upgrade_package ossec-hids-agent awp-agent
        fi
	if [[ ${PACKAGE} =~ clamav* ]]; then
                log_event "upgrade: ${PACKAGE} start"
		update_clamav_signatures
	fi


else
	show_help

fi


