#!/bin/bash
# SPDX-License-Identifier: GPL-2.0-only
#
# Copyright (c) 2024 - Greg Kroah-Hartman <gregkh@linuxfoundation.org>
#
# strak - "fixed/tight" in Dutch.
#	  Given a specific git id, list all of the CVE ids that are NOT fixed
#	  in that release.
#
# Usage:
#	strak [options] GIT_SHA
#	For full options, see the help text below.
#
# Requires:
#  A kernel git tree with the SHA to be used in it

# set to 1 to get some debugging logging messages (or use -v/--verbose option)
DEBUG=0

# Initialize our color variables if we are a normal terminal
if [[ -t 1 ]]; then
	txtred=$(tput setaf 1)          # Red
	txtgrn=$(tput setaf 2)          # Green
	txtblu=$(tput setaf 4)          # Blue
	txtcyn=$(tput setaf 6)          # Cyan
	txtrst=$(tput sgr0)             # Text reset
else
	txtred=""
	txtgrn=""
	txtblu=""
	txtcyn=""
	txtrst=""
fi

# set where the tool was run from,
# the name of our script,
# and the git version of it
DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
SCRIPT=${0##*/}
SCRIPT_VERSION=$(cd "${DIR}" && git ls-tree --abbrev=12 HEAD | grep "${SCRIPT}" | awk '{print $3}')

#############################
# help()
#	Print out help options and exit
#############################
help()
{
	echo "Usage: $0 [OPTIONS] GIT_SHA"
	echo "    List all CVE ids that are NOT fixed for this release."
	echo "    In other words, all of the public vulerabilities that this commit id has in it."
	echo ""
	echo "Arguments:"
	echo " -h, --help			This information"
	echo " --fixed=FIXED_VERSION		Kernel version to show what was fixed in it"
	echo " -v, --verbose			Show debugging information to stdout"
	echo ""
	exit 1
}

#############################
# dbg()
#	if DEBUG is enabled, print out a message.
#	Can also be set with -v or --verbose command line option
#	Does so with an initial "#" so it can be easily filtered out
# arguments:
# 	"message to print"
# assumes:
#	DEBUG is defined to something
#############################
dbg()
{
	if [[ ${DEBUG} -ge 1 ]] ; then
		echo "${txtcyn}# ${1}${txtrst}"
	fi
}

#############################
# info()
#	Print out a string as "information"
#	Does so with an initial "#" so it can be easily filtered out
# arguments:
#	"message to print"
#############################
info()
{
	echo "${txtgrn}# ${1}${txtrst}"
}

check_id()
{
	local git_id=$1
	local cve_id=$2
	local sha
	local cve
	local root
	local vuln_file
	local vulnerable_option
	local vulnerable_sha
	local dyad_out
	local dyad_entries
	local dyad_entry
	local found
	local must_look
	local is_in_vuln

	sha=$(cat "${cve_id}")
	cve=$(echo "${cve_id}" | cut -f 1 -d '.' | cut -f 4 -d '/')
	root=$(echo "${cve_id}" | cut -f 1 -d '.')

	dbg "checking ${cve}:"

	# Look to see if we have a "og_vuln" that is provided to us in a
	# published CVE.  This is used for when we can't determine it on our
	# own, but we have manually looked it up later on and added it to a
	# CVE-*.vulnerable file
	vuln_file="${root}.vulnerable"
	#echo "vuln_file=${vuln_file}"
	vulnerable_option=""
	vulnerable_sha=""
	if [[ -f "${vuln_file}" ]]; then
		vulnerable_sha=$(cat "${vuln_file}")
		vulnerable_option="--vulnerable=${vulnerable_sha}"
	fi

	sha_id=$(cat ${cve_id})

	# We want to call dyad without quotes for the arguments as we "know" these
	# arguments are ok, we just set them above explicitly.
	# shellcheck disable=SC2086
	dbg "${root}.dyad"
	dyad_out=$(cat "${root}.dyad" | grep -v "^#")
	#dyad_out=$("${dyad}" ${sha_id} | grep -v "^#")
	#dbg "dyad_out=${dyad_out}"
	dyad_entries=()

	for dyad_entry in ${dyad_out}; do
		dyad_entries+=("${dyad_entry}")
	done
	dbg "	dyad_entries: ${#dyad_entries[@]}"

	found=0
	must_look=0
	for entry in "${dyad_entries[@]}"; do
		x=(${entry//:/ })
		vuln=${x[0]}
		vuln_git=${x[1]}
		fix=${x[2]}
		fix_git=${x[3]}
		dbg "		dyad:	git_id=${git_id}	vuln_git=${vuln_git}	fix_git=${fix_git}"

		if [[ "${vuln_git}" == "0" ]]; then
			vuln_git="1da177e4c3f41524e886b7f1b8a0c1fc7321cac2"
		fi
		is_in_vuln=$(cd "${KERNEL_TREE}" && git merge-base --is-ancestor ${vuln_git} ${git_id})
		if [[ $? -eq 0 ]]; then
			# This id is a root of our id, so let's dig further!
			must_look=1

			# first, if this is NOT fixed, then of course this is vulnerable
			if [[ "${fix_git}" == "0" ]]; then
				# not fixed, let's just move on
				continue
			fi

			# the "vulnerable id is a root of our id, see if it's been fixed!"
			is_in_vuln=$(cd "${KERNEL_TREE}" && git merge-base --is-ancestor ${fix_git} ${git_id})
			if [[ $? -eq 0 ]]; then
				# our id has this fixed!
				found=1
			fi
		fi
	done
	dbg "	must_look=${must_look} found=${found}"
	if [[ "${must_look}" == "1" ]]; then
		if [[ "${found}" == "0" ]]; then
			echo "${txtgrn}${git_id}${txtrst} is vulnerable to ${txtred}${cve}${txtrst}"
		fi
	fi

}

search_year()
{
	local git_id=$1
	local year=$2
	local threads=$(nproc)

	# get a count of ids for this year
	count=$(ls cve/published/${year}/*.sha1 | wc -l)

	dbg "Searching ${txtcyn}${count}${txtrst} CVE ids for ${txtgrn}${year}${txtrst} with ${txtcyn}${threads}${txtrst} processes..."
	for id in cve/published/${year}/*.sha1 ; do
		while :
		do
			if [[ $(jobs -p | wc -l) -lt ${threads} ]]; then
				dbg "git_id=${git_id} id=${id}"
				check_id "${git_id}" "${id}" &
				break
			else
				sleep 1
			fi
		done
	done
	wait
}

fixed_version()
{
	local fixed_version=$1
	local out
	local id
	local year
	local commit

	cd "cve/published/"
	out=$(git grep -i -l "fixed in ${fixed_version}" | cut -f 2 -d '/' | cut -f 1 -d '.')
	if [[ "${out}" != "" ]]; then
		while IFS= read -r id; do
			year=$(echo "${id}" | cut -f 2 -d '-')
			commit=$(cat ${year}/${id}.sha1)
			echo "${id} is fixed in ${1} with commit ${commit}"
		done <<< "${out}"
	else
		echo "${1} does not have any CVE ids assigned yet."
	fi
}


#############################
#############################
# "main" logic starts here
#############################
#############################

# Verify that some basic environment variables are set up
KERNEL_TREE=${CVEKERNELTREE}

if [[ ! -d "${KERNEL_TREE}" ]] ; then
	echo "${txtred}ERROR:${txtrst}"
	echo "	${txtblu}CVEKERNELTREE${txtrst} needs setting to the stable repo directory"
	echo -e "\nEither manually export them or add them to your .bashrc/.zshrc et al."
	echo -e "\nSee HOWTO in the root of this repo"
	exit 1
fi

# Parse the command line
short_opts="hv"
long_opts="help,verbose,fixed:"

FIXED_VERSION=""
TMP=$(getopt -o "${short_opts}" --long "${long_opts}" --name="${SCRIPT}" -- "$@")
eval set -- "${TMP}"
while :; do
	dbg "arg=${1}"
	case "${1}" in
		-h | --help	) help;;
		--fixed		) FIXED_VERSION="${2}";	shift 2 ;;
		-v | --verbose	) DEBUG=1;		shift ;;
		-- )		  shift; break ;;
	esac
done

# Rest of the command line argument is the git sha we are looking at
GIT_SHA=$1

if [[ "${GIT_SHA}" == "" && "${FIXED_VERSION}" == "" ]]; then
	help
	exit 1
fi

# Now we can test for unset variables, before we would have failed if someone
# forgot the git sha on the command line.
set -o nounset

cd "${DIR}"/../ || exit 1

if [[ "${FIXED_VERSION}" != "" ]]; then
	fixed_version "${FIXED_VERSION}"
	exit 0
fi

dbg "git id to look up = ${GIT_SHA}"

for y in cve/published/* ; do
	year=$(echo "${y}" | cut -f 3 -d '/')
	search_year ${GIT_SHA} ${year}
done
#search_year "${GIT_SHA}" 2020

exit 0