#!/bin/bash
# asl-update.sh
# Author: Carsten Schoene <cs@internetx.de>
# $LastChangedDate$
# $Rev$
#
export PATH=/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin

if [ "`id -u`" != "0" ] ; then
	echo "This script needs to be run as user root!"
	exit 3
fi
ERRLOG="/var/log/ix-asl-updater.log"
RCPTS="asl-update@internetx.de"
WGET=`which wget` 2>${ERRLOG}
MAIL=`which mail` 2>${ERRLOG}
GREP=`which grep` 2>${ERRLOG}
AWK=`which awk` 2>${ERRLOG}
SED=`which sed` 2>${ERRLOG}
FIND=`which find` 2>${ERRLOG}
IP=`which ip` 2>${ERRLOG}
HEAD=`which head` 2>${ERRLOG}
SERVICE=`which service` 2>${ERRLOG}
HOSTNAME=`which hostname` 2>${ERRLOG}

SCRIPTNAME=`basename $0 .sh`
PREUA="${SCRIPTNAME}$Rev$"
USERAGENT=`echo ${PREUA}|${SED} -e s@"\s"@""@g`
WGETOPTS="-q --user-agent=${USERAGENT}"
BASEURL="http://85.236.33.12/.atomic/subscription"
LASTRUNCONF="/etc/ix-asl.lastrun"
FORCE_DOWNGADE="0"
[ -r /etc/ix-asl-update.conf ] && . /etc/ix-asl-update.conf
[ -r /etc/ix-asl-branchurl.conf ] && . /etc/ix-asl-branchurl.conf

if [ -n "`echo ${BASEURL} | grep -i ^https:`" ] ; then
	WGETOPTS="${WGETOPTS} --no-check-certificate"
fi

if [ -n "`echo ${BRANCHURL} | grep -i ^https:`" ] ; then
	WGETOPTS="${WGETOPTS} --no-check-certificate"
fi

function check_os() {
	if [ -z "`${GREP} -i -E '(CentOS Release 5|CentOS Linux release 6|CentOS release 6|CentOS Linux release 7|Red Hat Enterprise Linux Server release 5|Red Hat Enterprise Linux Server release 6|Red Hat Enterprise Linux Server release 7|Scientific Linux release 6)' /etc/redhat-release 2>/dev/null`" ] && [ -z "`${GREP} -i -E '(SUSE Linux Enterprise Server 10|SUSE Linux Enterprise Server 11)' /etc/SuSE-release 2>/dev/null`" ] ; then
		echo "only CentOS 5, 6 & 7, RHEL 5, 6 & 7, SL 6 and SLES 10 & 11 is supported!"
		exit 4
	fi
	if [ -s /etc/redhat-release ] ; then
		export OS=redhat
	fi
	if [ -s /etc/SuSE-release ] ; then
		export OS=suse
	fi
}

function dl_version() {
	if [ "${1}" == "modsec" ] && [ -n "${BRANCHURL}" ] ; then
		${WGET} ${WGETOPTS} ${BRANCHURL}/VERSION -O /tmp/VERSION
	else
		${WGET} ${WGETOPTS} ${BASEURL}/VERSION -O /tmp/VERSION
	fi
}

function unpack() {
	if [ $# -ge 2 ] ;then
		ARCHIV="$1"
		DSTPATH="$2"
		if [ ! -d "${DSTPATH}" ] ; then
			mkdir -p "${DSTPATH}"
		fi
		tar -C ${DSTPATH} -xzf ${ARCHIV}
		return $?
	else
		echo "wrong param count"
		exit 2
	fi	
}

get_system_ip() {
	LANG=C
	INTERFACE=`${IP} -4 route show default|${AWK} '{print $NF}'`
	if [ -n "${INTERFACE}" ] ;then
		IPADDR=`${IP} -4 addr show dev ${INTERFACE} | ${GREP} ${INTERFACE} | ${GREP} inet | ${HEAD} -n1 | ${AWK} '{print $2}' | ${AWK} -F/ '{print $1}'`
		echo ${IPADDR}
	else
		${HOSTNAME}
	fi
}

mail_admin() {
	if [ -s "${ERRLOG}" ] ; then
		${MAIL} -s "IX ASL Updater error on: `get_system_ip`" ${RCPTS} < ${ERRLOG}
	fi
}

function apa_configtest() {
	if [ "${OS}" == "redhat" ] ; then
		APACTL=`which apachectl` 2>${ERRLOG}
		${APACTL} configtest >${ERRLOG} 2>&1
		if [ $? == 0 ]; then
			# do reload
			${SERVICE} httpd reload >/dev/null 2>&1
			return 0
		else
			mail_admin
			return 1
		fi
	elif [ "${OS}" == "suse" ] ; then
		APA2CTL=`which apache2ctl` 2>${ERRLOG}
		${APA2CTL} configtest >${ERRLOG} 2>&1
		if [ $? == 0 ] ; then
			# do reload
			${SERVICE} apache2 reload >/dev/null 2>&1
			return 0
		else
			mail_admin
			return 1
		fi
	else
		return 2
	fi
}

function get_clamav_usergroup {
	CLAMDUSER=`${FIND} /etc -name clamd.conf -exec ${GREP} ^User {} \; | ${AWK} '{print $2}'`
	FRESHCLAMUSER=`${FIND} /etc -name freshclam.conf -exec ${GREP} ^DatabaseOwner {} \; | ${AWK} '{print $2}'`
	if [ -z "${CLAMDUSER}" ] && [ -z "${FRESHCLAMUSER}" ] ; then
		CLAMOWNER="root:root"
	elif [ -n "${FRESHCLAMUSER}" ] ; then
		CLAMGROUP=`id -gn ${FRESHCLAMUSER}`
		if [ -n "${CLAMGROUP}" ] ; then
			CLAMOWNER="${FRESHCLAMUSER}:${CLAMGROUP}"
		else
			CLAMOWNER="${FRESHCLAMUSER}"
		fi
	elif [ -n "${CLAMDUSER}" ] ; then
		CLAMGROUP=`id -gn ${CLAMDUSER}`
		if [ -n "${CLAMGROUP}" ] ; then
			CLAMOWNER="${CLAMDUSER}:${CLAMGROUP}"
		else
			CLAMOWNER="${CLAMDUSER}"
		fi
	fi
	echo ${CLAMOWNER}
	if [ -n "${CLAMOWNER}" ] ; then
		return 0
	else
		return 1
	fi
}

function save_lastrun() {
	case "$1" in
	clamav)
		if [ -n "${CLAMAV_VERSION}" ]; then
			echo "LAST_CLAMAV_VERSION=${CLAMAV_VERSION}" > ${LASTRUNCONF}.clamav
		fi
	;;
	geomap)
		if [ -n "${GEOMAP_VERSION}" ] ; then
			echo "LAST_GEOMAP_VERSION=${GEOMAP_VERSION}" > ${LASTRUNCONF}.geomap
		fi
	;;
	modsec)
		if [ -n "${MODSEC_VERSION}" ] ; then
			echo "LAST_MODSEC_VERSION=${MODSEC_VERSION}" > ${LASTRUNCONF}.modsec
		fi
	;;
	ossec)
		if [ -n "${OSSEC_VERSION}" ] ; then
			echo "LAST_OSSEC_VERSION=${OSSEC_VERSION}" > ${LASTRUNCONF}.ossec
		fi
	;;
	*)
		echo "noting to save"
		return 1
	;;
	esac
}
check_os
dl_version $1

if [ -s "${LASTRUNCONF}.clamav" ] ; then
	. ${LASTRUNCONF}.clamav
fi

if [ -s "${LASTRUNCONF}.geomap" ] ; then
        . ${LASTRUNCONF}.geomap
fi

if [ -s "${LASTRUNCONF}.modsec" ] ; then
        . ${LASTRUNCONF}.modsec
fi

if [ -s "${LASTRUNCONF}.ossec" ] ; then
        . ${LASTRUNCONF}.ossec
fi



if [ -s /tmp/VERSION ] ; then
	. /tmp/VERSION
	case "$1" in
		appinv)
			echo "appinv not implemented"
			exit 1
		;;
		clamav)
			if [ -n "${CLAMAV_VERSION}" ] ; then
				if [ -z "${LAST_CLAMAV_VERSION}" ] || [ ${CLAMAV_VERSION} -gt ${LAST_CLAMAV_VERSION} ] || [ "${FORCE_DOWNGRADE}" == "1" ] ; then
					URL="${BASEURL}/clamav-${CLAMAV_VERSION}.tar.gz"
				else
					# skip update
					exit 0
				fi
			else
				# maybe try default ruleset
				URL=""
			fi
			${WGET} ${WGETOPTS} ${URL} -O /tmp/clamav.tar.gz
			USERGROUP=`get_clamav_usergroup`
			if [ $? == 0 ] ; then
				unpack /tmp/clamav.tar.gz /var/lib && chown -R ${USERGROUP} /var/lib/clamav && save_lastrun clamav
			fi
		;;
		geomap)
			if [ -n "${GEOMAP_VERSION}" ] ; then
				if [ -z "${LAST_GEOMAP_VERSION}" ] || [ ${GEOMAP_VERSION} -gt ${LAST_GEOMAP_VERSION} ] || [ "${FORCE_DOWNGRADE}" == "1" ] ; then
					URL="${BASEURL}/geomap-${GEOMAP_VERSION}.tar.gz"
				else
					# skip update
					exit 0
				fi
			else
				# maybe try default ruleset
				URL=""
			fi
			${WGET} ${WGETOPTS} ${URL} -O /tmp/geomap.tar.gz
			unpack /tmp/geomap.tar.gz /var/lib && save_lastrun geomap
		;;
		modsec)
			if [ -n "${MODSEC_VERSION}" ] ; then
				if [ -z "${LAST_MODSEC_VERSION}" ] || [ ${MODSEC_VERSION} -gt ${LAST_MODSEC_VERSION} ] || [ "${FORCE_DOWNGRADE}" == "1" ] ; then
					if [ -z "${BRANCHURL}" ] ; then
						URL="${BASEURL}/modsec-${MODSEC_VERSION}.tar.gz"
					else
						URL="${BRANCHURL}/modsec-${MODSEC_VERSION}.tar.gz"
					fi
				else
					# skip update
					exit 0
				fi
			else
				# maybe try default ruleset
				URL="http://updates.atomicorp.com/channels/rules/delayed/modsec-201008260932.tar.gz"
			fi
			${WGET} ${WGETOPTS} ${URL} -O /tmp/modsec.tar.gz

			if [ "${OS}" == "redhat" ] ; then
				unpack /tmp/modsec.tar.gz /etc/httpd
				find /etc/httpd/modsec -name \*experimental\*.conf -exec rm {} \;
				find /etc/httpd/modsec -name \*paranoid\*.conf -exec rm {} \;
				if [ -s /etc/httpd/modsec/.droplist ] ; then
					for FILE in `cat /etc/httpd/modsec/.droplist` ; do
						rm -f /etc/httpd/modsec/${FILE}
					done
				fi
			elif [ "${OS}" == "suse" ] ; then
				unpack /tmp/modsec.tar.gz /etc/apache2
				find /etc/apache2/modsec -name \*experimental\*.conf -exec rm {} \;
				find /etc/apache2/modsec -name \*paranoid\*.conf -exec rm {} \;
				if [ -s /etc/apache2/modsec/.droplist ] ; then
					for FILE in `cat /etc/apache2/modsec/.droplist` ; do
						rm -f /etc/apache2/modsec/${FILE}
					done
				fi
			fi

			if [ ! -d /etc/asl ] ; then
				mkdir -p /etc/asl
			fi
			if [ ! -f /etc/asl/whitelist ] ; then
				touch /etc/asl/whitelist
			fi
			apa_configtest && save_lastrun modsec
		;;
		waf)
			echo "waf not implemented"
			exit 1
		;;
		ossec)
			if [ -n "${OSSEC_VERSION}" ] ; then
				if [ -z "${LAST_OSSEC_VERSION}" ] || [ ${OSSEC_VERSION} -gt ${LAST_OSSEC_VERSION} ] || [ "${FORCE_DOWNGRADE}" == "1" ] ; then
					URL="${BASEURL}/ossec-${OSSEC_VERSION}.tar.gz"
				else
					# skip update
					exit 0
				fi
                        else
                                # maybe try default ruleset
                                URL=""
                        fi
			${WGET} ${WGETOPTS} ${URL} -O /tmp/ossec.tar.gz
			unpack /tmp/ossec.tar.gz /etc && save_lastrun ossec
		;;
		*)
			echo "invalid action or not implemented!"
			echo "valid actions: <clamav|geomap|modsec|ossec>"
			exit 1
		;;
	esac
else
	echo "download of VERSION file failed!"
fi
