#!/bin/bash
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.


echo "Starting to check for yara rule updates at $(date)..."

output_dir="/opt/so/saltstack/local/salt/strelka/rules"
mkdir -p $output_dir
repos="/opt/so/conf/strelka/repos.txt"
newcounter=0
excludedcounter=0
excluded_rules=({{ EXCLUDEDRULES | join(' ') }})


{% if ISAIRGAP is sameas true %}

echo "Airgap mode enabled."

clone_dir="/nsm/repo/rules/strelka"
repo_name="signature-base"
[ -d $output_dir/$repo_name ] && rm -rf $output_dir/$repo_name
mkdir -p mkdir -p $output_dir/$repo_name
# Ensure a copy of the license is available for the rules
[ -f $clone_dir/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name

# Copy over rules
for i in $(find $clone_dir/yara -name "*.yar*"); do
  rule_name=$(echo $i | awk -F '/' '{print $NF}')
  if [[ ! "${excluded_rules}" =~ ${rule_name} ]]; then
    echo "Adding rule: $rule_name..."
    cp $i $output_dir/$repo_name
    ((newcounter++))
  else
    echo "Excluding rule: $rule_name..."
    ((excludedcounter++))
  fi
done

echo "Done!"

if [ "$newcounter" -gt 0 ] || [ "$excludedcounter" -gt 0 ];then
  echo "$newcounter rules added."
  echo "$excludedcounter rule(s) excluded."
fi

{% else %}

gh_status=$(curl -s -o /dev/null -w "%{http_code}" https://github.com)
clone_dir="/tmp"
if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then

  while IFS= read -r repo; do
    if ! $(echo "$repo" | grep -qE '^#'); then
      # Remove old repo if existing bc of previous error condition or unexpected disruption
      repo_name=`echo $repo | awk -F '/' '{print $NF}'`
      [ -d $output_dir/$repo_name ] && rm -rf $output_dir/$repo_name

      # Clone repo and make appropriate directories for rules
      git clone $repo $clone_dir/$repo_name
      echo "Analyzing rules from $clone_dir/$repo_name..."
      mkdir -p $output_dir/$repo_name
      # Ensure a copy of the license is available for the rules
      [ -f $clone_dir/$repo_name/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name

      # Copy over rules
      for i in $(find $clone_dir/$repo_name -name "*.yar*"); do
        rule_name=$(echo $i | awk -F '/' '{print $NF}')

        if [[ ! "${excluded_rules}" =~ ${rule_name} ]]; then
          echo "Adding rule: $rule_name..."
          cp $i $output_dir/$repo_name
          ((newcounter++))
        else
          echo "Excluding rule: $rule_name..."
          ((excludedcounter++))
        fi
     done
     rm -rf $clone_dir/$repo_name
    fi
    done < $repos

  echo "Done!"
  
  if [ "$newcounter" -gt 0 ] || [ "$excludedcounter" -gt 0 ];then
    echo "$newcounter rule(s) added."
    echo "$excludedcounter rule(s) excluded."
  fi
  
else
  echo "Server returned $gh_status status code."
  echo "No connectivity to Github...exiting..."
  exit 1
fi
{% endif %}

echo "Finished rule updates at $(date)..."