#!/bin/bash

# Configuration Variables
REPORT_BASE_DIR="./oscap_cve_reports"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
LOG_FILE="$REPORT_BASE_DIR/oscap_scan_$TIMESTAMP.log"

# Determine OS and corresponding DataStream file
# This script assumes a Red Hat-based system (RHEL, CentOS, Rocky Linux, AlmaLinux)
# For other distributions, you'll need to adjust the DS_FILE path accordingly.
if grep -q "Red Hat Enterprise Linux" /etc/os-release || grep -q "CentOS" /etc/os-release || grep -q "Rocky Linux" /etc/os-release || grep -q "AlmaLinux" /etc/os-release; then
    OS_RELEASE_ID=$(grep -oP '(?<=^VERSION_ID=")[0-9]+' /etc/os-release | head -1)
    if [ -n "$OS_RELEASE_ID" ]; then
        DS_FILE="/usr/share/xml/scap/ssg/content/ssg-rhel${OS_RELEASE_ID}-ds.xml"
        echo "ℹ️ Detected RHEL/CentOS/Rocky/AlmaLinux $OS_RELEASE_ID. Using DataStream: $DS_FILE" | tee -a "$LOG_FILE"
    else
        echo "⚠️ Could not determine RHEL/CentOS/Rocky/AlmaLinux version. Attempting RHEL8 DataStream as fallback." | tee -a "$LOG_FILE"
        DS_FILE="/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml" # Fallback to RHEL 8
    fi
else
    echo "❌ Unsupported OS detected. This script is primarily designed for RHEL-based systems." | tee -a "$LOG_FILE"
    echo "Please manually specify the DS_FILE for your operating system." | tee -a "$LOG_FILE"
    exit 1
fi

REPORT_HTML="$REPORT_BASE_DIR/cve_report_$TIMESTAMP.html"
REPORT_XML="$REPORT_BASE_DIR/cve_result_$TIMESTAMP.xml"

# --- Script Start ---

echo "🚀 Starting OpenSCAP CVE Scan..." | tee -a "$LOG_FILE"
mkdir -p "$REPORT_BASE_DIR"

# Pre-checks
if [ ! -f "$DS_FILE" ]; then
    echo "❌ SCAP DataStream file not found: $DS_FILE" | tee -a "$LOG_FILE"
    echo "Please ensure the 'scap-security-guide' package is installed and the DataStream exists." | tee -a "$LOG_FILE"
    exit 1
fi

if ! command -v oscap &> /dev/null; then
    echo "❌ OpenSCAP 'oscap' command not found." | tee -a "$LOG_FILE"
    echo "Please install OpenSCAP using your distribution's package manager (e.g., 'sudo dnf install openscap-scanner')." | tee -a "$LOG_FILE"
    exit 1
fi

echo "🔍 CVE scan initiated using DataStream: $DS_FILE" | tee -a "$LOG_FILE"
echo "Results will be saved to: $REPORT_HTML and $REPORT_XML" | tee -a "$LOG_FILE"
echo "Logs are being written to: $LOG_FILE" | tee -a "$LOG_FILE"

# Perform the OpenSCAP scan
# Using 'tee' to capture stdout/stderr to the log file while also displaying it
sudo oscap xccdf eval \
    --profile xccdf_org.ssgproject.content_profile_stig \
    --results "$REPORT_XML" \
    --report "$REPORT_HTML" \
    "$DS_FILE" 2>&1 | tee -a "$LOG_FILE"

SCAN_EXIT_CODE=${PIPESTATUS[0]} # Get the exit code of the oscap command

if [ "$SCAN_EXIT_CODE" -eq 0 ]; then
    echo "✅ OpenSCAP scan completed successfully!" | tee -a "$LOG_FILE"
else
    echo "⚠️ OpenSCAP scan completed with warnings or errors (Exit Code: $SCAN_EXIT_CODE)." | tee -a "$LOG_FILE"
fi

echo "Detailed report available at: $REPORT_HTML" | tee -a "$LOG_FILE"
echo "Raw XML results at: $REPORT_XML" | tee -a "$LOG_FILE"

# Attempt to open the report automatically
if command -v xdg-open >/dev/null 2>&1; then
    echo "🌐 Attempting to open the HTML report in your default browser..." | tee -a "$LOG_FILE"
    xdg-open "$REPORT_HTML" &> /dev/null # Redirect output to /dev/null to avoid console spam
elif command -v gnome-open >/dev/null 2>&1; then
    echo "🌐 Attempting to open the HTML report using gnome-open..." | tee -a "$LOG_FILE"
    gnome-open "$REPORT_HTML" &> /dev/null
elif command -v open >/dev/null 2>&1 && [[ "$(uname)" == "Darwin" ]]; then
    echo "🌐 Attempting to open the HTML report using 'open' (macOS)..." | tee -a "$LOG_FILE"
    open "$REPORT_HTML" &> /dev/null
else
    echo "ℹ️ No suitable command found to automatically open the report (xdg-open, gnome-open, open)." | tee -a "$LOG_FILE"
    echo "Please open '$REPORT_HTML' manually in your web browser." | tee -a "$LOG_FILE"
fi

echo "--- Script Finished ---" | tee -a "$LOG_FILE"드를 입력하세요