Merge branch 'current' into crux

4 files changed, 145 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index 1d0d37d51..d60c36316 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,8 @@
+vyos-1x (1.2.0-4) unstable; urgency=medium
+
+  * T240 adds feature system integrity check
+
+ -- hagbard <vyosdev@derith.de>  Mon, 29 Oct 2018 11:10:18 -0700
 vyos-1x (1.2.0-3) unstable; urgency=medium
 
   * T933: adding vmac_xmit_base if use_vmac has been chosen
diff --git a/op-mode-definitions/show-systemintegrity.xml b/op-mode-definitions/show-systemintegrity.xml
new file mode 100644
index 000000000..44b5faf68
--- /dev/null
+++ b/op-mode-definitions/show-systemintegrity.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+
+<interfaceDefinition>
+  <node name="show">
+    <children>
+      <leafNode name= "system-integrity">
+        <properties>
+          <help>checks the integrity of the system</help>
+        </properties>
+        <command>sudo ${vyos_op_scripts_dir}/system_integrity.py</command>
+      </leafNode>
+    </children>
+  </node>      
+</interfaceDefinition>
diff --git a/python/vyos/component_versions.py b/python/vyos/component_versions.py
new file mode 100644
index 000000000..ec54a1576
--- /dev/null
+++ b/python/vyos/component_versions.py
@@ -0,0 +1,57 @@
+# Copyright 2017 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+The version data looks like:
+
+/* Warning: Do not remove the following line. */
+/* === vyatta-config-version:
+"cluster@1:config-management@1:conntrack-sync@1:conntrack@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@4:nat@4:qos@1:quagga@2:system@8:vrrp@1:wanloadbalance@3:webgui@1:webproxy@1:zone-policy@1"
+=== */
+/* Release version: 1.2.0-rolling+201806131737 */
+"""
+
+import re
+
+def get_component_version(string_line):
+    """
+    Get component version dictionary from string
+    return empty dictionary if string contains no config information
+    or raise error if component version string malformed
+    """
+    return_value = {}
+    if re.match(r'/\* === vyatta-config-version:.+=== \*/$', string_line):
+
+        if not re.match(r'/\* === vyatta-config-version:\s+"([\w,-]+@\d+:)+([\w,-]+@\d+)"\s+=== \*/$', string_line):
+            raise ValueError("malformed configuration string: " + str(string_line))
+
+        for pair in re.findall(r'([\w,-]+)@(\d+)', string_line):
+            if pair[0] in return_value.keys():
+                raise ValueError("duplicate unit name: \"" + str(pair[0]) + "\" in string: \"" + string_line + "\"")
+            return_value[pair[0]] = int(pair[1])
+
+    return return_value
+
+
+def get_component_versions_from_file(config_file_name='/opt/vyatta/etc/config/config.boot'):
+    """
+    Get component version dictionary parsing config file line by line
+    """
+    f = open(config_file_name, 'r')
+    for line_in_config in f:
+        component_version = return_version(line_in_config)
+        if component_version:
+            return component_version
+    raise ValueError("no config string in file:", config_file_name)
diff --git a/src/op_mode/system_integrity.py b/src/op_mode/system_integrity.py
new file mode 100755
index 000000000..886d94f16
--- /dev/null
+++ b/src/op_mode/system_integrity.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+#
+
+import sys
+import os
+import subprocess
+import re
+import itertools
+from datetime import datetime, timedelta
+
+verf = r'/usr/libexec/vyos/op_mode/version.py'
+
+def get_sys_build_version():
+  if not os.path.exists(verf):
+    return None
+
+  a = subprocess.check_output(['/usr/libexec/vyos/op_mode/version.py']).decode()
+  if re.search('^Built on:.+',a, re.M) == None:
+    return None
+
+  dt = ( re.sub('Built on: +','', re.search('^Built on:.+',a, re.M).group(0)) )
+  return datetime.strptime(dt,'%a %d %b %Y %H:%M %Z')
+
+def check_pkgs(dt):
+  pkg_diffs = {
+    'buildtime' : str(dt),
+    'pkg'  : {}
+  }
+
+  pkg_info = os.listdir('/var/lib/dpkg/info/')
+  for file in pkg_info:
+    if re.search('\.list$', file):
+      fts = os.stat('/var/lib/dpkg/info/' + file).st_mtime
+      dt_str = (datetime.utcfromtimestamp(fts).strftime('%Y-%m-%d %H:%M:%S'))
+      fdt =  datetime.strptime(dt_str, '%Y-%m-%d %H:%M:%S')
+      if fdt > dt:
+        pkg_diffs['pkg'].update( { str(re.sub('\.list','',file)) : str(fdt)})
+
+  if len(pkg_diffs['pkg']) != 0:
+    return pkg_diffs
+  else:
+    return None
+
+def main():
+  dt = get_sys_build_version()
+  pkgs = check_pkgs(dt)
+  if pkgs != None:
+    print ("The following packages don\'t fit the image creation time\nbuild time:\t" + pkgs['buildtime'])
+    for k, v in pkgs['pkg'].items():
+      print ("installed: " + v + '\t' + k)
+
+if __name__ == '__main__':
+  sys.exit( main() )
+