#!/usr/bin/env bash
set -euo pipefail

HOST_IP="$(hostname -I | awk '{print $1}')"
DB_HOST="amazonaurora.cluster-ro-cemzxojvmybt.us-east-1.rds.amazonaws.com"
DB_USER="admin"
DB_PASS="xxatN6Lb8Kbwb9MiU1At"

STATE_DIR="/home/banners/logs"
STATE_FILE="${STATE_DIR}/mysql_nonssl_detector.state"
COUNT_FILE="${STATE_DIR}/mysql_nonssl_detector.counts.tsv"
DETAILS_FILE="${STATE_DIR}/mysql_nonssl_detector.details.log"
SOCKET_FILE="${STATE_DIR}/mysql_nonssl_detector.sockets.log"
SS_BIN="$(command -v ss || true)"
NETSTAT_BIN="$(command -v netstat || true)"
LSOF_BIN="$(command -v lsof || true)"
SLEEP_MIN_SECONDS="${SLEEP_MIN_SECONDS:-60}"
REPEAT_THRESHOLD="${REPEAT_THRESHOLD:-2}"

mkdir -p "${STATE_DIR}"

TMP_RESULTS="$(mktemp)"
TMP_IDS="$(mktemp)"
TMP_COUNTS="$(mktemp)"
trap 'rm -f "${TMP_RESULTS}" "${TMP_IDS}" "${TMP_COUNTS}"' EXIT

mysql --ssl \
  --ssl-ca=/etc/pki/tls/certs/rds-global-bundle.pem \
  --ssl-verify-server-cert \
  -h "${DB_HOST}" \
  -u "${DB_USER}" \
  -p"${DB_PASS}" \
  --batch --raw --skip-column-names \
  -e "SELECT p.ID,
             p.USER,
             p.HOST,
             COALESCE(p.DB,''),
             p.COMMAND,
             p.TIME,
             COALESCE(MAX(CASE WHEN a.ATTR_NAME='program_name' THEN a.ATTR_VALUE END),''),
             COALESCE(MAX(CASE WHEN a.ATTR_NAME='_client_name' THEN a.ATTR_VALUE END),''),
             COALESCE(MAX(CASE WHEN a.ATTR_NAME='_client_version' THEN a.ATTR_VALUE END),''),
             COALESCE(MAX(CASE WHEN s.VARIABLE_NAME='Ssl_cipher' THEN s.VARIABLE_VALUE END),'')
      FROM information_schema.PROCESSLIST p
      JOIN performance_schema.threads t
        ON t.PROCESSLIST_ID = p.ID
      LEFT JOIN performance_schema.status_by_thread s
        ON s.THREAD_ID = t.THREAD_ID
       AND s.VARIABLE_NAME = 'Ssl_cipher'
      LEFT JOIN performance_schema.session_connect_attrs a
        ON a.PROCESSLIST_ID = p.ID
      WHERE p.USER NOT IN ('rdsadmin','event_scheduler')
        AND p.HOST LIKE '${HOST_IP}:%'
      GROUP BY p.ID,p.USER,p.HOST,p.DB,p.COMMAND,p.TIME
      HAVING COALESCE(MAX(CASE WHEN s.VARIABLE_NAME='Ssl_cipher' THEN s.VARIABLE_VALUE END),'') = ''
         AND NOT (p.COMMAND = 'Sleep' AND p.TIME < ${SLEEP_MIN_SECONDS})
      ORDER BY p.TIME DESC;" > "${TMP_RESULTS}"

awk -F'\t' '{print $1}' "${TMP_RESULTS}" > "${TMP_IDS}"

if [[ ! -f "${STATE_FILE}" ]]; then
  touch "${STATE_FILE}"
fi

if [[ ! -f "${COUNT_FILE}" ]]; then
  touch "${COUNT_FILE}"
fi

declare -A prev_counts
declare -A cur_counts
declare -A row_by_sig

while IFS=$'\t' read -r sig count; do
  [[ -z "${sig}" ]] && continue
  prev_counts["${sig}"]="${count:-0}"
done < "${COUNT_FILE}"

while IFS=$'\t' read -r id user host db command time program client_name client_version ssl_cipher; do
  [[ -z "${id}" ]] && continue
  sig="${user}|${host}|${db}|${command}|${program}|${client_name}|${client_version}"
  cur_counts["${sig}"]=$(( ${cur_counts["${sig}"]:-0} + 1 ))
  if [[ -z "${row_by_sig["${sig}"]+x}" ]]; then
    row_by_sig["${sig}"]="${id}|${user}|${host}|${db}|${command}|${time}|${program}|${client_name}|${client_version}|${ssl_cipher}"
  fi
done < "${TMP_RESULTS}"

for sig in "${!cur_counts[@]}"; do
  prev="${prev_counts["${sig}"]:-0}"
  new_count=$(( prev + 1 ))
  printf '%s\t%s\n' "${sig}" "${new_count}" >> "${TMP_COUNTS}"

  # Only alert when this signature first crosses the repeat threshold.
  if (( prev < REPEAT_THRESHOLD && new_count >= REPEAT_THRESHOLD )); then
    IFS='|' read -r id user host db command time program client_name client_version ssl_cipher <<< "${row_by_sig["${sig}"]}"
    printf '%s\tid=%s\tuser=%s\thost=%s\tdb=%s\tcmd=%s\ttime=%s\tprogram=%s\tclient=%s\tclient_version=%s\tssl_cipher=%s\trepeat_count=%s\n' \
      "$(date '+%F %T')" "${id}" "${user}" "${host}" "${db}" "${command}" "${time}" "${program}" "${client_name}" "${client_version}" "${ssl_cipher}" "${new_count}" \
      >> "${DETAILS_FILE}"
    {
      echo "===== $(date '+%F %T') id=${id} host=${host} repeat_count=${new_count} ====="
      if [[ -n "${SS_BIN}" ]]; then
        "${SS_BIN}" -ntp dst :3306 || true
      elif [[ -n "${NETSTAT_BIN}" ]]; then
        "${NETSTAT_BIN}" -ntp 2>/dev/null | awk '$4 ~ /:3306$/ || $5 ~ /:3306$/ {print}' || true
      elif [[ -n "${LSOF_BIN}" ]]; then
        "${LSOF_BIN}" -nP -iTCP:3306 -sTCP:ESTABLISHED || true
      else
        echo "no socket inspection tool found"
      fi
      echo
    } >> "${SOCKET_FILE}"
  fi
done

mv "${TMP_IDS}" "${STATE_FILE}"
mv "${TMP_COUNTS}" "${COUNT_FILE}"
echo "$(date '+%F %T') checked host=${HOST_IP} offenders=$(wc -l < "${STATE_FILE}")"