#!/usr/bin/env python3
"""Agent for auditing and managing BitLocker disk encryption across endpoints."""

import json
import argparse
import subprocess
from datetime import datetime


def get_bitlocker_status():
    """Get BitLocker status on local machine via manage-bde."""
    try:
        result = subprocess.run(
            ["manage-bde", "-status"], capture_output=True, text=True, timeout=30)
        volumes = []
        current = {}
        for line in result.stdout.splitlines():
            line = line.strip()
            if line.startswith("Volume"):
                if current:
                    volumes.append(current)
                current = {"volume": line}
            elif ":" in line:
                key, _, value = line.partition(":")
                current[key.strip()] = value.strip()
        if current:
            volumes.append(current)
        return volumes
    except (subprocess.TimeoutExpired, FileNotFoundError):
        return []


def parse_bitlocker_report(report_path):
    """Parse BitLocker compliance report (CSV or JSON)."""
    entries = []
    if report_path.endswith(".json"):
        with open(report_path) as f:
            entries = json.load(f)
    else:
        import csv
        with open(report_path, newline="", encoding="utf-8-sig") as f:
            entries = list(csv.DictReader(f))
    return entries


def audit_bitlocker_compliance(devices):
    """Audit BitLocker compliance across fleet."""
    findings = []
    for device in devices:
        hostname = device.get("hostname", device.get("ComputerName", ""))
        protection = device.get("protection_status", device.get("ProtectionStatus", ""))
        encryption = device.get("encryption_method", device.get("EncryptionMethod", ""))
        key_protector = device.get("key_protector", device.get("KeyProtector", ""))
        recovery_key = device.get("recovery_key_escrowed",
                                  device.get("RecoveryKeyEscrowed", ""))
        if "off" in str(protection).lower() or protection == "0":
            findings.append({
                "hostname": hostname, "issue": "bitlocker_disabled",
                "severity": "CRITICAL",
            })
        if encryption and "aes" not in str(encryption).lower():
            findings.append({
                "hostname": hostname, "issue": "weak_encryption_method",
                "value": encryption, "severity": "HIGH",
            })
        if "128" in str(encryption):
            findings.append({
                "hostname": hostname, "issue": "aes_128_not_256",
                "severity": "MEDIUM",
                "recommendation": "Upgrade to AES-256",
            })
        if not key_protector or "tpm" not in str(key_protector).lower():
            findings.append({
                "hostname": hostname, "issue": "no_tpm_protector",
                "severity": "HIGH",
            })
        if str(recovery_key).lower() in ("no", "false", "0", ""):
            findings.append({
                "hostname": hostname, "issue": "recovery_key_not_escrowed",
                "severity": "HIGH",
                "recommendation": "Escrow recovery key to Active Directory",
            })
    return findings


def generate_gpo_recommendations():
    """Generate Group Policy recommendations for BitLocker."""
    return {
        "Computer Configuration": {
            "path": "Administrative Templates > Windows Components > BitLocker Drive Encryption",
            "settings": [
                {"name": "Choose drive encryption method (OS)",
                 "value": "AES-256", "policy": "Enabled"},
                {"name": "Require additional authentication at startup",
                 "value": "Allow BitLocker without compatible TPM: Disabled",
                 "policy": "Enabled"},
                {"name": "Choose how BitLocker-protected OS drives can be recovered",
                 "value": "Save to AD DS, Do not enable until stored",
                 "policy": "Enabled"},
                {"name": "Enforce drive encryption type on OS drives",
                 "value": "Full encryption", "policy": "Enabled"},
            ],
        },
    }


def calculate_compliance_metrics(devices, findings):
    """Calculate fleet encryption compliance metrics."""
    total = len(devices)
    encrypted = total - sum(1 for f in findings if f["issue"] == "bitlocker_disabled")
    strong_enc = encrypted - sum(1 for f in findings if f["issue"] in
                                  ("weak_encryption_method", "aes_128_not_256"))
    escrowed = total - sum(1 for f in findings if f["issue"] == "recovery_key_not_escrowed")
    return {
        "total_devices": total,
        "encrypted": encrypted,
        "encryption_rate": round(encrypted / total * 100, 1) if total else 0,
        "strong_encryption": strong_enc,
        "recovery_keys_escrowed": escrowed,
        "escrow_rate": round(escrowed / total * 100, 1) if total else 0,
    }


def main():
    parser = argparse.ArgumentParser(description="BitLocker Disk Encryption Agent")
    parser.add_argument("--report", help="BitLocker report CSV/JSON")
    parser.add_argument("--local", action="store_true", help="Check local machine")
    parser.add_argument("--output", default="bitlocker_audit_report.json")
    parser.add_argument("--action", choices=["audit", "local", "gpo", "full"], default="full")
    args = parser.parse_args()

    report = {"generated_at": datetime.utcnow().isoformat(), "findings": {}}

    if args.action in ("local", "full") and args.local:
        status = get_bitlocker_status()
        report["findings"]["local_status"] = status
        print(f"[+] Local volumes: {len(status)}")

    if args.action in ("audit", "full") and args.report:
        devices = parse_bitlocker_report(args.report)
        findings = audit_bitlocker_compliance(devices)
        metrics = calculate_compliance_metrics(devices, findings)
        report["findings"]["compliance_audit"] = findings
        report["findings"]["metrics"] = metrics
        print(f"[+] Devices: {metrics['total_devices']}, Encrypted: {metrics['encryption_rate']}%")

    if args.action in ("gpo", "full"):
        gpo = generate_gpo_recommendations()
        report["findings"]["gpo_recommendations"] = gpo
        print("[+] GPO recommendations generated")

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
BitLocker Compliance Checker

Checks BitLocker encryption status across endpoints and generates
compliance reports for audit purposes.
"""

import json
import subprocess
import sys
import os
import csv
from datetime import datetime


def check_bitlocker_status() -> dict:
    """Check BitLocker status on local Windows endpoint."""
    ps_cmd = """
    $volumes = Get-BitLockerVolume
    $results = @()
    foreach ($vol in $volumes) {
        $protectors = @()
        foreach ($kp in $vol.KeyProtector) {
            $protectors += @{
                Type = $kp.KeyProtectorType.ToString()
                Id = $kp.KeyProtectorId
            }
        }
        $results += @{
            MountPoint = $vol.MountPoint
            VolumeStatus = $vol.VolumeStatus.ToString()
            ProtectionStatus = $vol.ProtectionStatus.ToString()
            EncryptionMethod = $vol.EncryptionMethod.ToString()
            EncryptionPercentage = $vol.EncryptionPercentage
            VolumeType = $vol.VolumeType.ToString()
            KeyProtectors = $protectors
            AutoUnlockEnabled = $vol.AutoUnlockEnabled
            AutoUnlockKeyStored = $vol.AutoUnlockKeyStored
        }
    }
    $tpm = Get-Tpm
    @{
        Hostname = $env:COMPUTERNAME
        Volumes = $results
        TPM = @{
            Present = $tpm.TpmPresent
            Ready = $tpm.TpmReady
            Enabled = $tpm.TpmEnabled
            Activated = $tpm.TpmActivated
        }
    } | ConvertTo-Json -Depth 4
    """

    try:
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            capture_output=True, text=True, timeout=30,
        )
        if result.returncode == 0 and result.stdout.strip():
            return json.loads(result.stdout)
        return {"error": result.stderr or "Failed to check BitLocker status"}
    except FileNotFoundError:
        return {"error": "PowerShell not available (requires Windows)"}
    except subprocess.TimeoutExpired:
        return {"error": "Command timed out"}
    except json.JSONDecodeError as e:
        return {"error": f"Parse error: {e}"}


def assess_compliance(status: dict) -> dict:
    """Assess BitLocker compliance against security baseline."""
    findings = {
        "hostname": status.get("Hostname", "unknown"),
        "overall_compliant": True,
        "tpm_status": "compliant",
        "volume_findings": [],
    }

    tpm = status.get("TPM", {})
    if not tpm.get("Present") or not tpm.get("Ready"):
        findings["tpm_status"] = "non-compliant"
        findings["overall_compliant"] = False

    for vol in status.get("Volumes", []):
        vol_finding = {
            "mount_point": vol["MountPoint"],
            "compliant": True,
            "issues": [],
        }

        if vol["VolumeStatus"] != "FullyEncrypted":
            vol_finding["compliant"] = False
            vol_finding["issues"].append(f"Not fully encrypted: {vol['VolumeStatus']}")

        if vol["ProtectionStatus"] != "On":
            vol_finding["compliant"] = False
            vol_finding["issues"].append(f"Protection not enabled: {vol['ProtectionStatus']}")

        if vol["EncryptionMethod"] not in ("XtsAes256", "XtsAes128"):
            vol_finding["issues"].append(f"Weak encryption method: {vol['EncryptionMethod']}")

        protector_types = [kp["Type"] for kp in vol.get("KeyProtectors", [])]
        has_recovery = "RecoveryPassword" in protector_types or "NumericalPassword" in protector_types
        if not has_recovery:
            vol_finding["compliant"] = False
            vol_finding["issues"].append("No recovery password protector configured")

        has_tpm = any(t in protector_types for t in ["Tpm", "TpmPin", "TpmPinStartupKey"])
        if vol["VolumeType"] == "OperatingSystem" and not has_tpm:
            vol_finding["compliant"] = False
            vol_finding["issues"].append("OS volume missing TPM protector")

        if not vol_finding["compliant"]:
            findings["overall_compliant"] = False

        findings["volume_findings"].append(vol_finding)

    return findings


def generate_report(status: dict, compliance: dict, output_path: str) -> None:
    """Generate BitLocker compliance report."""
    report = {
        "report_generated": datetime.utcnow().isoformat() + "Z",
        "hostname": status.get("Hostname", "unknown"),
        "overall_compliance": "COMPLIANT" if compliance["overall_compliant"] else "NON-COMPLIANT",
        "tpm_status": compliance["tpm_status"],
        "tpm_details": status.get("TPM", {}),
        "volumes": [],
    }

    for vol, finding in zip(status.get("Volumes", []), compliance["volume_findings"]):
        report["volumes"].append({
            "mount_point": vol["MountPoint"],
            "status": vol["VolumeStatus"],
            "protection": vol["ProtectionStatus"],
            "encryption_method": vol["EncryptionMethod"],
            "encryption_percent": vol["EncryptionPercentage"],
            "key_protectors": [kp["Type"] for kp in vol.get("KeyProtectors", [])],
            "compliant": finding["compliant"],
            "issues": finding["issues"],
        })

    with open(output_path, "w", encoding="utf-8") as f:
        json.dump(report, f, indent=2)


if __name__ == "__main__":
    output_dir = sys.argv[1] if len(sys.argv) > 1 else "."

    print("Checking BitLocker status...")
    status = check_bitlocker_status()

    if "error" in status:
        print(f"Error: {status['error']}")
        print("This tool requires Windows with BitLocker support.")
        sys.exit(1)

    print("Assessing compliance...")
    compliance = assess_compliance(status)

    report_path = os.path.join(output_dir, "bitlocker_compliance.json")
    generate_report(status, compliance, report_path)
    print(f"Compliance report: {report_path}")

    print(f"\n--- BitLocker Compliance ---")
    print(f"Hostname: {compliance['hostname']}")
    print(f"Overall: {'COMPLIANT' if compliance['overall_compliant'] else 'NON-COMPLIANT'}")
    print(f"TPM: {compliance['tpm_status']}")

    for vf in compliance["volume_findings"]:
        status_icon = "PASS" if vf["compliant"] else "FAIL"
        print(f"\n  [{status_icon}] {vf['mount_point']}")
        for issue in vf["issues"]:
            print(f"    - {issue}")