changes

Author: Rizzy1857

Plugins/IDSPlugin/IDSPlugin.stub.cs

@@ -75,10 +75,8 @@ public async Task<string> RunInitDbAsync(string dbPath, string nvdKey, Action<st
         var script = Path.Combine(_pythonScriptsPath, "init_db.py");
         // Use -u to force unbuffered stdout/stderr so the WPF UI receives logs in real-time
         var args = $"-u \"{script}\" --db \"{dbPath}\" --days-back 30";
-        if (!string.IsNullOrWhiteSpace(nvdKey))
-        {
-            args += $" --nvd-key \"{nvdKey}\"";
-        }
+        // Always pass --nvd-key to override any system environment variables if the user cleared it in the UI
+        args += $" --nvd-key \"{nvdKey ?? ""}\"";
         return await RunPythonAsync(args, 300_000, onOutputData); // Allow 5 minutes for massive NVD sync
     }
 

SentryCore/IPC/ProcessRunner.cs

@@ -4,6 +4,7 @@
 using SentryShield.Core.Models;
 using System.ServiceProcess;
 using System.Threading;
+using System.Runtime.InteropServices;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
@@ -38,6 +39,22 @@ internal sealed class LegacyServiceHost : ServiceBase
     private readonly EventLogWriter  _eventLog;
     private readonly LegacyYaraGuard _yaraGuard;
 
+    [DllImport("wtsapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool WTSSendMessage(
+        IntPtr hServer,
+        int SessionId,
+        string pTitle,
+        int TitleLength,
+        string pMessage,
+        int MessageLength,
+        int Style,
+        int Timeout,
+        out int pResponse,
+        bool bWait);
+
+    [DllImport("kernel32.dll")]
+    private static extern int WTSGetActiveConsoleSessionId();
+
     private Timer?   _timer;
     private DateTime _lastVulnScan      = DateTime.MinValue;
     private DateTime _lastDriverAudit   = DateTime.MinValue;
@@ -73,6 +90,8 @@ protected override void OnStart(string[] args)
         _eventLog.WriteInfo("SentryShield legacy service starting.", eventId: 1000);
         _logger.LogInformation("SentryShield legacy service starting at {Time}", DateTime.Now);
 
+        ThreadPool.QueueUserWorkItem(_ => NotifyLegacyUserAsync().GetAwaiter().GetResult());
+
         // Probe Python availability once before starting the timer
         _yaraGuard.Probe();
 
@@ -138,6 +157,37 @@ private void RunSafe(string scanName, Func<System.Threading.Tasks.Task> action)
     // Individual scan runners (mirror SentryWorker logic)
     // -------------------------------------------------------------------------
 
+    private async System.Threading.Tasks.Task NotifyLegacyUserAsync()
+    {
+        try
+        {
+            string title = "SentryShield Security Alert";
+            string message = "WARNING: This machine is running a legacy operating system.\nPlease update to a modern OS to ensure security.";
+            int sessionId = WTSGetActiveConsoleSessionId();
+            
+            // 0x30 = MB_ICONEXCLAMATION (Warning icon)
+            WTSSendMessage(IntPtr.Zero, sessionId, title, title.Length * 2, message, message.Length * 2, 0x30, 0, out _, true);
+
+            var finding = new Core.Models.Finding
+            {
+                FindingType = "hardening",
+                Severity = "CRITICAL",
+                Title = "Legacy Operating System Detected",
+                Description = message,
+                AffectedComponent = Environment.OSVersion.VersionString,
+                Remediation = "Upgrade to Windows 10/11 IoT Enterprise.",
+                DetectionTimestamp = DateTime.UtcNow
+            };
+
+            await _historyDb.SaveFindingsAsync(new List<Core.Models.Finding> { finding });
+            _logger.LogWarning("Legacy OS notification sent and finding logged.");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to notify legacy user");
+        }
+    }
+
     private async System.Threading.Tasks.Task RunPluginsAsync()
     {
         var start = DateTime.UtcNow;
@@ -189,19 +239,37 @@ await _historyDb.RecordScanAsync("dynamic_plugins", findings.Count,
 
     private async System.Threading.Tasks.Task RunDriverAuditAsync()
     {
+        var startTime = DateTime.UtcNow;
         _logger.LogInformation("Starting driver audit...");
         var auditor  = new DriverAuditor(_logger);
         var findings = await auditor.AuditAsync();
         await _historyDb.SaveFindingsAsync(findings);
-        _logger.LogInformation("Driver audit complete: {Count} findings", findings.Count);
+
+        var elapsed = (int)(DateTime.UtcNow - startTime).TotalSeconds;
+        await _historyDb.RecordScanAsync("driver", findings.Count,
+            findings.Count(f => f.Severity == "CRITICAL"),
+            findings.Count(f => f.Severity == "HIGH"),
+            findings.Count(f => f.Severity == "MEDIUM"),
+            elapsed);
+
+        _logger.LogInformation("Driver audit complete: {Count} findings in {Elapsed}s", findings.Count, elapsed);
     }
 
     private async System.Threading.Tasks.Task RunHardeningCheckAsync()
     {
+        var startTime = DateTime.UtcNow;
         _logger.LogInformation("Starting hardening check...");
         var audit    = new HardeningAudit(_logger);
         var findings = await audit.CheckAsync();
         await _historyDb.SaveFindingsAsync(findings);
-        _logger.LogInformation("Hardening check complete: {Count} findings", findings.Count);
+
+        var elapsed = (int)(DateTime.UtcNow - startTime).TotalSeconds;
+        await _historyDb.RecordScanAsync("hardening", findings.Count,
+            findings.Count(f => f.Severity == "CRITICAL"),
+            findings.Count(f => f.Severity == "HIGH"),
+            findings.Count(f => f.Severity == "MEDIUM"),
+            elapsed);
+
+        _logger.LogInformation("Hardening check complete: {Count} findings in {Elapsed}s", findings.Count, elapsed);
     }
 }

SentryLegacyService/LegacyServiceHost.cs

@@ -1,5 +1,5 @@
 """
-SentryShield v1.0 — CERT-In Advisory Parser (cert_in_parser.py)
+SentryShield v2.5 — CERT-In Advisory Parser (cert_in_parser.py)
 
 Fetches live vulnerability advisories from India's CERT-In:
   https://www.cert-in.org.in/
@@ -35,13 +35,14 @@
 import sqlite3
 import sys
 import time
-import ssl
+import http.client
 from datetime import datetime, timedelta
 from html.parser import HTMLParser
 from pathlib import Path
+from urllib.parse import quote
 from urllib.error import HTTPError, URLError
-from urllib.parse import urlencode, quote
 from urllib.request import Request, urlopen
+import ssl
 from xml.etree import ElementTree
 
 logging.basicConfig(
@@ -71,6 +72,33 @@
 CIVN_PATTERN = re.compile(r"CIVN-\d{4}-\d{4}", re.IGNORECASE)
 
 
+def verify_nvd_key():
+    nvd_key = os.environ.get("NVD_API_KEY", "").strip()
+    if not nvd_key:
+        log.warning("[NVD] WARNING: No API key set — rate limited to 5 req/30s")
+        return
+
+    log.info("[NVD] Verifying API key...")
+    headers = {"User-Agent": "SentryShield/1.0", "apiKey": nvd_key}
+    try:
+        ctx = ssl._create_unverified_context() if sys.platform == "darwin" else None
+        conn = http.client.HTTPSConnection("services.nvd.nist.gov", context=ctx, timeout=30)
+        conn.request("GET", "/rest/json/cves/2.0?resultsPerPage=1", headers=headers)
+        resp = conn.getresponse()
+        resp.read()
+        
+        if resp.status in (403, 404):
+            raise Exception("NVD API key rejected (NIST returns 404/403 for invalid keys) — please verify your key or clear the NVD_API_KEY variable")
+        elif resp.status != 200:
+            log.warning(f"[NVD] API key verification failed: HTTP {resp.status}")
+        else:
+            log.info("[NVD] API key verified")
+        conn.close()
+    except Exception as e:
+        if "rejected" in str(e): raise
+        log.warning(f"[NVD] API key verification failed: {e}")
+
+
 # ---------------------------------------------------------------------------
 # CERT-In RSS parser
 # ---------------------------------------------------------------------------
@@ -86,7 +114,6 @@ def parse(self, xml_text: str) -> list[dict]:
             channel = root.find("channel")
             if channel is None:
                 # Try with namespace
-                ns = {"": "http://www.w3.org/2005/Atom"}
                 items = root.findall(".//item") or root.findall(".//entry")
             else:
                 items = channel.findall("item")
@@ -208,43 +235,51 @@ def fetch_nvd_cve(cve_id: str, retry: int = 3) -> dict | None:
     Fetch a single CVE's full record from NVD API.
     Returns the parsed CVE dict or None on failure.
     """
+    nvd_key = os.environ.get("NVD_API_KEY", "").strip()
     headers = {"User-Agent": "SentryShield/1.0 (Security Scanner)"}
-    if NVD_API_KEY:
-        headers["apiKey"] = NVD_API_KEY
+    if nvd_key:
+        headers["apiKey"] = nvd_key
 
     url = f"{NVD_CVE_URL}?cveId={cve_id}"
 
     for attempt in range(retry):
         try:
-            req = Request(url, headers=headers)
-            ctx = ssl._create_unverified_context()
-            with urlopen(req, timeout=20, context=ctx) as resp:
-                data = json.loads(resp.read().decode("utf-8"))
+            ctx = ssl._create_unverified_context() if sys.platform == "darwin" else None
+            conn = http.client.HTTPSConnection("services.nvd.nist.gov", context=ctx, timeout=20)
+            conn.request("GET", f"/rest/json/cves/2.0?cveId={cve_id}", headers=headers)
+            resp = conn.getresponse()
+            body = resp.read().decode("utf-8")
+            code = resp.status
+            conn.close()
+        except Exception as e:
+            log.warning("NVD fetch error for %s: %s", cve_id, e)
+            break
 
+        if code == 200:
+            data = json.loads(body)
             vulns = data.get("vulnerabilities", [])
             if not vulns:
                 return None
-
             return vulns[0].get("cve", {})
 
-        except HTTPError as e:
-            if e.code == 404:
-                return None  # CVE doesn't exist in NVD
-            if e.code == 429:
-                log.warning("NVD rate limit hit — waiting 35s...")
-                time.sleep(35)
+        if code == 403 or (code == 404 and "cveId=" not in url):
+            raise Exception("NVD API key rejected (NIST returned 404/403) — verify your key or clear NVD_API_KEY")
+        if code == 404:
+            log.error("NVD HTTP 404 Not Found for %s", url)
+            return None  # CVE doesn't exist in NVD
+        if code == 429:
+            if attempt < retry - 1:
+                wait_time = 6 * (2 ** attempt)
+                log.warning("NVD rate limit hit (HTTP 429). Waiting %ds before retrying...", wait_time)
+                time.sleep(wait_time)
+                continue
             else:
-                log.warning("NVD HTTP %d for %s", e.code, cve_id)
+                log.error("NVD HTTP error: 429 Too Many Requests (max retries reached)")
                 break
-        except URLError as e:
-            log.warning("NVD connection error for %s: %s", cve_id, e.reason)
-            break
-        except Exception as e:
-            log.warning("NVD fetch error for %s: %s", cve_id, e)
+        else:
+            log.warning("NVD HTTP %d for %s", code, cve_id)
             break
 
-        time.sleep(2 ** attempt)  # Exponential backoff
-
     return None
 
 
@@ -394,7 +429,7 @@ def sync(self, days_back: int = 30) -> dict:
                 log.debug("  %s already in DB — skipped", cve_id)
 
             # NVD rate limit: 5 req/30s without key, 50 req/30s with key
-            time.sleep(0.8 if NVD_API_KEY else 6.5)
+            time.sleep(1.0 if os.environ.get("NVD_API_KEY", "").strip() else 6.5)
 
         elapsed = (datetime.utcnow() - start).total_seconds()
         summary = {
@@ -428,7 +463,7 @@ def sync_single_advisory(self, civn_id: str) -> int:
             record = nvd_cve_to_record(cve_data, civn_id=civn_id)
             if record and self._insert_record(record):
                 inserted += 1
-            time.sleep(0.8 if NVD_API_KEY else 6.5)
+            time.sleep(1.0 if os.environ.get("NVD_API_KEY", "").strip() else 6.5)
 
         return inserted
 
@@ -600,6 +635,8 @@ def main():
 
     args = parser.parse_args()
 
+    verify_nvd_key()
+
     if not Path(args.db).exists():
         log.error("Database not found: %s — run init_db.py first", args.db)
         sys.exit(1)